Malte ZanderContents
Report a phishing website to the hosting provider, the domain registrar and the browser blocklists at the same time, and add the national reporting service where you are. Every report needs the exact URL, a screenshot, a short explanation of why the page is fraudulent and your contact details. In the EU, a complete notice must be handled by the host in a timely, diligent and objective way.
- A notice to a host under the Digital Services Act should contain four elements: the reasons, the exact URL, your name and email, and a good-faith statement (DSA, Article 16).
- In the first two months of ICANN's new abuse rules, registrars suspended 2,528 malicious domains and disabled 328 phishing websites after ICANN enforcement (ICANN).
- Most complaints to ICANN in that period were closed because the reporter had not contacted the registrar first (ICANN).
- DENIC, the registry for .de, says it cannot remove phishing sites (DENIC).
What evidence do you need before you report?
You need enough for a stranger to confirm the fraud in one minute without asking you. Capture it before you send the first report, because pages change or disappear once someone reacts.
The exact URL, including path and parameters. Some pages only show the fake with the full link.
Screenshots on desktop and mobile, with the address bar and the time visible.
Domain data: WHOIS or RDAP record, registrar and creation date.
Hosting data: IP address, hosting provider, DNS records and any CDN in front.
The TLS certificate: issuer and issue date.
The source: the phishing email with full headers, the ad, the QR code or the message that led there.
Open suspicious pages in a separate browser profile and never enter real credentials. Our evidence guide covers every item in detail.
Who do you report a phishing website to?
You report it to everyone who can switch it off or warn visitors, in parallel. The hosting provider removes the page, the registrar can suspend the domain and the browsers warn visitors in the meantime.
| Channel | What it can do | How to reach it | What to include |
|---|---|---|---|
| Hosting provider | Remove the page | Abuse email or form; in the EU, a notice under Article 16 DSA | Exact URL, screenshots, reasons, your name and email, good-faith statement |
| Registrar (for .com, .net, .online and other generic domains) | Suspend the domain | Abuse email or web form on the registrar's homepage, which registrars must publish (ICANN) | A screenshot of the phishing page and the complete URL |
| CDN or DNS provider | Forward to the host, sometimes restrict access | Abuse form | The same evidence, plus a note that the site sits behind them |
| Google Safe Browsing | Warning in Chrome and other browsers that use its data | Report form | The URL |
| Microsoft | Warning in Edge | Report unsafe site; corporate accounts can submit several URLs at once | The URL or URLs |
| APWG | Shares the data with security teams worldwide | Forward the phishing email to reportphishing@apwg.org (APWG) | The original email |
| National service | Warnings, analysis, sometimes takedown | See the next section | Depends on the service |
If the site sits behind a CDN such as Cloudflare, read reporting a phishing site behind Cloudflare.
Which national services accept phishing reports?
National services collect reports, warn the public and in some cases trigger takedowns. They complement the reports to host and registrar, they don't replace them.
Germany: forward phishing emails to the consumer center of North Rhine-Westphalia at phishing@verbraucherzentrale.nrw, which analyzes them for its Phishing-Radar warnings (Verbraucherzentrale NRW). Victims can file a criminal complaint online with the police of their federal state (DENIC).
Austria: report fraud sites through the online form of Watchlist Internet, an independent platform run by the Austrian Institute for Applied Telecommunications (Watchlist Internet).
Switzerland: report phishing sites at antiphishing.ch, run by the Federal Office for Cyber Security, and forward emails to reports@antiphishing.ch (antiphishing.ch). For confirmed phishing, the office emails host, registrar and domain holder, and it can have fraudulent .ch domains blocked (BACS).
United Kingdom: report suspicious websites through the NCSC form (NCSC), forward emails to report@phishing.gov.uk and texts to 7726 (GOV.UK).
Other EU countries: your national CSIRT or consumer protection authority is the usual contact.
How do you write a notice the host must process?
You write it so that a diligent reviewer can see the problem without a legal examination. Under Article 16 DSA, such a notice gives the host actual knowledge of the illegal content, which matters for its liability (DSA). Use this structure:
Subject: Phishing page impersonating [Brand] at [exact URL]: notice under Article 16 DSA
Location: [exact URL or URLs]
What it is: A copy of the [Brand] login page that collects usernames and passwords. [Brand] did not create or authorize it.
Why it is illegal: The page impersonates [Brand] to obtain credentials by deception and uses the registered [Brand] trademark.
Evidence: Screenshots attached, captured on [date, time, time zone]. First seen in [email, ad or QR code].
Contact: [Name, role, email]
Statement: I confirm in good faith that the information and allegations in this notice are accurate and complete.
More wording for each channel is in our abuse report template and the DSA notice guide.
Who has to act, and how fast?
None of the main channels promises a fixed deadline, but the rules set clear expectations:
Hosts in the EU must confirm receipt when you give an email address, decide in a timely, diligent, non-arbitrary and objective manner, and tell you the decision with options for redress (DSA).
Registrars of generic domains must promptly take appropriate mitigation action once they have actionable evidence. ICANN's guidance gives suspension within two business days as an example for a domain registered only for phishing, and stresses that examples are not fixed contractual timelines (ICANN).
Browser blocklists publish no timeline, but a warning often appears before the page is removed.
In AI Fraud Protect's experience, removal takes between two and fourteen days. Parallel reports shorten that, because the fastest party decides.
What about country-code domains like .de, .at or .ch?
ICANN's registrar rules cover generic domains only, so each country registry sets its own policy. DENIC states that it is not responsible for website content and cannot remove phishing sites (DENIC). For .de domains, the host and the registrar who manages the domain are your levers.
Switzerland is different: the Federal Office for Cyber Security had 57 fraudulent .ch domains blocked at the registry in 2024, based on the Swiss Ordinance on Internet Domains. It has no such lever for .com or .me domains (BACS).
What if nobody reacts?
If nothing happens within two business days, follow up and widen the circle:
Resend with the same evidence and the date of your first report.
Go upstream: the provider that owns the IP range, the CDN and the DNS provider.
Escalate to ICANN for generic domains. ICANN Compliance accepts complaints from anyone, but only after you reported to the registrar (ICANN).
Use trademark procedures such as UDRP if the domain itself infringes your mark.
More escalation paths are in what to do when a host ignores your abuse report.
Criminals register several lookalike domains for one campaign. Start the free fraud scan to see which other copies use your name. You get a short report within 48 hours.
FAQ
Can I report a phishing website anonymously?
Partly. Browser blocklists and some national services accept reports without contact details. A notice under Article 16 DSA needs your name and email, and it gives you a confirmation and a decision in return.
Do I need to own the brand to report a phishing site?
No. Anyone can report a phishing site to the host, the registrar, the browsers and national services. Brand owners can add trademark arguments and use dispute procedures.
Does reporting to Google Safe Browsing remove the site?
No. Safe Browsing makes browsers show a warning, which protects visitors. Removing the page or the domain takes the host or the registrar.
Should I fill in the form on the phishing page to test it?
No. Never enter real credentials or personal data. Capture screenshots and the page source instead, and let the reviewers at host and registrar assess the page.
Who reports when the phishing site uses our name?
Ideally one owner in security or brand protection, with a written process. Our 24-hour response plan assigns every step.
Sources
Digital Services Act, Article 16, with the official text on EUR-Lex
ICANN advisory: DNS abuse obligations in the registrar and registry agreements, 5 February 2024
ICANN: enforcement of DNS abuse requirements, the first two months, 7 June 2024
APWG: Phishing Activity Trends Reports and reporting address