How to Report a Website
A step-by-step guide to getting a phishing website scanned, reported, and taken down.
Introduction
This guide explains how to report malicious websites so they can be taken down before anyone else falls victim to them. Malicious websites take many forms; this guide focuses specifically on phishing websites.
Reporting phishing websites makes the internet safer for everyone, so it is worth doing even if you were not the one targeted.
Scanning websites
Before reporting a website, you should first confirm that it is malicious. Visiting a phishing website directly exposes you to risk, but this can be avoided entirely by scanning the site with a URL scanning tool instead.
Several free options exist. urlscan.io and radar.cloudflare.com let you scan a suspicious website without creating an account. Both return detailed technical information along with a screenshot you can use to confirm signs of phishing, such as a fake login page, and both attempt to automatically match the site against known phishing campaigns.
You can also submit the website to virustotal.com, which returns results from more than 70 antivirus engines and shows which providers have already flagged the site as malicious.
Scanning a website with these tools is itself a form of reporting, since each platform collects and shares the threat intelligence gathered from submissions. This is the first step toward getting a phishing website taken down.
Reporting to law enforcement
Depending on your location, you may also want to report the website to law enforcement. Be sure to comply with the laws that apply to you, and only file a report if you believe it to be genuine.
- For those living in the United States, you can report phishing websites to the Federal Trade Commission (FTC) by visiting reportfraud.ftc.gov.
- For those living in the United Kingdom, you can report phishing websites to the National Cyber Security Centre (NCSC) by visiting ncsc.gov.uk
- For those living in the European Union, you can report phishing websites to your local law enforcement. You can find the contact details for police based on your location by visiting https://www.europol.europa.eu/report-a-crime/report-cybercrime-online
- For those living elsewhere, you can contact your local law enforcement.
Reporting to the domain hosting provider
Every phishing website depends on a host, and that host is usually a third-party provider unrelated to the phishing operation itself. Reporting the website to its hosting provider is the most effective way to have it taken down permanently.
To identify a website's hosting provider, visit phish.report/analysis, which provides a direct link or email address you can use to report the site.
Alternatively, you can find the provider's report form manually. Visit hostingchecker.com and enter the website's address to identify its host, then search for "[hosting provider name] report phishing" to find the appropriate reporting form.
Reporting to cybersecurity organizations
After reporting the website to its hosting provider, you should also notify cybersecurity organizations that can block it for their own users. Note that most of these organizations use automated systems to review submissions, so a legitimate report may occasionally be rejected in error.
- PhishIndex: https://phishindex.com/contact/report_url
- Google Safebrowsing: https://www.google.com/safebrowsing/report_phish/
- Microsoft Security Intelligence: https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site
- Netcraft: https://report.netcraft.com/report
- Bitdefender: https://www.bitdefender.com/consumer/support/answer/29358
- Phishing Initiative: https://phishing-initiative.eu/contrib
- ESET: https://phishing.eset.com/en-us/report
- Avast: https://www.avast.com/en-us/report-false-negative
- CRDF Threat Center: https://threatcenter.crdf.fr/submit_url.html
If you report a malicious website to PhishIndex by visiting the report URL form, a person reviews it directly and reports it to the appropriate organizations on your behalf, saving you the effort of doing so yourself.
Conclusion
Reporting phishing websites helps make the internet safer for everyone and allows organizations to detect and block similar attempts in the future.
If you come across a phishing website, report it — doing so could save someone from losing their savings. You can simplify the process by reporting it to PhishIndex instead: we will report it to the hosting provider and relevant cybersecurity organizations on your behalf, and add it to our own blocklist to protect everyone who uses it.
To reduce your own risk of falling victim to phishing in the future, consider using our malicious website blocklist.