How to report abuse to a hosting provider

Replace the bracketed parts and keep the numbered structure. The subject line alone should tell the desk what, where and which brand.

Subject: Phishing site on your network: login page impersonating [Brand] at hxxps://example[.]com/login

Hello abuse team,

I am reporting a website hosted on your network that is being used for [phishing / fraud / malware distribution].

1. URL: hxxps://example[.]com/login  (defanged; replace [.] with . to visit)
2. What it does: imitates the [Brand] sign-in page and sends entered passwords to a third party.
3. Where it is hosted: resolves to 203.0.113.10, which your RDAP record lists as part of your network.
4. When observed: 2026-09-18 09:54 UTC, still live at 2026-09-18 10:15 UTC.
5. Evidence: screenshot attached (full page, address bar visible); the legitimate site is https://www.[brand].com.

Please remove the content and preserve relevant logs. A reply with your ticket reference would be appreciated.

Regards,
[Name]
[Contact email]

The example uses documentation-reserved addresses (example[.]com, 203.0.113.10). Get the real host and IP from the abuse contact lookup.

1. The exact URL, including the path, defanged. "The whole site" is not enough if the phishing page is at one path.
2. What it does, in one sentence: impersonates a named brand, sells goods that never ship, serves a malware download.
3. Why it is on their network: the IP it resolves to and the fact that their RDAP record covers it. This saves them a lookup and shows you did yours.
4. When you saw it, with a UTC timestamp, and whether it is still live.
5. Verifiable evidence: a screenshot and, for impersonation, the legitimate site to compare against.

• A full-page screenshot with the address bar and system clock visible.
• For phishing emails: the complete message with headers as a .eml file, not a forward.
• For malware: the download URL and a hash (SHA-256) of the file — never the file itself unless the provider asks for it in a password-protected archive.
• For fake shops: order confirmation and payment receipt, with your card number removed.

• Threats or legal demands you cannot back up. They slow the ticket down and get routed to legal instead of abuse.
• Accusations about people. Report the website and what it does; leave identifying individuals to the police.
• Your full personal details, bank data or passwords. The provider may forward your complaint to its customer.
• Live, clickable malicious links — defang them.
• A wall of text. If the five facts are not visible in the first screen, the report waits.

Give a reasonable window, then move up one step at a time. Each step is independent, so you can run several in parallel.

1. Reply to your own ticket with any new evidence and a short, polite request for status.
2. The upstream network. Small hosts buy connectivity and IP space from larger networks. The regional internet registry record for the IP range shows who that is; their abuse desk can pressure or disconnect the customer.
3. The registrar. If you started with the host, the registrar can suspend the domain regardless of where it is hosted. See finding the registrar abuse contact.
4. Browser and security blocklists. Google Safe Browsing, Microsoft SmartScreen and similar services warn users before the page loads. This protects people even while the site stays up.
5. The registry for the domain ending, as a last resort for registrars that do not respond.

A hosting complaint is not a crime report. If you lost money or data, also report to the authorities in your country — see where to report cybercrime by country. A police report creates a record and an investigation route; the hosting complaint is what takes the site down.

If you would rather not run the process yourself, report the site to Fraudpol. Our team verifies the case and contacts the host, registrar and blocklists on your behalf. Reporting is free.