Short answer
Send the full phishing URL, screenshots of the live page and your official site to Gandi through its abuse form.
Who this is for: Teams that found a phishing copy of their site on a Gandi domain.
Where to report a domain to Gandi
| Abuse page | help.gandi.net/en/abuse |
|---|---|
| Phishing report form | helpdesk.gandi.net/hc/en-us/requests/new?ticket_form_id=10796011863324 |
| Abuse email | Not published: use the form |
| IANA ID | 81 |
Not sure the domain is with Gandi? Check it in our abuse contact lookup: it reads the registrar from RDAP.
What Gandi asks for
- The domain or domains and the website URL.
- The server IP, if you know it.
- For email phishing: the full headers and the body of the email.
- Date, time and time zone, logs, a description and attachments.
Take full-page screenshots that show the address bar before you report: the page may be gone or hidden from you later. Our takedown request template covers all of the above.
What to expect
Gandi's abuse page states no processing time.
Gandi says it forwards some of the information you provide to the parties involved, so keep private details out of the report.
Accredited registrars of generic domains must act on actionable evidence of phishing under their ICANN contract. If nothing happens, see how to escalate to ICANN.
Report it here too
- The host. The registrar controls the domain, the host controls the site. The lookup shows when the site sits behind Cloudflare.
- Browsers. Google Safe Browsing and Netcraft make browsers warn visitors, often before the domain is suspended.
- Wallets. See how to report a phishing site to wallets.
Sources
Frequently asked questions
How do I know a domain is registered with Gandi?
Look the domain up in RDAP: our free abuse contact lookup or ICANN Lookup shows the registrar, its IANA ID and its abuse contact.
What if Gandi does not act on my report?
Reply with new evidence, then file a DNS abuse complaint with ICANN Contractual Compliance and attach your report. Meanwhile report the site to Google Safe Browsing and Netcraft so browsers warn visitors.