Report a phishing site: who can take it down

Most phishing sites stay up because nobody reports them. Everyone assumes someone else already has. Yet a good report takes five minutes, and the right recipients can often suspend a site within hours or at least neutralise it with a browser warning. Here is where to report a phishing site and what each recipient can actually do.

Report a phishing site: the order

1. Don’t enter anything. Copy the full address from the address bar or by right-clicking the link. Take a screenshot.
2. Google Safe Browsing. The fastest effect for most users. Chrome, Firefox and Safari all use Safe Browsing lists and show a red warning page.
3. The domain’s registrar. It can suspend the domain so it stops working altogether.
4. The hosting provider. It can remove the content even if the domain stays.
5. Forward the email. To APWG or your national service, and to the company being impersonated.
6. Police. If anyone has lost money or data.

Who can do what

APWG asks you to forward suspicious emails as attachments where your mail client allows it, because that preserves the headers. The NCSC runs two separate channels: forwarded emails go to its Suspicious Email Reporting Service, while suspicious websites go through a web form on ncsc.gov.uk. Neither replaces a crime report; in England, Wales and Northern Ireland that goes to Report Fraud, in the US to the FBI’s IC3.

Finding the registrar’s abuse contact

For .com, .net, .info and every other gTLD, the abuse contact is in the WHOIS output. Here with google.com so you can see what the lines look like:

whois google.com | grep -i "abuse"

Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.2086851750

Since 5 April 2024, stricter rules apply to ICANN-accredited registrars. They must publish abuse contacts prominently, confirm receipt of reports and take prompt, appropriate action when given actionable evidence of DNS abuse, which explicitly includes phishing. Registrars are allowed to use a web form instead of an email address, so if the WHOIS points you to a URL, use that.

Country-code domains follow their own registry rules, and some publish less in WHOIS. If you can’t find a registrar contact, the hosting provider is often the quicker route.

Finding the hosting provider

First the IP address, then who owns the network:

dig A suspicious-domain.com +short
whois 203.0.113.10 | grep -iE "abuse|orgname|org-name"

The second query shows the network the IP belongs to and usually an abuse address. The IP in the example is a documentation address; use the real one from the first query. If it belongs to a CDN such as Cloudflare, that isn’t the actual host, but Cloudflare has its own abuse form and forwards reports to the hosting provider.

Writing a report that gets acted on

Abuse teams get a lot of mail. What gets handled quickly is short, factual and complete. Feel free to copy this:

Subject: Phishing: hxxps://examplebank-login[.]info/account

Hello,

The following URL hosts a phishing page imitating the
login page of Example Bank (examplebank.com):

hxxps://examplebank-login[.]info/account

Observed: 18 Oct 2026, 13:20 UTC
Type: harvesting login credentials and one-time codes
Evidence: screenshot attached

Please review the domain and the content.

Regards

Writing hxxps and [.] is standard practice; it stops mail clients from turning the URL into a clickable link. Leave out threats or guesses about who is behind it. They slow things down.

Fake shops are a special case

Not every fraudulent site asks for passwords. Fake shops lure people with low prices, take payment by bank transfer and never deliver. The reporting routes are the same: registrar, host and Google Safe Browsing. In the US, the FTC collects reports at reportfraud.ftc.gov.

Typical signs are prices far below the market, bank transfer as the only payment option, contact details that lead nowhere and a domain that is only a few weeks old or used to serve a completely different purpose. That last point is worth a look: fraudsters like to buy expired domains with a good reputation and build a shop on them. A web archive shows what the address used to host.

If you have already paid, speed matters. For a bank transfer, ask your bank right away to try to recall the payment. It doesn’t always work, but the chances drop with every hour. Card payments and PayPal have chargeback and buyer-protection procedures.

When your own brand is being impersonated

Then you’re not just a reporter but a victim. Besides the reports above, warn your customers and check your own domain situation. If the attacker compromised your real domain rather than setting up a copy, the right guide is website hacked: what to do. Understanding the lookalike pattern helps too; spot a phishing domain and typosquatting cover the common ones.

Prevention means registering the variants fraudsters like best. Checking whether your brand plus “login” is free takes seconds. betadomain offers around 490 extensions at fixed yearly prices, and if you want to monitor or register variants automatically, there is a domain API for developers.

Step by step

1. Don't interact, save the URLCopy the full address without using the site further and take a timestamped screenshot.
2. Report to Google Safe BrowsingSubmit the URL through Google Safe Browsing's phishing report form so browsers start warning.
3. Find registrar and hostUse WHOIS for the registrar and its abuse address, and dig plus IP WHOIS for the hosting provider.
4. Send abuse reportsSend a short, factual report with URL, time, impersonated brand and screenshot to both abuse contacts.
5. Forward the phishing emailForward the email to [email protected] or, in the UK, [email protected], and to the impersonated company.
6. Report lossesIf details were entered or money was lost, report to the police or a service such as IC3 or Report Fraud.