Who Should Receive the Report?
The right recipient depends on what you are reporting:
- Traffic from an IP address (spam, brute-force logins, port scans): the operator of the network that owns the address.
- A malicious website (phishing, malware): the hosting provider of the server, and often the domain’s registrar.
- Abuse of a domain name itself (for example a lookalike domain used for fraud): the registrar.
Finding the Abuse Contact of an IP Address
Regional Internet Registries publish an abuse contact for most address blocks. In the RIPE region this is the abuse-c contact; ARIN lists an organization abuse email. Our Abuse Contact Lookup finds the published address for you. You can also see the network owner with ASN Lookup; our guide What is an ASN? explains the difference between the network owner and the actual customer using an address.
If the address belongs to a cloud or hosting provider, report to the provider. It can identify and act on its customer; you cannot.
Finding the Abuse Contact of a Domain
- Look up the domain with our WHOIS Lookup. The record shows the registrar, and for generic top-level domains registrars are required to publish an abuse email address and phone number.
- Resolve the domain to its IP address with DNS Record Lookup and find the hosting provider’s abuse contact as above.
- If the site is behind a CDN, report to the CDN; most have abuse forms that forward reports to the hosting customer.
Writing a Report That Gets Handled
- Be specific: IP address or URL, exact timestamps with time zone, and what happened.
- Include evidence: relevant log lines or full email headers for spam. Screenshots alone are weak evidence.
- Keep it short and factual. Abuse teams handle many reports; clear reports are processed faster.
- One incident per report, sent to the contact responsible for that address.
Other Places to Report
- Phishing: Google Safe Browsing and Microsoft accept phishing reports, which can get a page blocked in browsers quickly.
- Spam: reporting through your mailbox provider’s “report spam” button helps its filters.
- Serious crimes: fraud and extortion should also be reported to the police or your national cybercrime authority.
When Nothing Happens
Some networks ignore abuse reports. In that case, protect yourself: block the addresses or networks at your firewall, and check whether the sender is already listed on blacklists with the Spam Database Lookup.