Why We Report
Via Email Only
We provide registrars with complete evidence packages—doing their investigation work for free. Our reports follow legal channels because internal platform games cannot supersede international regulations.
Why This Matters
Phishing isn't just an inconvenience. It's a global criminal industry destroying lives and businesses every day.
The Legal Framework
Registrar Accreditation Agreement §3.18.1
"Registrar shall maintain an abuse contact to receive reports of abuse... Registrar shall publish an email address to receive such reports on the home page of Registrar's website."
Source: 2013 RAA, Section 3.18.1
24-Hour Monitoring Requirement
"Registrar shall establish and maintain a dedicated abuse point of contact, including a dedicated email address and telephone number that is monitored 24 hours a day, seven days a week."
Source: ICANN RAA §3.18.2
Digital Services Act - Article 16
"Providers of hosting services shall put mechanisms in place to allow any individual or entity to notify them of the presence on their service of specific items of information that the individual or entity considers to be illegal content."
Source: EU DSA, Article 16
2024 DNS Abuse Amendments
"To facilitate submission of reports from any party alleging abuse and/or Illegal Activity, the registrar must publish an email address or web form that is readily accessible... Web forms must not require a login to submit abuse reports."
Source: ICANN Advisory, Feb 2024
Why Web Forms Fail
Broken CAPTCHAs & Technical Barriers
Some registrars deploy unsolvable CAPTCHAs, rate limits, and technical barriers that make form submission impossible. When reports fail, they claim "technical issues" or "reports didn't arrive."
No Audit Trail
Web forms provide no verifiable proof of submission. Email creates a timestamped, legally admissible record that can be presented to ICANN Compliance if the registrar fails to act.
Deliberate Obstruction
Certain registrars intentionally complicate their forms to discourage reporting. This is a direct violation of the RAA requirement for "readily accessible" abuse contacts.
Auto-Response Absurdity
Some registrars send auto-responses that classify phishing as "plagiarism" or "copyright issues"—demonstrating willful ignorance of DNS Abuse definitions established by ICANN.
Login Requirements
ICANN explicitly states: "Web forms must not require a login to submit abuse reports." Requiring account creation violates contractual obligations.
Arbitrary Field Requirements
Mandatory fields for irrelevant information, character limits on evidence descriptions, and forced categorization into incorrect report types all serve to frustrate legitimate reporters.
What We Actually Send
Our reports are comprehensive evidence packages designed to make the abuse team's job as easy as possible. We do the investigation work—they just need to act.
Unique tracking ID and threat severity classification
Domain, IP address, detection timestamp, URLScan forensic links
VirusTotal detections, threat engine analysis, blacklist status
Automated screenshot proving phishing content
Specific AUP/TOS violations and applicable laws
Clear action items for the abuse team
100% Non-Profit
We receive zero donations, zero payments, zero profit. No contracts, no directors, no commercial interests. Our project is completely open-source and exists only to fight scams.
One Goal: Eliminate Threats
We're not protecting a specific victim or company. We're eliminating threats from the internet before they cause more damage. That's it. No hidden agenda.
Complete From the Start
We front-load all available evidence in our initial report: domain, IP, URLScan analysis, screenshots (multiple, attached as files and in PDF), VirusTotal detections, and threat intel. There's simply nothing more we could add.
Why We May Not Respond to Follow-Up Requests
Our initial email already contains everything we have: domain, IP, URLScan forensic links, VirusTotal detections, multiple screenshots (attached as files AND embedded in the PDF report), policy violations, and legal references. Requesting "additional screenshots" when 3+ are already attached, or asking for "more evidence" when a complete PDF is included, suggests the report wasn't fully reviewed.
Additionally, we've learned that some registrars' abuse forms redirect reports to unrelated parties—their partners, resellers, or entirely different domains than the one reported. To ensure proper handling, we follow ICANN's mandated procedure: sending reports to the official abuse email address published in WHOIS records.
False Positive? We Want to Know
We take false positives seriously and actively work to prevent them. If you believe a domain was reported in error, please let us know through one of these channels:
- Appeal Form (recommended) — anonymous, simple, with ticket tracking to monitor status
- GitHub Issue — public, transparent, community-visible
- appeal@phishdestroy.io — may be delayed due to spam from reported fraudsters
The appeal form is preferred because offended scammers frequently flood our email with spam, making legitimate appeals easy to miss. The form provides a ticket number for tracking and doesn't require any personal information.
Our Methodology
Complete Evidence Package
Every report includes comprehensive documentation: domain WHOIS data, screenshots, URLScan results, source code analysis, and PDF attachments. We provide everything needed for the registrar's abuse team to make an informed decision without additional investigation.
Direct Email Communication
We use the abuse email addresses published in WHOIS records and on registrar websites, exactly as mandated by ICANN RAA §3.18.1. This creates a legal audit trail and ensures our reports reach the designated abuse handling contacts.
Clear DNS Abuse Classification
Our reports explicitly identify the type of DNS Abuse (phishing, malware, botnets, pharming) using ICANN's official definitions from SAC115. We do not use vague terms that allow registrars to deflect responsibility.
