Build abuse reports for registrars, hosting providers and CDNs, as an email and as JSON.
New
Abuse Contact Lookup
Network: RDAP + DoHNew
Use Abuse Contact Lookup
What it does
Enter a domain, URL, IP address or AS number to get the abuse contacts that registries publish in RDAP: the registrar's abuse address for a domain, and the network owner's abuse address for the IP addresses it resolves to.
Domain lookups go through the PhishDestroy RDAP relay (/api/rdap.php) to the registry; IP and ASN lookups go straight to the regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC). DNS names you look up are sent to the PhishDestroy DNS relay (/api/dns-resolve.php), which asks Cloudflare or Google DNS over HTTPS.
Example
A reserved domain
example.comRegistrar of example[.]com
DOMAIN
example[.]com
REGISTRAR
RESERVED-Internet Assigned Numbers Authority IANA ID 376
CREATED
1995-08-14 (11391 days ago)
EXPIRES
2027-08-13 (in 296 days)
LAST CHANGED
2026-08-14 (67 days ago)
RDAP SERVER
rdap.verisign.com
REGISTRAR ABUSE CONTACT
The registry response has no abuse contact for this registrar.
STATUS
clientDeleteProhibited clientTransferProhibited clientUpdateProhibited
NAMESERVERS
elliott[.]ns[.]cloudflare[.]com
hera[.]ns[.]cloudflare[.]comThe registrar is RESERVED-Internet Assigned Numbers Authority (IANA ID 376) with no abuse address, because IANA holds the name. Find hosting abuse contact then resolves example.com and shows the networks that serve it.
FAQ
Where do the contacts come from?
From RDAP, the registration data protocol that replaced WHOIS. For a domain the registry of its TLD answers, and the registrar's abuse contact is part of that answer; for IP addresses and AS numbers the regional internet registries ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC answer.
Why is an abuse contact sometimes missing or not the right one?
Some registries publish no RDAP (.de and .io are not in the IANA bootstrap file), some networks have no abuse role, in which case the tool falls back to remarks or other contacts and labels them, and a CDN such as Cloudflare hides the real host. Sites on shared platforms such as github.io must be reported to the platform, not to the registrar.
What is sent, and to whom?
Nothing until you press a button. A domain goes to PhishDestroy's RDAP relay (/api/rdap.php), which asks the registry; IP addresses and AS numbers go from your browser to rdap.arin.net and the regional registry it redirects to; Find hosting abuse contact resolves the host through PhishDestroy's DNS-over-HTTPS relay.