Phishing Domain Takedown: How to Report and Remove
2026-10-13 · 8 min read · By the DomainGuard team
The short version
Phishing domains come down fastest when you report them everywhere at once instead of waiting on one channel. The ladder: the domain's registrar (via WHOIS/RDAP abuse contact), the hosting provider (via the IP's ASN abuse desk), browser blocklists (Google Safe Browsing, Microsoft SmartScreen, the fastest user protection, often within hours), community feeds (PhishTank, Netcraft), and law enforcement (FBI IC3) for financial fraud. Attach the same evidence pack to every report: the domain, screenshots, certificate details, and the date you first observed it. Then prevent the next one with defensive registrations and registry lock.
Why speed decides everything
A phishing site's economics run on a clock. The attacker pays ~$12 for the domain and a few dollars for hosting; every hour the site stays live, more victims land on it. Defenders who report to one channel and wait, "we filed with the registrar, now let's see", give the attacker days of free operation. The channels below work in parallel, not in sequence. File all of them in the same hour and you compress the site's viable life from days to hours.
There's a second reason for parallel reporting: no single channel reliably kills a phishing domain. Registrars vary wildly in abuse responsiveness. Hosting providers act fast on clear evidence and slowly on vague complaints. Browser blocklists don't take the site down at all, they just stop most users from reaching it. You want all of these effects stacking, because the attacker's infrastructure only needs one surviving path to keep working.
Step 0: build your evidence pack first
Before filing anything, assemble one evidence pack and reuse it everywhere. Sloppy reports get deprioritized; complete ones get actioned. Your pack needs:
- The exact domain and URLs, the phishing pages, not just the apex domain. Include any redirect chains (phishing kits often bounce through two or three domains).
- Screenshots of the phishing page, including the browser address bar showing the fraudulent domain. Capture the page asking for credentials or payment details mid-flow if you safely can.
- Certificate details if it uses HTTPS: issuer, serial number, and validity dates. Click the padlock → connection details, or pull it via CT logs. The serial is what CAs and blocklists use to identify the exact cert.
- DNS data: the A/AAAA records (current IPs), nameservers, and MX records if present. Note the date and time of each lookup, IPs change.
- The date you first observed it and, if you have it, how it was distributed (the phishing email headers, the SMS text, the ad it ran in).
- Your relationship to the abused brand — are you the brand owner, a vendor, a researcher? Registrars weight complaints from the impersonated party heaviest.
Save all of this with timestamps. If the case ever reaches law enforcement or a dispute proceeding, contemporaneous notes beat reconstructed memories. DomainGuard packages this automatically into a one-click takedown packet for every finding, but even doing it manually in a shared doc puts you ahead of most reporters.
1. The registrar
The registrar controls the domain itself, suspension here kills every path at once. Find it with WHOIS or RDAP:
$ whois phishing-example.com | grep -i registrar $ whois phishing-example.com | grep -i abuse
RDAP (the structured successor to WHOIS) often gives cleaner abuse-contact data; most registrars also publish an abuse web form. Write to the abuse contact with your evidence pack and a one-paragraph summary: what the domain is doing, who it's impersonating, and what you're asking for (suspension of the domain for phishing, citing the registrar's own abuse policy and its ICANN obligations).
If the registrar stonewalls, and some do, especially high-volume cheap registrars, escalate to ICANN Contractual Compliance at icann.org/compliance/complaint. ICANN doesn't suspend domains directly, but a compliance complaint creates a paper trail that registrars have to answer, and it changes the economics of ignoring you.
2. The hosting provider
While the registrar decides, kill the content. Resolve the domain to its IP, identify who operates that IP space, and hit their abuse desk:
$ dig +short phishing-example.com $ whois 93.184.216.34 | grep -i abuse
The whois on the IP returns the network owner (the ASN's organization) and usually an abuse contact. Cloud hosts and CDNs all run abuse desks that suspend phishing content routinely, a clear report with screenshots and the exact URLs moves fast, often same-day. Be precise about which URLs host the phishing content; providers are much quicker to act on "this exact path serves a credential-harvesting form" than on "this domain seems bad."
One wrinkle: if the site sits behind a CDN or reverse proxy, the IP you resolve belongs to the CDN, not the attacker. Report to the CDN's abuse channel anyway, they can identify the origin customer, and say so explicitly in your report so it gets routed correctly instead of bounced.
3. Browser blocklists, the fastest user protection
Blocklisting doesn't take the site down, but it puts a full-page warning in front of nearly every potential victim — often within the hour of submission. For user protection per unit of effort, nothing else comes close:
- Google Safe Browsing: safebrowsing.google.com/safebrowsing/report_phish/, covers Chrome, which is most of the browsing web. Also report via Google's Search Console phishing report if the site appears in search results.
- Microsoft SmartScreen: microsoft.com/en-us/wdsi/support/report-unsafe-site, covers Edge and Windows-level URL reputation.
File these first if you're triaging under time pressure, because they protect users while the slower registrar and hosting processes grind. A phishing site behind a browser warning converts almost nobody.
4. The community feeds
Submit to PhishTank (phishtank.org) and Netcraft (report.netcraft.com/report). These feed security vendors, email gateways, and threat-intel platforms worldwide, your one submission propagates into dozens of blocklists you'd never reach individually. The APWG (Anti-Phishing Working Group) eCrimeX feed is another distribution path if you're a member or working with one.
Community feeds also create the public record. When the same kit or actor reappears under a new domain next month, and they will, the historical submissions are what let analysts connect the campaigns.
5. Law enforcement
For serious cases, credential harvesting at scale, financial fraud, business email compromise, file with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. IC3 complaints feed investigations and, in aggregate, drive the statistics that shape enforcement priorities. Include your evidence pack and any financial details: amounts, account numbers the funds went to, and timelines.
Set expectations honestly: IC3 won't call you back about a single phishing domain. Its value is cumulative and investigative. File it alongside the fast channels, not instead of them.
6. Prevent the next one
Takedowns are reactive by nature. After the fire is out, close the openings the attacker walked through:
- Register the highest-risk lookalikes yourself, transpositions, omissions, and top-TLD variants of your brand. A few hundred dollars a year beats another takedown cycle. (See our typosquatting guide for the priority math.)
- Enable registrar transfer lock (clientTransferProhibited) on every domain you own, so domains can't be transferred away without your explicit unlock.
- Put a registry lock on your primary domain. Registry lock (offered by Verisign for .com/.net and most major registries) requires out-of-band verification for any change — DNS, transfer, even nameserver updates. It's the strongest protection against domain hijacking and worth it for any domain your business depends on.
- Monitor continuously. New lookalikes get registered daily. A takedown program without monitoring is mowing the lawn once and declaring victory.
FAQ
How long does a phishing takedown usually take?
Browser blocklists: often within hours. Hosting providers: same day to a few days with clear evidence. Registrars: days to weeks, highly variable. That's why you run all channels in parallel, the fastest one protects users while the slowest one finishes the job.
Should I contact the attacker or pay to buy the domain?
No to both. Contacting the attacker tips them off and can accelerate the fraud; paying ransom for a domain funds the next campaign and marks you as willing to pay. Use the abuse channels and dispute processes.
What if the phishing site is behind a CDN?
Report to the CDN's abuse channel with the exact phishing URLs, they can identify and suspend the origin customer. Also keep the registrar and browser-blocklist reports going; those paths don't depend on finding the origin server.
Does reporting to Google Safe Browsing take the site down?
No, it shows a full-page warning to Chrome users instead. The site stays up until the registrar or host acts. The warning still neutralizes most of the harm, which is why blocklist reports are the highest-leverage first move.