Guide To Reporting Scams

Introduction

Hello,

If you’re reading this, then I imagine you’re here to learn how to report assets of scamming operations.

Note: This is a beginner guide, covering only Domains & Phone Numbers. A more advanced one may come out in the future.

**Domains**
First things first. 2 things are needed for a website (excluding the code)
- A domain (Provided by a domain registrar, such as Namecheap)
- A host (Provider by the hoster, such as AWS)

Now, how do we identify the domain and the host? A simple whois query/lookup.
Many websites provide this. On Unix based operating systems you can even use the `whois` command.
I use: https://www.whois.com/whois
You can use whatever you like, they should all provide the same output.
Lets take scammer.info as an example:
- Find your whois lookup tool, I will be using the one mentioned above.
- Enter it in the search bar.
- You will receive a result that looks like this:
image examplepng.png![image examplepng.png](https://tlscommunity.com/assets/2021-03-03/14:42:080-examplepng.png)
From this we now know who to contact:
- In the registrar field, we see that NameCheap is the registrar
- In the nameservers field, we see that Cloudflare is the hoster
Scrolling a bit further down, we are presented with an abuse email:
image example2png.png![image example2png.png](https://tlscommunity.com/assets/2021-03-03/14:45:440-example2png.png)
This is where we are sending the report to.
As an additional, I tend to take a screenshot of the website. This is going a bit off topic, but when conducting an investigation - I also tend to upload the site to an archive site, in case they change it or take it down.

I obviously won't be reporting scammer.info to NameCheap, that was just used as an example.
Below, I have provided a template you can use when writing your email:
https://pastebin.com/pGVTzFuB
Change it however you like, but this should at least be an idea if you are struggling to structure it.

Finally, send the email and await a response. Some providers are notorious for being slow to respond, in that case - You can contact the hoster instead.

**Numbers**
Okay, domains out the way. This is near enough the same.
First off, we need to identify the carrier - This is the provider of the number (An example being Onvoy)
We can do this several ways, most conveniently, if you have 500xp+ on BobRTC. Then you can head over to chat.bobrtc.tel and use BobBot's `!verify [number]`
Another option is to use a carrier lookup site, the one I use is: https://freecarrierlookup.com/
Enter the number, and you'll be provided with an output similar to this:
image example3png.png![image example3png.png](https://tlscommunity.com/assets/2021-03-03/16:43:050-example3png.png)
From this, we can tell that the carrier is: Neutral Tandem-Illinois, LLC - IL. These guys are a reseller for Onvoy, and with a short bit of research - We find that we can report the number through the web form, located here: https://www.inteliquent.com/legal/unwanted-calls

It's not always this simple, sometimes carriers request that you email them, some request that you call them. Below is another email template, this time for reporting numbers:
https://pastebin.com/xiFZbFHc
Again, change it however you like and await their response.

**Ending notes**
That's all for now, hopefully now you have the basics down for reporting.
If you want any changes made to this guide, leave a reply and that'd be much appreciated.
If you have any questions, reply below and I'll be happy to help you out.

Thanks!

1 Like

that was helpfull

1 Like

Thanks for sharing. You can also call US banks and share mule account numbers. They won’t tell you anything about that account but usually forward it over to their fraud group to investigate.

casually replies 2 years later

yeah great post man

PS, using a website like http://phish.report is super useful when taking down websites because it gives you all the tools and does all the work for you. Highly suggest it.