Who do you report this domain to? One API call answers it.
Give AbuseRoute a domain. It returns the registrar's abuse contact, the network operators hosting it and their abuse contacts, and tells you when a CDN or reverse proxy is hiding the real host. Built for SOCs, CERTs and abuse desks.
What you get back
Registrar abuse contact
The sponsoring registrar, its IANA ID and the abuse mailbox it publishes. From registry and registrar RDAP, with WHOIS fallback for ccTLDs that have not moved yet.
Hosting network abuse contacts
For every IP the domain resolves to: the responsible network operator, its range and the abuse contact it registered with ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC.
Infrastructure classification
Whether Cloudflare, Fastly, Akamai, CloudFront or another proxy fronts the site. If it does, the network contact reaches the CDN, not the host, and the response says so instead of letting you send the report to the wrong place.
A routed answer, not a data dump
The abuse_contacts list is deduplicated and ordered by who can act fastest. Origin visible: host first, then registrar. Origin hidden: registrar first, then the CDN as a forwarding channel.
A real response
One request for a large news site fronted by Fastly. Abridged; the full response also includes DNS records, registration dates and per-IP network data.
curl -H "X-Api-Key: $KEY" \
https://api.abuseroute.com/v1/lookup/theguardian.comNotice what the classification does: the hosting network is Fastly, but Fastly does not host the content. The routed list puts the registrar first and labels Fastly as a CDN so an analyst knows a report there will be forwarded, not actioned.
{
"domain": "theguardian.com",
"registration": {
"registrar": "GoDaddy.com, LLC",
"iana_id": 146,
"registrar_abuse": { "email": "abuse@godaddy.com" }
},
"infrastructure": {
"cdn": "Fastly",
"origin_obscured": true,
"mail_provider": "Google Workspace",
"dns_provider": "NS1",
"confidence": "high"
},
"abuse_contacts": [
{
"role": "registrar",
"entity_name": "GoDaddy.com, LLC",
"email": "abuse@godaddy.com"
},
{
"role": "cdn",
"entity_name": "Fastly",
"email": "abuse@fastly.com"
}
]
}How a lookup works
- You send a domain name. Internationalised names are accepted and converted to punycode.
- We resolve its A, AAAA, MX, NS and CNAME records with our own resolver.
- We query the registry's RDAP server for the registrar and its abuse contact, falling back to WHOIS where a ccTLD has no RDAP.
- For each resolved IP we query the responsible Regional Internet Registry for the network operator and its abuse contact. One request at a time per registry, over a persistent connection.
- We classify the infrastructure from the CNAME chain, nameservers, mail exchangers and network ownership.
- We return everything, plus a routed contact list ordered for action. Nothing is stored beyond a short cache.
Who it is for
Security operations centres
Phishing and malware takedowns where the analyst needs the right abuse desk in seconds, not after three WHOIS lookups and a guess.
CERTs and CSIRTs
Incident coordination across many networks and registrars, with consistent structured output that fits a ticketing system.
Abuse desks and trust and safety teams
Routing inbound reports to the party that can act, and documenting where each report went.
Not a WHOIS reseller. AbuseRoute does not return registrant identity data, does not compile a database and does not offer bulk exports. It answers the routing question, using registry data for the purpose it was published.
A private, access-controlled API. AbuseRoute is not a public lookup service. There is no public lookup page and no anonymous or self-service API access. Keys are issued on request to organisations that identify themselves and describe their abuse-handling or security use, and every key is rate-limited and bound to our terms.
Looking for an individual lookup? For manual, one-at-a-time checks, use the RrSG's ACID Tool, which is free for individual use. AbuseRoute is a separate service for teams that need the same routing answer inside their own systems.
Start with a trial key
Free, 5 requests a minute, 50 lookups a day, valid for two days from first use. Access is private and issued on request: tell us who you are and how you will use it, and we reply within one business day. Keys go to security, abuse, CERT and trust and safety teams, not to individuals.