Where to report a phishing site, in what order
A phishing page has a shelf life measured in hours. The people who can shorten it are, roughly in order of speed: the company hosting the page, the company that registered the domain, the proxy in front of it if there is one, the browser vendors who can warn visitors before it loads, and the brand being impersonated. National reporting addresses matter too, for reasons other than speed.
Most reports go to one of these and stop. The ones that work go to two or three at once, chosen for the situation.
First, one question: registered for this, or compromised?
Look at the domain before you look up any contact.
A domain like secure-login-yourbank-verify.com, registered nine days ago, exists for the attack. Everything about it can be taken down: content, domain, the lot. Report to the host and the registrar together.
A domain like smallbakery-lincoln.co.uk, registered in 2014, with the phishing page at /wp-content/uploads/inv/, is a compromised legitimate site. The domain is innocent. Reporting it to the registrar for suspension takes a bakery offline and gets you a reputation as someone whose reports need checking. Report to the host and, if you can find them, the site owner.
Registration date and the path of the URL usually settle this in ten seconds. RDAP gives the date under events with "eventAction": "registration".
1. The hosting network
Fastest content removal, because they hold the server. Find the abuse contact from the RIR record for the IP the domain resolves to; the guide to finding abuse contacts covers the lookup. Send the URL, the IP you resolved it to, a UTC timestamp and a screenshot. Large hosts (Hetzner, OVH, DigitalOcean, the cloud providers) run ticketed abuse desks and respond to well-formed reports within a day; many far faster for phishing.
Skip this step only when the IP belongs to a CDN. Then the host is invisible and you go to step 3.
2. The registrar
Slower on average than a good host, but decisive: a suspended domain stops resolving for everyone, including the copies of the kit the attacker has on other servers. Use the abuse contact from the domain's RDAP record. Registrars are obliged under their ICANN agreement to publish it and to take "reasonable and prompt steps", which in practice ranges from hours to days depending on the registrar.
Registrars are most responsive when the report shows the domain itself is abusive: brand look-alike, recent registration, no legitimate content anywhere on it. Include those facts. For a compromised site, do not send to the registrar at all unless the host is unresponsive and the owner unreachable.
3. The CDN or reverse proxy
If the domain resolves to Cloudflare, Fastly, Akamai, CloudFront or a similar service, the IP you have belongs to them and they do not store the page. They will not remove it either, because they cannot; they forward your report to the hosting provider behind them and, for phishing, may tell you who that provider is.
Use their form rather than the RIR abuse address, which for Cloudflare is abuse.cloudflare.com. Details and the other providers are in the CDN guide. Report to the registrar in parallel; behind a CDN it is often the registrar who ends the campaign.
4. Browser blocklists
Google Safe Browsing protects Chrome, Firefox, Safari and most Android browsers. Microsoft SmartScreen protects Edge and Windows. Getting a URL onto either list puts a full-page warning in front of most of the world's browsers, usually within hours, regardless of whether the site is still up.
- Google: safebrowsing.google.com/safebrowsing/report_phish/
- Microsoft: microsoft.com/en-us/wdsi/support/report-unsafe-site
Do this for every confirmed phishing URL. It does not remove anything, but it protects victims while the takedown works its way through a queue, and it costs a minute.
5. The impersonated brand
Banks, payment companies and large retailers run anti-fraud teams that want to know about pages impersonating them, and many have contracts with takedown vendors who will file the same reports you would with more weight behind them. Look for a phishing@ or abuse@ address on the brand's security page, or a "report phishing" link in their help centre. If you are the brand, this is your own team and the report is where the rest of this list starts.
6. National and sector reporting addresses
These rarely speed up a takedown, but they feed the blocklists, statistics and law enforcement that make the next campaign harder.
- United Kingdom: forward phishing emails to
report@phishing.gov.uk(the NCSC's Suspicious Email Reporting Service), and report websites through the NCSC website. The NCSC does pursue takedowns on what it receives. - Global:
reportphishing@apwg.org, the Anti-Phishing Working Group, whose data feeds many blocklists. - Your own country's CERT or cybercrime unit, and your sector's information sharing group if you belong to one.
7. Whoever delivered it
If the phishing arrived by email, the sending infrastructure is a separate target. Take the sending IP from the Received: headers (the one that handed the message to your mail server, not the ones the attacker wrote above it) and look up its network abuse contact exactly as for a hosting IP. If it came through a bulk email provider, that provider's abuse desk will close the account quickly; they dislike phishing more than anyone.
What to send
One incident per report, all evidence in the first message, nothing the recipient has to ask for. The guide on writing reports that get actioned has a template. In short: the full URL, the resolved IP and time in UTC, a screenshot, the brand being impersonated, and for email the complete original message with headers.
When nothing happens
Give the host 48 hours and the registrar 72, then follow up once, quoting the ticket or your original subject line. If the host is unresponsive, the RIR record shows the larger allocation it belongs to; the upstream network operator often has terms its customers must meet and a more attentive abuse desk. If the registrar is unresponsive, ICANN accepts complaints about registrars that do not act on abuse reports, though that is a matter of weeks, not hours.
The short version
Malicious registration: host and registrar at once, blocklists immediately, brand if it is not you. Compromised site: host and owner, blocklists immediately, not the registrar. Behind a CDN: CDN form and registrar at once, blocklists immediately. Email delivery: add the sending network. Report the same incident in the same words to each; the time saved by writing once is time the page is still up.
AbuseRoute is a private API that returns the registrar and hosting abuse contacts for a domain in one call, for security and abuse teams. How it works. For individual manual lookups, use the RrSG's ACID Tool.