Reporting Phishing Websites So They Get Taken Down
Found a fake login page or scam shop? How to report it to browser blocklists, the hosting company and the domain registrar, and what happens after you report.
Phishing websites only work while they are online and not blocked. Every report brings that moment closer. You do not need technical skills: a few reports in the right places can get a fake page blocked in browsers and removed by its host.
Step 1: copy the link safely
Right-click or long-press the link in the message and copy it. Do not open it. If you need to share it, break it so nobody clicks by accident, for example hxxps://secure-login-check[.]com. See how to read a URL.
Step 2: report to browser blocklists
- Google Safe Browsing: protects users of many browsers and apps.
- Your browser's own report option, often under Help or the menu.
- Phishing reporting services such as Netcraft, which pass reports to hosts.
Once blocklisted, visitors see a warning page. See browser protections.
Step 3: report to the host and registrar
- Look up the domain with ICANN Lookup to find the registrar and its abuse contact.
- Email the abuse address with the full link, when you received it and why it is phishing.
- If the page is on a free site builder, form service or file-sharing service, use that service's "report abuse" link.
Step 4: forward the message
Forward the email or text that contained the link to the reporting service in your country. See where to report phishing.
If the site impersonates your own business, you have extra options. See responding to brand impersonation.
Not sure a site is fake? Paste the link into CyberWatch AI Scan for a free check.
For more, see how to report phishing in our complete guide.
Frequently asked questions
How long does a takedown take?
It varies from hours to days, depending on the host and registrar. Browser blocklisting is often faster and protects many people even before the site goes down.
Is it safe to visit the site to report it?
You do not need to. Copy the link from the message without clicking it, and never enter any details.
Who owns the site?
Registration details are usually hidden, but a lookup shows the registrar, which is who you report abuse to.
Sources
- Report a phishing page, Google Safe Browsing
- Report Phishing, Malware and Suspicious URLs, Netcraft
- ICANN Lookup, ICANN
- Report Phishing, Anti-Phishing Working Group
