How to report a phishing site to Microsoft Azure

How to reach them

[email protected] is Microsoft's address for Outlook spam only; phishing sites hosted on Azure go through the MSRC form.

• Choose the incident type URL, Phishing Website

Reporting to Microsoft Azure, step by step

1. Open the MSRC "Submit Abuse Report (CERT)" form with the incident type set to "URL - Phishing Website". Microsoft says this form covers abuse from Microsoft Online Services such as Azure, Bing, OneDrive and Office 365. The form loaded without signing in.
2. Give your name, email, organisation and phone number, then the incident date, time and time zone.
3. Add up to 10 URLs that host the content (Source URL and Destination URL), all for the same incident type. You can add report notes and upload a file.
4. Tick "Anonymize report" if you do not want your contact details shared with the Azure customer.

What Microsoft Azure asks you to include

• Up to 10 URLs believed to host the malicious content, all of the same incident type.
• The incident date, time and time zone.
• Optional report notes (up to 2000 characters), additional information and a file upload.

What happens after you report

• Microsoft says it will investigate complaints of malicious or illegal activity, and may notify its customer and ask them to fix the issue.
• If you do not tick Anonymize report, Microsoft may share your whole report, including your name, organisation and email, with the customer or other relevant third parties.
• Microsoft says it may contact you by phone or email about the report.
• Where customers do not comply with its policies, Microsoft says it may take action, including suspending their service.
• Microsoft says it does not arbitrate disputes between parties that belong in other channels, such as legal action.

Write the report

Paste the link, phone number or email address and we'll write the message for Microsoft Azure. You send it yourself.

Other ways to report to Microsoft

• Microsoft SmartScreen: Blocklist: warns Edge users away from the site.

Not sure who hosts the site?

Scan it: we'll identify the host and registrar and give you the routes that apply.