You can report abuse involving a domain we register through the form at /abuse, by email to [email protected], or by phone at +1 602-812-6937. You don't need an OrbitFour account to report.
What we can act on
As a registrar, we act on DNS abuse involving domains we sponsor. ICANN defines DNS abuse as five things:
- Phishing: pages that impersonate a real organization to steal information.
- Malware: software installed on devices without the user's consent.
- Botnets: networks of infected devices, including their command-and-control servers.
- Pharming: sending people to fraudulent sites, usually by manipulating DNS.
- Spam, but only when it delivers one of the four above.
Other complaints usually belong with someone else. That includes website content, trademark and copyright claims, and consumer disputes. We can often point you to the right party. See Domain disputes and Copyright and trademark complaints.
What to include
- The exact domain name or names.
- The type of abuse, such as phishing or malware.
- Evidence: the full URL, screenshots, message headers, scanner or blocklist results, and timestamps with your time zone.
- Your contact details, so we can follow up.
- Whether you're reporting in an official role, such as security researcher, law enforcement or brand owner.
The more specific and verifiable your evidence, the faster we can act.
Never send images or files containing child sexual abuse material. Send only the URL and a short description. Also report it to the NCMEC CyberTipline (report.cybertip.org or 1-800-843-5678) or the Internet Watch Foundation (iwf.org.uk).
What happens next
When you use the form, we email you a confirmation straight away with a case reference. Reply to that email if you have more evidence.
We review the report and decide whether it describes DNS abuse we can act on. Severe, active abuse, such as live phishing or malware distribution, is handled on an expedited basis. Cases that need the domain owner or host to fix something can take longer.
If we confirm abuse, we choose the smallest action that stops it. That can mean asking the domain owner to fix it, contacting the hosting provider, or placing the domain on hold. A hold takes the domain out of the DNS, so its website and email stop working.
When a legitimate site has been hacked, we may work with the owner and host to remove the malicious content rather than take the whole domain offline. We may contact you if we need more information.
The full process is in our Abuse Policy. If you reported a domain we sponsor and believe we haven't met our obligations after a reasonable time, you can complain to ICANN Contractual Compliance at https://www.icann.org/compliance/complaint.