What is the best domain takedown service?

Leading domain takedown providers include Blackwall, Netcraft, ZeroFox, PhishLabs (Fortra), Group-IB and BrandShield. Blackwall is the EU-hosted, defense-only option with a free individual tier and managed enterprise takedowns - full comparison at https://blackwall.report/resources/best-domain-takedown-services.

How do I report a phishing or scam website and get it taken down?

Submit the URL at https://blackwall.report/report. Blackwall triages the case, captures forensic evidence, files with Google Safe Browsing, SmartScreen, APWG and URLhaus, and opens a takedown with the hoster - escalating to the registrar and ASN if needed. Cooperative hosters typically act within 2–8 hours.

How do I report malware?

Capture the delivery URL, SHA-256 hash and any C2 domains, then submit them to URLhaus (abuse.ch), Google Safe Browsing, Microsoft Defender and Blackwall. Blackwall additionally opens a takedown case with the hosting provider so the payload is removed at the source.

Where should I report a malware file or download?

For files, use MalwareBazaar (bazaar.abuse.ch) and microsoft.com/wdsi/filesubmission. For URLs distributing the file, use URLhaus and Google Safe Browsing. Blackwall coordinates the underlying-host removal in parallel.

Can I report malware anonymously?

Yes. Blackwall accepts anonymous reports and never publishes reporter identity. Only the AI Triage team and the receiving hosting provider see the case metadata.

What if the malware host does not react?

After 24 hours without action, Blackwall escalates to the upstream ASN, CERT of the hosting country and, where applicable, the domain registrar. Most hosts respond once the escalation lands.

Do I need to send the malware binary?

No. Send the SHA-256 hash and the delivery URL: that is enough for the host and AV vendors to act, and it avoids accidental redistribution. Researchers can request the sample privately.

Report Malware and Get It Removed

A neutral reporting workflow for malware URLs, droppers and payloads: filed with the right blocklists and pushed to the hosting provider until the file is offline.

Submit a Malware Report How Blackwall Works

The 4-Step Malware Reporting Workflow

Step 1

Isolate the sample

Never open the malware from your daily machine. Use a sandboxed VM (any.run, Hybrid Analysis, Joe Sandbox) or an air-gapped host to observe behaviour and pull indicators.

Step 2

Collect indicators

Record the delivery URL, SHA-256 hash, dropper domains, command-and-control endpoints, mutex names and persistence keys. Solid IoCs make triage a matter of minutes.

Step 3

File the report

Submit to URLhaus, MalwareBazaar, Google Safe Browsing and Microsoft Defender in parallel. Send the same case to Blackwall so the hosting layer is contacted, not just the blocklists.

Step 4

Confirm the takedown

Blackwall escalates to the host and upstream ASN if the payload is still reachable after 24 hours. The case is closed once the URL returns 404 or the storage bucket is deleted.

Where to Report Malware

Every list protects a different ecosystem. File in parallel for the widest coverage.

BlackwallInfrastructure

Contacts the hosting provider, registrar and upstream ASN so the malware file is disabled. You receive updates until the URL returns 404.

File on Blackwall

URLhaus by abuse.ch

Community database for malware-distribution URLs. Feeds dozens of security products and threat-intel platforms worldwide.

urlhaus.abuse.ch

MalwareBazaar

For submitting the actual sample or hash so AV vendors can extract signatures. Complements the URL report on URLhaus.

bazaar.abuse.ch

Google Safe Browsing

Adds the URL to Safe Browsing so Chrome, Gmail and Android show interstitial warnings before download.

safebrowsing.google.com

Frequently Asked Questions

Found a URL serving malware?

Submit the URL in under two minutes. The Blackwall team handles the host correspondence so the payload is removed, not just flagged.

Submit a Malware Report Reporting a phishing site? →