# How to report a phishing website that impersonates your company

> To report a phishing website, collect evidence of the page, then send an abuse report to the hosting provider, the domain registrar and the browser block-list operators.

Canonical page: https://www.edgeprotect.io/guides/how-to-report-a-phishing-website
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Guides](https://www.edgeprotect.io/resources) > How to report a phishing website
Guide: brand protection. For security and IT teams. UK routes included. Updated 29 October 2026.

## What are the steps?

Work through these six steps in order. Evidence first, because the page can disappear before you have recorded it.

1. **Preserve the evidence.** Capture the page address, a dated screenshot and the page source before you report. Do this in an isolated browser and never type real details into the page.
2. **Identify the host and the registrar.** Look up the domain and its IP address in an RDAP or WHOIS tool. The records name the registrar, the hosting network and their abuse contacts.
3. **Send abuse reports.** Email the hosting provider and the registrar with your evidence pack. Use the abuse contact from the record, not a general support address.
4. **Report to the block-list operators.** Submit the page to Google Safe Browsing and Microsoft SmartScreen so browsers warn visitors while the site is still online.
5. **Warn your customers and staff.** Tell them the exact address to avoid and where your real sign-in page is. Brief your support team in case people call.
6. **Track the removal.** Log each report, its reference number and the reply. Follow up with the same evidence pack, and check the page again to confirm it is gone.

## Who can act on a phishing site?

No single party controls a phishing site. Each of these can remove it, block it or pass the report on. Contact routes change, so check each organisation's own page before you send.

Who to contact about a phishing website, what each can do, and how to reach them.

| Contact | What they can do | How to find or reach them |
|---|---|---|
| Hosting provider | Disable the site or the account that serves it. Often the fastest route. | Look up the site's IP address in an RDAP or WHOIS tool. The record names the network owner and an abuse contact. If the site sits behind a proxy or content network, report to that service as well as the origin host. |
| Domain registrar | Suspend the domain name, which stops it resolving. | Look up the domain in RDAP or WHOIS. The record names the registrar and its abuse contact. Registrars of generic domain endings must publish an abuse contact and review reports. |
| Domain registry | Act on the name when the registrar does not. Registries usually work through the registrar first. | The registry runs the domain ending, such as .uk or .com. Find its abuse page from the ending's registry website. Use this route after the registrar. |
| Google Safe Browsing | Add the page to the block-list that warns visitors in Chrome and other browsers. | Use the Safe Browsing phishing report form and give the exact page address. |
| Microsoft SmartScreen | Add the page to the block-list used by Microsoft Edge and Microsoft Defender. | Use the Microsoft report unsafe site form and choose the phishing option. |
| APWG | Share the report with the anti-phishing community that feeds many security products. | Forward the phishing email to the APWG reporting address, or report through its published route. |
| NCSC (UK organisations) | Take the report into national action against scam websites and phishing email. | Use the NCSC page for reporting a scam website, and forward phishing emails to the Suspicious Email Reporting Service. Report fraud losses to the national fraud reporting service. |

## Phishing domain detection: how to find the site first

You cannot report a site you have not found. Phishing domain detection is the work of finding domains built to imitate yours before customers or staff report them.

Attackers pick a web address that looks like yours. They change one letter, swap a letter for a lookalike character such as `1` for `l`, or add a word such as `payroll` or `refunds`. Lookalike discovery works out those variants of the domains you own and checks each one.

Two checks matter for each lookalike. First, is it registered? An unregistered variant is only a risk if someone registers it. Second, does it have mail records? A lookalike that can receive or send email can be used for phishing mail, not only for a fake page.

Other sources also point to the site: reports from customers and staff, the headers of the phishing email, and a search for your brand name and common product words. EdgeProtect keeps watching for lookalikes of the domains you add. See domain monitoring for brand protection.

## Fake website detection: signs a site is copying yours

A fake website copies your look to borrow your trust. These four signs, taken together, separate a copy from an unrelated site that happens to look similar.

- **A lookalike address.** The domain differs from yours by a letter, a lookalike character, a hyphen or an added word, such as acme-payro11.com for acme.co.uk.
- **Copied branding.** The logo, colours, wording and page layout are lifted from your site, often as a direct copy of your sign-in page.
- **A sign-in or payment form.** The page asks for a password, a card number or personal data, and sends it to the attacker instead of to you.
- **Mail records on a domain that should not send mail.** A lookalike with mail records can be used for phishing email. A domain you do not use for mail that has them is a warning sign.

## Website impersonation: what to call it when you report it

Hosts and registrars sort reports by category. A report filed under the right category reaches the right team. Website impersonation can fit several categories at once.

