Short answer
Look up the domain's registrar and host (RDAP or our free lookup), then send each one a short report with the full URL, a screenshot and your official site. At the same time report the URL to Google Safe Browsing and Netcraft so browsers warn visitors, and to MetaMask's phishing list so wallets block it. If the registrar ignores a well-evidenced report, complain to ICANN Compliance.
Who this is for: Teams that found a fake website or a fake claim page of their project.
Who can stop a fake site
| Party | What it can do | How to reach it |
|---|---|---|
| Registrar | Suspend the domain everywhere (ICANN names clientHold as a typical action) | Registrar contacts or the lookup tool |
| Host or platform | Remove the page or the account that serves it | Platform contacts; Cloudflare forwards to the real host |
| Browsers | Show a red warning page before anyone sees the site | Google Safe Browsing, Netcraft, Microsoft |
| Wallets | Block the connection or signature request | Wallet blocklists |
Step by step
- Capture evidence. Screenshot the page with the address bar visible. Copy the full URL of the phishing page and of any wallet prompt. Note the time, your country and your browser.
- Find the registrar and host. Paste the domain into our abuse contact lookup. It reads RDAP, shows the registrar's abuse email or form and tells you if the site sits behind Cloudflare.
- Report to the registrar. Use the takedown request template. Pick the phishing category on forms.
- Report to the host. For Cloudflare use abuse.cloudflare.com/phishing; Cloudflare forwards the report to the hosting provider and shows visitors a warning once it confirms phishing.
- Trigger browser warnings. Report the URL to Google Safe Browsing (used by Chrome and Safari, among others), Netcraft and Microsoft.
- Get wallets to block it. See report phishing to wallets.
- Check again in 24 hours. Record each answer. If the site is still up, follow up with new evidence.
Evidence that gets acted on
Since April 5, 2024, ICANN's contract requires registrars to "promptly take the appropriate mitigation action(s)" against a domain used for phishing once they have actionable evidence. ICANN's own example of that evidence is "a screenshot showing a phishing attempt with an indication of what the phish is against" and "the complete URL where the abuse is located".
Phishing kits often hide from the people who review reports: they show a blank page to visitors from other countries, to desktop browsers or to security companies. Say where and how you saw the page. Namecheap, Spaceship and Cloudflare ask for the country and user agent for this reason.
How common and how fast
| Fact | Figure | Source |
|---|---|---|
| Phishing attacks seen, Q2 2026 | 1,069,681 (up 10.1% from Q1) | APWG |
| Share of attacks against crypto, Q2 2026 | 7.2% of targeted sectors | APWG |
| Phishing domains registered by the criminals themselves | 74% (May 2025 to April 2026) | Interisle |
| Published abuse processing targets | 24 hours (Spaceship) to 72 hours (Namecheap) | Registrar pages |
Because most phishing domains are registered on purpose, the registrar can suspend them without hurting an innocent owner. That is why a well-evidenced report to the registrar usually works.
When nothing happens
- Reply to the registrar's confirmation with fresh screenshots or victim reports.
- After a reasonable time (ICANN asks you not to complain on the same day you report), file a DNS abuse complaint with ICANN Contractual Compliance. ICANN reports nearly 20,000 malicious domains mitigated as a direct result of its enforcement between April 2024 and August 2025.
- For a lasting copy of your trademark, a UDRP case can transfer the domain. It costs from USD 1,500 and takes about two months.
Sources
- ICANN advisory: DNS abuse obligations
- ICANN: progress in enforcing DNS abuse requirements
- Cloudflare: abuse complaint types
- Netcraft: reporting FAQ
- APWG Phishing Activity Trends Report, Q2 2026
Frequently asked questions
Registrar or host: who should I report to first?
Both, on the same day. The registrar can suspend the whole domain; the host can remove the page. Whichever acts first ends the attack. For a free subdomain such as name.vercel.app there is no registrar: report to the platform.
The site shows a normal page when the registrar opens it. Why?
Phishing kits often hide from visitors outside the target country, from desktop browsers or from known security companies. Say in your report which country, device and browser you saw it from, and attach a screenshot.
The fake came back on a new domain. Now what?
Report the new domain the same way. Repeat fakes are common; monitoring that watches new certificates and registrations finds the next one within hours.
Can I send a DMCA notice instead?
You can, when the site copies your own text, code or images: it goes to the host's DMCA agent. For an active phishing page the phishing report is faster, because no counter-notice period applies.