What is the best domain takedown service?

Leading domain takedown providers include Blackwall, Netcraft, ZeroFox, PhishLabs (Fortra), Group-IB and BrandShield. Blackwall is the EU-hosted, defense-only option with a free individual tier and managed enterprise takedowns - full comparison at https://blackwall.report/resources/best-domain-takedown-services.

How do I report a phishing or scam website and get it taken down?

Submit the URL at https://blackwall.report/report. Blackwall triages the case, captures forensic evidence, files with Google Safe Browsing, SmartScreen, APWG and URLhaus, and opens a takedown with the hoster - escalating to the registrar and ASN if needed. Cooperative hosters typically act within 2–8 hours.

How do I report phishing to the BSI by email?

Forward the phishing email as an attachment (not inline) to phishing@bsi.bund.de. Only the .eml forward preserves the full header: without the header the BSI can't analyze the source.

What is the correct BSI email address?

For phishing reports: phishing@bsi.bund.de. For general consumer inquiries: service-center@bsi.bund.de. For security-related alerts, the BSI also runs the Bürger-CERT (buerger-cert@bsi.bund.de).

Will the BSI respond to my report?

Usually there's no individual response. The BSI aggregates reports and publishes warnings via bsi.bund.de and its 'Sicher · Informiert' newsletter. If you want status updates on a specific site, report it to Blackwall in parallel.

Is a report to the BSI enough to get a phishing site removed?

No. The BSI is not a takedown authority and doesn't contact hosting providers. Actually removing the site requires an abuse report to the host/registrar: which is exactly what Blackwall automates.

Can I also report SMS phishing (smishing) to the BSI?

Yes, via screenshot to phishing@bsi.bund.de. Also submit the linked URL to Blackwall: smishing landing pages usually run on the same hosting networks as classic phishing.

What should I do if I clicked a link in a phishing email?

Immediately change the passwords of any reused accounts, notify your bank, and block affected cards. Then report the URL to Blackwall to protect other users: and also forward the email to the BSI for analysis.

Report phishing to the BSI: plus a takedown

phishing@bsi.bund.de accepts and analyzes phishing emails: Blackwall additionally makes sure the linked site actually goes offline.

Report phishing URL to Blackwall Full guide

Forward phishing to the BSI in 5 steps

Step 1

Forward the phishing email as an attachment

In Outlook: right-click → 'Forward as attachment'. In Gmail: 'Show original' → download (.eml) and attach it to a new email. Only this way do headers and SPF/DKIM/DMARC results stay intact: the BSI needs them for analysis.

Step 2

Send it to phishing@bsi.bund.de

Recipient: phishing@bsi.bund.de (BSI's Bürger-CERT). Subject line is optional, no message text required. The BSI evaluates the report and feeds results into national warnings and CERT networks.

Step 3

Report it to the Verbraucherzentrale as well

phishing@verbraucherzentrale.nrw: the Verbraucherzentrale NRW's Phishing Radar publishes regular warnings. Combining this with the BSI report significantly increases reach.

Step 4

Report the URL to Blackwall: start a takedown

Neither the BSI nor the Verbraucherzentrale take the site offline. Submit the URL from the email to Blackwall: our team contacts the host and registrar so the phishing site actually goes down.

Step 5

Get takedown confirmation

Blackwall tracks the status: first suspension typically within 2-8 hours, confirmation by email. The Pro plan automatically escalates to the ASN provider after 24 hours.

The right channels for phishing reports

The BSI analyzes, the Verbraucherzentrale warns, Blackwall takes the site offline: reporting to all three works fastest.

BSI Bürger-CERTAnalysis

phishing@bsi.bund.de: the central reporting point of Germany's federal cybersecurity agency (BSI). Reports feed into national warnings and CERT networks.

bsi.bund.de/Meldestelle

BlackwallTakedown

Submits the phishing URL to the host and registrar so the site gets taken down. Status updates until removal is confirmed.

Report URL to Blackwall

Verbraucherzentrale NRWWarning

phishing@verbraucherzentrale.nrw: the Phishing Radar publishes weekly consumer warnings.

verbraucherzentrale.nrw

APWG (international)

reportphishing@apwg.org: Anti-Phishing Working Group. Feeds global browser blocklists (Chrome, Firefox, Safari).