Report abuse. Reach the right team.

What to include

Provide enough detail for us to investigate and reproduce the issue where reasonably possible. Do not send passwords, live malware, full payment-card data, illegal imagery or unnecessary sensitive Personal Data. Describe sensitive evidence and ask for a suitable secure channel where needed.

• The affected domain name, relevant full URLs, hostnames or other locations, and the type of suspected abuse.
• What happened, when you observed it, and the time zone, preferably UTC.
• Supporting evidence such as screenshots, logs, email headers, file hashes, technical analysis references or trusted abuse reports. Explain how the evidence connects to the domain.
• For phishing, provide the exact fraudulent URL where possible rather than only the domain name. For malicious email, include relevant headers. For malware, provide the URL, file hash or analysis reference where available.
• Your contact email and, where relevant, your organisation and authority to act.
• Any immediate risk to people, systems or critical services. Identify urgent reports clearly.

What our abuse team handles

DNS Abuse includes malware, botnets, phishing and pharming, plus spam when it is used to deliver or facilitate these forms of DNS Abuse. We also receive and investigate reports of Illegal Activity involving domains that we sponsor.

The contractual DNS Abuse definition is narrower than every possible form of online harm. A report outside that definition may still be reviewed as Illegal Activity, a breach of our Registration Terms or another complaint.

A registrar may not operate the website or host its content. We assess what action is available at the domain level and, where appropriate, coordinate with the Registrant, hosting provider, DNS provider, email provider, Registry Operator, security provider or relevant authorities.

An allegation alone does not automatically result in suspension. We consider the evidence, our contractual role, applicable law, relevant policy, urgency and the circumstances of the domain before deciding what action is appropriate.

Trademark and similar domain-name disputes may have separate UDRP, URS, court or registry dispute procedures.

• Domain dispute procedures

How we receive, handle & track reports

1. Receive & confirm

   We record the report, issue a case reference or other information sufficient to identify the submission, and confirm receipt to the reporter. Subsequent correspondence is attached to the same case.

2. Assess & investigate

   We check whether the domain is sponsored by us, assess the alleged abuse, severity, urgency and quality of the evidence, and take reasonable and prompt investigative steps. We may request further information where details are incomplete or clarification would materially assist the investigation.

3. Establish actionable evidence

   We consider whether the available evidence gives us a sufficiently reliable basis to conclude that a sponsored domain is being used for DNS Abuse. We may corroborate reports using technical observations, reputable abuse intelligence, public information, Registry Operator or infrastructure-provider information, account history or direct examination of reported URLs.

4. Take appropriate action

   When actionable evidence establishes DNS Abuse, we promptly take the measures reasonably necessary to stop or disrupt it. Depending on the case, these may include requiring remediation, coordinating with another provider, applying an appropriate hold or lock, suspending resolution, restricting related registrar services or taking another technically and contractually available action.

5. Respond & follow up

   We communicate an appropriate outcome or status update where possible, subject to legal, security and privacy restrictions. Reply with the case reference to provide additional evidence, request an update or ask for further review.

Proportionate action & collateral effects

Mitigation is selected according to the facts of the case. We consider the cause and severity of the harm, whether the activity is ongoing, and the possibility of collateral damage.

A domain may support legitimate users or services, and legitimate infrastructure can be compromised without the Registrant’s knowledge. Where a narrower effective remedy is available, we may prefer it over disabling the entire domain.

Severe, ongoing or clearly malicious activity may justify immediate registrar-level action. Other cases may appropriately be handled by notice to the Registrant or relevant service provider and an opportunity for prompt remediation.

Complaints that are not DNS Abuse

Not every complaint concerning a domain is DNS Abuse. Examples include ordinary unsolicited email, contractual disputes, trademark or copyright claims, defamation, commercial disagreements, website-content complaints and ownership disputes.

We may review such reports where they concern Illegal Activity or a breach of our Registration Terms, but registrar-level suspension is not automatically appropriate.

Depending on the issue, the appropriate route may instead be the website host, email provider, Registry Operator, a competent authority, court process, UDRP, URS or another applicable dispute procedure.

• Domain dispute procedures
• Contact support

Records, privacy & confidentiality

We record receipt, investigation, evidence, correspondence, actions and response for each abuse case. These records are kept for the shorter of two years or the longest period permitted by applicable law, and made available to ICANN on reasonable notice during that period where required.

Abuse reports may contain Personal Data. We process this information for abuse investigation, registrar security, contractual compliance, dispute handling and legal compliance as described in our Privacy Policy.

Information supplied by a reporter may, where appropriate and lawful, be shared with the Registrant, Registry Operator, hosting or infrastructure provider, security provider, ICANN, competent authority or another party involved in investigating or mitigating the issue.

We disclose only information reasonably appropriate and lawful for the purpose. We cannot promise absolute confidentiality where disclosure is required by law or necessary to investigate and respond appropriately.

Requests whose primary purpose is access to non-public Registration Data should use the dedicated disclosure procedure rather than the abuse process.

• Privacy notice
• Non-public Registration Data requests