1. Where to report
Email security@bytesbrains.com. This address is monitored by a named member of staff, not an auto-responder, and it is the fastest route for anything urgent. It takes vulnerability reports as well as abuse — if you have found a weakness in something we run, this is the same door.
If you are following the usual convention and looking for abuse@: that address is reserved by our mail provider and does not reach us. Use the address above, or go straight to our registrar at abuse@tucows.com, who are the registrar of record for every domain we sell.
Please include, where you can: the domain name or email address involved, what it is doing, and evidence — a URL, message headers, a screenshot, or a timestamped log line. A report we cannot verify takes longer to act on than one we can, so specifics help the people you are trying to protect.
Do not send credentials, and do not include personal data beyond what the report needs. If a matter is a law-enforcement request, say so in the subject line and identify the requesting body.
2. What happens next
Reports are triaged by an accountable owner at BytesBrains, currently the founder, who is responsible for the outcome of each one.
- Acknowledgement within one business day. You will get a human reply confirming the report was received and who is handling it.
- Assessment within three business days. We verify the report, check what we are actually able to act on, and decide.
- Action, then a written outcome. We tell you what we did — including when the answer is that we did nothing, and why.
- Clear, ongoing harm is handled immediately, ahead of those windows. Active phishing that is collecting credentials right now is not a three-day matter.
3. What we can and cannot do
We are a reseller. Domains are registered through our registrar partner, Tucows/OpenSRS, and ultimately governed by the relevant registry and by ICANN policy. That shapes what is within our power:
- We can suspend the DNS we operate for a name, disable mailboxes we provide, suspend the customer's account, and escalate to our registrar for registry-level action.
- We cannot unilaterally delete a registration, act on a name we did not register, resolve trademark or defamation disputes, or adjudicate a contractual disagreement between you and a customer.
Where a matter is genuinely a dispute rather than abuse, the routes are ICANN's UDRP for trademark claims, or the courts. We will not pretend to a jurisdiction we do not have.
4. Escalation
If you are not satisfied with our response, escalate to our registrar directly at abuse@tucows.com, and to the relevant registry or ICANN Contractual Compliance. We would rather you had that route and never needed it.
5. Registrants: your rights
If you hold a domain through us, ICANN publishes what you are entitled to and what is expected of you: Registrant Rights & Responsibilities. Keeping the contact details on your registration accurate is one of them, and it is the one that most often costs people their domain: registrations with unreachable contacts can be suspended.