Phishing & Pharming Reporting Process

You may submit reports of suspected phishing or pharming DNS abuse directly to Trustname at any time.

Reporters are strongly encouraged to first contact the relevant Internet Service Provider (ISP), Web Hosting Provider, or the domain registrant, as these parties often have direct control over server infrastructure and can typically mitigate malicious content more quickly.

However, prior contact with any third party is not required, and Trustname will review all properly submitted DNS Abuse reports regardless of whether such contact has occurred.

Key Takeaways

• Remember to Contact the Web Host Too – Reports of suspected phishing or pharming DNS abuse may be submitted directly to Trustname at any time. Reporters are strongly encouraged to contact the ISP, hosting provider, or registrant for faster mitigation, but prior contact is not required.
• Submitting a Report to Us – If the problem persists, reports can be filed through our Abuse Report Form, including clear evidence like live site links and email headers.
• Investigation and Actions– Upon receiving a report, we issue a case number, investigate, and may disable name servers or engage the registrant if the domain is clearly used for phishing or pharming.
• Limits of Our Authority – Our actions are bound by ICANN and Estonian law; we can only act on valid court orders from specified jurisdictions and do not control website content.
• Our Commitment – We track all complaints to enhance anti-abuse processes and contribute to a safer online environment, addressing verified threats such as phishing, malware, and DNS abuse.

TABLE OF CONTENTS

• Key Takeaways
• Definition
• Your Action Plan
• Additional Complaint Requirements For Phishing
• What Will Happen
• Please Keep In Mind
• Remember

Definition

Phishing is the attempt to obtain sensitive personal, corporate, or financial information (e.g. account numbers, login IDs, passwords, payment details) through fraudulent or "look-alike" emails or websites that purposefully masquerade as trustworthy sources. Pharming is a type of redirection that leads to fraudulent websites or services. Often, phishing and pharming occur simultaneously. 

Your Action Plan

1. Because a domain registrant or hosting account holder may be unaware of phishing, pharming, or similar abuse conducted through their domain, we recommend that you also notify the domain registrant directly when submitting a report, so they can investigate and remediate the issue promptly.

   You can contact them using the information you find by performing a Whois lookup on the Registrar’s website or via a generic service; this may be a link to a contact form or their email address.

   Look for a line that starts with "Registrant Email". If they are using our Whois Privacy Protection Service (WHOISPPS), you can use the contact privacy form. Please note that we have no control over the content of websites hosted on domains registered with us or any of our registrars.

2. Complainants submitting legal documentation from outside the European Union must first proceed through the appropriate Mutual Legal Assistance Treaty (MLAT) channels to ensure full compliance with EU legal requirements.
3. If you still believe Trustname can help you, you may submit a report here - Abuse Report Form - Phishing & Pharming.

Information Required for Initial Assessment and Investigation

To allow Trustname to identify the reported activity and begin its assessment, please provide the following information:

• Reporter contact informationA working email address that Trustname may use to acknowledge the report or request clarification.
• Reported domain nameThe domain name alleged to be involved in phishing or credential harvesting.
• Reported URLThe complete URL of the reported page, including the protocol, path, and relevant query parameters, where available. If the exact URL cannot be obtained, please provide the domain name and explain how the reported content was accessed.
• Target of the attackThe legitimate organization, brand, service, or website that is allegedly being impersonated or targeted.
• Description of the reported activityA brief explanation of what was observed and why the reporter believes that the domain is being used for phishing or credential harvesting.
• Direct supporting evidencePreferably, a screenshot of the reported page showing the allegedly abusive content together with the browser address bar and full URL. If a screenshot cannot reasonably be obtained, please explain why and provide any other available evidence demonstrating the reported activity.

Trustname will record and assess a report even when certain information is unavailable. Where the submitted information is insufficient to identify, locate, or understand the reported activity, Trustname may request clarification or additional evidence. Trustname may also consider information reasonably available to it as part of its investigation.

