How to report a phishing site to APWG

How to reach them

• Forward the whole suspected phishing email
• By submitting, you allow APWG to keep the email in full

Reporting to APWG, step by step

1. APWG says the best way to report is to forward the suspected phishing email to [email protected].
2. APWG asks you to use "Forward As Attachment" if your email client has it, because this gives its systems more detail.
3. If your email provider blocks forwarding, use the web form. Select the type of report (phishing or malicious content), paste the URL, and for phishing enter the name of the brand being copied in the Brand field.
4. Enter the date and time the message was received. An email address is optional and only needed if you want a receipt.

What APWG asks you to include

• The whole suspected phishing email, ideally forwarded as an attachment.
• On the form: the URL the sender wants you to visit (often the link behind a Login, Verify Account or View Document button), or the URL that hosts or downloads malicious content.
• The brand being impersonated, if you can tell.
• The date and time shown on the original message.
• Optionally, the message contents pasted in.

What happens after you report

• APWG says forwarded emails are analysed and archived on the APWG eCrime eXchange.
• APWG says reports feed fraud and crime prevention services and help track criminal activity.
• APWG says data is handled under contract with its vetted member community, so member institutions can trace and monitor the phishing sites.
• By submitting, you give APWG permission to save the email in full.

Write the report

Paste the link, phone number or email address and we'll write the message for APWG. You send it yourself.

Not sure who hosts the site?

Scan it: we'll identify the host and registrar and give you the routes that apply.