How to report a phishing site to Google Cloud

How to reach them

Google Cloud owns the parent domain of these addresses, so it can remove a page on any of them directly:

• *.web.app
• *.firebaseapp.com

• Include the abusive IP addresses or URLs
• Send a separate report for each IP address

Reporting to Google Cloud, step by step

1. Open the form "Report suspected abuse on Google Cloud Platform". You can sign in to a Google account to prefill details, but you do not have to.
2. Enter your email address (required) and choose the Google Cloud Platform Service. If you do not know which one, choose "Not Sure". The choices are Not Sure, Google App Engine, Compute Engine, Cloud Storage, Big Query, Cloud SQL, Cloud Data Store, Cloud Memory Store and Cloud AI.
3. Fill in the abuse date and the abuse details (required), and optionally upload a log file.
4. Google asks for a separate report for each IP address.

What Google Cloud asks you to include

• The abusive IP addresses or URLs.
• Full HTTP request headers, if you have them.
• Optionally a log file, with sensitive information removed first.

What happens after you report

• Google says some account and system information is sent with the report.

Write the report

Paste the link, phone number or email address and we'll write the message for Google Cloud. You send it yourself.

Other ways to report to Google

• Google Safe Browsing: Blocklist: Chrome and other browsers that use Safe Browsing warn people away from listed sites.

Not sure who hosts the site?

Scan it: we'll identify the host and registrar and give you the routes that apply.