Three different providers
A domain can be registered at one company, use DNS from another and be hosted by a third. Nameserver records reveal the DNS provider; the IP address of the website reveals the network holder and usually the host. Getting this right decides who can actually take a fraudulent site offline.
When a CDN is in front
Many sites sit behind a content delivery network. The visible IP then belongs to the CDN. Report abuse to the CDN, which can forward the complaint to the origin host, and preserve evidence of the CDN relationship.
Making the report
Abuse desks act faster on precise reports: exact URLs, the time observed, what the site does, and preserved evidence. Avoid accusations that the evidence does not support.
- Registrar from RDAP.
- DNS provider from NS records.
- Host or CDN from IP RDAP.
- Abuse contacts for each.
Sources and further reading
ICANN, Registrar abuse contactsRFC 9082, RDAP query formatThis resource supports investigative triage. It is not legal advice, an attribution finding or a certification that a website is safe.