--- title: "Abuse & Phishing Reporting" url: "https://help.internetx.com/de/icann/ts-abuse-reporting/" lang: "de" section: "Fehlerbehebung" subtitle: "How to report domain abuse, phishing, spam, and what happens next" --- # Abuse & Phishing Reporting InterNetX is an ICANN-accredited registrar and takes domain abuse seriously. This article explains what types of abuse we handle, how to submit a report, what happens after you report, and when other paths (such as UDRP) are more appropriate. ## What We Handle (and What We Don't) We handle **Phishing:** domains used to impersonate legitimate websites to steal credentials or financial information. **Malware:** domains distributing malicious software. **Spam:** domains used as the source or landing page for unsolicited bulk email. **Domain abuse:** domains registered in bad faith to exploit trademarks, deceive users, or facilitate fraud. **Illegal content:** where the domain itself (not the hosting) is the vehicle for illegal activity under applicable law. We don't handle **Website content issues:** if the problem is content hosted on a website (e.g. defamation, copyright on a specific page), the complaint should go to the hosting provider, not the domain registrar. We control the domain name and DNS, not the web server. **Email content:** spam originating from a mail server is a hosting/ISP issue. We can act if the domain itself is the spam vehicle. **Personal disputes:** disagreements between private parties about domain ownership are resolved via UDRP (see below), not abuse reports. ## How to Submit an Abuse Report Contact **abuse@internetx.com** Include Domain name(s) involved. Type of abuse (phishing, malware, spam, trademark, illegal content). Supporting evidence: URLs, screenshots, email headers, WHOIS data. Your contact information for follow-up. Format Plain text or PDF attachments. Include one report per incident. For bulk reports (multiple domains, same abuse pattern), group them in a single submission with a clear list. ℹ The more specific your evidence, the faster we can act. A screenshot of a phishing page with the URL visible is significantly more actionable than a general statement that "this domain is suspicious". ## What Happens After You Report 1. **Acknowledgement**You receive a confirmation with a reference number. This confirms your report has been received and is in the queue. 2. **Review**The abuse team reviews the report, verifies the evidence, and determines whether the domain is within InterNetX's responsibility (we can only act on domains we are the registrar of record for). 3. **Determination**The team determines the appropriate action based on the type and severity of abuse, the evidence provided, and the applicable registry rules for the TLD. 4. Possible actions include: contacting the domain registrant to resolve the issue, applying **ClientHold** (suspending DNS resolution so the domain stops working), modifying DNS records (e.g. redirecting to a warning page), referring the case to the relevant TLD registry, or referring to law enforcement. 5. **Notification**The reporter is informed of the outcome where possible and appropriate. ## Response Time Targets Phishing / Malware Initial response within **4 hours**. Active phishing sites are treated as urgent. Law enforcement requests Initial response within **24 hours**. General abuse Initial response within **48 hours**. Trademark / UDRP Acknowledged within 48 hours. UDRP proceedings follow the dispute provider's timeline (see below). ## If You Don't Receive a Response If you submitted a report and have not received an acknowledgement within the stated response time: Check spam The acknowledgement email may have been filtered. Check your spam/junk folder for a message from abuse@internetx.com. Re-send Forward your original report again to abuse@internetx.com with "FOLLOW-UP" in the subject line and reference any previous reference number. Escalate If the matter is urgent (active phishing, law enforcement), contact InterNetX support directly and reference the abuse report. ## Alternative: Report via NetBeacon NetBeacon is a free, centralized DNS Abuse reporting service operated by the NetBeacon Institute (formerly DNS Abuse Institute, created by Public Interest Registry). Reports submitted via NetBeacon are standardized, enriched with data from abuse databases, and routed to the appropriate registrar for investigation. NetBeacon Reporter Submit reports at **[netbeacon.org/reporting](https://netbeacon.org/reporting/)**. Free for anyone. No technical knowledge required. What it accepts Phishing, malware, botnets, and spam. Reports are checked against online abuse databases and enriched before