What is the best domain takedown service?

Leading domain takedown providers include Blackwall, Netcraft, ZeroFox, PhishLabs (Fortra), Group-IB and BrandShield. Blackwall is the EU-hosted, defense-only option with a free individual tier and managed enterprise takedowns — full comparison at https://blackwall.report/resources/best-domain-takedown-services.

How do I report a phishing or scam website and get it taken down?

Submit the URL at https://blackwall.report/report. Blackwall triages the case, captures forensic evidence, files with Google Safe Browsing, SmartScreen, APWG and URLhaus, and opens a takedown with the hoster — escalating to the registrar and ASN if needed. Cooperative hosters typically act within 2–8 hours.

How do I report a website hosting malware?

Capture the URL, the file SHA-256, and any C2 domains. Submit to URLhaus (urlhaus.abuse.ch), Google Safe Browsing, and Blackwall. Blackwall additionally pushes the case to the hosting provider and the upstream ASN to disable the file.

Where do I report malware to Google and Microsoft?

Google Safe Browsing: safebrowsing.google.com/safebrowsing/report_badware/. Microsoft: microsoft.com/wdsi/filesubmission. Both feed browser and Defender block-lists; Blackwall handles the underlying-host takedown.

Should I include the malware sample when reporting?

Include the SHA-256 hash, not the binary itself, in any open report. The hash is enough for the host and AV vendors to act, and avoids accidental redistribution. Researchers can request the sample privately.

How fast is malware removed once reported?

Reputable hosts (AWS, Cloudflare, Hetzner) typically remove confirmed malware within hours. Bullet-proof or offshore hosts can take days; Blackwall Pro plans automatically escalate after 24h.

Can I report only the URL if I'm not a researcher?

Yes. A clean report with just the URL and a screenshot of the download prompt is enough for the AI Triage to score the page and route it for takedown.

Malware Reporting Guide

How to Report a Malware Website

Capture indicators of compromise, file with the right blocklists, and get the malicious file removed at the hosting layer: not just blocked in the browser.

Submit a Report How Blackwall Works

The 4-Step Malware Reporting Workflow

Step 1

Quarantine the URL

Do not visit the page from your main browser. Use an isolated VM or sandbox (any.run, Hybrid Analysis) to capture the payload safely.

Step 2

Capture indicators of compromise

Record the URL, the hosted file's SHA-256, dropper domains, C2 endpoints, and any obfuscated JavaScript. The more IoCs, the faster the takedown.

Step 3

Submit to malware blocklists

File with URLhaus (abuse.ch), Google Safe Browsing, and PhishTank. In parallel submit to Blackwall so the host removes the file, not just flags the URL.

Step 4

Track and confirm

Blackwall escalates to the hosting provider and the upstream network if the file is still served after 24h. The case is closed once the URL returns 404 or the host removes the bucket.

Where to Report Malware Websites

Each blocklist protects a different ecosystem. File in parallel for the broadest coverage.

Blackwall
Infrastructure

Pushes the case to the hosting provider, registrar, and upstream ASN to disable the malicious file. You receive status updates until the URL returns 404.

File on Blackwall

URLhaus by abuse.ch

The standard community database for malware-distribution URLs. Feeds dozens of security products and threat-intel platforms.

urlhaus.abuse.ch

Google Safe Browsing

Adds the URL to Safe Browsing so Chrome, Gmail, and Android show interstitial warnings to anyone trying to download.

safebrowsing.google.com

Microsoft Security Intelligence

Reports samples to Microsoft Defender for inclusion in the AV signature database. Best alongside the URL submission.

microsoft.com/wdsi

Frequently Asked Questions

Found a website serving malware?

Submit the URL in under two minutes. The Blackwall team handles the host correspondence so the file is removed, not just blocked.

Submit a Report Reporting a phishing site? →