Guide

How do I report a lookalike or phishing domain?

Author: Nathan Dunn, CISSP, founder of Rubus Labs

Last updated: October 18, 2026

Short answer: Send an abuse report to the domain's registrar and to the company hosting the site, using the abuse contacts you can find with a free public tool such as ICANN Lookup. If the site is phishing, also report the URL to Google Safe Browsing and Microsoft so it can be reviewed for browser warnings. Save the URL and screenshots with dates first, because these sites often change or disappear.

Step by step

Save records before you do anything else. Copy the full URL, take screenshots with dates and times visible, and note when you first saw the site and how you found it (an email, a text, an ad or a customer complaint). Keep any phishing email that pointed to it. Don't enter passwords or payment details, and don't download files from the site. If you can, open it from a device you don't use for work or banking.
Find the registrar with ICANN Lookup. Go to lookup.icann.org and enter the domain name (for example, yourbrand-login.example). In the results, look at the Registrar Information section. It lists the registrar's name and its abuse contact email and phone number. You only need the registrar's abuse contact; you don't need the domain owner's personal details.
Find the hosting provider. Look up the IP address the domain points to with a DNS lookup tool, such as nslookup yourbrand-login.example in a terminal or any free online DNS lookup. Then enter that IP address in ICANN Lookup. The result shows the network that owns the address, and it usually includes an abuse contact. If the address belongs to a content delivery network such as Cloudflare, use that company's abuse form. Cloudflare, for example, forwards phishing reports to the site's hosting provider.
Send an abuse report to each one. Use the registrar's and host's abuse form if they publish one, or email their abuse address. Keep each report short and factual, and use the checklist below. Send separate reports rather than one message to everyone, so each company sees exactly what it can act on.
Report phishing pages to browser blocklists. Submit the URL to Google Safe Browsing and to Microsoft's unsafe-site report. If someone received a phishing email, forward it to the Anti-Phishing Working Group at [email protected], as an attachment if your email app allows it.
Keep a simple log and follow up. Write down who you reported to, when, and any reference number in the confirmation. If the site is still up after you hear back, reply with fresh screenshots with dates.
Talk to counsel about trademark options. If the domain uses your brand name, a trademark attorney can tell you whether other routes, such as the UDRP, are worth considering.

What to include in an abuse report

The full URL of each harmful page, written in "defanged" form so nobody clicks it by accident (for example, hxxps://yourbrand-login[.]example/signin)
What the site pretends to be: your brand name and your real website address
The type of abuse: phishing, a fake store, malware, or a mix
Screenshots with dates and times (and the time zone)
How people reached the site, such as a phishing email (attached), a text message or an ad
The date you first saw it
Who you are and how you're connected to the brand (owner, employee or authorized representative), plus your contact details
A clear, polite request to review the domain or pages under their abuse policy

Plain facts work better than threats or legal language. Abuse teams handle many reports, and a complete, easy-to-check report is easier for them to act on.

FAQ

Should I report to the registrar or the hosting provider?

Report to both. The registrar controls the domain name itself, and the hosting provider controls the server where the pages live. Either one may be able to act under its own abuse policy, and they often respond at different speeds.

What if the lookalike domain doesn't show a website yet?

Registrar and host abuse policies focus on harmful activity such as phishing, malware and fraud. A lookalike name with no content may not fall under those policies yet. Save a dated screenshot and the lookup results now, check back regularly, and ask a trademark attorney whether options such as the UDRP make sense for your situation.

What if I don't hear back after I report?

Reply to the confirmation you received with any new screenshots and a short note. Registrars accredited by ICANN must confirm that they received an abuse report. If a registrar for a generic domain such as .com doesn't follow its abuse obligations, ICANN accepts complaints about that registrar on its website.

Does this work for country-code domains like .co or .uk?

Often, but the rules differ. ICANN's registrar contracts cover generic domains such as .com, .net and .shop. Country-code domains follow the policies of each country's registry, so if ICANN Lookup doesn't show what you need, check the registry for that country code for its own abuse or complaint process.

Watching for the next one

Thicket scans every day for new lookalike domains of your brand that may host fake stores or phishing pages, and prepares takedown notices for you to approve. See plans and pricing.

This is general information, not legal advice. Rubus Labs is not a law firm. No takedown is guaranteed.