DemoSee the dashboard, report widget and takedown live
DE Log in Free fraud scan
TakedownsGuide

What to do when a host ignores your abuse report

No answer from the hosting provider? How to follow up, when to bring in the upstream network, the registrar and Google, and what works with hosts abroad.

Malte ZanderWritten with AI, reviewed by the author 6 min read
Contents
  1. How long should you wait for an answer?
  2. Step 1: check your report and the recipient
  3. Step 2: send a reminder with a reference
  4. Step 3: use the channels that don't depend on the host
  5. Step 4: go one level up
  6. Step 5: involve public reporting services
  7. Step 6: consider legal action
  8. What about hosts that never respond?
  9. How does AI Fraud Protect help?
  10. FAQ
In short

When a host doesn't respond, first check your report and the recipient, then send a reminder with the ticket number and immediately use the channels that don't depend on the host: the registrar, the DNS provider and Google Safe Browsing. If the host stays silent, go one level up to its upstream network provider and, for generic domains, through the registrar to ICANN's complaint process. Record every step with date and time.

Key facts
  • Hosts in the EU must promptly confirm receipt of a notice when you give electronic contact details, and must tell you their decision (DSA, Article 16).
  • Since 2013, the RIPE NCC has required all IP address resources it allocates and assigns to carry an abuse contact in the "abuse-c" attribute (RIPE NCC).
  • Between April 2024 and August 2025, ICANN opened 400 investigations into DNS abuse. About 20,000 malicious domains were mitigated as a direct result (ICANN).
  • ICANN complaints about registrars require that you reported to the registrar first (ICANN).

How long should you wait for an answer?

Not long, and never idly. Many hosts confirm a report automatically within minutes. If a host in the EU sends no confirmation at all although you gave an email address, that already suggests the report didn't arrive or went to the wrong inbox. As a rule of thumb: follow up after one business day without confirmation and after two business days without a decision. For active phishing, don't wait a minute with the other channels.

Step 1: check your report and the recipient

Before you escalate, check the three most common causes:

  • The right host? If the IP address belongs to a CDN such as Cloudflare, the recipient isn't the host. You need the route through the CDN, described in Taking down a site behind Cloudflare or another CDN.

  • The right inbox? The official abuse contact of a European network is in the RIPE Database in the "abuse-c" attribute. Write to that address rather than to every contact of a network.

  • A complete report? URL with path, evidence, reason and contact details. If something is missing, the report is often quietly filed. The checklist is in Why takedowns fail.

Step 2: send a reminder with a reference

Reply to your first report instead of sending a new one, so the reminder lands in the same ticket. Give the ticket number and the date of your first report, confirm that the page is still online and attach a current screenshot. A template is in Writing an abuse report that hosts actually act on.

Step 3: use the channels that don't depend on the host

A silent host doesn't block the whole takedown. Three routes work without it:

  1. Registrar: If the domain was registered for the fraud, the registrar can suspend it. The site then goes offline everywhere, wherever it is hosted.

  2. DNS provider: If a separate provider runs the name servers, it can remove the records.

  3. Browser warning: A report to Google Safe Browsing and to Microsoft protects visitors while the page is still reachable.

These channels really belong in the first hour. If you haven't used them yet, now is the time.

Step 4: go one level up

Every host connects to a larger network. If the host stays silent, report to its upstream provider, the network through which its own network reaches the internet. You find it in the routing data for the IP address, for example with the RIPE NCC's tools. Upstream providers react differently, but many take reports about customers who ignore abuse persistently seriously.

For generic domains, the registry is the level above the registrar. If a registrar doesn't react, you can complain to ICANN as long as you reported to the registrar first. Keep the date and ticket number of your report ready.

Step 5: involve public reporting services

In some countries, public or nonprofit bodies help. In Switzerland, the Federal Office for Cybersecurity accepts phishing sites through antiphishing.ch. In 2024 it received 975,309 reports and confirmed 20,872 phishing sites (BACS). In the UK, the NCSC accepts reports of scam websites. In Austria, Watchlist Internet collects tips on online fraud and publishes warnings. An overview by country is in How to report a phishing website in Europe.

If the same domain keeps harming you or the operator is known, a dispute procedure or a lawsuit can make sense. Your legal team decides. When it pays off is compared in Takedown or legal action.

LevelWhenWhat you need
Reminder to the hostAfter 1 to 2 business days without a decisionTicket number, current screenshot
Registrar, DNS, browsersImmediately, now at the latestEvidence package, the right framing
Upstream networkIf the host stays silentRouting data for the IP, history of your reports
ICANN complaintIf a registrar doesn't actProof of your report to the registrar
Public reporting serviceIn parallel, where one existsURL and evidence
Legal actionFor recurring harmFull documentation of every step

What about hosts that never respond?

Some providers ignore reports on purpose, often called "bulletproof hosting". Further follow-ups won't help there. Focus on the levers outside the host: suspend the domain, get a browser warning, warn your customers and watch for new domains. Without a domain and behind a red browser warning, even a page on an uncooperative server reaches hardly any victims.

How does AI Fraud Protect help?

AI Fraud Protect sets a follow-up date for every channel and prepares the reminder with the ticket number and current evidence as soon as a provider doesn't respond. The registrar, DNS provider and Google Safe Browsing are reported in parallel from the start, so a silent host doesn't stall the case. A person reviews and sends every message, and each case keeps its full history.

See which fakes use your name.

Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.

Start the free fraud scanRequest a demo

FAQ

Can I force a host to remove a phishing page?

Directly, only through legal action. In the EU, however, a host must decide on a complete notice in a timely and diligent way. A host that knows of illegal content and doesn't act risks its liability exemption.

Does it help to call the host?

Rarely. Abuse teams work through tickets. A call can help you find the right inbox, but it doesn't replace a written report with evidence.

Should I name the host publicly?

We advise against it. Public pressure often slows cooperation and warns the operators. Use the escalation routes and document everything.

What if the host forwards my report to the scammer?

It happens. That's why you secure the evidence before every report and report to the registrar and browsers in parallel, so a page that moves still gets suspended and flagged.

Sources

More in this series

Back to the blogAuf Deutsch lesen