Quick answer
How do you report a phishing domain?
To report a phishing domain, look up its registrar and abuse contact with an RDAP query, send a documented report there, then tell the web host and flag the URL with Google Safe Browsing, Netcraft, Chainabuse and MetaMask's blocklist. Since 5 April 2024, ICANN rules oblige registrars to act on actionable evidence; Wardmint acts within 24 hours of a well-documented report.
Who to tell, and what each one can do
| Recipient | What it can do | How to reach it |
|---|---|---|
| Registrar of the domain | Suspend or lock the domain; ICANN-accredited registrars must act promptly on actionable evidence of phishing | Abuse address or webform from the RDAP record |
| Web host or CDN of the site | Remove the page or the account that serves it | Abuse contact of the IP network, from an RDAP IP query |
| Google Safe Browsing | Flag the page so supporting browsers show a warning | Report a Page form at safebrowsing.google.com |
| Netcraft | Take the URL into its phishing and malware reporting service | report.netcraft.com |
| MetaMask eth-phishing-detect | Add the domain to the open blocklist MetaMask uses | Pull request to the GitHub repository |
| Chainabuse | Publish a community report that others can search | Report a Scam on chainabuse.com |
Seven steps from a suspect URL to filed reports
Build the evidence pack
Save the full URL, a dated screenshot, the page source if you can capture it safely, the wallet addresses it asks you to sign for and the urlscan.io result link. Write the URL with the dots defanged (example[.]com) in emails so mail filters do not strip it.
Look up the registrar
Run the RDAP query below. It returns the registrar name, the creation date, the name servers and, in most records, the registrar abuse contact.
Find the web host
Resolve the domain to an IP address and query RDAP for that address. The abuse contact of the network owner is the host to notify.
Send the registrar report
State the URL, the brand it copies, why it is phishing (a wallet-signature request, a seed-phrase form) and attach the evidence. Ask for suspension and ask for the reference number.
Send the host report
Send the same pack to the host. A host can remove the page even if the registrar is slow.
Flag the URL on the warning lists
File the URL with Google Safe Browsing and Netcraft, and add a report on Chainabuse. For wallet users, open a pull request to MetaMask's blocklist.
Log the references and the dates
Note each acknowledgement and each reply. A UDRP file or a later escalation to ICANN starts from this log.
DOMAIN=suspect-example.com
# registrar name, creation date, name servers
curl -sL "https://rdap.org/domain/$DOMAIN" > domain.json
jq -r '.entities[] | select(.roles[]=="registrar") | .vcardArray[1][] | select(.[0]=="fn") | .[3]' domain.json
jq -r '.events[] | select(.eventAction=="registration") | .eventDate' domain.json
jq -r '.nameservers[].ldhName' domain.json
# registrar abuse email, when the record carries one
jq -r '.entities[] | select(.roles[]=="registrar") | .entities[]? | select(.roles[]=="abuse") | .vcardArray[1][] | select(.[0]=="email") | .[3]' domain.json
# web host: resolve, then ask RDAP about the address
IP=$(dig +short A "$DOMAIN" | head -n 1)
curl -sL "https://rdap.org/ip/$IP" | jq -r '.name, (.entities[]? | .. | objects | select(.roles? and (.roles | index("abuse"))) | .vcardArray[1][] | select(.[0]=="email") | .[3])'What does ICANN require a registrar to do with your report?
Since 5 April 2024, an ICANN-accredited registrar that holds actionable evidence of DNS abuse must promptly take appropriate mitigation action. ICANN's 2024 global amendment to the Registrar Accreditation Agreement also requires the registrar to publish abuse contacts on its website, to confirm receipt of a report to the person who sent it, and to offer a webform as an alternative to email. The registrar keeps reasonable discretion over the action it takes.
ICANN Compliance enforces these obligations against registrars. A report with the URL, the evidence and the harm in the first lines is what turns a ticket into actionable evidence. If the registrar does not answer, the next step is a complaint to ICANN Compliance, with your log of dates.
How do you find the registrar and the host?
