You find a suspicious website.

Maybe it is pretending to be a bank.

Maybe it is copying a Microsoft, Google, Instagram, PayPal, or government login page.

Maybe it is distributing malware, running a fake investment scheme, selling something that does not exist, or collecting people’s passwords and card details.

The natural reaction is:

“How do I get this website taken down?”

The good news is that ordinary internet users can do something about it.

You don’t need to be law enforcement. You don’t need access to the server. And you definitely don’t need to hack the attacker.

In many cases, you can identify the relevant infrastructure, report the abuse to multiple organizations, preserve evidence, and potentially get the domain suspended, the hosting account terminated, browser warnings activated, advertisements removed, or payment infrastructure disabled.

The important part is knowing who actually has the power to act.

1. A Website Is More Than Just a Domain

One of the biggest misconceptions about takedowns is thinking:

“The website is hosted by the domain registrar.”

Usually, it isn’t.

A malicious website can involve several different companies:

                    Victim
                      │
                      ▼
                Domain Name
                      │
                      ▼
                DNS Provider
                      │
                      ▼
              CDN / Reverse Proxy
                      │
                      ▼
                Origin Server
                      │
                      ▼
              Hosting Provider
                      │
                      ▼
               Website Files

There can also be other layers:

Phishing Site
     │
     ├── Domain Registrar
     ├── Registry
     ├── DNS Provider
     ├── CDN / WAF
     ├── Hosting Provider
     ├── Advertising Network
     ├── Payment Provider
     ├── Search Engine
     └── Impersonated Company

Each organization controls something different.

That’s why reporting only to Google is usually not enough.

2. Understand What You’re Actually Reporting

Before reporting a website, identify what kind of abuse you’re dealing with.

Common examples include:

Phishing

A website designed to steal:

• passwords
• banking credentials
• OTPs
• cryptocurrency wallet information
• API keys
• personal information

Malware distribution

A website distributing:

• trojans
• ransomware
• infostealers
• malicious browser extensions
• malicious APKs
• malicious scripts
• unwanted software

Fake websites

Examples:

• fake banking websites
• fake government portals
• fake shopping stores
• fake cryptocurrency exchanges
• fake job portals
• fake technical-support pages

Investment scams

Examples:

• fake trading platforms
• fake crypto exchanges
• fake investment dashboards
• “guaranteed returns” schemes

Brand impersonation

The website may copy the identity of:

• Microsoft
• Google
• Apple
• banks
• payment companies
• government agencies
• social-media companies

Compromised legitimate websites

This is an important distinction.

Sometimes:

legitimate-site.com
        ↓
legitimate website gets hacked
        ↓
/login/microsoft.html
        ↓
phishing page

In this situation, the domain owner may actually be a victim.

Don’t automatically accuse the website owner of being the scammer.

Report the compromised page to the site’s administrator/hosting provider as well.

3. First Rule: Preserve Evidence

Before you start reporting, collect evidence.

Don’t rely on:

“I saw it earlier.”

Websites disappear, change URLs, redirect visitors, or replace their content.

Record:

Domain:
Full URL:
Date/time observed:
What it is doing:
What organization it impersonates:
Redirect URL:
IP address:
Registrar:
Hosting provider:
CDN:
Nameservers:
Screenshots:
Relevant HTTP information:

For example:

Domain:
example-login[.]com
URL:
https://example-login[.]com/microsoft/login
Observed:
23 August 2026, 00:15 IST
Type:
Credential phishing
Impersonates:
Microsoft
Behavior:
Requests Microsoft username and password
Registrar:
Example Registrar
Hosting:
Example Hosting
Evidence:
Screenshot + DNS information

When sharing malicious URLs publicly, consider defanging them:

https://evil-example[.]com/login

instead of:

https://evil-example.com/login

This reduces the chance of accidentally sending readers to the malicious website.

4. Report the Site to Google Safe Browsing

For phishing and malware, Google is one of the first places you should report.

Google’s Safe Browsing systems can warn users about dangerous websites in supported browsers and services. Google also provides reporting mechanisms for phishing and malware. (Google Transparency Report)

For phishing:

Google Safe Browsing → Report Phishing

For malware:

Google Safe Browsing → Report Malware

Google’s current documentation specifically directs users who encounter pages designed to steal personal information to the Safe Browsing phishing reporting process. (Google for Developers)

What does this accomplish?

