Security operations and response
Abuse desk
An abuse desk is the team at a registrar, hosting provider, platform or network operator that receives reports of abuse on its infrastructure and decides what to do about them under its own terms of service.
What it can and cannot do
A registrar can suspend or lock a domain registration. A hosting provider can take down the content or terminate the account. A DNS provider can stop resolving the name. A platform can remove the account or listing. Each acts only on what it controls, which is why one phishing site may need reports to two or three abuse desks, and why the report has to make clear which provider is being asked to do what.
What a good report contains
Abuse desks handle volume. A report that can be verified in a minute gets handled; one that needs research waits.
- The exact URL or hostname, the IP it resolved to and the time of observation.
- What the abuse is, in one sentence, and which policy it breaches.
- Evidence: a capture of the page, the relevant DNS and registration data, and the certificate if there is one.
- Who is reporting, on whose behalf, and how to reply.
Following up
Record when the report was sent, when it was acknowledged and when the abuse stopped, and check that it actually stopped rather than trusting a closed ticket. Where a provider does not respond, escalate to the next provider in the chain, and for registrars, ICANN's contractual requirements on abuse contacts give a basis for complaint.
Related terms
Sources
- ICANN: reporting abuse to registrars and registries
- NIST SP 800-61 Rev. 3: incident response recommendations
External guidance is general. Adapt it to your legal, regulatory and operational requirements.