being forwarded to the registrar. Report format Reports are converted to XARF (industry standard abuse reporting format), enriched with external data, and delivered to the responsible registrar. When to use Use NetBeacon if you are unsure which registrar to contact, or if you want your report standardized and enriched automatically. For direct reporting to InterNetX, use **abuse@internetx.com**. ℹ NetBeacon is not a law enforcement service. For CSAM (Child Sexual Abuse Material), report to **iwf.org.uk/report** or your local authority. Do not submit CSAM to NetBeacon or to abuse@internetx.com. ## UDRP: Trademark Domain Disputes The Uniform Domain Name Dispute Resolution Policy (UDRP) is the correct path when a domain name infringes on a trademark and the registrant registered it in bad faith. UDRP is not an abuse report; it is a formal dispute proceeding. When to use UDRP Someone has registered a domain that is identical or confusingly similar to your trademark, AND they have no legitimate interest in the name, AND they registered it in bad faith (e.g. to sell it to you, to disrupt your business, to attract traffic by confusion). Where to file File with an ICANN-approved dispute resolution provider: **WIPO** (wipo.int/amc/en/domains), **NAF** (adrforum.com), **ADR.eu** (for .eu domains), or **Czech Arbitration Court** (for new gTLDs). Registrar role InterNetX locks the domain during proceedings (prevents transfer or deletion). We provide registrant data to the dispute provider. We implement the decision (transfer or cancellation) within 10 business days of the decision. Timeline Respondent has 20 days to reply. Decision typically issued within 14 days after response deadline. Implementation within 10 business days unless court action is filed. Cost Paid by the complainant. Fees vary by provider and number of domains (typically $1,500-5,000 USD for a single domain). ℹ UDRP is not the right tool for every trademark dispute. If the domain is being used for active phishing or fraud, submit an abuse report instead. Abuse reports are faster and do not require a formal proceeding. UDRP is for cases where the domain is registered in bad faith but may not involve active criminal activity. ## URS: Uniform Rapid Suspension The URS is a faster, lower-cost alternative to UDRP for clear-cut cases of trademark infringement in new gTLDs. It does not transfer the domain; it suspends it. Scope Available for **new gTLDs only** (.shop, .online, .tech, .app, etc.). Not available for legacy gTLDs (.com, .net, .org) or ccTLDs (.de, .fr, .uk). Standard of proof Higher than UDRP: complainant must demonstrate **clear and convincing evidence** that the domain is identical or confusingly similar to a trademark, the registrant has no legitimate right, and the domain was registered and used in bad faith. Outcome if successful Domain nameservers redirected to an informational page. Domain is **not transferred or deleted**. It remains registered but non-functional for the registrant. The suspension lasts for the remainder of the registration period. Timeline Examiner reviews within **1 business day** of filing. If accepted, registrant has **14 days** to respond. Decision typically within **3 days** after response period. Significantly faster than UDRP (which takes ~60 days). Cost Lower than UDRP. Filing fee is approximately **$375-500 USD** per domain (vs $1,500-5,000 for UDRP). Where to file **MFSD (National Arbitration Forum)** is the current URS provider approved by ICANN. Registrar role InterNetX locks the domain upon notification. If URS succeeds, nameservers are changed to point to an informational suspension page. Domain remains locked for the rest of its registration. Appeal Registrant can appeal within 6 months of the decision. If appeal succeeds, domain is restored. ### URS vs UDRP: When to Use Which Use URS when Clear-cut infringement in a **new gTLD**. You want fast suspension (days, not months). You do not need to acquire the domain, just stop it being used. Evidence is strong and straightforward. Use UDRP when You want the domain **transferred** to you (not just suspended). The domain is a legacy gTLD (.com, .net, .org) or ccTLD. The case involves nuance or complexity that needs a full panel review. You need a binding transfer decision. Use abuse report when The domain is being used for **active phishing, malware, or fraud**. Immediate action needed (hours, not days). Criminal activity, not just trademark infringement. ℹ URS and UDRP are complementary, not competing. URS is the quick suspension for obvious cases in new gTLDs. UDRP is the full proceeding for transfer. An abuse report is the emergency path for active criminal use.