Choose the category that matches what the page does, then name the others in the text of the report.

- **Phishing** when the page asks for sign-in details, payment details or personal data.
- **Brand impersonation** or **trademark infringement** when the page uses your name, logo or wording to pass as you.
- **Fraud** or **deceptive site** when the page takes payment for goods or services you do not sell.
- **Malware distribution** when the page offers a download or redirects to one.

State the facts in the first two lines: the exact address, that it impersonates your organisation, what the page asks visitors to do, and the date and time you saw it. Attach the evidence from the next section.

## What goes in an evidence pack?

A complete pack lets a host or registrar act without writing back to you. Build the same pack for each report. The page offers the checklist as a text file download.

- **Page address.** The full address, written so it cannot be clicked by accident, for example hxxps://example[.]com/login.
- **Dated screenshot.** A full-page screenshot with the date and time of capture in UTC.
- **Registration record.** The RDAP or WHOIS record for the domain, showing the registrar, creation date and abuse contact.
- **Hosting record.** The IP address and the network owner, with the abuse contact.
- **Mail-record status.** Whether the domain has mail records (MX and SPF), and what they say.
- **Related email headers.** The full headers of any phishing email that points to the site, with the sending address and message identifier.
- **Impersonation statement.** Two lines saying who you are, what is being impersonated and why you are authorised to report it.

## What should you expect?

No party can promise to remove a site by a set date. Some act within hours. Some do not reply.

Keep a log of every report: who you sent it to, when, the reference number if one came back, and the reply. Follow up after a few working days with the same evidence pack and a reference to the first report. If the host and registrar both stay silent, escalate to the registry and report to the block-list operators if you have not yet done so.

Block-list entries protect visitors who use those browsers while the site is still online. They do not remove the site. Warn your own customers and staff in parallel, with the exact address to avoid and where your real sign-in page is.

## When does a managed takedown provider make sense?

Reporting by hand works for a few cases a year. Some organisations reach a point where it does not. These criteria help you decide.

- **Volume.** You report more cases a month than your team can follow up by hand.
- **Coverage hours.** Attacks land at weekends and out of hours, and your team is not on call.
- **Unresponsive hosts.** Your cases keep ending at hosts and registrars that do not reply, and you need escalation routes.
- **Other channels.** The impersonation spreads to social media, app stores or advertising, not only websites.
- **Evidence and legal support.** You need formal notices, a record that stands up in a dispute, or help with legal escalation.

Compare any provider on what it removes, how it reports progress, who holds the evidence and how it is priced. Ask for removal times on cases like yours, not an average.

## What does EdgeProtect do here?

EdgeProtect does not remove sites. It helps with the first and last steps of this guide, and stops there.

- **It finds the lookalike.** It keeps checking the lookalikes of the domains you add.
- **It records registration and mail-record status** for each lookalike, so you can see whether it is registered and whether it can receive email.
- **It gathers the evidence for the abuse report you send.** The record carries the registration status, mail-record status and a technical record.

You send the email yourself. EdgeProtect does not contact the host, the registrar or anyone else for you, and it cannot say when a site will come down. Read more on brand protection.

## Questions

### What is phishing domain detection?

It is finding domains that were registered to imitate your organisation, ideally before anyone is tricked. It works by generating likely variants of the domains you own, such as changed letters or added words, and checking which are registered and whether they can receive email.

### What counts as website impersonation?

A website impersonates your organisation when it uses your name, logo, wording or a near copy of your address to make visitors believe it is you. It counts whether or not it asks for a password or a payment.

### How long does it take to get a phishing site removed?

No one can promise a set time. Some hosts act within hours, some take days and some do not reply. Keep a log, follow up with the same evidence pack and report to the block-list operators in parallel so visitors are warned while the site is up.

### Is it safe to open the phishing page to collect evidence?

Take care. Use an isolated browser or a separate device, do not type any real details and do not download anything. If you cannot do this safely, use the evidence from the phishing email and the domain records instead of visiting the page.

### Does EdgeProtect take phishing sites down?

No. EdgeProtect finds lookalike domains, records whether each is registered and can receive email, so you have the evidence for an abuse report you send yourself, and EdgeProtect does not contact anyone on your behalf.

## Find lookalikes of your name before customers do.

Add your domains and EdgeProtect keeps watching for lookalikes, with registration and mail-record status for each.

## Related

- [Domain monitoring](https://www.edgeprotect.io/features/domain-monitoring)
- [Brand protection](https://www.edgeprotect.io/features/brand-protection)
- [Book a demo](https://www.edgeprotect.io/contact)