How to get a phishing site taken down (report a fake login page)

A fake login page wearing your logo costs you more than a pirated PDF does. Every hour it stays up, your customers hand over passwords they think they are giving to you, and you inherit the support tickets, the chargebacks, and the reputation damage. The good news is that phishing comes down faster than copyright infringement. Hosts, registrars, and browser vendors treat a credential-harvesting page as a security incident, and nobody on the other end wants to defend it.

The order you report in decides whether the page dies in two hours or two weeks.

Confirm what you are actually looking at

Four different problems get called phishing, and each one goes to a different desk:

• A credential-harvesting page. A copy of your sign-in screen, hosted somewhere you do not control, with a form that posts the password somewhere else. This is the case this guide covers.
• A lookalike domain with no page on it yet. Someone registered yourbrand-login.com and parked it. There is nothing to take down, but it will be weaponised later. See what typosquatting looks like for how to find and handle these.
• An impersonation account. A profile on a social platform posing as your support team, usually DMing your customers. That runs through the platform’s impersonation process, covered in finding and reporting fake accounts.
• A counterfeit storefront. A shop selling fake versions of your product. Different route again, covered in counterfeit listings on Amazon and Etsy.

If you are looking at a form that asks for a password, a card number, or a one-time code, keep reading.

Capture the evidence before you report anything

Abuse teams act on specifics. Vague reports sit in a queue. Before you file, collect:

1. The full URL, path and query string included. Phishing kits often live at something like secure-yourbrand.xyz/auth/verify?id=8823, and the domain alone is not enough for a host to locate the account.
2. A dated screenshot of the page. Phishing pages rotate content and geo-fence themselves, so the page an abuse analyst loads may look nothing like what your customer saw.
3. The brand assets they copied. Your logo file, your favicon, your stylesheet, your product screenshots. Copied assets give you a second, independent claim, and they make the report impossible to dismiss as a false positive.
4. Where the page sends the data. View the page source and find the form’s action attribute. It usually points at a PHP endpoint on the same host or at a Telegram bot API. Quote that line in your report.

Never type a real password into the page to test it, and do not encourage a customer to. Fake credentials are fine, and watching what happens after submission tells you whether the kit redirects to your real site (the usual tell).

Report it to the browser blocklists first

This is the single highest-leverage step, and creators skip it because they assume removal has to start with the host. It does not. Chrome, Edge, Firefox, and Safari all pull from a small number of reputation feeds, and once a URL lands on one, visitors get a full-page red warning instead of your fake login form. Traffic to the page collapses before the host has read your email.

Two submissions cover most of the browser market:

• Google’s phishing report form feeds Safe Browsing, which Chrome, Firefox, and Safari consume.
• Microsoft’s report an unsafe site form feeds SmartScreen, which covers Edge and Windows Defender.

Both are free, take a minute, and need no proof of ownership. Confirmed phishing URLs usually get flagged within hours. File these before you do anything else.

Then go after the host and the registrar

Blocklisting hides the page. Removing it takes the host, and killing the domain takes the registrar. Run the domain through ICANN Lookup to get the registrar and the name servers, then check where the IP resolves.

• The host can pull the account or the individual file. Every hosting provider bans phishing in its acceptable-use policy, so you do not need to build a copyright argument. Find their abuse@ address or abuse form, state that the page is harvesting credentials for your brand, and include your evidence list.
• Cloudflare and other CDNs sit in front of a lot of phishing infrastructure and will not remove content themselves, but their abuse process forwards the report to the origin host and often discloses it to you. That gets you to the party who can act.
• The registrar is the one who can suspend the domain. This matters for domains registered for the attack, where pulling one file just moves the kit to a new path. Registrars move slower than hosts, so file with both at the same time rather than waiting.

Phishing reports get honored at rates copyright notices never reach. A host that argues with a DMCA notice for three weeks will suspend a credential-harvesting account the same day.

Add the industry and enforcement channels

These will not clear the page today, but they compound:

• APWG aggregates phishing reports across the industry and feeds the same blocklists the browsers use.
• IC3 and reportfraud.ftc.gov build the record that matters when the same operator hits you a fifth time and you want law enforcement involved.

File these once per incident and move on. The value is the paper trail, not the response time.

Tell your customers before the page is gone

Removal takes hours at best, and anyone who already submitted their password is exposed right now. Send a short notice through the channel you normally use: the domain you actually sign in at, a reminder that you never ask for passwords over email, and a line telling anyone who entered credentials to reset them. Two sentences beat a polished post that ships a day late.

Why the same phishing site keeps coming back

Phishing kits are cheap and domains are cheaper. Suspend yourbrand-secure.com and the operator redeploys the same kit on yourbrand-verify.net by the afternoon. The removal worked; the campaign did not stop.

Catching the next one early means watching for the domain before the page goes live. Certificate transparency logs publish every TLS certificate issued, so a new certificate for a hostname containing your brand name is a signal you can act on hours after registration and days before the first customer sees a fake login screen. Search de-indexing helps too, since a phishing page that ranks for your brand keeps pulling traffic after the host removes it, which is the same mechanic covered in how search delisting works.

How Clampdown helps

Clampdown watches for the impersonation side of this problem the same way it watches for pirated copies. You register your brand and your real domains once, and it monitors new domain registrations, certificate transparency logs, and live lookalike pages for anything wearing your name, verifies each match, files the abuse and blocklist reports, and keeps watching so the next domain in the sequence gets caught on day one instead of after a customer reports it. One-off phishing pages you can handle yourself with the steps above. Repeat campaigns against your brand are the part that eats your week, and that is the part we take.

FAQ

How long does it take to get a phishing site taken down? Browser blocklisting usually lands within a few hours of a confirmed report, which stops most of the traffic. Host removal typically takes one to three business days, and registrar suspension takes longer.

Do I need to own the trademark to report a phishing website? No. Phishing violates the acceptable-use policy of every host and registrar regardless of who owns the brand, and the browser blocklists accept reports from anyone. Owning the brand strengthens the report and gives you a second claim over your copied logo and page assets.

What if the phishing page is behind Cloudflare? File with Cloudflare’s abuse form. They will not take the page down, but they forward the report to the origin host and usually tell you who that is, which is what you need to escalate.

Should I report phishing emails as well as the website? Yes, and they go to different places. Forward the email to reportphishing@apwg.org and report it to the provider whose service sent it. Killing the landing page without reporting the sending infrastructure leaves the operator free to point the next batch of emails at a fresh domain.

If fake login pages and lookalike domains keep appearing with your brand on them, start with a free audit to see what is already live, or talk to us about monitoring the ones that have not launched yet.