# Report domain abuse: one email, no account

> Report phishing, malware, botnets, CSAM or fraud to abuse@isthmusdomains.com, no account needed. We suspend within 24 hours of a well-documented report.

- URL: https://isthmusdomains.com/abuse/
- Last updated: 2026-10-19
- Publisher: Isthmus Domains (https://isthmusdomains.com)

Anyone can report a domain registered with us: victims, security teams, registries, researchers or authorities. Write to abuse@isthmusdomains.com. No sign-up, no form, no login.

**Quick answer — How do I report abuse on a domain at Isthmus Domains?**

Email **abuse@isthmusdomains.com**: no account needed. As of 19 October 2026, phishing, malware, botnets and fraud on victims lead to suspension within 24 hours of a well-documented report, CSAM is handled immediately, and each sender gets an acknowledgement with a reference number. Isthmus Domains is an offshore domain registrar in Panama: register any domain with no KYC and pay in crypto.

## The abuse desk at a glance

| Attribute | Value |
| --- | --- |
| Address | abuse@isthmusdomains.com |
| Who can report | Anyone; no account, no login, no form |
| Language | English |
| Acknowledgement | an acknowledgement with a reference number |
| Phishing (incl. pharming), malware, botnets | Suspension within 24 hours of a well-documented report |
| Child sexual abuse material (CSAM) | Suspension immediately, with a report to the competent hotline or authority |
| Fraud that takes money from victims | Suspension within 24 hours of a well-documented report |
| Any other complaint | Reply within 2 business days; a Panamanian court decision is needed before any action |
| Trademark disputes | UDRP, lock within 2 business days of a request from a UDRP provider |
| Legal basis | ICANN RAA §3.18, as amended on 5 April 2024 |

## What should a well-documented report contain?

A report we can act on names the domain, shows the abuse and says when you saw it. Five items are enough in most cases:

- **The domain name** and the full URL where the abuse appears.
- **The type of abuse**: phishing, malware, botnet, CSAM or fraud.
- **Evidence**: a screenshot with the date and time (UTC), the phishing email with full headers, a file hash (SHA-256) or a scan result.
- **When** you saw it, and whether it was still live when you wrote.
- **A way to reach you**, if you want news of the outcome.

For fraud, add what the victim was asked to do: pay, send crypto, connect a wallet or enter a password. For CSAM, send the URL only. Never attach the material, and report it to the hotline of your country as well.

## Categories and target times

| Category | Examples | What we do |
| --- | --- | --- |
| Phishing | Fake bank login, fake webmail, pharming through DNS | Suspension within 24 hours of a well-documented report |
| Malware | Domain that serves ransomware, a trojan or a fake update | Suspension within 24 hours of a well-documented report |
| Botnet | Command-and-control domain, domain from a generation algorithm | Suspension within 24 hours of a well-documented report |
| CSAM | Any child sexual abuse material | Suspension immediately, with a report to the competent hotline or authority |
| Fraud on victims | Fake shop, investment or crypto scam, wallet drainer, bank or brand impersonation, stolen data for sale | Suspension within 24 hours of a well-documented report |
| Spam | Only when it carries one of the cases above | Handled as that case |
| Everything else | Copyright, defamation, politics, competitors, trademarks outside the UDRP | Reply within 2 business days; Panamanian court decision needed |

## What happens after you report

1. **We confirm receipt** — You get an acknowledgement with a reference number. Keep it: quote it if you write again about the same domain.
2. **We check the category** — We check whether the report is one of the strict exceptions (phishing, malware, botnets, CSAM, fraud against victims) and whether the evidence shows it.
3. **We act or we explain** — A strict exception leads to suspension within 24 hours of a well-documented report. Any other complaint gets a reply within 2 business days with the route to follow.
4. **With Domain protection** — With Domain protection, a person reads every complaint before any action on the domain, and the beneficiary is told when the law allows it. Without the option, this policy applies as written.

