Finding the registrar and its real abuse contact
Updated on August 5, 2026 · LegalBrandGuard · 3 min read
Quick answer
A domain’s registrar and its abuse contact are obtained by querying the registry via RDAP, or via WHOIS on extensions that have not yet migrated. Never guess the address: abuse@ followed by the fraudulent domain designates the fraudster themselves.
Who to contact, and why these two players
Two distinct intermediaries make a fake site accessible, and they do not have the same levers.
| Player | What it can do | How to identify it |
|---|---|---|
| Registrar | Suspend the domain — the site and its email stop working | RDAP or WHOIS lookup of the domain |
| Host | Take down the content — the domain survives but serves nothing | DNS resolution followed by identifying the owner of the IP address |
Notifying both doubles your chances: they fall under different jurisdictions, have different policies, and one may act while the other drags its feet.
RDAP, the source that replaced WHOIS
For thirty years, WHOIS was the protocol for querying registries. It returned free text, whose format varied from one registry to another — every tool had to maintain its own regular expressions.
RDAP is progressively replacing it. It returns structured JSON, where the abuse contact is an entity identified by its role rather than a line of text to be pattern-matched.
The switch is already under way
This is not a distant prospect. Querying the WHOIS server for the .shop extension now returns this response:
« Effective May 1, 2026, the WHOIS service has been retired in accordance with ICANN’s RDAP transition policy. All registration data queries are now served via RDAP. »
Practical consequence: a tool that only queries WHOIS no longer finds any registrar on this extension — and .shop is heavily used by fake stores.
The trap of the guessed address
When the lookup fails, the temptation is to reconstruct the address: abuse@ followed by the domain name. This is the usual convention among hosts, and it often works.
Applied to the domain being reported, it is disastrous: that address belongs to the fraudster. The message tells them they have been spotted, hands them the complainant’s identity, and gives them all the time they need to move their store.
When the published address is never read
Section 3.18 of the ICANN accreditation agreement requires every registrar to publish an abuse address and to process reports. In practice, publishing and reading are two different things.
The lesson goes beyond this one registrar: verify the real channel before sending. A notification sent to a mailbox nobody reads gives the illusion of having acted, which is worse than doing nothing at all — you end up waiting for a reply that will never come.
The case of sites behind a CDN
Most fake stores sit behind Cloudflare or an equivalent service. The IP address you get by resolving the domain then belongs to the CDN, never to the server that actually hosts the content.
Writing to the host of that IP amounts to writing to Cloudflare. That is not useless — they do forward reports to the origin host — but you need to go through their dedicated form rather than an email address, and explicitly check the box to forward the report to the host, otherwise it is not relayed to anyone.
Key takeaways
- RDAP returns structured JSON and is progressively replacing WHOIS — .shop already switched over in May 2026, other extensions are following.
- Two separate players need notifying in parallel: the registrar (can suspend the domain) and the host (can remove the content) — waiting for one before the other doubles the delay.
- A published abuse address isn’t always read: some registrars, Dynadot for instance, reserve it for law enforcement and only accept reports through a webform.
- Behind a CDN like Cloudflare, the resolved IP never belongs to the real host — only their dedicated abuse form forwards the complaint to the right recipient.
- This trap isn’t hypothetical: our own tool fell into it once, before we removed the guessed-address fallback entirely rather than trying to improve it.
Frequently asked questions
What is the difference between WHOIS and RDAP?+
Can I write to abuse@ followed by the fraudulent domain name?+
The registrar publishes an abuse address but never replies. Is that normal?+
How can I find out who actually hosts the site behind Cloudflare?+
Check your own brand
Our analysis identifies the registrar, its real abuse contact, and tells you whether that registrar handles reports by email or only through a form.
Scan my site for freeSources
See also: the step-by-step takedown procedure.