What if the registrar ignores my report about a look-alike?

What does ICANN check?

The amendments, which received broad support from generic top-level domain (gTLD) registries and ICANN-accredited registrars, became effective on 5 April 2024. They introduce new requirements that require gTLD registry operators and registrars to take action to stop or disrupt well-evidenced cases of DNS Abuse.

ICANN accredits registrars and holds them to a contract. Its complaint page lists a registrar's failure to display abuse contacts, to investigate and respond to an abuse report, or to take mitigation action against a domain used for DNS Abuse.

Amendments to the registrar contract took effect on 5 April 2024 and require registrars to take action to stop or disrupt well-evidenced cases of DNS Abuse.

Does a complaint lead anywhere?

During the first six months of enforcement of the DNS Abuse mitigation requirements, from 5 April 2024 through 5 October 2024, ICANN's Contractual Compliance team launched 192 investigations into potential violations.

From 5 April 2024 to 5 October 2024, ICANN's compliance team opened 192 investigations under these rules.

ICANN reports that those actions led to the suspension of more than 2,700 abusive domain names in that period.

How do I file one?

A registrar's failure to: Display abuse contacts and procedures. Investigate and respond to an abuse report involving a domain name registered with the registrar. Take mitigation action(s) to stop or disrupt the use of a domain name for DNS Abuse

1. Report to the registrar's abuse contact first and keep the date and any reference number.
2. Wait a reasonable time for an answer.
3. File a complaint on ICANN's contractual compliance page under DNS Abuse (Registrar), with your original report attached.
4. Use the evidence you sent the registrar: the look-alike, the emails and the dates.

What counts as DNS Abuse here?

(malware, botnets, phishing, pharming, and spam when spam is used to deliver any of the other four types of DNS Abuse)

ICANN's complaint page names malware, botnets, phishing, pharming, and spam when spam is used to deliver one of the other four. A look-alike used to send false payment emails is reported as phishing.