# How do you report a phishing domain?

> Report a phishing domain to its registrar, host and blocklists: an RDAP lookup finds the abuse contact; ICANN rules in force since 5 April 2024.

- URL: https://wardmint.com/guides/report-a-phishing-domain/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

Reporting works in two layers: the parties who can switch the site off, and the lists that warn users while it is still up. Send both, in this order.

**Quick answer — How do you report a phishing domain?**

To report a phishing domain, look up its registrar and abuse contact with an RDAP query, send a documented report there, then tell the web host and flag the URL with Google Safe Browsing, Netcraft, Chainabuse and MetaMask's blocklist. Since 5 April 2024, ICANN rules oblige registrars to act on actionable evidence; **Wardmint** acts within 24 hours of a well-documented report.

## Who to tell, and what each one can do

*Read on 12 November 2026 from the services' own pages and the ICANN amendment.*

| Recipient | What it can do | How to reach it |
| --- | --- | --- |
| Registrar of the domain | Suspend or lock the domain; ICANN-accredited registrars must act promptly on actionable evidence of phishing | Abuse address or webform from the RDAP record |
| Web host or CDN of the site | Remove the page or the account that serves it | Abuse contact of the IP network, from an RDAP IP query |
| Google Safe Browsing | Flag the page so supporting browsers show a warning | Report a Page form at safebrowsing.google.com |
| Netcraft | Take the URL into its phishing and malware reporting service | report.netcraft.com |
| MetaMask eth-phishing-detect | Add the domain to the open blocklist MetaMask uses | Pull request to the GitHub repository |
| Chainabuse | Publish a community report that others can search | Report a Scam on chainabuse.com |

## Seven steps from a suspect URL to filed reports

1. **Build the evidence pack** — Save the full URL, a dated screenshot, the page source if you can capture it safely, the wallet addresses it asks you to sign for and the urlscan.io result link. Write the URL with the dots defanged (example[.]com) in emails so mail filters do not strip it.
2. **Look up the registrar** — Run the RDAP query below. It returns the registrar name, the creation date, the name servers and, in most records, the registrar abuse contact.
3. **Find the web host** — Resolve the domain to an IP address and query RDAP for that address. The abuse contact of the network owner is the host to notify.
4. **Send the registrar report** — State the URL, the brand it copies, why it is phishing (a wallet-signature request, a seed-phrase form) and attach the evidence. Ask for suspension and ask for the reference number.
5. **Send the host report** — Send the same pack to the host. A host can remove the page even if the registrar is slow.
6. **Flag the URL on the warning lists** — File the URL with Google Safe Browsing and Netcraft, and add a report on Chainabuse. For wallet users, open a pull request to MetaMask's blocklist.
7. **Log the references and the dates** — Note each acknowledgement and each reply. A UDRP file or a later escalation to ICANN starts from this log.

*Steps 2 and 3: registrar, creation date and abuse contacts through RDAP*

```bash
DOMAIN=suspect-example.com

# registrar name, creation date, name servers
curl -sL "https://rdap.org/domain/$DOMAIN" > domain.json
jq -r '.entities[] | select(.roles[]=="registrar") | .vcardArray[1][] | select(.[0]=="fn") | .[3]' domain.json
jq -r '.events[] | select(.eventAction=="registration") | .eventDate' domain.json
jq -r '.nameservers[].ldhName' domain.json

# registrar abuse email, when the record carries one
jq -r '.entities[] | select(.roles[]=="registrar") | .entities[]? | select(.roles[]=="abuse") | .vcardArray[1][] | select(.[0]=="email") | .[3]' domain.json

# web host: resolve, then ask RDAP about the address
IP=$(dig +short A "$DOMAIN" | head -n 1)
curl -sL "https://rdap.org/ip/$IP" | jq -r '.name, (.entities[]? | .. | objects | select(.roles? and (.roles | index("abuse"))) | .vcardArray[1][] | select(.[0]=="email") | .[3])'
```

## What does ICANN require a registrar to do with your report?

**Since 5 April 2024, an ICANN-accredited registrar that holds actionable evidence of DNS abuse must promptly take appropriate mitigation action.** ICANN's 2024 global amendment to the Registrar Accreditation Agreement also requires the registrar to publish abuse contacts on its website, to confirm receipt of a report to the person who sent it, and to offer a webform as an alternative to email. The registrar keeps reasonable discretion over the action it takes.

ICANN Compliance enforces these obligations against registrars. A report with the URL, the evidence and the harm in the first lines is what turns a ticket into actionable evidence. If the registrar does not answer, the next step is a complaint to ICANN Compliance, with your log of dates.

