Find the registrar and network abuse contacts for a domain or IP from RDAP.
Network: RDAP + DoHNew
Abuse Report Generator
Runs locallyNew
Use Abuse Report Generator
What it does
Enter the URLs, IP addresses, dates and evidence of a phishing or scam site and get a ready-to-send abuse e-mail for its registrar, hosting provider or CDN. File hashes are computed in your browser and nothing is sent anywhere.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Wallet drainer on a lookalike domain
hxxps://connect.wallet-verify[.]example/claimFind the registrar's abuse address with Abuse Contact Lookup. Section 3.18 of the RAA binds ICANN-accredited registrars of gTLDs (.com, .net, .xyz and the other generic TLDs); for country-code domains the report cites the registry's policy instead.
Subject
Abuse report: crypto wallet drainer domain wallet-verify[.]example (impersonating Example Wallet)
Body
Hello abuse team,
I am reporting the domain name wallet-verify.example, registered through your company. It is used for a crypto wallet drainer: a fake site that asks visitors to connect a wallet and sign transactions that send their funds to the attacker, impersonating Example Wallet.
Details
Attack type: Crypto wallet drainer
Brand: Example Wallet
Domain: wallet-verify.example
URLs: https://connect.wallet-verify.example/claim
IP addresses: 192.0.2.10
First seen: 2026-10-19T08:00:00Z (UTC)
Last seen: 2026-10-20T09:30:00Z (UTC)
Evidence
https://urlscan.io/result/00000000-0000-4000-8000-000000000000/
Description
The page copies the Example Wallet site and asks visitors to connect a wallet and sign a token approval for all their assets.
Request
Section 3.18 of the ICANN Registrar Accreditation Agreement requires accredited registrars to investigate abuse reports and, when there is actionable evidence that a domain name is used for DNS abuse such as phishing or malware, to take prompt mitigation action. Please suspend this domain name (for example with the clientHold status) so that it stops resolving, and lock it against transfer while you investigate.
Please confirm that
…A registrar report for wallet-verify.example: the subject carries the defanged domain, the body the real URL, the IP 192.0.2.10, first and last seen in UTC, a urlscan.io link and a suspension request that cites section 3.18 of the ICANN RAA.
FAQ
What do the three templates ask for?
The registrar template asks for suspension of the domain (for example clientHold) and a transfer lock, citing section 3.18 of the ICANN Registrar Accreditation Agreement for generic TLDs. The hosting template asks for removal of the content and preservation of logs, and the CDN template asks the provider to name the origin host, forward the report and show a phishing warning.
Does the generator check that the site is malicious?
No. It formats what you enter and checks only the form: URL, IP address, hash and date syntax, last seen after first seen, and a domain for registrar reports. Whether the evidence is enough is up to you, and the RAA reference applies only to ICANN-accredited registrars of generic TLDs.
Is the report or my contact data sent anywhere?
No. The report is built in your browser and dropped files are hashed locally without being uploaded. It leaves the page only when you copy it, open it in your mail app or download it.