An RDAP query returns the registrar for a domain and the network owner for an IP address, in machine-readable JSON. RDAP is the successor of WHOIS; the rdap.org service redirects each query to the right registry. The commands above print the registrar, the registration date and the abuse email. The ownership check guide explains how to read the rest of the record and what redaction hides.
If the domain sits behind a reverse proxy, the IP address belongs to the proxy, not to the origin host. Report to both: the proxy operator can often forward the report to its customer.
Which warning lists matter for a crypto phishing site?
Safe Browsing and Netcraft warn browser users; MetaMask's blocklist and Chainabuse warn wallet users. A flag does not remove the site, so it complements the registrar and host reports instead of replacing them.
MetaMask's open-source blocklist asks for sites that impersonate established sites or collect signing keys. Its README gives the command yarn add:blocklist <domain> and takes changes by pull request; it publishes no turnaround time. Chainabuse is a community platform for reporting malicious crypto activity; it states that local authorities are the ones who investigate.
For a hostile site that copies your own project, follow the full sequence in how to take down a phishing site copying your dApp.
How do you report a phishing site on a domain registered at Wardmint?
Send it to [email protected]; no account is needed. Wardmint acknowledges a report with a reference number and acts within 24 hours of a well-documented report on phishing, malware, botnets and fraud that takes money from victims. Child sexual abuse material is handled immediately, and a request from a UDRP provider locks the domain within 2 business days of a request from a UDRP provider. Copyright, defamation, political or competitor complaints are not acted on on the complaint alone; they take a decision that binds Wardmint. The details are on the abuse page.
According to Wardmint's survey of 12 November 2026, the six routes in this guide cost USD 0 to file, against USD 1,500 for the entry-level WIPO UDRP filing (one to five domains, single panelist).
What is the short version?
Registrar and host can switch a phishing site off; Safe Browsing, Netcraft, MetaMask and Chainabuse warn users. RDAP finds the registrar and the host for free. ICANN rules in force since 5 April 2024 oblige accredited registrars to act on actionable evidence of phishing.
Questions about reporting a phishing domain
How long does a registrar take to act on a phishing report?
No published timeline binds every registrar: ICANN requires prompt action on actionable evidence and leaves the form of the action to the registrar. Delays are shortest when the report names the URL, shows the copied brand and attaches dated evidence.
Does a Google Safe Browsing report remove the site?
No. It flags the page so that supporting browsers show a warning. The page stays online until the host or the registrar acts.
What if the registrar does not answer?
Report to the web host in parallel, then file a complaint with ICANN Compliance with your log of dates. If you hold a trademark, a UDRP complaint is the next route.
Should I report from my project's official account?
Report from a mailbox that you can show is yours, such as the security address on your main domain. A registrar is more likely to act when the sender is the brand the page copies.
Which sender address should I use?
Use a role mailbox on your main domain, such as a security address, rather than a personal one. A registrar report by email carries the sender address, and replies then reach the whole team.
In summary
- Report to the registrar and the host first; they can switch the site off.
- RDAP (rdap.org) returns the registrar, creation date and abuse contacts for free.
- ICANN's DNS abuse amendment has applied to accredited registrars since 5 April 2024.
- Safe Browsing, Netcraft, MetaMask's blocklist and Chainabuse warn users but do not remove the site.
- ICANN Compliance enforces the obligations, so an unanswered report can be escalated to it.
- Wardmint acknowledges reports with a reference number and acts within 24 hours of a well-documented report.
- Reports to [email protected] need no account.
Sources (6)
- 2024 Global Amendments to the Registrar Accreditation Agreement: DNS abuse — ICANN (read 2026-11-12)
- MetaMask eth-phishing-detect (README) — MetaMask, GitHub (read 2026-11-12)
- Report a Page to Google Safe Browsing — Google (read 2026-11-12)
- Netcraft: report a URL — Netcraft (read 2026-11-12)
- Chainabuse — Chainabuse (read 2026-11-12)
- WIPO fees for UDRP cases — WIPO (read 2026-11-12)