It may not directly shut down the server.

Instead, it can help trigger warnings such as:

Deceptive site ahead

That can dramatically reduce the number of people who successfully reach the phishing page.

Think of it as:

Website still exists
        ↓
Google identifies/report receives threat
        ↓
Browser/Search protections
        ↓
Potential warning
        ↓
Fewer victims

So reporting to Google is valuable even when the website isn’t immediately removed.

5. Report the Domain to Its Registrar

This is one of the most important steps.

A registrar is the company through which the domain was registered.

Examples of registrar-related information might appear in registration data as:

Registrar:
Example Registrar
Registrar Abuse Contact:
abuse@example-registrar.com

You can use ICANN Lookup to investigate registration information for many domains.

Look for:

Registrar
Registrar IANA ID
Registrar Abuse Contact
Name Servers
Domain Status

ICANN’s registration-data tools are specifically intended to help identify the sponsoring registrar or registry operator. (ICANN)

6. Why the Registrar Matters

Suppose you have:

fake-bank-login.com

The registrar may have the ability to take action against the domain under its policies and contractual obligations.

ICANN’s DNS Abuse framework includes phishing and malware among the defined categories of DNS Abuse. (ICANN)

Since April 2024, ICANN’s registrar and registry agreements include requirements concerning mitigation of well-evidenced DNS Abuse. (ICANN)

That doesn’t mean:

“Send an email and the domain will definitely disappear.”

It means you have a legitimate abuse-reporting route to the organization responsible for the domain registration.

7. What Should You Put in the Registrar Report?

Don’t send:

“This site is a scam. Take it down.”

Give them something they can investigate.

A good report contains:

Subject:
DNS Abuse Report — Phishing Domain
Domain:
example-login[.]com
Malicious URL:
https://example-login[.]com/login
Abuse Type:
Phishing
Impersonated Organization:
Example Bank
Description:
The website appears to impersonate Example Bank's login page
and requests users to submit their account credentials.
Evidence:
[Describe screenshots and observed behavior]
Date/Time Observed:
23 August 2026, 00:15 UTC
Additional Technical Information:
IP:
ASN:
Nameservers:
Hosting Provider:

The more actionable the report, the easier it is for an abuse team to investigate.

ICANN’s current guidance emphasizes evidence such as affected domains, screenshots showing the abuse, and proof that the matter was first reported to the relevant registrar or registry when escalating to ICANN. (ICANN)

8. What If the Registrar Has No Abuse Email?

Check the registrar’s website.

Under ICANN’s registrar requirements, accredited registrars must provide an abuse contact/mechanism for reporting abuse. ICANN’s guidance also describes accessible abuse-reporting mechanisms and confirmation of receipt. (ICANN VIP)

Look for:

Report Abuse
Abuse
Security
Trust & Safety
Security Contact
Abuse Form

Don’t waste time hunting for the individual domain owner if the registrar already provides an abuse process.

9. Find the Hosting Provider

Now comes the more interesting OSINT part.

The registrar and host are not necessarily the same company.

Start with DNS.

For example:

dig example.com

or:

dig A example.com
dig AAAA example.com
dig NS example.com
dig MX example.com

You can also use:

nslookup example.com

You may discover an IP such as:

example.com → 203.0.113.50

Now investigate the IP.

You want to determine:

IP
 ↓
ASN
 ↓
Network
 ↓
Organization
 ↓
Hosting Provider

If the IP belongs to a VPS provider or hosting company, find its abuse-reporting process.

10. But Be Careful: The IP May Not Be the Real Server

This is extremely important.

Suppose:

example.com
      ↓
104.x.x.x
      ↓
Cloudflare

That does not necessarily mean Cloudflare hosts the website.

Cloudflare may simply be providing:

• CDN
• reverse proxy
• DNS
• WAF
• DDoS protection

Cloudflare’s own documentation explains that many abuse reports concern sites using its pass-through CDN/security services rather than Cloudflare hosting the underlying content. (Cloudflare Docs)

So:

Domain
   ↓
Cloudflare
   ↓
Origin server
   ↓
Actual hosting provider

may be the real architecture.

