Short answer
If the fake site lives on a platform subdomain (vercel.app, pages.dev, web.app, github.io, netlify.app), report it to that platform, not to a registrar. Use the platform's abuse form or email below, give the full URL and say which official site it copies. Platforms usually remove phishing pages faster than registrars suspend domains.
Who this is for: Teams that found a fake site on a free hosting subdomain.
Why the platform, not a registrar
Scammers like free subdomains: yourproject-claim.vercel.app costs nothing, gets HTTPS at once and borrows the platform's good reputation. The domain vercel.app belongs to the platform, so a registrar will not suspend it for one customer's page. Only the platform can remove that one subdomain, and most of them do it quickly for clear phishing.
Abuse contacts by platform
| Platform | Subdomains | Abuse email | Abuse form |
|---|---|---|---|
| Cloudflare | pages.dev, workers.dev |
Form only | Open form |
| Firebase (Google) | web.app, firebaseapp.com |
Form only | Open form |
| GitHub | github.io |
Form only | Open form |
| Netlify | netlify.app |
[email protected] | Email only |
| Render | onrender.com |
[email protected] | Email only |
| Replit | replit.app, repl.co |
[email protected] | Email only |
| Vercel | vercel.app |
[email protected] | Open form |
| Webflow | webflow.io |
Form only | Open form |
| Wix | wixsite.com |
[email protected] | Open form |
Not sure where a site is hosted? Paste it into the abuse contact lookup.
How to report
- Save the full URL and take a screenshot that shows the address bar.
- Open the platform's form, or write to its abuse email, and choose phishing or fraud as the category.
- Say which official site the page copies and link to it, so the reviewer can compare in seconds.
- Report the URL to Google Safe Browsing as well. Chrome, Safari and Firefox use its lists to warn visitors.
- Check again after a day. Scammers often move to a new subdomain of the same platform; report each one.
Sites behind Cloudflare
Many fake sites on their own domains use Cloudflare in front of the real host. Cloudflare says it cannot remove content and forwards complaints "to entities like the hosting provider and/or website owner". Once it confirms a phishing page, it shows visitors a warning page. Report at abuse.cloudflare.com/phishing with the exact phishing URL, and report the domain to its registrar too.
Sites on pages.dev and workers.dev are hosted by Cloudflare itself, so the same form removes them.
Sources
- Cloudflare: report phishing
- Cloudflare: abuse complaint types
- Mozilla: how phishing protection works
- Apple: Safari fraudulent website warning
- Each platform's own abuse page, linked in the table above.