Malte ZanderContents
- What belongs in an abuse report?
- How do you write the subject line and first sentence?
- Template 1: report to the hosting provider
- Template 2: report to the registrar
- Template 3: report to a CDN
- Template 4: reminder when there's no answer
- Which attachments should you include?
- How does AI Fraud Protect help?
- FAQ
A good abuse report states the issue in the subject line and contains the full URL, a one-sentence reason, evidence with date and time, and your name and contact details. For hosts in the EU, add a statement that you act in good faith. Keep the tone factual and short, ask each party only for what it can do and use the templates below as your framework.
- A notice under Article 16 of the Digital Services Act contains a reason, the exact URL, your name and email address and a good-faith statement (DSA, Article 16).
- If you give electronic contact details, the host must promptly confirm receipt and tell you its decision along with the available redress options (DSA, Article 16).
- For registrars, ICANN names a screenshot and the full URL as examples of actionable evidence (ICANN).
- ICANN plans to publish multilingual guidelines because many complaints lack the detail needed to act (ICANN).
What belongs in an abuse report?
Everything a reviewer needs to decide without asking:
The full URL with path and parameters, exactly as victims received it.
A one-sentence reason: what the page does and whom it imitates.
Your official address for comparison, such as the real login page.
Evidence: desktop and mobile screenshots with date, time, time zone and the visible address bar, and the page source if needed.
Who is reporting: name, role, company, email and phone, plus the registration number for trademarks.
The specific request: remove the content, close the account or suspend the domain.
For hosts in the EU: a reference to Article 16 DSA and the good-faith statement.
How do you write the subject line and first sentence?
So that the abuse team can classify the case without opening the attachments. A proven pattern for the subject is type of abuse, affected brand and address, such as "Phishing page abusing the [brand] trademark at [domain]". The first sentence repeats this with the full URL. Avoid threats, capital letters and long preambles. Abuse teams handle factual reports faster.
Template 1: report to the hosting provider
For content on a server, such as a phishing page, a fake shop or a fake verification page. In the EU, this is also a notice under Article 16 DSA.
Subject: Phishing page abusing the [brand] trademark at [domain]
Dear [host] abuse team,
The page at [full URL with path and parameters] impersonates [brand]. It copies our [login page, shop, verification page] and [asks for login credentials, sells goods under our name, confirms forged certificates]. Our official site is [official URL]. [Brand] is a registered trademark of [company], registration number [number].
Evidence: desktop and mobile screenshots from [date, time, time zone] and the page source are attached. The page is served from IP address [IP], which belongs to your network.
Please remove the content and suspend the account concerned. This is a notice under Article 16 of the Digital Services Act. I confirm that the information is accurate and complete to the best of my knowledge and that I am acting in good faith.
[Name, role, company, email, phone]
Template 2: report to the registrar
For domains registered only to impersonate you. For generic domains, the obligations in ICANN's registrar agreement apply.
Subject: DNS abuse (phishing) via the domain [domain]
Dear [registrar] abuse team,
The domain [domain], registered with you, is being used for phishing against customers of [brand]. At [full URL], a page imitates our [login page] and asks for login credentials. The domain was registered on [date from RDAP] and mimics our brand name. We have no connection with its registrant.
Evidence: screenshots from [date, time, time zone], the full URL, the DNS records and the registration data are attached.
We ask you to suspend the domain for DNS abuse. You can reach me with the details below for any questions.
[Name, role, company, email, phone]
Never ask for the suspension of a hacked but otherwise legitimate domain. That report belongs with the host and the site owner. The reasoning is in Host, registrar or DNS.
Template 3: report to a CDN
For sites behind Cloudflare or another proxy. Many CDNs use a form instead of email, and this text fits the description field. Cloudflare forwards reports to the operator and the host and gives the host the origin IP (Cloudflare).
The page [full URL] impersonates [brand] and asks our customers for their login credentials. Our official site is [official URL]. Screenshots from [date, time, time zone] are attached.
Please forward this report to the hosting provider and give them the origin IP so they can remove the content. Where possible, please show visitors a warning.
[Name, role, company, email]
The steps in detail are in Taking down a site behind Cloudflare or another CDN.
Template 4: reminder when there's no answer
For reports still unanswered after one or two business days.
Subject: Reminder on ticket [ticket number]: phishing page at [domain] still online
Dear [provider] abuse team,
On [date] we reported the phishing page at [full URL] to you (ticket [ticket number]). As of [date, time, time zone], the page is still reachable; a current screenshot is attached. Please let us know when you will process the report.
[Name, role, company, email, phone]
Which attachments should you include?
A few well-named files rather than an unsorted archive. What works: screenshots as PNG files with the date in the file name, a PDF comparing the fake with the original and, if needed, the page source as a text file. Some providers block ZIP attachments, so single files or a link to a protected folder are safer. What to secure before you report is in Securing evidence of a fake website.
How does AI Fraud Protect help?
AI Fraud Protect fills in these templates for every case automatically: with the full URL, evidence, registration and hosting data and the right grounds for the host, registrar, DNS provider, CDN and Google Safe Browsing. A person reviews and sends every message. Reminders with the ticket number are prepared as soon as a channel doesn't respond.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Should I report in English or the local language?
In English for providers abroad. Abuse teams at large providers work internationally, and an English report gets handled faster. For small local providers, the local language is fine.
Do I have to mention Article 16 DSA explicitly?
It isn't required, but it helps. The reference shows the host that your notice meets the requirements and that it owes you a confirmation of receipt and a decision.
May a service provider send the report for us?
Yes. It should state that it acts on behalf of the rights holder and be able to show written authorization.
How long should an abuse report be?
As short as possible. Five to ten sentences plus attachments are enough. Everything else is in the evidence.
Sources
Digital Services Act, Article 16, with the official text on EUR-Lex
ICANN advisory: DNS abuse obligations in the registrar and registry agreements, 5 February 2024
ICANN: progress and next steps in enforcing DNS abuse mitigation requirements, 20 October 2025