Taking a phishing site down
- Capture evidence safelyFull URL, dated screenshots and the original email, without entering anything.
- Report to blocklistsGoogle Safe Browsing and Microsoft, so browsers warn visitors.
- Report to host and registrarThe host can take pages offline; the registrar can suspend the domain.
- Claim the domainA UDRP complaint can transfer a lookalike domain to you for good.
- Watch for it returningOperators move the same kit to new domains, so keep monitoring.
Who to report to
None of these depends on the others, so report to all of them in parallel.
| Report to | What they can do | Where |
|---|---|---|
| Google Safe Browsing | Warn visitors in Chrome and other browsers using Safe Browsing | Report a phishing page |
| Microsoft | Flag it in Microsoft's protections, including SmartScreen in Edge | Report unsafe site |
| Hosting provider | Take the pages or account offline | The host's abuse contact or form |
| Domain registrar | Suspend the domain and every page on it | The registrar's abuse contact, found through ICANN Lookup |
| Cloudflare, if the site uses it | Forward your report to the host and owner, and give the host the origin IP; act directly on domains it registers and content it hosts | abuse.cloudflare.com |
| APWG | Share the report across the anti-phishing community | Forward the phishing email to [email protected] |
Collect evidence safely
Treat the site as hostile: never enter real credentials, payment or personal details. Copy the link as text rather than clicking it in the email, and open it in an isolated browser profile or virtual machine, not on a machine signed in to company systems.
A days-old domain copying your login page is a strong signal to abuse teams. Some pages change by country or device, or show only once: if the URL looks blank, say so and send what you captured.
Blocklists protect people fastest
They don't need the host's cooperation. Once a page is flagged, browsers using those services show a full-page warning, which covers most of your customers even if the site stays up. In the UK, also use the NCSC's report a scam website form; the NCSC says it analyses reported sites and may work with hosts to remove them.
Reporting to the host and registrar
Find the host from the site's IP address (how to find a website's host, including behind Cloudflare, whose addresses hide the real host) and the registrar from the registration record. ICANN-accredited registrars must keep an abuse contact and take reasonable, prompt steps to investigate; many country-code domains follow their own registry rules. Each report needs:
- "Phishing" and the full URL in the subject line.
- The brand impersonated, and that you're authorised to report for it.
- What the page does: fake login, payment form, download.
- Your screenshots, and when you took them.
A DMCA notice is the backup
If the site copies your design, photos, text or logo, a DMCA notice can move a host that's slow on phishing but has a copyright process. Its limits:
- It removes material, not the domain.
- Your contact details are often passed to the operator and published, for example on Lumen.
- It needs a sworn statement that you own or represent the work.
- It fails if nothing was copied: your name with original artwork is a trade mark and fraud problem.
Lookalike domains: the UDRP
A suspended domain can expire and be re-registered by the same people. To take it over, file under ICANN's Uniform Domain-Name Dispute-Resolution Policy with a provider such as WIPO. You must show:
- The domain is identical or confusingly similar to your trade mark;
- The holder has no rights or legitimate interests in it; and
- It was registered and is being used in bad faith (a phishing page usually settles this).
The panel can only cancel the domain or transfer it to you. At the time of writing, WIPO charges USD 1,500 for one panelist and one to five domains. Many country-code domains, such as .uk, have their own procedures.
How fast is it?
There's no standard time, and a guaranteed one is a guess. Blocklist warnings can appear before the site comes down; hosts and registrars with active abuse teams can move quickly on a clear report. Some hosts, and some registrars outside major markets, never respond. Expect the same kit to reappear on new domains, so keep watching for lookalikes.
Choosing a phishing takedown service
Services do this at volume, with established host and registrar contacts, and monitor for lookalike domains, new certificates and copied login pages. The takedown service checklist applies too. Ask:
- What counts as a takedown: offline, suspended or blocklisted?
- Which channels: hosts, registrars, blocklists, CDNs, app stores, social platforms?
- Is re-filing included when the site returns?
- Is there out-of-hours cover?
- Who files, under whose name, and do they use DMCA notices, which carry your details?
- How do they avoid false positives against partners, resellers or your own campaign domains?
FAQs
How do I report a phishing website?
Report the URL to Google Safe Browsing and Microsoft so browsers warn visitors, then to the host and the domain registrar through their abuse contacts. If the site uses Cloudflare, report it there too so the complaint reaches the real host.
What is website impersonation?
A site that poses as a real brand, usually with a lookalike domain and copied design, to steal logins, payments or personal data, or to sell counterfeit goods.
Can I use a DMCA notice to take down a phishing site?
Sometimes, if the site copies your own text, images or design. But it only removes material, passes your contact details to the operator, and doesn't touch the domain. Report the site as phishing first.
What does a phishing takedown service do?
It monitors for lookalike domains and copied pages, reports them to hosts, registrars and blocklists, and follows up until they come down or come back. Ask what counts as a takedown and whether re-emergence is covered. More on brand protection.
How do I get a lookalike domain transferred to me?
File a UDRP complaint with an approved provider such as WIPO. You must show the domain is confusingly similar to your trade mark, the holder has no legitimate interest in it, and it was registered and used in bad faith.
Check your website now
Use the free DMCA checker: no sign-up, results in seconds.