For more actionable reporting, here are some tips: More reports can be sent to Cybersecurity & Anti-Phishing Organizations. For the remaining sites, we can send to
Google Safe Browsing via [Google’s Report Phishing Page](
https://safebrowsing.google.com/safebrowsing/report_phish/).
PhishTank (OpenDNS/Cisco): [Report Here](
https://www.phishtank.com/).
Netcraft (
https://report.netcraft.com/report).
APWG (Anti-Phishing Working Group)**: [Report Here](
https://apwg.org/reportphishing/).
Notify Browser & Search Engine Blocklists
- Microsoft SmartScreen: Report via [Microsoft Defender SmartScreen](
https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site).
- Mozilla Blocklist: Email `blocklist@mozilla.org` (if Firefox isn’t blocking it).
- Bing Webmaster Tools: Report malicious URLs [here](
https://www.bing.com/webmasters/about).
Legal & Law Enforcement Options
- FTC (U.S.): Report at [ReportFraud.ftc.gov](
https://reportfraud.ftc.gov/) (if targeting U.S. users).
- IC3 (FBI’s Cybercrime Division): File a complaint at [ic3.gov](
https://ic3.gov/).
- Local CERT: If the site is hosted in a specific country, report to their national CERT (e.g., [US-CERT](
https://www.cisa.gov/report)).
- Online suggestion says we can publicly shame unresponsive registrars (e.g., Twitter/X tagging their support).
Public Warnings (If Safe)
- Post on forums like Reddit’s r/Scams, Spamhaus, or Malwarebytes to alert others.
- more reports on virustotal.com can be helpful
Some vendors may block them.
Key Evidence to Include
- Screenshots of phishing pages (with timestamps).
- Network logs (e.g., `curl` or `traceroute` outputs).
- Links to archived phishing pages (via [Wayback Machine](
https://archive.org/)).
If the sites are still up after these steps, we would assume the registrar/host may be complicit— we should consider naming them in reports to ICANN or legal authorities.