FakeWatch
Start free

Domain takedown request template

A short, factual report that a registrar's abuse desk can verify in a minute. Copy it and fill in the blanks.

Last updated: · By the FakeWatch team

The template

Subject: Phishing: [fake-domain.example] impersonates [Your Project]

Hello,

I am reporting a domain registered through your service that is used for phishing.

Domain: [fake-domain.example]
Full phishing URL: [https://fake-domain.example/claim]
Abuse type: phishing (DNS abuse under the ICANN Registrar Accreditation Agreement)

What it does: the page copies [Your Project] ([https://your-project.example]) and asks
visitors to [connect a wallet / enter a seed phrase / sign a transaction] to [claim an
airdrop / fix a wallet / ...].

Evidence:
- Screenshot attached: [file name], taken [2026-10-09 14:20 UTC]
- Seen from [country], [browser and device]. The page may hide from other locations.
- Wallet address the page sends funds to: [0x...] (if any)

Our official links: [https://your-project.example/links]

I am [name], [role] at [Your Project]. The information in this report is accurate to
the best of my knowledge. Please suspend the domain and confirm receipt.

[Name]
[Role, Your Project]
[Contact email on your project's domain]

Follow-up after 48 to 72 hours

Reply in the same thread, so the abuse desk sees the history:

Hello,

Following up on my report of [date] (your reference [ticket number]).
[fake-domain.example] is still live as of [date, time UTC]. New screenshot attached.
[Number] of our users have reported losses since [date].

Please suspend the domain or let me know what further evidence you need.

[Name]

If there is still no action after a reasonable time, file a complaint with ICANN Compliance and attach both messages.

What makes it work

  • Send to the abuse contact, not general support. Find it with the abuse contact lookup or the registrar list.
  • Name the abuse type. "Phishing" is one of the five types of DNS abuse in ICANN's contract. "Trademark infringement" sends your report to a slower legal queue.
  • One domain per report. It is easier to act on and to escalate.
  • Write the URL as text. Some teams defang it (hxxps://fake-domain[.]example) so no one clicks it by accident; abuse desks understand both forms.
  • Use an email on your project's domain. It shows you speak for the brand.
  • Leave out threats and guesses. Facts that the reviewer can check are what make a report actionable.

Sources

Frequently asked questions

Should I write to the registrar's support or its abuse address?

The abuse address or abuse form. Support queues are for customers and can take days to route your message. Every ICANN-accredited registrar must publish an abuse contact.

Can I report several domains in one email?

Only when they belong to the same registrar. One report per domain is easier to track and to escalate, and some forms accept only one domain.

What if I am not the project owner?

Say so. Community moderators and users can report phishing too. Platforms such as X accept impersonation reports only from the brand or someone authorised by it, but phishing reports to registrars are open to anyone.

  • Take down a phishing siteStep by step: find the registrar and host of a fake crypto site, send reports that get acted on, trigger browser and wallet warnings, and escalate to ICANN.
  • Registrar abuse contactsAbuse emails and report forms of the registrars most often used for crypto phishing domains, with what to include in a report. Checked by hand.
  • Abuse contact lookupFree tool: enter a phishing domain and get its registrar, the registrar's abuse email or form, and the hosting platform to report it to. No sign-up.