Quick answer
How do I report abuse on a domain registered with PanamaRegistrar?
Email [email protected]; you do not need a PanamaRegistrar account. Phishing, malware, botnets and fraud that takes victims' money lead to suspension within 24 hours of a well-documented report. Child sexual abuse material is handled immediately, and the URLs are reported to NCMEC. We follow RAA section 3.18, as amended on 5 April 2024. This applies as of October 2026.
Abuse reports at a glance
| Address | [email protected] |
|---|---|
| Account needed | No |
| First answer | an automatic acknowledgement with a reference number |
| Phishing, pharming, malware, botnets, fraud | Suspension within 24 hours of a well-documented report |
| Child sexual abuse material | immediately, and the URLs are reported to NCMEC |
| Other abuse reports | Answered within 2 business days |
| Domain protection | On a protected domain, every report is read by a person before any action on the domain |
| Content disputes | Not handled here: see how we handle complaints |
How do I send an abuse report?
Plain email works. You do not need to sign in, fill in a form or give your name.
Write to [email protected]
Put the domain and the type of abuse in the subject, for example "Phishing: example.com".
Give the exact URLs
Full URLs, not only the domain. Defanged links such as hxxp:// are fine.
Attach the evidence
Screenshots with the date and time, message headers, file hashes or sandbox reports.
Keep the reference number
You receive an automatic acknowledgement with a reference number. Quote it if you send more evidence.
What should an abuse report include?
A report we can act on names the domain, the exact location of the abuse, and evidence that we can check.
- Phishing or pharming: the full URL, the brand or service imitated, a screenshot, and the email or message that carried the link.
- Malware: the URL that serves it, the SHA-256 hash of the file, and a sandbox or scanner report.
- Botnet command-and-control: the domain, the malware family and the source of the identification.
- Fraud: the URL, how victims pay (payment page, wallet address) and any victim statement or police reference.
- Spam carrying any of the above: the full headers and the links in the message.
We do not ask you to prove that a victim lost money or that credentials were stolen. Evidence that the site is built to do it is enough.
What evidence do you accept?
We accept any evidence we can verify, and refuse only material that is itself harmful.
- Accepted: URLs, screenshots, PDF captures, full message headers, file hashes, sandbox reports, listings on recognised blocklists with their reference, and victim or police reports.
- Do not attach: live malware files. Send the hash or a sandbox link instead.
- Never attach: images or videos of child sexual abuse. Send the URL only. Copying such material is a crime in most countries, and in Panama under Penal Code arts. 184 and 185.
A report without checkable evidence is not refused. We read it, look at the URL ourselves, and may ask you for more.
How fast do you act on a report?
Our commitments, measured from the moment a well-documented report reaches [email protected].
| Report | What we do | When |
|---|---|---|
| Any report | Acknowledgement | an automatic acknowledgement with a reference number |
| Phishing, pharming, malware, botnets | Suspension of the domain | within 24 hours of a well-documented report |
| Fraud that takes money from victims | Suspension of the domain | within 24 hours of a well-documented report |
| Child sexual abuse material | Suspension and report of the URLs | immediately, and the URLs are reported to NCMEC |
| UDRP provider's request | Lock of the domain | Within 2 business days |
| Other abuse reports | Written answer | within 2 business days |
What happens after I report?
We check the evidence, decide, and write to you and to the domain holder.
- The report is logged with its reference number.
- We open the URLs and check the evidence. On a domain with Domain protection, a person reads the report before any action.
- If the abuse is confirmed, the domain is suspended within the times above.
- The holder is told what was reported and how to answer, by the domain's verified email.
- You receive a written answer with the outcome.
A holder whose legitimate site was compromised can show that the abuse has been removed and ask for a review, which we answer in writing. Every report and its outcome is counted in the quarterly transparency report.
What is not abuse under this procedure?
Disputes about what a website says or shows are not abuse reports. They follow our complaint procedure, which needs a Panamanian court decision before any action on the domain.
That covers copyright and DMCA notices, defamation, personal data, political or government content, reviews and competitor complaints. Trademark disputes over the name itself go to the UDRP or URS. Unwanted email that carries no phishing, malware or fraud is forwarded to the holder, not acted on.
The full list of what leads to suspension is in the acceptable use policy.
What does ICANN require of registrars on abuse?
ICANN requires every accredited registrar, including our registrar partner, to investigate abuse reports and to act on proven DNS abuse. Our partner keeps its own abuse contact, shown in the RDAP record.
- RAA §3.18.1: a registrar "shall take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse".
- RAA §3.18.2, in force since 5 April 2024: with actionable evidence of DNS abuse, the registrar "must promptly take the appropriate mitigation action(s)".
- RAA §3.18.3: reports from law enforcement get a review within 24 hours when well-founded.
ICANN enforces these duties. According to ICANN's termination notice to the registrar Trustname, dated 27 August 2026, its grounds included acting weeks after phishing reports. The notice also cited asking for proof that credentials had been stolen before acting. Our procedure is written to avoid both.
How do I report child sexual abuse material?
Send the URL to [email protected] with the subject "URGENT", and nothing else from the page.
We act immediately, and the URLs are reported to NCMEC. The domain is suspended without waiting for a court. Do not download, screenshot or forward the material, even to us. A report with the URL alone is complete.
Panama's Penal Code, as amended by Law 478 of 2025, punishes the production and distribution of child sexual abuse material (art. 184). Possession carries 5 to 10 years (art. 185). You can also report to the hotline of your own country.
Reporting abuse: questions
Do I need to give my name to report abuse?
No. A report needs the domain, the URLs and the evidence, not your identity. We do need an email address to send an automatic acknowledgement with a reference number and our answer. Police and authorities who send a formal request should identify themselves and use the subject "Legal request"; see law enforcement.
How fast will a phishing site be suspended?
We act within 24 hours of a well-documented report, counted from a report with checkable evidence. We verify the evidence first, so a full URL and a screenshot speed things up. Pharming, malware, botnets and fraud that takes money from victims follow the same timetable. Each suspension is counted in the transparency report.
Will you suspend a site for copyright infringement?
Not on a report. Copyright, defamation, political and competitor complaints need a decision from a Panamanian court, or a foreign judgment recognised in Panama by exequatur. They are logged and forwarded to the holder. See how we handle complaints and DMCA notices.
Does the domain holder learn who reported them?
The holder receives what was reported and the evidence relied on, so that they can answer. Leave your personal details out of the evidence if you do not want the holder to read them. A child sexual abuse report needs only the URL.
What if the domain uses Domain protection?
The timetable does not change. Domain protection registers the domain in our company's name, and a person reads every report before any action on the domain, but phishing, malware and child abuse material are still acted on without waiting for a court. The option costs +$29 a year per domain, on top of the price on the pricing page.
Can I report a domain that is registered elsewhere?
We can act only on domains registered through PanamaRegistrar. For another domain, use the abuse contact of the registrar named in its WHOIS/RDAP record, or the registry of the extension. The registry and its country are listed in the registry jurisdiction index.
Sources (5)
- 2013 Registrar Accreditation Agreement (§3.18) — ICANN (checked 2026-10-19)
- 2024 global amendments to the RAA and Registry Agreement (DNS abuse) — ICANN (effective 5 April 2024)
- Compliance advisory: DNS abuse obligations under the amended RAA and RA — ICANN (5 February 2024)
- Notice of termination of registrar accreditation (Trustname) — ICANN Contractual Compliance (27 August 2026)
- Ley 478 de 4 de agosto de 2025 (Penal Code arts. 184, 185) — Gaceta Oficial No. 30337 (5 August 2025)