## What do we not act on alone?

We do not suspend a domain because of a complaint about copyright, defamation, political content or a competitor. Those need a decision from a Panamanian court; a foreign judgment must first be recognised by the Fourth Chamber of Panama's Supreme Court. The same applies to sanctions questions, content about drugs or weapons, and content that a court abroad ordered removed.

Trademark disputes follow the [UDRP](https://isthmusdomains.com/udrp/). The full table of complaints and outcomes is on [complaints and court orders](https://isthmusdomains.com/complaints-and-court-orders/). This is not legal advice.

## Why do we still act on these five cases?

Because they hurt people who never chose to deal with the domain, and because ICANN rules require it. The 2024 amendment to section 3.18 of the Registrar Accreditation Agreement obliges registrars to take action on DNS abuse once it is shown.

A registrar that does not handle such reports can lose its ICANN accreditation. Our policy, in force for every domain and every price shown on the [pricing page](https://isthmusdomains.com/pricing/), keeps both promises: due process for disputes, fast action on real abuse.

## What if my domain was suspended by mistake?

Reply to the suspension email with your evidence and the reference number. We review the reply. If the report was wrong, for example because a page was hacked and has since been cleaned, the domain is restored. Write to support@isthmusdomains.com for anything else about your account; see [contact](https://isthmusdomains.com/contact/).

## Questions about abuse reports

### Do I need an account to report abuse?

No. Send an email to abuse@isthmusdomains.com from any address. There is no form and no login. You get an acknowledgement with a reference number, so you can follow up. If you do not want news of the outcome, say so; the report is handled the same way.

### How long does it take to suspend a phishing domain?

Suspension comes within 24 hours of a well-documented report. A clear report saves time: the domain, the full URL, a dated screenshot or the email with its headers, and when you saw it. Reports with only a domain name and no evidence take longer, because we must find the abuse ourselves first.

### Can I report a website for copyright infringement here?

You can write, but a copyright complaint alone does not lead to suspension. You need a decision from a Panamanian court, or a foreign judgment recognised in Panama. We reply within 2 business days and explain this route. The host of the website has its own rules, which you can use separately.

### What should I do if I find child sexual abuse material?

Send the URL to abuse@isthmusdomains.com and report it to the hotline of your country. Never download, copy or attach the material. We act immediately, with a report to the competent hotline or authority.

### Is spam counted as abuse?

Only when it carries one of the strict exceptions: a phishing link, a malware attachment, a botnet or a fraud that takes money from victims. In that case we treat it as that abuse. Unwanted marketing with no such content is outside our abuse policy; the email provider that sent it is the better place to report.

### Can the registry of the extension act on its own?

Yes. Each registry has its own abuse policy and can act on a domain directly, whatever the registrar does. Verisign for .com, for example, works under its own rules and contract with ICANN. The registrar of record shown in RDAP, our ICANN-accredited partner, also keeps its own abuse contact. You can report to the registry as well as to us; our own policy is the one written on this page.

## Sources

1. [2024 Global Amendments: DNS abuse](https://www.icann.org/resources/pages/global-amendment-2024-en) — ICANN (checked 2026-10-19)
2. [2013 Registrar Accreditation Agreement](https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en) — ICANN (checked 2026-10-19)
3. [Updated UDRP Rules](https://www.wipo.int/en/web/amc/domain-name-disputes/resources/updated_udrp_rules) — WIPO Arbitration and Mediation Center (checked 2026-10-19)

**Seen abuse on one of our domains?** Write to abuse@isthmusdomains.com with the domain, the URL and your evidence. [How complaints are handled](https://isthmusdomains.com/complaints-and-court-orders/) · [Contact us](https://isthmusdomains.com/contact/)

---

Isthmus Domains: Isthmus Domains is an offshore domain registrar in Panama: register any domain with no KYC and pay in crypto. A .com costs $11.99/year; Domain protection adds $29 a year.