November 5, 2026 - 5 min read

By PhishClean Research Team

How to report a phishing website so that it actually gets blocked

One report form won't remove a site from the internet. A few reports in the right places can get it blocked in browsers within hours and taken down soon after.

Reporting a phishing site feels like shouting into the void, but it does more than you'd think. Browser warnings reach far more people than a takedown notice ever could. Eric Lawrence, a longtime browser engineer, writes that blocking pages are highly effective, even for novice users. Reports are part of how a page gets onto those lists, and reviewers look at them directly.

Do this from a safe place. You don't need to visit the site again to report it. Copy the address from the email by right-clicking the link, and don't enter anything on the page.

The order we'd report in

If you have five minutes, do the first two. They affect the most people, the fastest.

Government reporting by country

• United States: report at ReportFraud.ftc.gov. The FTC also asks you to forward phishing emails to reportphishing@apwg.org, and phishing texts to 7726 (SPAM).
• United Kingdom: the NCSC has a separate form for scam websites and says it can investigate and remove them. Forward emails to report@phishing.gov.uk, and texts to 7726.
• India: file at cybercrime.gov.in. Call 1930 if you lost money.

Government services use these reports to spot patterns. Don't expect a personal reply or your money back from a report alone.

Finding out who hosts the site

1. Enter the domain into ICANN Lookup. It shows the registrar and usually an abuse email address.
2. If the site uses Cloudflare, the record will show Cloudflare's name servers rather than the true host. Cloudflare has its own abuse form, which passes reports along to the host.
3. If the page sits on a free service, such as a website builder, form tool or file-sharing site, report it to that company directly. They usually act fastest, since it's their own domain being abused.

A short message works best:

Subject: Phishing site impersonating [brand]

This page impersonates [brand] and collects passwords:
hxxps://example-login[.]com/secure/

Seen: 5 Nov 2026, 10:42 UTC. It arrived in an email; headers attached.
Please suspend it.

Writing the address as hxxps with [.] stops mail systems from turning it into a live link.

Why a report might get ignored

The biggest obstacle is cloaking. Phishing kits hide from reviewers by showing a harmless page to anyone who isn't the intended victim, checking location, device type or whether the visitor came through the original email link. Lawrence notes that reviewers load the URL to judge it, and cloaking can fool them. You can make that harder:

• Send the exact, full link, including everything after the domain. Many kits show the fake page only with that specific token.
• Add a screenshot if you already have one, and mention what you saw. Say which brand it copies and what it asks for.
• Mention the device. If the fake only appears on a phone, say so.
• Report quickly. Lawrence notes phishing sites often last only hours. A report next week helps nobody.

One caution: scanning a link on a public service such as urlscan.io may publish the URL and a screenshot. If that link contains your email address or a personal token, remove it first or use a private scan.

Reporting phishing emails at work

Use your company's report button rather than forwarding the message around. The ETH Zurich study of 14,000 employees found that people reporting phish worked well as a collective detection system, spotting new campaigns quickly. One early report can protect the whole company. It's also a better thing to measure than who clicked.

Think we got a site wrong?

Lists make mistakes, ours included. If a legitimate site is flagged in Chrome, its owner can request a review through Google Search Console. Edge's warning page has its own link for disputing a block.

Frequently asked questions

How do I report a phishing website to Google?

Use the Google Safe Browsing report form at safebrowsing.google.com/safebrowsing/report_phish. Include the full address. Google may then show a warning in Chrome and other browsers that use its lists, but this doesn't remove the site from the internet.

Who can actually take a phishing site down?

The web host, the domain registrar or the service whose platform is being abused. Look up the domain at lookup.icann.org to find the abuse contact. Browser vendors can only block it in their browsers.

Where do I report phishing emails in the US?

Forward them to reportphishing@apwg.org, report at ReportFraud.ftc.gov, and forward phishing texts to 7726. At work, use your company's report button.

Is it safe to visit a phishing site to report it?

You don't need to. Copy the link without opening it. If you do need to look, use a separate device or a scanning service, and don't enter anything.

Sources

• Eric Lawrence: Defense techniques, reporting phish
• FTC: How to recognize and avoid phishing scams
• NCSC: Report a scam website
• GOV.UK: Report suspicious emails and websites
• Microsoft: Report an unsafe site
• Lain, Kostiainen and Capkun: Phishing in organizations (ETH Zurich, IEEE S&P 2022)

Last updated: 5 November 2026