## How do you find the registrar and the host?

**An RDAP query returns the registrar for a domain and the network owner for an IP address, in machine-readable JSON.** RDAP is the successor of WHOIS; the rdap.org service redirects each query to the right registry. The commands above print the registrar, the registration date and the abuse email. The [ownership check guide](https://wardmint.com/guides/check-who-owns-a-lookalike-domain/ "How to check who owns a look-alike domain") explains how to read the rest of the record and what redaction hides.

If the domain sits behind a reverse proxy, the IP address belongs to the proxy, not to the origin host. Report to both: the proxy operator can often forward the report to its customer.

## Which warning lists matter for a crypto phishing site?

**Safe Browsing and Netcraft warn browser users; MetaMask's blocklist and Chainabuse warn wallet users.** A flag does not remove the site, so it complements the registrar and host reports instead of replacing them.

MetaMask's open-source blocklist asks for sites that impersonate established sites or collect signing keys. Its README gives the command `yarn add:blocklist <domain>` and takes changes by pull request; it publishes no turnaround time. Chainabuse is a community platform for reporting malicious crypto activity; it states that local authorities are the ones who investigate.

For a hostile site that copies your own project, follow the full sequence in [how to take down a phishing site copying your dApp](https://wardmint.com/guides/take-down-a-phishing-site/ "How to take down a phishing site copying your dApp").

## How do you report a phishing site on a domain registered at Wardmint?

**Send it to abuse@wardmint.com; no account is needed.** Wardmint acknowledges a report with a reference number and acts within 24 hours of a well-documented report on phishing, malware, botnets and fraud that takes money from victims. Child sexual abuse material is handled immediately, and a request from a UDRP provider locks the domain within 2 business days of a request from a UDRP provider. Copyright, defamation, political or competitor complaints are not acted on on the complaint alone; they take a decision that binds Wardmint. The details are on the [abuse page](https://wardmint.com/abuse/ "How to report abuse on a Wardmint domain").

According to Wardmint's survey of 12 November 2026, the six routes in this guide cost USD 0 to file, against USD 1,500 for the entry-level WIPO UDRP filing (one to five domains, single panelist).

## What is the short version?

Registrar and host can switch a phishing site off; Safe Browsing, Netcraft, MetaMask and Chainabuse warn users. RDAP finds the registrar and the host for free. ICANN rules in force since 5 April 2024 oblige accredited registrars to act on actionable evidence of phishing.

## Questions about reporting a phishing domain

### How long does a registrar take to act on a phishing report?

No published timeline binds every registrar: ICANN requires prompt action on actionable evidence and leaves the form of the action to the registrar. Delays are shortest when the report names the URL, shows the copied brand and attaches dated evidence.

### Does a Google Safe Browsing report remove the site?

No. It flags the page so that supporting browsers show a warning. The page stays online until the host or the registrar acts.

### What if the registrar does not answer?

Report to the web host in parallel, then file a complaint with ICANN Compliance with your log of dates. If you hold a trademark, a UDRP complaint is the next route.

### Should I report from my project's official account?

Report from a mailbox that you can show is yours, such as the security address on your main domain. A registrar is more likely to act when the sender is the brand the page copies.

### Which sender address should I use?

Use a role mailbox on your main domain, such as a security address, rather than a personal one. A registrar report by email carries the sender address, and replies then reach the whole team.

**In summary**

- Report to the registrar and the host first; they can switch the site off.
- RDAP (rdap.org) returns the registrar, creation date and abuse contacts for free.
- ICANN's DNS abuse amendment has applied to accredited registrars since 5 April 2024.
- Safe Browsing, Netcraft, MetaMask's blocklist and Chainabuse warn users but do not remove the site.
- ICANN Compliance enforces the obligations, so an unanswered report can be escalated to it.
- Wardmint acknowledges reports with a reference number and acts within 24 hours of a well-documented report.
- Reports to abuse@wardmint.com need no account.

## Sources

1. [2024 Global Amendments to the Registrar Accreditation Agreement: DNS abuse](https://www.icann.org/resources/pages/global-amendment-2024-en) — ICANN (read 2026-11-12)
2. [MetaMask eth-phishing-detect (README)](https://github.com/MetaMask/eth-phishing-detect) — MetaMask, GitHub (read 2026-11-12)
3. [Report a Page to Google Safe Browsing](https://safebrowsing.google.com/safebrowsing/report_phish/) — Google (read 2026-11-12)
4. [Netcraft: report a URL](https://report.netcraft.com/) — Netcraft (read 2026-11-12)
5. [Chainabuse](https://www.chainabuse.com/) — Chainabuse (read 2026-11-12)
6. [WIPO fees for UDRP cases](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.