ICANN Escalation Path
When registrars fail to respond appropriately, we escalate to ICANN Contractual Compliance with full documentation of our reports and the registrar's failure to comply with RAA §3.18.
✓ Bottom Line
Internal platform policies, proprietary forms, and custom procedures do not supersede ICANN contractual obligations or EU regulations. A registrar cannot invent obstacles to avoid their legal duty to investigate and respond to well-founded abuse reports.
What the Law Actually Says
Registrars Must Investigate
"Registrar shall take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse." The RAA does not say "investigate only if submitted through our preferred form" or "respond only if it's convenient."
Time-Sensitive Obligations
Under the 2024 DNS Abuse Amendments, registrars must "promptly take the appropriate mitigation action(s) that are reasonably necessary to stop, or otherwise disrupt, the Registered Name from being used for DNS Abuse." Phishing domains require immediate action—not bureaucratic delays.
Email Is the Legal Standard
ICANN explicitly requires registrars to publish and monitor an abuse email address. While web forms are permitted as an additional option, they cannot be the only method, and they cannot create barriers to reporting. Email remains the legally mandated baseline.
Non-Compliance Has Consequences
Registrars who fail to comply with RAA §3.18 face breach notices from ICANN Contractual Compliance. Continued non-compliance can result in termination of accreditation. We document everything and escalate when necessary.
Recommendations for Registrars
When you receive our report, here's what we recommend beyond just suspending the single domain:
Audit the Client
If a domain is compromised or malicious, check all domains owned by this client. There's a high probability their other domains also contain malicious content—either because the account is compromised, or because the "client" is actually a fraudster using your infrastructure systematically.
Blocking ≠ Justice
Simply suspending one domain doesn't stop the criminal. If the client is a scammer, they'll register new domains and continue. Consider whether this warrants a full account termination and potential referral to law enforcement in your jurisdiction.
Preserve Evidence
Depending on your jurisdiction, after receiving our report you may be required to retain logs and client data for potential law enforcement requests. You've been formally notified that this resource is likely malicious—act accordingly with data preservation.
Consider Legal Obligations
In many jurisdictions, knowingly hosting criminal infrastructure after notification creates liability. Our report serves as formal notice. Consult your legal team about reporting obligations to authorities and evidence retention requirements.
Compromised vs. Malicious Registration
We report what we find—we don't determine intent. It's your job to investigate whether the domain was compromised (legitimate client, hacked account) or maliciously registered (fraudster using your service). Either way, the threat must be neutralized, but your follow-up actions may differ.
Compliance or Complicity.
Your Choice.
We provide comprehensive evidence of criminal activity. We follow legal reporting channels. We do your abuse team's job for free. After that, the decision is yours: protect internet users, or enable fraud.
Be Law-Abiding
- Investigate reports promptly
- Suspend confirmed phishing domains
- Comply with ICANN RAA §3.18
- Protect your reputation
Be Complicit
- Ignore documented abuse
- Request endless "clarifications"
- Face ICANN breach notices
- Risk accreditation termination
We're not your enemy. We're doing your abuse department a service by identifying threats on your infrastructure before they result in regulatory action, reputation damage, or legal liability. Work with us, not against us.
On False Positives
We're Sorry When It Happens
Yes, false positives happen. And we're genuinely sorry when they do. We're operators constantly improving our detection logic and verification systems. Every false positive is embarrassing to us, and we do everything possible to minimize them.
Our Track Record
Since July 2025, our false positive rate is less than 1 per 1,000 correctly identified threats. Our repository is fully open—you can verify every report, every removal, every correction we've made.
View our open repository →Don't Use Our Mistakes to Justify Yours
Our occasional errors don't excuse ignoring legitimate reports or treating every notification as a false positive. We're unpaid operators with no legal protection and no obligation to defend fraudsters. We simply hope you'll comply with legal standards and maintain a competent abuse department.
Full Transparency & Open Data
Everything we send is open. Everything we do is public. No secrets, no hidden agendas.
Forward Our Reports
You may forward our reports to the domain owner, the alleged scammer, third parties, law enforcement, or anyone else. We explicitly permit this.
Disclose Our Email
Our email address abuse@phishdestroy.io is public. Feel free to share it with anyone, including the reported party.
Share Report Contents
The full contents of our reports, including all attachments and PDF files, can be shared, copied, or published without restriction.
Provide to Authorities
You may provide our reports and all associated data to law enforcement, regulatory bodies, or legal proceedings. We encourage this.
No Confidential Information
Our reports contain no confidential or private information. Everything we provide—domains, IPs, screenshots, analysis—is either publicly available or generated by us under MIT license. We don't require privacy, non-disclosure, or any non-transparent handling of our communications.
Thank You
To all registrars, hosting providers, and abuse teams who follow the rules, investigate reports fairly, and act to protect internet users—thank you. You make the internet safer for everyone.
We're all on the same side. Let's keep it that way.