11. Report to Cloudflare Too

If a malicious website uses Cloudflare, report it.

Cloudflare provides an official abuse-reporting system and accepts reports involving technical abuse such as phishing and malware. (Cloudflare Docs)

Cloudflare’s current complaint guidance says a valid phishing report should include:

1. the domain
2. the specific phishing URL

For confirmed phishing, Cloudflare can place a warning in front of the phishing link and notify the site owner to address malicious content at the origin. (Cloudflare Docs)

This makes an important distinction:

Reporting Cloudflare doesn’t necessarily mean Cloudflare is the host.

You’re reporting the abuse occurring through its infrastructure.

12. Find the Origin Infrastructure

If Cloudflare is involved, you can investigate publicly available information to determine whether there are clues about the origin infrastructure.

Useful sources can include:

• historical DNS records
• certificate transparency
• subdomains
• DNS records
• mail infrastructure
• publicly indexed hostnames
• passive DNS
• historical infrastructure information

For example, you might discover:

www.example.com
       ↓
Cloudflare
origin.example.com
       ↓
185.x.x.x
       ↓
Hosting Provider

That gives you another organization to report to.

Important boundary

There is a huge difference between:

Passive investigation

and

attacking the infrastructure.

Passive investigation:

DNS
WHOIS/RDAP
certificate records
public HTTP information
public DNS history

is very different from:

exploiting the server
bypassing authentication
stealing files
brute forcing accounts
defacing the site
DDoSing the server

Don’t cross that line.

You’re trying to get the website removed—not become another attacker.

13. Use Certificate Transparency

Certificate Transparency can reveal additional hostnames associated with a domain.

One useful public service is:

crt.sh

Search:

example.com

You may discover:

example.com
www.example.com
login.example.com
secure.example.com
origin.example.com
admin.example.com

Sometimes a forgotten subdomain exposes useful infrastructure information.

For example:

www.example.com → CDN
mail.example.com → Email Provider
origin.example.com → Hosting IP

You don’t need to attack anything.

You’re simply building an infrastructure map from publicly available information.

14. Report to the Actual Hosting Company

Once you’ve identified the host, find its abuse page.

For example:

Hosting Provider
      ↓
Abuse / Security
      ↓
Report phishing
      ↓
Submit evidence

A hosting provider may be able to:

• disable the malicious account
• remove the website
• suspend the VPS
• disable the malicious content
• contact its customer
• preserve relevant information
• escalate internally

This can sometimes be more effective than reporting only the domain.

15. Report the Impersonated Company

This is one of the most underrated options.

Imagine:

fake-microsoft-login[.]com

The website is pretending to be Microsoft.

Don’t only report the domain.

Also report it to Microsoft.

The same applies to:

• banks
• payment companies
• cryptocurrency exchanges
• social-media platforms
• universities
• governments
• airlines
• shopping websites

Why?

The legitimate organization may have:

• an abuse team
• fraud team
• brand-protection team
• security operations center
• legal department
• threat-intelligence team

They may already have relationships with registrars, hosting providers, browser vendors, and law enforcement.

Your report becomes another piece of threat intelligence.

16. Report the Advertisement That Led You There

Sometimes the malicious website isn’t discovered through search.

You might encounter it through:

Google Ads
Facebook Ads
Instagram
YouTube
TikTok
Telegram
Discord

If an advertisement is promoting the scam, report the advertisement itself.

Think about the attack chain:

Malicious advertisement
          ↓
Landing page
          ↓
Phishing website
          ↓
Credential theft

Removing the landing page is useful.

Removing the advertising campaign is even better.

17. Report the Payment Infrastructure

If the scam accepts payments, investigate the payment provider.

For example:

Scam website
     ↓
Payment gateway
     ↓
Merchant account

The provider may have a fraud/abuse process.

This is particularly useful for:

• fake stores
• investment scams
• fake subscriptions
• fraudulent services
• fake crypto platforms

A domain can be replaced in minutes.

A payment account can be much harder for the attacker to replace if the provider has identified the fraud.

18. Report the Scam to the Relevant Platform

If the scam is being distributed through another platform, report the source too.

For example:

Discord message
       ↓
Phishing URL

Report both:

Discord
+
Phishing website

Or:

Telegram channel
       ↓
Scam website

Report both:

Telegram
+
Website

This helps disrupt the distribution mechanism, not just the final destination.

