How to report a fake website

Fake sites change and disappear, then reappear elsewhere. Before you report anything, record what is there now, because an abuse desk will want to see it and the site may look different by the time they check.

• Write down the exact address, including the full domain and any path, and the date and time you saw it.
• Take full-page screenshots of the home page and of anything that shows intent: a checkout, a login form, a donation page, a contact form.
• Archive it independently. Paste the address into the Wayback Machine's “Save Page Now” at web.archive.org/save. An archive link is evidence nobody can accuse you of editing.
• Note what was copied: your logo, text, photos, team pictures, product descriptions. If images are loaded straight from your own server, that is strong proof the content came from you.

Do not enter real card details, passwords or personal information to “see what happens”. A screenshot of the form is enough.

There are two kinds of company that can remove a website, and several more that can make it much less dangerous while you wait.

1. The registrar sold the domain name. It can suspend the domain, which takes the site offline wherever it is hosted. For fraud and impersonation this is usually the most effective report.
2. The hosting provider runs the server the site lives on. It can switch the site off. This is also where a copyright (DMCA) notice goes.
3. Cloudflare, if the site sits behind it. Cloudflare is not the host, but it forwards abuse reports to the real host and can act on phishing itself.
4. Browser blocklists: Google Safe Browsing (Chrome, Firefox, Safari and others use it) and Microsoft SmartScreen (Edge and Windows). Once listed, visitors see a full-screen warning instead of the site.
5. Anti-phishing feeds: Netcraft and the APWG share reports with browsers, security vendors and hosts.
6. Search engines, if the copy appears in results.
7. The police: in the UK, Action Fraud, which gives you a crime reference number.

Look the domain up on ICANN's lookup tool at lookup.icann.org. It uses RDAP, the modern replacement for WHOIS, and shows the registrar, the registration date and, usually, the registrar's abuse email address. The owner's details will almost certainly be redacted. That does not matter: you report to the registrar, not the owner.

Finding the host takes one more step: resolve the domain to its IP address, then look up who that address belongs to. Our guide to finding who hosts a website covers this in detail, including what to do when the answer is “Cloudflare”.

A registration date of days or weeks ago, on a domain that imitates an established business, is worth pointing out in your report. It is a strong sign of fraud.

Abuse desks handle large volumes. A report that is quick to verify gets dealt with first; a vague one gets a template reply. Keep it factual and give them everything in one message:

• The full address of the fake site and the address of your real one.
• What the site does: impersonates your business, takes payments, collects logins, copies your content.
• Why it harms people: customers lose money or credentials, and believe they dealt with you.
• Your evidence: archive link, screenshot (attached or available on request), the copied elements.
• Your rights: registered trade marks if you have them, and that the copied text and images are your copyright.
• A clear request: suspend the domain (registrar) or disable the site (host).
• Your name, role, organisation and contact details, and a reference number they can quote.

For the host, include a DMCA notice as well as the abuse report. It has specific required elements; see our DMCA takedown notice template.

Removal can take time. Browser warnings often arrive faster, and they protect the people most likely to be harmed.

• Google Safe Browsing: report it as phishing at safebrowsing.google.com/safebrowsing/report_phish. Explain briefly that it impersonates your site.
• Microsoft SmartScreen: use Microsoft's report an unsafe site form.
• Netcraft: email the address to [email protected] or use report.netcraft.com.
• APWG: email [email protected] with the address and a short description.

If people have lost money, or the site is clearly built to defraud, report it to the police. In the UK that is Action Fraud. The crime reference you get is useful when your customers talk to their banks, and some registrars take reports that quote one more seriously.

If the copy shows up when people search for you, search for site:the-fake-domain.com on Google and Bing. If it is indexed, file a removal request through Google's legal removal tools and Bing's content removal form. If nothing comes up, skip this step.

First reports are often ignored or answered with an automated reply. Check the site every day. If it is still live after a couple of days and you have had no meaningful response, reply to your original report (so the history stays together), restate the case reference and ask for an update. Be polite and specific; escalate to the next party on the list rather than repeating the same message louder.

Keep a simple log: who you reported to, when, what they said. If the same people come back on a new domain, you will reuse almost all of it.

Everything above is what a Takedown Pack does for you. The free check identifies the registrar, the host or Cloudflare, and the abuse contacts in about 20 seconds. The pack captures the evidence, drafts every report with the facts filled in, sends the email reports from us with your reply-to once you approve them, and rechecks and chases for 30 days. You can see exactly what that looks like in the sample pack.