How to report to Google Safe Browsing: a step-by-step guide

Safe Browsing is a blocklist, not a takedown service. When Google confirms a URL is phishing, malware or unwanted software, it adds the URL to a list that Chrome, Firefox, Safari and Android check before loading a page. Users see a full-screen warning and most abandon the visit.

Key limitation: the site stays online. Safe Browsing blocks browsers from reaching it, but the server, domain and hosting account remain active. A user on an unprotected browser, a mobile app WebView or a direct API call can still reach the site. For complete removal, you need a hosting-provider or registrar takedown.

Report when you encounter:

• Phishing pages that imitate a brand to steal credentials or payment data.
• Malware distribution sites that trigger unwanted downloads or exploit kits.
• Unwanted software that changes browser settings, injects ads or collects data without clear consent.
• Social engineering pages that use deceptive tactics (fake system warnings, prize scams) to manipulate users.

Do not report for copyright infringement, defamation or non-criminal abuse: Google ignores these categories in Safe Browsing.

1. Navigate to the Google Safe Browsing phishing report form.
2. Enter the exact URL of the phishing page, including any query parameters. Avoid shortened links: expand them first.
3. Add a comment if the page is part of a larger campaign or targets a specific brand. This context helps Google's analysts prioritise the case.
4. Complete the CAPTCHA and submit.
5. Save the confirmation reference number. Google does not send email updates, but the blocklist status is visible within Chrome's internal security check.

1. Use the Google Safe Browsing malware report form.
2. Enter the URL that initiates the download or hosts the exploit kit.
3. Describe the behaviour: "Auto-downloads a .zip that Windows Defender flags as Trojan:Win32", or "Redirects through three domains before serving a fake Flash update."
4. If you have a malware sample hash (SHA-256), include it. Google correlates URL reports with VirusTotal intelligence.

Google's automated systems evaluate most reports within a few hours. Human review adds 24-72 hours for edge cases. You can verify the result:

• Chrome: Visit the URL in an incognito window. A red warning page means the blocklist entry is live.
• Google Search Console: If you own the site (for false-positive appeals), the Security Issues report shows the status.
• VirusTotal: Search the URL: Safe Browsing status is displayed in the community score.

If the site is still accessible after 72 hours, it may have evaded detection via cloaking (showing different content to Googlebot than to real users). In that case, escalate to Blackwall for a forensic capture and direct hosting-provider abuse report.

Safe Browsing is a speed bump, not a wall. Escalate when:

• The campaign uses dozens of rotating subdomains or URL paths, outrunning the blocklist.
• The site is promoted through ads, email or SMS and reaches non-technical users who may ignore browser warnings.
• The site hosts active malware that infects visitors automatically: a browser warning is too late for drive-by downloads.
• You need the domain suspended or the registrant exposed for legal action.

Blackwall combines Safe Browsing submission with direct abuse reports to the host, registrar and upstream ASN, plus blocklist coverage for Microsoft SmartScreen, PhishTank and SURBL. The result is removal, not just a warning.