19. What About ICANN?

ICANN is frequently misunderstood.

People sometimes think:

“I’ll just email ICANN and they’ll shut down the domain.”

That’s not how it works.

ICANN does not control the entire Internet, and it does not directly operate websites or hosting servers. ICANN itself explains that it does not control website content or general Internet access. (ICANN)

Instead, ICANN has contractual authority over participating registrars and registries.

The normal escalation looks like:

Malicious domain
       ↓
Identify registrar
       ↓
Report registrar
       ↓
Give registrar reasonable opportunity to act
       ↓
Registrar fails to properly address DNS Abuse
       ↓
ICANN Contractual Compliance

ICANN’s current DNS Abuse program explicitly says that after reporting to the registrar and allowing a reasonable period, a reporter can escalate a well-evidenced matter to ICANN Contractual Compliance. (ICANN)

20. ICANN Is Especially Relevant for Phishing and Malware

ICANN’s current definition of DNS Abuse includes:

• botnets
• malware
• pharming
• phishing
• spam when it is used to deliver those forms of abuse

(ICANN)

That makes phishing and malware reports particularly relevant to the registrar/registry abuse process.

But remember:

ICANN is an escalation mechanism—not your first stop.

First report to the appropriate registrar or registry.

21. India: Report It to the National Cyber Crime Portal

If you’re in India, there is another very useful option.

The National Cyber Crime Reporting Portal has a dedicated “Report Suspect” facility.

It specifically accepts reports involving suspicious:

• website URLs
• phone numbers
• WhatsApp numbers
• Telegram handles
• email IDs
• SMS headers/numbers
• social-media URLs

(Cyber Crime Portal)

You can report a suspicious website even when you’re reporting an attempted cybercrime, not necessarily a crime you personally suffered.

If you have actually lost money or become a victim of cybercrime, the portal directs victims to report through the national cybercrime system and the 1930 helpline. (Cyber Crime Portal)

Official portal:

cybercrime.gov.in

22. What About CERT-In?

India’s CERT-In is another important reporting channel for cybersecurity incidents.

CERT-In accepts incident reports and specifically lists identity theft, spoofing and phishing attacks among incident categories in its reporting form. (CERT-IN)

CERT-In’s current incident-reporting information provides:

Email:
incident@cert-in.org.in
Toll-free:
1800-11-4949

(CERT-IN)

For an ordinary malicious website, the National Cyber Crime Reporting Portal may be the more natural public reporting route, while CERT-In is particularly relevant to cybersecurity incidents and technical incident reporting.

If there is a broader incident affecting an organization, infrastructure, or systems, CERT-In becomes especially relevant.

23. If the Scam Involves a Bank or Payment Account

Don’t stop at the website.

Report the fraudulent activity to the relevant:

• bank
• payment provider
• wallet provider
• cryptocurrency exchange
• merchant processor

For an actual financial loss in India, report immediately through the cybercrime system/1930 rather than waiting for the website to disappear. (Cyber Crime Portal)

Speed matters enormously in financial fraud.

24. Don’t Forget Browser and Security Vendors

Depending on the threat, you can also submit indicators to security services.

Examples include:

Malicious URL
IP address
Domain
File hash
Phishing page
Malware sample

Security vendors and threat-intelligence services use these reports to improve detection.

The result might be:

Attacker website
      ↓
Threat intelligence
      ↓
Browser / endpoint protection
      ↓
Warning or blocking

Again, the goal isn’t necessarily to make the server disappear immediately.

Making the infrastructure dangerous to operate is also a successful defensive outcome.

25. A Website Can Be “Taken Down” in Several Different Ways

“Takedown” doesn’t necessarily mean the server gets deleted.

There are several possible outcomes.

Domain suspension

example.com
     ↓
Registrar suspends domain
     ↓
Visitors can't reach it normally

Hosting suspension

Hosting provider
      ↓
Terminates VPS/account
      ↓
Website disappears

CDN/browser warning

Website
   ↓
Cloudflare / Safe Browsing
   ↓
Warning page

Search removal/de-ranking

Search engine
      ↓
Website becomes harder to discover

Payment termination

Scam
 ↓
Payment provider
 ↓
Merchant account disabled

Distribution removal

Telegram/Discord/Social platform
        ↓
Malicious post/account removed

All of these reduce the attacker’s ability to reach victims.