Additional Technical Information That May Be Helpful

The following information may assist Trustname in reproducing, verifying, or assessing the reported activity. It is helpful where available but is not required for Trustname to accept or begin investigating the report:

• The country or geographic location from which the reported content was accessed;
• The device type, operating system, browser, or user-agent used;
• The date and time, including time zone, when the content was observed;
• A copy of the associated phishing email or message, including full email headers;
• The login-form POST endpoint or other destination to which submitted information is sent;
• Captured HTTP requests, responses, redirects, or network traffic;
• Evidence showing that information is transmitted to an unauthorized third party;
• Information indicating whether the report was verified manually or generated through automated detection;
• Threat-intelligence reports, scan results, exfiltration endpoints, or other independently verifiable technical indicators.

The absence of this additional technical information will not, by itself, cause a report to be rejected, disregarded, or discarded.

Additional Requirements for Alleged Phishing or Credential Harvesting

Where a report alleges phishing or credential theft, Trustname may request additional information, including:

• A screenshot of the reported page showing the allegedly abusive content, with the browser address bar and the full URL clearly visible;
• The complete URL of each reported page, including the protocol, path, and any relevant query parameters;
• Confirmation that active credential harvesting has been verified rather than inferred solely from visual similarity or brand impersonation;
• The destination of submitted credentials (such as the login form POST endpoint or equivalent);
• Evidence that credentials are transmitted to an unauthorized third party or otherwise used for unauthorized purposes;
• Whether the determination is based on manual verification or solely on automated detection;
• Any additional technical indicators supporting the allegation, such as exfiltration endpoints, captured requests, or other independently verifiable evidence.

Brand Impersonation and Trademark Issues

The existence of a similar domain name, visual resemblance to another website, or the presence of a login form does not, by itself, establish phishing or credential harvesting.

Where no evidence exists that credentials or sensitive information are being collected for unauthorized use, the matter may instead constitute trademark infringement, brand impersonation, unfair competition, or another content-related dispute. Such matters are generally more appropriately addressed through applicable legal procedures, hosting providers, or dispute resolution mechanisms rather than registrar-level DNS Abuse enforcement.

Additional Complaint Requirements For Phishing

• The domain name, brand, or business the phish is mimicking.
• The website must be live and contain a login area.
• An example phishing email, including the full email header information.

What Will Happen

Upon receipt of such a request via our Abuse Report Form,Trustname will:

1. Respond with a case number.
2. Review the site and investigate your complaint, including validating the court order. Please note that we, as a Registrar, will only accept court orders issued by or domesticated in the courts of Estonia, Germany, Canada, or the United States.
3. If it is clearly a phishing or pharming site, we will either expeditiously reset its Name Servers so that they do not point to any site or work with the registrant to resolve an issue where a malicious actor has gained control of their site to use it for phishing or pharming.

Please Keep In Mind

• We cannot guarantee any particular outcome, but we will review your complaint and contact you only if necessary.
• Your complaint will be evaluated on its merits and addressed as appropriate.
• You will not receive any updates regarding the evaluation or outcome of the complaint. It is entirely at the discretion of the domain registrant whether or not to respond to you.
• We reserve the right to use your complaint to prove abuse to our customer, if necessary.
• Complaints are tracked by our team to improve anti-abuse processes and mitigate threats.
• If you submit your report using the Abuse Report Form, you will not receive further notification of receipt for additional submissions from your email address within 24 hours.
• The support code to submit this type of abuse report is S7Q-PSNG-Y9W.

Remember

• Limited Role – Domain name Registrars, such as Trustname, only maintain the system of domain names (example.org) that uniquely identify websites. They are not responsible for the content of the sites to which those domain names point.

  This means that if you dislike a site or its content, you should first contact the domain owner, then the service that hosts the site (web hosting service), and, if necessary, your local law enforcement authorities. As a domain Registrar, we can only act on court orders issued by or domesticated in the courts of Estonia, Germany, Canada, or the United States.

• ICANN Compliance – According to the ICANN Registrar Accreditation Agreement (RAA) and Estonian law, as a Registrar, we are not authorized to take independent action against a domain based on third party allegations. The responsibility for content and activities related to a domain lies with its administrator.

  However, in accordance with our role as an accredited Registrar, we will take action against a domain administrator if we receive a valid court order or a request from an ICANN-recognized authority.

• Our responsibilities – As a Registrar, we include addressing issues such as Botnets, Malware, Pharming, Phishing, Spam, DNS security threats, and trademark infringement, as detailed by ICANN. For more information and our recommended solutions to these issues, please refer to the related articles on ICANN's website.