# Abuse Contact Lookup

URL: https://phishdestroy.io/developer-tools/abuse-contact-lookup
Category: Reporting & IOC
Where it runs: Network: RDAP, DoH

Enter a domain, URL, IP address or AS number to get the abuse contacts that registries publish in RDAP: the registrar's abuse address for a domain, and the network owner's abuse address for the IP addresses it resolves to.

Domain lookups go through the PhishDestroy RDAP relay (/api/rdap.php) to the registry; IP and ASN lookups go straight to the regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC). DNS names you look up are sent to the PhishDestroy DNS relay (/api/dns-resolve.php), which asks Cloudflare or Google DNS over HTTPS.

## Example input

A reserved domain

```
example.com
```

The registrar is RESERVED-Internet Assigned Numbers Authority (IANA ID 376) with no abuse address, because IANA holds the name. Find hosting abuse contact then resolves example.com and shows the networks that serve it.

## FAQ

### Where do the contacts come from?

From RDAP, the registration data protocol that replaced WHOIS. For a domain the registry of its TLD answers, and the registrar's abuse contact is part of that answer; for IP addresses and AS numbers the regional internet registries ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC answer.

### Why is an abuse contact sometimes missing or not the right one?

Some registries publish no RDAP (.de and .io are not in the IANA bootstrap file), some networks have no abuse role, in which case the tool falls back to remarks or other contacts and labels them, and a CDN such as Cloudflare hides the real host. Sites on shared platforms such as github.io must be reported to the platform, not to the registrar.

### What is sent, and to whom?

Nothing until you press a button. A domain goes to PhishDestroy's RDAP relay (/api/rdap.php), which asks the registry; IP addresses and AS numbers go from your browser to rdap.arin.net and the regional registry it redirects to; Find hosting abuse contact resolves the host through PhishDestroy's DNS-over-HTTPS relay.

## Related tools

- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [DNS over HTTPS Lookup](https://phishdestroy.io/developer-tools/dns-over-https-lookup)
- [WHOIS Fields Guide](https://phishdestroy.io/developer-tools/whois-fields-guide)
- [IOC Converter](https://phishdestroy.io/developer-tools/ioc-converter)
- [ASN Ranges Reference](https://phishdestroy.io/developer-tools/asn-reference)
- [Blocklist Converter](https://phishdestroy.io/developer-tools/blocklist-converter)

All tools: https://phishdestroy.io/developer-tools