When Abuse Reports Go Nowhere: How Registrars Become Silent Partners in Cybercrime

The Broken System

Every abuse report we send follows a clear protocol: domain URL, category (phishing, crypto drainer, fake casino), VirusTotal detection count, screenshot evidence, and blacklist status. Each one is a forensic package. And yet domain after domain stays online for weeks and months after the first report.

There is no universal standard for how registrars must handle abuse reports: no SLA, no mandatory response time, and no accountability metric. Each registrar decides on its own whether a domain flagged by 16 antivirus engines deserves attention or a template reply and a closed ticket.

Who Overrules 16 Antivirus Engines?

This is the question no registrar wants to answer. When Kaspersky, ESET, Fortinet, BitDefender, Sophos, G-Data and ten more security vendors flag a domain as malicious on VirusTotal and the registrar's abuse team decides "no action needed", who exactly made that call?

Consider the absurdity: a single abuse analyst at a registrar overrules the combined threat intelligence of 16 independent antivirus engines, each with billions of data points, dedicated research labs, and decades of experience. On what basis? What scanning infrastructure does an abuse team at NiceNIC or GlobalDomainGroup operate that surpasses Kaspersky's?

None. They don't scan and they don't verify. They either don't look at the report at all, or they apply a financial calculation: a live domain generates revenue; a suspended domain does not.

In other words, someone at the registrar looked at evidence from 13 independent security vendors and 13 separate abuse reports and decided their own judgment was superior. That is a policy decision.

Name a single antivirus vendor that registrars treat as authoritative. You can't, because there isn't one.

• Kaspersky detects the domain? Ignored.
• ESET flags it as phishing? Ignored.
• Fortinet blocks it at the network level? Ignored.
• BitDefender warns millions of users? Ignored.
• Google Safe Browsing, the largest web safety system on Earth? Still ignored.

There is no detection threshold at which a registrar is obligated to act: not 5 engines, not 10, not 16. A domain can be flagged by every antivirus vendor on VirusTotal, appear on multiple blacklists, and have a dozen abuse reports filed. The registrar is still under no enforceable obligation to do anything.

The system is built this way. The domain registration industry has successfully avoided any binding standard that would require registrars to respect the findings of security researchers, antivirus vendors, or threat intelligence platforms. When 16 out of 70 engines detect a domain, that is a consensus. And the registrar's abuse team, with zero scanning infrastructure and a financial interest in keeping the domain alive, overrules that consensus.

The Financial Incentive

Domain registrars charge annual fees for every domain. Every suspension is lost revenue, and every takedown is a refund risk. There is a direct, measurable financial incentive to keep domains active, and no financial penalty for ignoring abuse reports.

This is not the case for all infrastructure providers. Cloudflare, for example, processes abuse reports efficiently and does not earn revenue from domain registrations in the same way. The distinction matters: when the company processing your report profits from the domain staying online, the conflict of interest is structural.

The Evidence: Live Data From Our Reports

Below is a sample from our March 2026 abuse escalation log. Every entry represents a real phishing domain that was still active at the time of reporting, despite prior reports and confirmed detections.

VT = VirusTotal detections out of ~70 engines. "Active" = hours since first detection at time of escalation. Data: PhishDestroy abuse escalation log, March 19–21, 2026.

The Numbers Don't Lie

The Repeat Offenders: Registrar Breakdown

Not all registrars are equal. Our data shows clear patterns: some registrars appear repeatedly in the worst-performing entries.

Combined Hours of Inaction by Registrar

Combined active hours of all reported domains per registrar in our March 2026 dataset. These figures cover only what we observed in one sample, not total registrar abuse.

What We Send vs. What They Do

Every PhishDestroy abuse report includes:

After registrar inaction, we escalate to ICANN Compliance (compliance@icann.org). In every case shown above, ICANN was CC'd on the second or subsequent report. Those escalations produced no results either.

The ICANN Standard That Doesn't Exist

ICANN's Registrar Accreditation Agreement (RAA), Section 3.18 requires registrars to maintain an abuse contact and to "take reasonable and prompt steps to investigate and respond appropriately" to reports of abuse.

In practice, "reasonable and prompt" means whatever the registrar decides it means. There is:

• No maximum response time: a registrar can wait weeks and claim it was "reasonable"
• No mandatory suspension threshold: 16 VT detections don't automatically trigger anything
• No public reporting requirement: registrars don't have to publish how many reports they receive or act on
• No meaningful penalty: ICANN has rarely revoked accreditation for abuse inaction

As a result, registrars treat abuse handling as a cost center to minimize rather than a safety obligation.

They Act on Typosquatting but Not on Phishing

More absurd still, some of the same registrars that ignore phishing reports for months are extremely efficient at one specific type of abuse: typosquatting (domains that are confusingly similar to established brand names).

The reason is that typosquatting targets corporations with legal budgets. When Google, Apple, or Microsoft files a UDRP complaint about a lookalike domain, registrars act within days. The threat of litigation and ICANN sanctions for trademark abuse is real and immediate.

But when a phishing domain steals money from individual victims, a crypto drainer empties someone's life savings, or a fake casino steals credit card data from gamers, there is no corporate legal team, no UDRP filing, and no urgency. The registrar's abuse department applies a different standard, one in which a victim's financial loss doesn't trigger the same response as a brand's trademark concern.

Registrars protect brands, not people. They respond to legal power and ignore evidence of harm. Our reports contain more objective evidence than any UDRP filing (VirusTotal scans, antivirus detections, blacklist confirmations, screenshots), and yet they sit unanswered.

We Do Their Job for Free

PhishDestroy is an independent, non-commercial project. We scan domains, classify threats, generate VirusTotal reports, take screenshots, and write detailed abuse reports that we send to registrars, registries, and ICANN. We do the security work that registrars should be doing themselves.

