How to report a phishing website that impersonates your company
To report a phishing website, collect evidence of the page, then send an abuse report to the hosting provider, the domain registrar and the browser block-list operators.
What are the steps? In this order.
Work through these six steps in order. Evidence first, because the page can disappear before you have recorded it.
Preserve the evidence
Capture the page address, a dated screenshot and the page source before you report. Do this in an isolated browser and never type real details into the page.
Identify the host and the registrar
Look up the domain and its IP address in an RDAP or WHOIS tool. The records name the registrar, the hosting network and their abuse contacts.
Send abuse reports
Email the hosting provider and the registrar with your evidence pack. Use the abuse contact from the record, not a general support address.
Report to the block-list operators
Submit the page to Google Safe Browsing and Microsoft SmartScreen so browsers warn visitors while the site is still online.
Warn your customers and staff
Tell them the exact address to avoid and where your real sign-in page is. Brief your support team in case people call.
Track the removal
Log each report, its reference number and the reply. Follow up with the same evidence pack, and check the page again to confirm it is gone.
Who can act on a phishing site? Seven routes, one table.
No single party controls a phishing site. Each of these can remove it, block it or pass the report on. Contact routes change, so check each organisation's own page before you send.
| Contact | What they can do | How to find or reach them |
|---|---|---|
| Hosting provider | Disable the site or the account that serves it. Often the fastest route. | Look up the site's IP address in an RDAP or WHOIS tool. The record names the network owner and an abuse contact. If the site sits behind a proxy or content network, report to that service as well as the origin host. |
| Domain registrar | Suspend the domain name, which stops it resolving. | Look up the domain in RDAP or WHOIS. The record names the registrar and its abuse contact. Registrars of generic domain endings must publish an abuse contact and review reports. |
| Domain registry | Act on the name when the registrar does not. Registries usually work through the registrar first. | The registry runs the domain ending, such as .uk or .com. Find its abuse page from the ending's registry website. Use this route after the registrar. |
| Google Safe Browsing | Add the page to the block-list that warns visitors in Chrome and other browsers. | Use the Safe Browsing phishing report form and give the exact page address. |
| Microsoft SmartScreen | Add the page to the block-list used by Microsoft Edge and Microsoft Defender. | Use the Microsoft report unsafe site form and choose the phishing option. |
| APWG | Share the report with the anti-phishing community that feeds many security products. | Forward the phishing email to the APWG reporting address, or report through its published route. |
| NCSC (UK organisations) | Take the report into national action against scam websites and phishing email. | Use the NCSC page for reporting a scam website, and forward phishing emails to the Suspicious Email Reporting Service. Report fraud losses to the national fraud reporting service. |
Phishing domain detection: how to find the site first
You cannot report a site you have not found. Phishing domain detection is the work of finding domains built to imitate yours before customers or staff report them.
Attackers pick a web address that looks like yours. They change one letter, swap a letter for a lookalike character such as 1 for l, or add a word such as payroll or refunds. Lookalike discovery works out those variants of the domains you own and checks each one.
Two checks matter for each lookalike. First, is it registered? An unregistered variant is only a risk if someone registers it. Second, does it have mail records? A lookalike that can receive or send email can be used for phishing mail, not only for a fake page.
Other sources also point to the site: reports from customers and staff, the headers of the phishing email, and a search for your brand name and common product words. EdgeProtect keeps watching for lookalikes of the domains you add. See domain monitoring for brand protection.
Fake website detection: signs a site is copying yours
A fake website copies your look to borrow your trust. These four signs, taken together, separate a copy from an unrelated site that happens to look similar.
A lookalike address
The domain differs from yours by a letter, a lookalike character, a hyphen or an added word, such as acme-payro11.com for acme.co.uk.
Copied branding
The logo, colours, wording and page layout are lifted from your site, often as a direct copy of your sign-in page.
A sign-in or payment form
The page asks for a password, a card number or personal data, and sends it to the attacker instead of to you.
Mail records on a domain that should not send mail
A lookalike with mail records can be used for phishing email. A domain you do not use for mail that has them is a warning sign.