26. A Practical Investigation Workflow

If I encounter a suspicious website, I’d use this order:

STEP 1
Don't interact unnecessarily
        ↓
STEP 2
Capture evidence
        ↓
STEP 3
Identify the domain
        ↓
STEP 4
Check registration data
        ↓
STEP 5
Identify registrar
        ↓
STEP 6
Identify DNS/CDN
        ↓
STEP 7
Resolve IP addresses
        ↓
STEP 8
Identify hosting/ASN
        ↓
STEP 9
Check certificate/subdomains
        ↓
STEP 10
Report to Google Safe Browsing
        ↓
STEP 11
Report to registrar
        ↓
STEP 12
Report to hosting provider
        ↓
STEP 13
Report to CDN if applicable
        ↓
STEP 14
Report to impersonated company
        ↓
STEP 15
Report advertisements/platform distribution
        ↓
STEP 16
Report payment infrastructure
        ↓
STEP 17
Report to cybercrime authorities
        ↓
STEP 18
If appropriate, escalate registrar failure
        ↓
ICANN Contractual Compliance

You don’t necessarily need every step for every incident.

But the more serious and well-evidenced the abuse is, the more useful a multi-party report becomes.

27. What Information Makes a Report Strong?

A good abuse report answers five questions:

1. What?

Phishing
Malware
Fraud
Impersonation

2. Where?

Domain
Full URL
IP
Specific malicious path

3. When?

Date
Time
Timezone

4. Why?

Explain exactly what makes it malicious.

For example:

The page impersonates the Microsoft login portal and requests a user’s Microsoft credentials. The domain is unrelated to Microsoft.

That’s much better than:

“Looks suspicious.”

5. Evidence?

Provide:

• screenshots
• URLs
• DNS information
• redirect information
• relevant headers
• timestamps
• downloaded-file hashes when appropriate

28. Don’t Overload the Report With Irrelevant Information

More information isn’t always better.

Bad report:

I think this hacker is from Russia.
I found this IP.
He is probably using a VPN.
His website looks suspicious.
Please investigate.

Better:

The URL below hosts a page impersonating Example Bank.
URL:
https://example[.]com/login
The page requests the user's bank username,
password and OTP.
Observed:
23 August 2026 00:20 UTC
Evidence:
Screenshot attached.
The page was accessible at the time of observation.

Stick to what you can actually demonstrate.

29. Don’t Claim Something You Can’t Prove

This is especially important if you’re doing OSINT.

Don’t write:

“This person is the hacker.”

when all you know is:

“This domain is registered through Registrar X and hosted on Provider Y.”

Infrastructure attribution is not the same thing as attacker attribution.

The domain could have been:

• compromised
• registered using stolen information
• purchased through a reseller
• hosted on a compromised server
• created by a third party

Your report should focus on the observable abuse.

30. Don’t Try to “Fight Back”

This deserves its own section.

If you discover a phishing website, don’t:

• DDoS it
• hack the server
• delete its files
• steal its database
• dox the operator
• brute-force the administrator
• exploit vulnerabilities
• deploy malware against the attacker

Even if the website is clearly criminal.

Your objective is:

Collect evidence → report → escalate.

Not:

Attack attacker.

You can do a surprisingly effective takedown without ever touching the attacker’s system.

31. Build an Evidence Package

For serious cases, create a folder:

incident-2026-08-23/
│
├── screenshots/
│   ├── homepage.png
│   ├── phishing-form.png
│   └── redirect.png
│
├── dns/
│   ├── A.txt
│   ├── AAAA.txt
│   ├── NS.txt
│   └── MX.txt
│
├── certificates/
│   └── crtsh.txt
│
├── notes/
│   └── incident.txt
│
└── report.txt

Your incident.txt might contain:

First observed:
2026-08-23 00:15 UTC
URL:
https://example[.]com/login
Threat:
Credential phishing
Impersonated brand:
Example Bank
Requested information:
Username
Password
OTP
Registrar:
Example Registrar
Hosting:
Example Hosting
CDN:
Cloudflare
Evidence:
Screenshots attached

Now you can submit essentially the same evidence to multiple organizations.

