Reporting Pipelines That Actually Do Something (IC3, FTC, abuse.ch)
most scam reports die in a web form that nobody reads, which is why people stop reporting, which is exactly what the scammers want. the fix is not reporting harder, it is reporting to the right places with a clean evidence pack. some channels create a record, some actually pull infrastructure down, some chase the money. you want all three, aimed correctly.
first, build the evidence pack once
every channel wants the same core facts, so assemble them once and reuse. the pack:
- what happened, in plain language, with a timeline in utc
- dollar loss and payment method (card, wire, gift card brands and codes, crypto wallet)
- scammer contact: phone number(s), email(s), the domain(s) involved with creation dates
- technical iocs: ips, hosting org, file hashes, the rmm instance id and relay
- screenshots with visible urls and timestamps
the record channels: IC3 and FTC
these create the official paper trail that law enforcement aggregates. they rarely give you a personal reply, and that is fine, that is not their job. volume and pattern are.
IC3 (ic3.gov) is the fbi’s internet crime complaint center. file here for anything with a real dollar loss, especially wire or crypto, because ic3 feeds the recovery asset team that occasionally claws back wires if you report fast. FTC (reportfraud.ftc.gov) takes five minutes, no login, and feeds the consumer-sentinel database that investigators and state ags query. if a specific company is being impersonated, tell them too; many have a phishing/abuse address.
the takedown channels: abuse.ch and the hosts
this is where infrastructure actually dies. abuse.ch runs free, industry-wide platforms: urlhaus for malicious urls, malwarebazaar for samples, threatfox for iocs. submit there and the whole defensive industry gets the indicator for free, which means blocklists, edr, and email filters start catching it.
then go to the hosting and registrar abuse contacts you pulled from whois. a factual email with the domain/ip, the evidence, and utc timestamps is what gets a scam site suspended. keep it calm and specific. abuse desks ignore rants and act on tidy iocs. if the crew abused a legitimate rmm vendor (screenconnect, anydesk), report the instance id to that vendor’s abuse team directly. they can kill the tenant.
the money channel: exchanges and wallet reports
if crypto left the building, report the wallet to the cash-out exchange’s compliance/law-enforcement portal and note it in your ic3 filing. chainalysis-style public reporting and the forms behind many “report scam address” services aggregate these. you will not personally recover funds, but a wallet flagged at a kyc exchange is the lead that can.
the pipeline, in order
- assemble the evidence pack (once)
- abuse.ch (urlhaus/malwarebazaar/threatfox) for the indicators
- hosting + registrar abuse, and the rmm vendor for the instance id, for the takedown
- ic3 + ftc for the record, plus the impersonated brand
- exchange / wallet report for the money
- keep your confirmation numbers and dates in the evidence pack
what defenders and victims can do
- report fast on wires: the ic3 recovery asset team’s odds drop by the hour. same day matters.
- report even small scams: the pattern is the point. your “tiny” report plus a thousand others is how a cluster gets prosecuted.
- automate the boring part: a small script that resolves abuse contacts and drafts the email (for you to review and send) saves hours on repeat campaigns.
sloth take
“reporting never does anything” is true only if you report to the wrong place with no evidence. send the indicators to abuse.ch, the takedown request to the host, the record to ic3 and ftc, and the wallet to the exchange. it is twenty minutes and it is the difference between venting and actually costing them their vps.
want a repeatable abuse-reporting and takedown workflow wired into your security program? Book Dark Edge Consulting.
sources
- FBI IC3 (ic3.gov) and the Recovery Asset Team process
- FTC ReportFraud (reportfraud.ftc.gov) and Consumer Sentinel
- abuse.ch URLhaus, MalwareBazaar, ThreatFox submission APIs
- ICANN registrar abuse contact requirements; hosting provider abuse processes
- Lab artifacts generated on-box 2026-10-17 (synthetic submissions and terminal captures)