Website impersonation: what to call it when you report it
Hosts and registrars sort reports by category. A report filed under the right category reaches the right team. Website impersonation can fit several categories at once.
Choose the category that matches what the page does, then name the others in the text of the report.
- Phishing when the page asks for sign-in details, payment details or personal data.
- Brand impersonation or trademark infringement when the page uses your name, logo or wording to pass as you.
- Fraud or deceptive site when the page takes payment for goods or services you do not sell.
- Malware distribution when the page offers a download or redirects to one.
State the facts in the first two lines: the exact address, that it impersonates your organisation, what the page asks visitors to do, and the date and time you saw it. Attach the evidence from the next section.
What goes in an evidence pack? Keep it the same every time.
A complete pack lets a host or registrar act without writing back to you. Build the same pack for each report.
- Page addressThe full address, written so it cannot be clicked by accident, for example hxxps://example[.]com/login.
- Dated screenshotA full-page screenshot with the date and time of capture in UTC.
- Registration recordThe RDAP or WHOIS record for the domain, showing the registrar, creation date and abuse contact.
- Hosting recordThe IP address and the network owner, with the abuse contact.
- Mail-record statusWhether the domain has mail records (MX and SPF), and what they say.
- Related email headersThe full headers of any phishing email that points to the site, with the sending address and message identifier.
- Impersonation statementTwo lines saying who you are, what is being impersonated and why you are authorised to report it.
What should you expect? No set timescale.
No party can promise to remove a site by a set date. Some act within hours. Some do not reply.
Keep a log of every report: who you sent it to, when, the reference number if one came back, and the reply. Follow up after a few working days with the same evidence pack and a reference to the first report. If the host and registrar both stay silent, escalate to the registry and report to the block-list operators if you have not yet done so.
Block-list entries protect visitors who use those browsers while the site is still online. They do not remove the site. Warn your own customers and staff in parallel, with the exact address to avoid and where your real sign-in page is.
When does a managed takedown provider make sense? Five tests.
Reporting by hand works for a few cases a year. Some organisations reach a point where it does not. These criteria help you decide.
Volume
You report more cases a month than your team can follow up by hand.
Coverage hours
Attacks land at weekends and out of hours, and your team is not on call.
Unresponsive hosts
Your cases keep ending at hosts and registrars that do not reply, and you need escalation routes.
Other channels
The impersonation spreads to social media, app stores or advertising, not only websites.
Evidence and legal support
You need formal notices, a record that stands up in a dispute, or help with legal escalation.
Compare any provider on what it removes, how it reports progress, who holds the evidence and how it is priced. Ask for removal times on cases like yours, not an average.
What does EdgeProtect do here? Finds it and gathers the evidence.
EdgeProtect does not remove sites. It helps with the first and last steps of this guide, and stops there.
- It finds the lookalike. It keeps checking the lookalikes of the domains you add.
- It records registration and mail-record status for each lookalike, so you can see whether it is registered and whether it can receive email.
- It gathers the evidence for the abuse report you send. The record carries the registration status, mail-record status and a technical record.
You send the email yourself. EdgeProtect does not contact the host, the registrar or anyone else for you, and it cannot say when a site will come down. Read more on brand protection.
It is finding domains that were registered to imitate your organisation, ideally before anyone is tricked. It works by generating likely variants of the domains you own, such as changed letters or added words, and checking which are registered and whether they can receive email.
A website impersonates your organisation when it uses your name, logo, wording or a near copy of your address to make visitors believe it is you. It counts whether or not it asks for a password or a payment.
No one can promise a set time. Some hosts act within hours, some take days and some do not reply. Keep a log, follow up with the same evidence pack and report to the block-list operators in parallel so visitors are warned while the site is up.
Take care. Use an isolated browser or a separate device, do not type any real details and do not download anything. If you cannot do this safely, use the evidence from the phishing email and the domain records instead of visiting the page.
No. EdgeProtect finds lookalike domains, records whether each is registered and can receive email, so you have the evidence for an abuse report you send yourself, and EdgeProtect does not contact anyone on your behalf.
Find lookalikes of your name before customers do.
Add your domains and EdgeProtect keeps watching for lookalikes, with registration and mail-record status for each.