Domain abuse explained: hosts, registrars, ASNs
Reporting a malicious site to the wrong party wastes days. Understanding the four layers below: and who has the power to remove content at each: is the difference between a browser warning and a real takedown.
The four layers of a live website
Every reachable URL depends on a stack of independent parties. From the physical bytes upward:
- Hosting provider: owns the disk and the running web server. Can delete files in minutes.
- ASN (autonomous system): the network provider announcing the hosting IP. Can null-route the whole prefix.
- Registrar: sold the domain to the registrant. Can suspend or transfer the domain.
- Registry: operates the TLD (Verisign for .com, DENIC for .de). Can lock or delete the domain zone-wide.
CDNs (Cloudflare, Fastly) and DNS providers sit alongside but are not custodians of content: they proxy or resolve.
Who actually removes what
- Phishing page on shared hosting → hosting provider. Fastest single lever.
- Malware served from a bulletproof host → ASN escalation once the host is unresponsive.
- Whole fraudulent domain (fake shop, cloned brand) → registrar suspension. The site plus every subdomain go dark.
- Systematic abuse of an entire TLD → registry policy action. Rare, slow, but happens (see .zip, .top clean-ups).
Blocklists (Safe Browsing, SmartScreen, PhishTank) are orthogonal: they warn users, they do not remove.
The three lookups you always run
- RDAP / WHOIS: surfaces registrar, registrant contact and creation date. Try rdap.org.
- IP → ASN: resolve the host to an IP, then look up the ASN on bgp.he.net.
- Abuse contact: abusix.com/contact-db gives the canonical abuse mailbox for both the host and the ASN.
The Cloudflare (and CDN) trap
A public IP behind Cloudflare, Fastly or Akamai does not host the content: the origin server does. Cloudflare will not remove third-party content, but they will forward abuse reports to the origin and reveal the origin IP under law-enforcement request. File the abuse report to both Cloudflare and, in parallel, to the origin as soon as you can identify it (TLS SAN leak, historical DNS on SecurityTrails, misconfigured direct-IP requests).
When speed actually matters
Credential-harvesting phishing has a half-life of hours. Wire-fraud landing pages, minutes. If the abuse mail is unlikely to be read within the attacker's window, escalate immediately to the ASN and to the brand's own security team: most large financials operate 24/7 fraud desks that can request browser blocks faster than any public blocklist.
Have a URL to report right now?
Blackwall triages the case, files with the right blocklists and opens a takedown with the hosting provider: usually within minutes.
Report a website to BlackwallRelated guides
Frequently asked questions
What is the difference between a hoster and a registrar?
A hoster serves the website's content and can remove specific URLs or accounts. A registrar controls the domain name and can suspend the whole domain. Different companies, different powers.
What is an ASN and when should I contact one?
An ASN (Autonomous System Number) identifies a network operator that routes traffic. Contact them only when hoster and registrar are unresponsive: they can null-route entire IP ranges.
How do I find a hoster's abuse contact?
Try /abuse on their website, abuse@<domain>, or look them up on abuse.net. RFC 2142 mandates abuse@ mailboxes for every registered domain.
What happens if the hoster ignores my report?
Escalate to the registrar (domain suspension) or the upstream ASN (network-level block). Blackwall automates this escalation ladder.
Can I report abuse anonymously?
Yes, most hosters accept anonymous abuse reports. Providing contact info speeds up follow-up questions but is not required for the takedown itself.