How to report a phishing website

If you have the address of a phishing site, you can send it to Phish Takedown. You do not need to investigate it first. In fact, please don’t: there is no reason to sign in, connect a wallet, download anything, or get past a browser warning just to prove that the site is bad.

The URL and a sentence or two about where it came from are usually enough for us to start looking.

Copy the link without opening it if you can. Email clients and messaging apps normally have a Copy link or Copy address option when you right-click or hold down on a link.

If the page is already open, copy the address from the browser and close the tab. The full address is helpful, including anything after the domain name. Some phishing pages only appear at a particular path.

Please do not put passwords, one-time codes, wallet recovery phrases, or payment details in the report. We will never need them.

Tell us what you saw rather than trying to write a technical analysis. Say where the link appeared, whether that was an email, text message, Discord DM, or search result. Add the company or person the sender claimed to be, what the message asked you to do, and roughly when you received it.

A perfectly good report might say:

This arrived in a Discord DM today. The sender said they worked for a wallet company and asked me to verify my account by entering my recovery phrase. I copied the link but did not open it.

It is fine if you are not certain. Say what made you suspicious and leave the checking to us.

Sending the report

Open the phishing report form, paste the suspicious URL, add your email address, and include any context you have. We use the email address to contact you about the report.

Once we have reviewed the site, we may report it to the company hosting it, its domain registrar, and services that warn users about dangerous pages. Which route we take depends on how the site is set up. Some providers act quickly; others take longer. A report is not a promise that the site will disappear straight away.

Phish Takedown deals with websites used for phishing and scams. An account that copies a company’s name but does not link to a phishing site is normally a matter for the platform where the account appears. Copyright, trademark, and moderation disputes also need to go to the relevant platform or company.

Removing a website is only part of the job. Report the email, text, or social media message in the app where you received it. If it was posted in a community, let the moderators know without reposting the live link in a public channel.

Gmail has a built-in Report phishing option, and suspicious pages can also be sent to Google Safe Browsing. In the United States, the Federal Trade Commission accepts reports of phishing and fraud. Other countries have their own official fraud or cybercrime reporting services.

Use contact details from an official website when reporting something. Do not use a phone number or support link supplied in the suspicious message.

If you already entered something

Deal with the affected account before spending time on the report. Change an exposed password through the real service, review active sessions, and check that the recovery email and phone number still belong to you. Contact your bank or payment provider if you shared financial details.

Our guide on what to do after clicking a phishing link separates the steps for passwords, login approvals, and downloaded files.

We cannot recover accounts, reverse payments, or retrieve stolen crypto. Be careful with anyone who contacts you after an incident and promises that they can get your money back for a fee.