Who Actually Reads Abuse Reports
Every network that holds IP addresses is expected to publish an abuse contact: a mailbox where the public can report spam, attacks, malware and phishing coming from its addresses. Hosting companies, ISPs and cloud providers have teams or automated systems that read these mailboxes. A clear report lets them match your complaint to a customer in minutes; an unclear one usually ends in an auto-reply and nothing else.
Step 1: Report to the Right Place
Send the report to whoever controls the thing that is causing harm:
| Problem | Report to | How to find the contact |
|---|---|---|
| Attacks, scans or spam from an IP address | The network that owns the IP (hosting company or ISP) | Look up the IP with Abuse Lookup or an ASN lookup |
| A phishing or malware website | The hosting company of the site, and the domain’s registrar | Find the host’s IP, then its abuse contact; the registrar is in WHOIS |
| Spam that uses a domain in links | The registrar and the host of the linked site | WHOIS for the registrar, the site’s IP for the host |
| Abuse inside a big platform (a social account, a shared file) | The platform’s own reporting form | Use the in-app report button; the IP owner cannot act on single accounts |
The registry databases (RIPE, ARIN, APNIC, LACNIC, AFRINIC) store the abuse mailbox for each IP block; our guide how to find the abuse contact for an IP address or domain walks through it. Report the IP to its owner, not to your own ISP: your ISP has no control over another company’s servers.
Step 2: Collect Evidence They Can Verify
Abuse teams cannot act on “this IP is attacking me”. They need to find the exact event in their own logs, so give them:
- The source IP address exactly as it appeared, and the destination (your server’s IP or hostname).
- Timestamps with a time zone, ideally in UTC. “Yesterday afternoon” is useless to a provider in another country.
- Raw log lines (web server, SSH, firewall or mail logs), copied as plain text, not as screenshots.
- For spam or phishing e-mail: the full original message including all headers, not just a forward. Most mail apps have “Show original” or “View source”.
- For a phishing site: the full URL, the brand being imitated and when you saw it.
Keep it short. A few representative log lines and a count (“1,240 failed SSH logins between 08:00 and 09:00 UTC”) are more useful than a 50 MB log file.
Step 3: Write the Report
Use a subject line the team can sort, and put the facts first:
Subject: Abuse report: SSH brute force from 203.0.113.45
Hello,
The IP address 203.0.113.45, which belongs to your network,
attempted SSH logins on our server 198.51.100.10 (port 22).
Time window: 2026-11-01 08:02 to 08:57 UTC
Failed attempts: 1,240 (sample log lines below)
2026-11-01T08:02:11Z sshd[2210]: Failed password for root from 203.0.113.45 port 50122
2026-11-01T08:02:13Z sshd[2210]: Failed password for admin from 203.0.113.45 port 50140
Please investigate and stop this activity.
Contact: security@your-domain.exampleWrite in English unless the provider is clearly local, send one report per incident, and attach nothing executable. If the provider publishes a web form, use it; forms often feed straight into their ticket system.
Step 4: Know What to Expect
- Most providers do not tell you the outcome; customer details are private. An automatic ticket number is normal.
- Large clouds usually act within days; some small hosts never answer. Hosts that ignore reports are often already on blocklists, which you can check with our guide on blacklist checks.
- Meanwhile, protect yourself: block the IP or range at your firewall, rate-limit logins and keep software patched. A report is not a substitute for defence.
Mistakes That Get Reports Ignored
- Reporting the wrong party, for example a CDN’s IP when the real origin server is elsewhere. For sites behind a CDN, report to the CDN; it can forward the complaint to the origin host.
- Reporting your own private IP addresses (192.168.x.x, 10.x.x.x). They never leave your network and belong to no provider.
- Threatening or abusive language. It slows the ticket down and adds nothing.
- Reporting content you simply disagree with. Abuse desks handle technical abuse and illegal content, not opinions.
Common Questions
Should I report every single scan?
No. Port scans are constant background noise on the internet. Report sustained attacks, successful intrusions, spam runs and phishing; block the rest.
Is there a standard format for abuse reports?
Some networks accept machine-readable formats such as X-ARF, but a clear plain-text e-mail with IP, time in UTC and log lines is accepted everywhere.
Can I report an attack anonymously?
You can use a separate mailbox, but providers may need to reply with questions. A role address such as security@ or abuse@ on your own domain works well.