File a Registrar Abuse Report

Every domain registrar accredited by ICANN is contractually required to maintain an abuse contact and investigate credible reports of phishing, brand impersonation, and malicious domain use. Filing a registrar abuse report is often the fastest way to get a lookalike domain suspended or taken down entirely. This guide walks you through the complete process, from identifying the registrar to escalating if they fail to act.

1 Collect evidence before you file

A well-documented abuse report is taken more seriously and processed faster. Gather the following evidence before contacting any registrar:

Screenshots

• Full-page screenshots of the lookalike site (if live), including the URL bar showing the domain
• Side-by-side comparison with your legitimate site to show the impersonation
• Screenshots of any phishing emails sent from the domain, including full email headers
• Screenshots of the domain's WHOIS/RDAP record (taken in the next step)

DNS records

Run these commands and save the output. They prove the domain is configured for malicious use:

MX records are especially important: they prove the domain is configured to send or receive email, which is a strong indicator of phishing intent even if no website is live.

Documentation checklist

• The lookalike domain name (e.g., acme-login.com)
• Your legitimate domain name (e.g., acme.com)
• Proof you own the legitimate domain: a link to your website, trademark registration number, or business registration
• The type of abuse: typosquat, homograph attack, brand impersonation, phishing, email fraud
• The specific harm: credential theft, financial fraud, customer confusion, malware distribution
• Timeline: the date you first observed the domain and any subsequent activity
• Any known victims: if customers or employees have been targeted, note the number and nature of incidents

2 Identify the registrar using ICANN Lookup

You need to know which registrar manages the domain so you can report abuse to the right company. ICANN provides an official lookup tool for this.

Using ICANN Lookup (recommended)

1. Go to lookup.icann.org
2. Enter the lookalike domain name (e.g., acme-login.com) in the search field
3. Click Lookup
4. In the results, locate and record the following fields:
   • Registrar Name: the company that manages the domain registration
   • Registrar IANA ID: unique identifier for the registrar
   • Registrar Abuse Contact Email: the email address to send your report to
   • Registrar Abuse Contact Phone: for urgent/active phishing cases
   • Creation Date: when the domain was registered (recently created domains strengthen your case)
   • Expiration Date: useful context for your report

Even when WHOIS data is redacted under GDPR/privacy protection, the registrar name and abuse contact are always visible. These fields cannot be hidden.

Using RDAP (alternative method)

RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS and provides structured, machine-readable data. You can query it directly:

In the JSON response, look for:

• The entities array with roles: ["registrar"] to find the registrar name
• The entities entry with roles: ["abuse"] for the abuse contact email and phone
• The events array for registration and expiration dates

Using the command line

This returns the registrar name, abuse email, and abuse phone number filtered from the full WHOIS record.

3 Send the abuse report

Email the registrar's abuse contact address you found in Step 2. Use the template below as a starting point. Be factual, specific, and reference the registrar's obligations under the ICANN Registrar Accreditation Agreement (RAA).

4 Registrar-specific reporting instructions

In addition to emailing the abuse contact, most major registrars have dedicated abuse forms. Use both the form and the email for the best chance of a fast response.

5 Also report to the hosting provider

If the domain is serving a live phishing site, the hosting provider can often take down the content faster than the registrar can suspend the domain. Report to both simultaneously.

1. Resolve the domain to its IP address:
   dig A lookalike-domain.com +short
2. Look up who owns the IP address:
   whois [IP address] | grep -i "orgname\|abuse\|netname"
3. Send a similar abuse report to the hosting provider's abuse contact. Hosting providers typically have faster takedown times (often same-day for active phishing) because they can remove the content without affecting the domain registration.

Common hosting providers and their abuse contacts: AWS (abuse@amazonaws.com), Google Cloud (abuse@google.com), DigitalOcean (abuse@digitalocean.com), Hetzner (abuse@hetzner.com), OVH (abuse@ovh.net).

6 What to expect after filing

7 Escalation paths if the registrar does not respond

If the registrar has not responded or taken action within a reasonable time (5-10 business days for active abuse, 14-30 days for inactive domains), escalate through the following channels in order: