FakeWatch
Start free

Registrar abuse contacts for phishing domains

Where to send a takedown request for a domain, by registrar. Every address and form below was checked by hand on the registrar's own pages.

Last updated: · By the FakeWatch team

How to report a phishing domain

  1. Find the registrar. Enter the domain in our abuse contact lookup or in ICANN Lookup. Both read RDAP, the registry's live registration data.
  2. Capture evidence first. Take a full-page screenshot that shows the address bar and what the page copies. Save the full URL of the phishing page, not only the domain.
  3. Send one report per domain to the registrar's abuse email or form below. Use the phishing category when the form has one.
  4. Report the site where it is hosted too: the hosting company, or Cloudflare when the domain uses Cloudflare name servers. The lookup tool shows both.
  5. Ask browsers to warn visitors with Google Safe Browsing and Netcraft. This often protects people before the domain is suspended.

What to put in the report

Registrars act faster on a report they can check in a minute. ICANN's own example of actionable evidence is "a screenshot showing a phishing attempt with an indication of what the phish is against" and "the complete URL where the abuse is located". Most registrar forms ask for the same things:

  • The full phishing URL and the domain.
  • Your official site, so they can see what is being copied.
  • One or two screenshots of the live page.
  • The country and the browser you saw it from. Many phishing kits hide from visitors outside their target region or from desktop browsers.
  • Email headers, if the link came by email.
  • Your name, your role in the project and a short good-faith statement.

Copy our takedown request template and fill in the blanks.

Abuse contacts by registrar

Checked by hand on each registrar's own pages, last on October 6, 2026. Linked names have a page with what that registrar asks for. Domains of other registrars: use the lookup tool, which reads the contact from RDAP.
RegistrarIANA IDAbuse emailAbuse form
Alibaba Cloud (HiChina) 1599 [email protected] Email only
Cloudflare Registrar 1910 [email protected] Open form
Dynadot 472 Form only Open form
eNom 48 Form only Open form
Gandi 81 Form only Open form
Global Domain Group 3956 [email protected] Email only
GMO Internet (Onamae.com) 49 [email protected] Email only
Gname 1923 [email protected] Open form
GoDaddy 146 [email protected] Open form
Hostinger 1636 [email protected] Email only
Key-Systems 269 [email protected] Email only
Name.com 625 [email protected] Open form
Namecheap 1068 [email protected] Open form
NameSilo 1479 [email protected] Open form
Network Solutions / Register.com 9 [email protected] Email only
NICENIC 3765 [email protected] Open form
PDR (PublicDomainRegistry) 303 [email protected] Open form
Porkbun 1861 [email protected] Open form
Registrar.eu / Openprovider 1647 [email protected] Open form
Spaceship 3862 [email protected] Email only
Squarespace Domains 3827 [email protected] Open form
Trustname 4318 [email protected] Email only
Tucows / OpenSRS 69 [email protected] Open form
West.cn 1556 [email protected] Email only

What registrars must do

Registrars of generic domains (.com, .xyz, .app and others) sign the ICANN Registrar Accreditation Agreement. Since April 5, 2024, its DNS abuse amendments say a registrar "must promptly take the appropriate mitigation action(s) that are reasonably necessary to stop, or otherwise disrupt" a domain used for phishing once it has actionable evidence. For a domain registered only to phish, ICANN names suspension with the clientHold status as a typical action.

A registrar must also publish an abuse email or web form on its homepage and confirm that it received your report. Country-code domains such as .io, .co or .me follow their own registry's rules, which differ.

Published processing times, read on October 9, 2026. They are targets, not guarantees.
RegistrarWhat the abuse page says
Namecheap"Our general abuse complaint processing time is 72 hours"
Spaceship"Our general email processing time is 24 hours"
PorkbunConfirmation email within 24 hours; verifiable evidence required
Tucows (Hover, eNom, OpenSRS)For a clear phishing site, will "expeditiously reset its Name Servers"
DynadotThe site must be live and contain a login area; you may not hear back

If the registrar does not act

  1. Wait a reasonable time. ICANN asks not to send the report and a complaint on the same day.
  2. Reply to the registrar's confirmation with any new evidence, such as fresh screenshots or victim reports.
  3. File a DNS abuse complaint with ICANN Contractual Compliance. Attach your original report and the registrar's reply. ICANN says many complaints it receives are incomplete, so include the evidence again.
  4. For a long-lived fake that uses your trademark, a UDRP case at WIPO can transfer the domain to you. It costs from USD 1,500 for one to five domains and normally takes about two months, so it is not a tool for a phishing site that is live today.

Sources