Yet some registrars actually do this work. They run their own domain scanning infrastructure, use private threat intelligence feeds, and proactively suspend malicious domains before anyone even reports them. So it can be done.

Fast abuse response is possible. What needs explaining is why some registrars choose not to do it, and every time the answer comes back to the same structural incentive: a suspended domain stops generating revenue.

The framework for holding registrars accountable already exists, but it is not enforced:

50,000 Domains and Counting

The examples above are a sample from a single week. The real scale is far larger.

Our continuously updated threat feed at content_active.txt (GitLab) contains over 50,000 domains that have been reported as malicious. Each one received at least one abuse report, and many received more than one. The registrars had the evidence (the VirusTotal scans, the screenshots, the blacklist confirmations) and chose their client over the safety of the public.

It is a choice. The registrar's client is the person who registered the domain, in this case the scammer. The registrar's client is not the grandmother who lost her savings to a fake banking page, or the crypto user whose wallet was drained, or the gamer whose Steam account was stolen. The registrar chose the scammer, every time.

From Report to Victims: Every Hour Counts

The moment we send an abuse report, a clock starts. From that moment, the registrar is officially aware that a domain under their management is being used to commit fraud. Every hour of inaction after that notification is an hour of informed complicity.

Many domains in our dataset survive report after report until their registration period expires. They run the full cycle: register, scam, get reported, get reported again, get escalated to ICANN, continue scamming, expire naturally. The registrar collected the registration fee and the scammer collected the stolen funds. The victims got nothing.

A timely domain suspension is more than an administrative action or "an inconvenience for the registrant." It is a rescue operation. Every domain banned in time is a wallet not drained, a credential not stolen, and a savings account not emptied. Registrars who frame takedowns as "censorship" or "business disruption" are revealing exactly whose interests they serve.

Should Registrars Compensate Victims?

The entire domain registration industry refuses to engage with one question:

Once the registrar receives the report, they are no longer ignorant. They have been informed, with evidence, that a domain under their control is being used to steal money, credentials, and identities. From that moment, continued inaction stops being negligence and becomes a conscious decision to allow harm.

• Is the registrar willing to accept liability for every dollar stolen through a domain they were warned about?
• Is the registrar prepared to compensate victims who lost funds after the abuse report was filed and ignored?
• Does the registrar's legal team understand that "we reviewed and found no issue" is not a defensible position when 16 antivirus engines disagree?

If the answer to all three is "no," there is no legitimate reason to keep the domain active. Suspend first, investigate later. That is how responsible infrastructure providers operate, Cloudflare among them, and hosting providers like Hetzner and OVH increasingly work the same way. Only domain registrars cling to a model where the scammer's convenience outweighs the victim's safety.

Who Pays the Price

Every hour a phishing domain stays online translates directly to victims:

• Crypto drainer domains (farewex, perowex, xerowex, naebex) empty wallets in seconds. The 4,658 combined hours of apiname.com domains represent thousands of potential wallet drains.
• Fake casino / CS:GO scams (casebattle variants, csgomy, ggddrop, tastdrop) target gamers with credit card fraud, identity theft, and rigged outcomes.
• Fake service impersonation (dexscreener[.]at, trustwallet[.]receipts[.]sh, amlbot[.]im, dotabuff[.]org) copies real brands, which leads to credential theft and financial loss.
• Carding infrastructure (patricksstash, stashhpatrick) sells stolen payment data to other criminals.

What Must Change

The current model is broken by design: registrars profit from domains staying active, ICANN has no enforcement teeth, and victims have no recourse. These changes would fix it:

1. Mandatory SLA for abuse response: 24-hour acknowledgment, 72-hour initial action, and a 7-day escalation path, all measurable and auditable.
2. Automatic suspension threshold: Any domain with VirusTotal detections ≥10 and 2+ independent reports must be suspended first and reviewed later.
3. Public abuse transparency reports: Every ICANN-accredited registrar must publish quarterly: reports received, average response time, actions taken, domains suspended.
4. Financial penalties for non-compliance: Graduated fines for registrars that systematically fail to act, and loss of accreditation for repeat offenders.
5. Independent abuse ombudsman: A third-party body that can review registrar decisions, override inaction, and fast-track suspensions for critical threats.
6. Cross-registrar ban list: When a registrant is confirmed as a serial abuser, all accredited registrars should be notified. That would end domain shopping.

What PhishDestroy Has Done About It

Rather than write reports and wait for the industry to fix itself, we build systems that force transparency and create consequences for inaction.

PhishDestroy doesn't protect brands or defend victims. We destroy phishing and scam infrastructure.

Conclusion

When 16 antivirus engines say a domain is malicious and a registrar says "no action," the registrar is protecting revenue. When 13 separate abuse reports go unanswered and a domain stays live for 1,352 hours, the registrar is enabling crime.

The data in this article comes from our live abuse escalation log for a single week in March 2026, and behind it sit 50,000+ reported domains in our continuously updated threat feed. The problem goes well beyond any one registrar: it is an industry-wide failure that the domain registration ecosystem has no interest in fixing, because the current model is profitable.

Registrars are not obligated to respect any antivirus vendor's findings, and no detection threshold triggers mandatory action. There is no SLA, no accountability, and no consequences. The registrar collects the fee and ignores the reports, and the victims pay the price.

Registrars are gatekeepers, and they are not neutral. Every day, with every ignored report, they choose to keep criminal infrastructure online. They know about the harm and have the power to stop it, and they choose not to. Nothing will change until someone asks them the only question that matters: "Are you willing to compensate the victims of domains you refused to suspend?"

So far, the industry has answered this question with silence.