32. The “Report Everywhere” Strategy

For a serious phishing campaign, think in terms of choke points.

Imagine:

                    ATTACKER
                       │
          ┌────────────┼────────────┐
          ▼            ▼            ▼
       Domain        Hosting       Ads
          │            │            │
          ▼            ▼            ▼
      Registrar       Host       Ad Network
          │
          ▼
       DNS/CDN
          │
          ▼
      Victims

Your goal is to disrupt multiple points.

For example:

Google
   ✓
Registrar
   ✓
Hosting provider
   ✓
Cloudflare
   ✓
Impersonated company
   ✓
Advertising platform
   ✓
Payment provider
   ✓
Cybercrime authority
   ✓

Even if one organization doesn’t act, another may.

33. What If the Website Is Already Down?

Still preserve the evidence you have.

A dead domain can still be useful intelligence.

For example:

Domain
 ↓
Historical DNS
 ↓
Previous IP
 ↓
Previous host
 ↓
Related domains
 ↓
Same campaign

A phishing campaign often uses multiple domains.

You might find:

bank-login-1[.]com
bank-login-2[.]com
bank-login-secure[.]com
bank-verification[.]com

The domains may share:

• hosting infrastructure
• certificates
• page templates
• tracking IDs
• analytics IDs
• nameservers
• IP ranges
• redirectors

One report can therefore reveal a larger campaign.

34. The Most Important Lesson

Don’t think:

“How do I take down this website?”

Think:

“Which organizations control the infrastructure that allows this abuse to operate?”

Then work outward.

                MALICIOUS WEBSITE
                       │
       ┌───────────────┼────────────────┐
       ▼               ▼                ▼
    Registrar        Hosting           CDN
       │               │                │
       ▼               ▼                ▼
   Suspension       Server kill      Warning/block
       │
       └───────────────┬────────────────┘
                       ▼
                 Search Engines
                       │
                       ▼
                 Fewer Victims

And then:

Impersonated Company
        +
Payment Provider
        +
Social Platform
        +
Cybercrime Authorities

You are attacking the attacker’s ability to operate, without attacking the attacker.

35. Quick Reference: Where Should You Report?

36. Official Reporting Resources

For the most reliable reporting routes, use the organizations’ official websites rather than random “website takedown” services.

Google Safe Browsing: report phishing and malware URLs through Google’s official reporting mechanisms. (Google for Developers)

ICANN: use ICANN’s DNS Abuse and Contractual Compliance resources when dealing with registrar/registry abuse and escalation. (ICANN)

Cloudflare: use Cloudflare’s official abuse reporting system for domains using Cloudflare services. (Cloudflare Docs)

India — National Cyber Crime Reporting Portal: suspicious website URLs can be reported through the portal’s “Report Suspect” facility. (Cyber Crime Portal)

India — CERT-In: cybersecurity incidents can be reported to CERT-In through its official incident-reporting channels. (CERT-IN)

Conclusion

You don’t need to be a law-enforcement officer to make a difference when you encounter a phishing or scam website.

You can:

1. Preserve evidence.
2. Identify the domain and registrar.
3. Identify the hosting infrastructure.
4. Determine whether a CDN such as Cloudflare is involved.
5. Report the phishing/malware URL to Google.
6. Report the domain to its registrar.
7. Report the infrastructure to the hosting provider.
8. Report CDN abuse where appropriate.
9. Notify the organization being impersonated.
10. Report malicious advertisements and distribution platforms.
11. Report fraudulent payment infrastructure.
12. Report serious cases to the relevant cybercrime authorities.
13. Escalate an unresolved registrar/registry DNS Abuse complaint to ICANN when appropriate.

The most effective approach isn’t usually a single report.

It’s evidence + correct attribution + multiple reporting channels + escalation.

And perhaps the most important rule of all:

Don’t hack the scammer. Report the infrastructure.

A phishing site can be rebuilt. A domain can be replaced. A server can move.

But when multiple providers, browsers, security companies, payment processors, legitimate brands, and law-enforcement channels all receive good evidence about the same campaign, the attacker’s infrastructure becomes much harder to operate.

That is how ordinary users can help make the web safer—without becoming vigilantes themselves.