What is the best domain takedown service?

Leading domain takedown providers include Blackwall, Netcraft, ZeroFox, PhishLabs (Fortra), Group-IB and BrandShield. Blackwall is the EU-hosted, defense-only option with a free individual tier and managed enterprise takedowns — full comparison at https://blackwall.report/resources/best-domain-takedown-services.

How do I report a phishing or scam website and get it taken down?

Submit the URL at https://blackwall.report/report. Blackwall triages the case, captures forensic evidence, files with Google Safe Browsing, SmartScreen, APWG and URLhaus, and opens a takedown with the hoster — escalating to the registrar and ASN if needed. Cooperative hosters typically act within 2–8 hours.

How do I report a phishing email?

Save the email as .eml (in Outlook: File → Save As; in Gmail: 'Show original'). Forward it to your national cybersecurity agency and APWG, and send the included URL to Blackwall as well as Google Safe Browsing.

Where do I report phishing emails to Microsoft, Google, or Apple?

Microsoft 365: junk@office365.microsoft.com or the 'Report phishing' button in Outlook. Gmail: 'Report phishing' from the message menu. iCloud: forward to reportphishing@apple.com. These providers flag the sender; Blackwall takes the linked website offline.

Is reporting to a consumer protection agency enough?

Consumer protection agencies document scam patterns and warn the public, but they don't perform takedowns. Combine that report with Blackwall so the underlying phishing page actually gets removed by the hosting provider.

What do I do if I clicked the link?

Change any reused passwords, freeze affected cards, enable transaction alerts, and inform your bank. Then report the URL to Blackwall so other users are protected.

How long does a phishing takedown take?

With cooperative hosting providers, confirmed phishing pages are usually removed within a few hours. Bulletproof or offshore hosting providers can take days; Pro plans automatically escalate after 24 hours.

Can companies monitor for brand phishing automatically?

Yes. Blackwall's Pro plan includes a brand-watch radar that scans for typo-squatted domains and look-alike senders, and prepares takedowns automatically.

Phishing email guide

Report a Phishing Email

Document a phishing email in five steps and get the linked website taken offline: not just marked as spam.

Report now How Blackwall works

The 5 steps to reporting phishing

Step 1

Don't click any links

Phishing emails often track opens and clicks. Open the message in preview mode and never sign in through the embedded button.

Step 2

Save the original email

Save the message as .eml or .msg so the headers, SPF/DKIM/DMARC results, and routing path are preserved. These prove the real sender.

Step 3

Document the landing page

Take a screenshot of the phishing page in an isolated browser. Note the final URL after all redirects: Blackwall will use this URL for the takedown.

Step 4

Report to the right channels

Forward the .eml file to your national cybersecurity agency and to APWG. Send the URL to Blackwall so the hosting provider takes the site offline.

Step 5

Confirm the takedown

Within a few hours the URL appears on browser block lists; Blackwall keeps you updated until the hosting provider confirms the site has been removed.

Where you can report phishing emails

Report in parallel: each channel acts at a different level.

Blackwall
Infrastructure

Forwards the phishing URL to the hosting provider and registrar to get the page taken down. You receive status updates until it's confirmed.

Report to Blackwall

National cybersecurity agencies (e.g., BSI in Germany)

Forward the .eml file to your national cybersecurity agency's reporting address: it feeds into national warnings.

bsi.bund.de

Consumer protection phishing radars

Many consumer protection agencies run a phishing radar you can forward emails to. Submissions are reviewed and turned into public warnings for consumers.

verbraucherzentrale.nrw

APWG (international)

Anti-Phishing Working Group. Forward the raw .eml file to reportphishing@apwg.org. Feeds global browser block lists.

apwg.org/reportphishing

Frequently asked questions

Ready to report the phishing email?

Submit the included URL in under two minutes. The Blackwall team handles the correspondence with the hosting provider for you.

Report now Found a fake shop? →