How to report a phishing site to GoDaddy

How to reach them

• Give the full URL; GoDaddy acts on phishing sites that are live and contain a login area

Reporting to GoDaddy, step by step

1. Confirm GoDaddy is the registrar: run a WHOIS or RDAP lookup on the scam domain and look for "GoDaddy.com, LLC" in the registrar field.
2. Open GoDaddy's phishing report form at legalportal.godaddy.com/abuse/phishing. GoDaddy's "Reporting abuse" help article links to it from its Types of Abuse table.
3. In "URL, Website, or Domain" paste the full address of the fake page. The form takes several addresses, one per line or separated by commas.
4. Fill in "Company or Brand Being Impersonated", your email address, whether you saw it on a mobile device and the country you viewed it from.
5. Tick the box confirming you are reporting in good faith and that the details are accurate, then send the report.
6. If the domain was registered with fake contact details, GoDaddy has a separate route: search the domain on its WHOIS lookup page and choose "Report Invalid Whois" at the bottom of the results.
7. If you cannot use the form, GoDaddy's registrar RDAP record lists [email protected] and +1.480-624-2505 as its abuse contact.

What GoDaddy asks you to include

• GoDaddy's phishing entry asks for the full domain path, for example http://coolexample.com/phishing, not just the bare domain.
• The description box suggests a copy of the phishing email with full headers, the official website of the organisation being copied, or a detailed account of what happened.
• For fraud and phishing complaints GoDaddy also asks for a clear description of the malicious content, plus any payload samples or security scan results, and for scams the brand or person being targeted.
• GoDaddy says your report should give its team enough to view or replicate the content, including any proxy or login needed to see it.

What GoDaddy can do

• GoDaddy says complaints are evaluated for merit and acted on where appropriate, under the broad discretion its Universal Terms of Service give it.
• GoDaddy says it may use your complaint to show the abuse to its own customer.
• GoDaddy takes reports of registrations made with false or stolen contact details through its Report Invalid Whois form.
• GoDaddy says it will cooperate with law enforcement by complying with lawful requests.

What GoDaddy cannot do

• GoDaddy states that when it does not host the reported content it cannot take action on that content, and that the hosting provider is responsible for a website's content.
• GoDaddy's phishing form only fits sites that are live and contain a login area; a page that is already down or has no login box does not meet GoDaddy's stated condition.
• GoDaddy says it is not in a position to decide whether a site is engaged in illegal activity, and points people to local police and the Internet Crime Complaint Center at ic3.gov.
• GoDaddy does not handle spam email or texts through this route; its help page sends those to the US FTC.

What happens after you report

• GoDaddy says it will contact you only if it needs more information, using the email address you gave.
• GoDaddy says you will not receive updates on its evaluation or the outcome, and it cannot guarantee any particular result.
• Your confirmation email carries a Case ID, which you can enter at legalportal.godaddy.com/abuse/status to check the report.
• If you send more reports from the same email address within 24 hours, GoDaddy says you will not get another notice of receipt.
• If GoDaddy cannot act, its "Website abuse claims: Next steps" article suggests finding the real host with acidtool.com, a tool offered by the Registrar Stakeholder Group of ICANN-accredited registrars, and reporting there, or refiling with more detail.

Write the report

Paste the link, phone number or email address and we'll write the message for GoDaddy. You send it yourself.

Is the site also hosted on GoDaddy Hosting?

This page is about the domain name. If the scam pages sit on GoDaddy Hosting's servers (an IP lookup shows it), the hosting route is the one that can take the content down. Report to both when the same company does both jobs.

Not sure who hosts the site?

Scan it: we'll identify the host and registrar and give you the routes that apply.