·
3 min read
How to take down a phishing site, step by step
How to take down a phishing site impersonating your brand. Capture evidence, warn browsers, report the registrar and host, and escalate when they stall.
ChainPatrol
To take down a phishing site, capture the evidence, report it to browser blocklists such as Google Safe Browsing and Microsoft so visitors get a warning, then report it to the registrar, the host and any proxy in front of it at the same time. Registrars of generic domains such as .com must act promptly on actionable evidence of phishing under ICANN rules, and you can escalate to ICANN Compliance if one doesn't.
Here's the full sequence in the order we work it. For who controls what, see registrar vs host vs Cloudflare.
Step 1. Capture the evidence
The full URL, and screenshots of the page with the date and time visible.
What it impersonates, such as your login page, withdrawal flow or support form.
Where you found it, such as an ad, a message or a fake account.
The page's source or a saved copy, if you can capture it safely in an isolated browser.
Step 2. Get it on browser blocklists
Report the URL to Google Safe Browsing and to Microsoft through its unsafe site report, and forward details to the Anti-Phishing Working Group at [email protected]. Blocklists warn visitors even while the site is still up. Once a malicious website or phishing link is confirmed, ChainPatrol gets it flagged in 20+ wallets in about 5–10 minutes and in browsers in about 1–3 hours. Blocking applies to web domains and URLs; fake social profiles and chat accounts are removed through platform takedowns.
Step 3. Find the registrar, host and proxy
An RDAP or WHOIS lookup shows the registrar. The site's IP address shows the host, unless a proxy such as Cloudflare sits in front of it, in which case report to the proxy to learn the host.
Step 4. Report to all of them at once
Who | What to ask for | What helps |
|---|---|---|
Registrar | Suspend the domain | Actionable evidence of phishing, the impersonated brand, proof you represent it |
Host | Remove the content or account | The same evidence, plus the exact URL path |
Proxy or CDN | Forward to the host, share the host's contact, and warn visitors | A complete report; the proxy can't remove content it doesn't host |
Step 5. Follow up and escalate
Re-file with new evidence if nothing happens within a few days.
For generic domains, escalate a registrar that doesn't act to ICANN Compliance, citing its 2024 DNS abuse obligations.
For country-code domains, escalate to the registry for that country.
Watch for the next domain. Phishing kits move, so a new lookalike often appears within days.
Why some takedowns take longer
Abuse-tolerant hosts, hidden origins and country-code registries outside ICANN's contracts all slow things down. See why some phishing takedowns take weeks.
Doing this at volume
ChainPatrol confirms phishing sites, gets them blocked, files with registrars, hosts and proxies with the evidence each one requires, and follows up with platforms until we've confirmed each case has been removed. You can follow every case in the ChainPatrol app as it moves. You also get regular reports on what's been removed, what's blocked with a takedown in progress, what's still live and why, and what's waiting on your approval.
Frequently asked questions
Does a phishing takedown need a letter of authorization?
Phishing abuse reports to registrars, hosts and proxies generally don't. Impersonation and trademark claims with platforms do. See what a letter of authorization is.
Is reporting to Google Safe Browsing enough?
No. It warns visitors but doesn't remove the site. Report to the registrar and host too.
What if the site is on a free website builder or a cloud platform?
Report it to that platform's abuse team. It acts as the host and can remove the page.
See which phishing sites are impersonating your brand. Get a free scan, with results within 48 hours.
Sources
Accessed October 2026. Platform processes change; check each source for the latest.
Fakes of your brand already out there?
ChainPatrol finds them, blocks the links in wallets and browsers, and files the takedowns for you.
