How to Report a Scam Website (and Get It Taken Down)

How to report a scam website to Google Safe Browsing, Microsoft, Netcraft, the host, registrar, Cloudflare and national CERTs, with what evidence to include.

Here is how to report a scam website: copy its full URL without entering any data, then submit it to Google Safe Browsing, Microsoft's Report unsafe site form and Netcraft so browsers start warning visitors. Next, email the abuse contacts of the domain's registrar and host, and notify your national cyber agency and the impersonated brand.

Blocklists protect people quickly, while hosts and registrars can remove the site or suspend the domain. Doing both gives you the best chance of stopping it. Here is how to report a website step by step, with the official forms to use.

How to report a scam website: collect evidence first

If you are not sure the site is fake, check the warning signs in our guide on how to spot a phishing website. Then gather what you need without interacting with the page:

• The full URL, including the path after the domain (for example https://login.example.com/secure/verify), copied as text. The UK's NCSC advises copying or writing down a suspicious link rather than clicking it again.
• Screenshots of the page, including the address bar, with the date and time.
• How you found it: an email, a text message, a search ad, a social media post. Keep the original message.
• Which brand it imitates and what it asks for: passwords, card details, ID documents, a crypto deposit.

When you share a link in an email or chat, you can "defang" it so nobody clicks it by accident, for example hxxps://login.example[.]com. Most report forms want the normal, working URL, so paste the original there.

Step 1: Report the site to browser blocklists

Blocklists are usually the fastest win. Once a URL is listed, browsers, email filters and security tools show warnings or block it, even before the site is removed.

Google Safe Browsing

Google Safe Browsing protects Chrome and other browsers and apps that use it. Google has separate forms for different threats, listed on its Report spam, phishing or malware page:

• Phishing (fake login pages, fake shops, pages that steal data): Report a phishing page
• Malware (sites that infect devices or push harmful downloads): Report malware

Microsoft SmartScreen

Microsoft Defender SmartScreen protects Microsoft Edge and Windows. Use the Report unsafe site form. You can sign in with a Microsoft account or continue as a guest.

Netcraft

Netcraft's report form accepts phishing, malware and suspicious URLs. It is a quick way to put the URL in front of another set of defenders.

APWG and PhishTank

• APWG: forward phishing emails to reportphishing@apwg.org, ideally as an attachment, or submit the URL through the forms on the APWG reporting page.
• PhishTank: a community phishing database operated by Cisco Talos. You can submit suspected phishes after registering a free account.

Step 2: Find the host and registrar

Blocklists warn people; the hosting provider and the domain registrar can actually take the site offline. To find them:

1. Go to ICANN Lookup and enter the domain name (for example example.com, not the full URL). It queries registration data using RDAP.
2. Note the registrar and its abuse contact email. Registrars accredited by ICANN publish an abuse contact even when the owner's details are hidden for privacy.
3. For many country-code domains, use the lookup service of that country's domain registry instead.
4. To find the host, check which IP address the domain points to and look that address up in a WHOIS or RDAP service. The network owner is usually the hosting company, and it lists an abuse contact.

If the domain is a lookalike of a real brand, such as an extra letter or a swapped character, our guide to typosquatting and homoglyph domains explains what to point out in your report.

Step 3: Email the abuse contacts

Send a short, factual report to the registrar's and host's abuse addresses. Include:

• The full URL or URLs, and when you saw the site live
• What the site does: impersonates a named brand, collects logins or card data, distributes malware
• Screenshots and, if you have it, the original phishing email or text
• Your name and a contact address for follow-up

Keep it brief and stick to facts. Abuse teams handle a lot of reports, and clear evidence gets acted on faster.

Step 4: If the site is behind Cloudflare

If the lookup shows Cloudflare instead of a hosting company, the real host is hidden behind Cloudflare's network. Submit a report through Cloudflare's abuse form. According to Cloudflare's abuse approach, it generally forwards reports to the hosting provider and site operator and can take its own action on phishing. Our guide to taking down a phishing site behind Cloudflare covers this in detail.

Step 5: Report to your national CERT or cyber agency

• Türkiye: the reporting services formerly run by USOM now operate under the Cyber Security Presidency. Use the Siber Olay Bildirimi form, which lists phishing sites impersonating banks, institutions and companies as reportable, or email ihbar@siberguvenlik.gov.tr.
• United Kingdom: the NCSC's Report a suspicious website form.
• Elsewhere: check your national CERT or cyber security agency's website for a phishing report form.

If you lost money or entered personal details on the site, report it to the police and your bank as well. See how to report a scam for the right channel in your country.

Step 6: Tell the impersonated brand

Companies often have the strongest standing to get a fake site removed, and they want to know. Find their security or abuse contact by typing their real web address yourself, never through a link on the suspicious site. Look for pages such as "report phishing," "security" or "trust."

What not to do

• Do not enter any data, not even fake details, and do not download anything.
• Do not try to attack or flood the site. Hacking, overloading or "punishing" a scam site is illegal in most countries and can destroy evidence.
• Do not contact the operators or reply to the messages that led you there.
• Do not share the live link publicly without defanging it.

For brands: let Phishvoid handle it end to end

If your company is the one being impersonated, reporting one site at a time quickly becomes a full-time job. Phishvoid detects lookalike domains and cloned login pages, verifies them, and runs the whole takedown: hosting providers, registrars, Cloudflare, DMCA notices where content is copied, browser blocklists and CERTs, followed by monitoring in case the site reappears. We act only with your written authorization, and one all-inclusive subscription covers unlimited takedowns. See the takedown process step by step, or book a free exposure scan.

Found a fake site copying a brand? You can report a phishing site to Phishvoid using our public form.

FAQ

How long does it take for a scam website to be taken down?

It varies. Blocklist warnings can appear relatively quickly, while removal depends on how responsive the host and registrar are. Reporting to several places at once usually gives the best result.

Can I report a website without an account?

Yes. Microsoft's Report unsafe site form lets you continue as a guest, and you can email registrar and host abuse contacts directly. PhishTank is one service that requires a free account.

What is the difference between reporting to Google and to the host?

Google Safe Browsing adds a warning in browsers that use it, but the site stays online. The host or registrar can remove the content or suspend the domain. Do both.

What if the scam website comes back on a new domain?

Report the new domain the same way. Scammers often reuse the same page on fresh domains, so brands benefit from continuous monitoring. Our guide to the first 24 hours after finding a brand impersonation site explains how to respond.

Should I report a site I only suspect is fake?

Yes. Blocklist providers and agencies review submissions before acting, and the UK's NCSC explicitly welcomes reports of sites that just feel suspicious.