How to report a domain or server for abuse.
To take down a farm's domain or server, report it to whoever keeps it online: the registrar for the domain and the hosting provider for the server. This is how we do it.
Before you report
Capture the evidence first. Operators delete things once they're reported, and a report without evidence is easy to ignore.
- Archive the pages and repos in the Wayback Machine
- Save the DNS records, the domain's RDAP record and the server's IP address and network
- Note what the site or server does and which service it abuses
- Hash the files you saved with SHA-256, so you can show they haven't changed
Step by step
Find the registrar
Look up the domain's RDAP record, for example with ICANN's lookup tool. It names the registrar and its abuse contact.
Find the hosting provider
Resolve the domain to an IP address, then look up the IP's RDAP record at the regional internet registry. It names the network that owns the address and its abuse contact.
Check for a subdomain service or mail provider
If the domain is a subdomain of a free service, report it to that service too. If it receives mail, its MX records show which provider forwards it.
Send one report per provider
Keep each one short: what the domain or server is, what it's used for, which service it abuses, and the evidence. Use the provider's own form if it asks for one; some won't act on email.
Follow up
If there's no reply after seven days, follow up with any new evidence. Keep checking whether the domain still resolves and the server still answers.
Where doing it yourself falls short
One farm can mean a dozen providers. In Case 001 we reported to nine in the first 12 days, warned about 35 other companies the operator was targeting, and followed up on each. That's the work Esuba takes off your team; see Esuba vs doing it in-house.
Questions
What if the registrar doesn't respond?
Follow up after seven days, and report to the host, the subdomain service or the mail provider as well. Any one of them can take the farm's domain or server offline.
Is WHOIS still used?
For generic top-level domains, RDAP has replaced WHOIS as the official lookup, though many tools still call it WHOIS.
Should we contact the operator?
We don't. Contacting the operator warns them before the providers act.