In the old days you'd just do a whois of the domain name and email the system administrator or tech contact. But GDPR made whois data illegal and destroyed that system so now there is no way to contact anyone unless you both happen to be on the same corporate walled garden (facebook, twitter, etc) they might list on their site.

Whois still works. Try it:

    > whois ycombinator.com
    Domain Name: ycombinator.com
    [snip]
    Admin Name: REDACTED FOR PRIVACY
    [snip]
    Admin Email: 1bd279b6ad24fb60b2e200db8f486c3f-2545852@contact.gandi.net

It's still possible to use whois data. Most of the time it'll be an abuse@ email address from a provider and they can forward the message to the real admin, or they could directly block the website if you explain the issue.

The problem is not the GDPR, but the fact that this public contact data was abused. If some assholes had not decided to spam people, we would probably still have public contact info.

whois was effectively dead well before GDPR -- most people used registration privacy services to hide their mailing address, phone number, etc.