Find a URL warning review or reporting route
Choose a reporting route by the action you need: review a browser warning, flag a message or report abuse involving a domain or host. These routes have different responsibilities, and one organization’s response does not settle every other warning. This directory links twenty official entrypoints without submitting anything or declaring a URL safe.
Match the route to the issue
For a site owner facing a browser warning, begin with the named warning system and the affected scope. A website warning, download warning and certificate error are not interchangeable. Google’s Security Issues workflow asks for an explanation of the issue, the correction and its outcome. Microsoft documents a separate SmartScreen feedback route for site owners.12 Keep the warning wording and time with the request record rather than assuming the same appeal serves both systems.
Mozilla’s guidance directs phishing-list removal requests to a Google form.3 The directory includes both entrypoints because people encounter both browser contexts, but it does not count them as independent review authorities. A missing warning in one context also does not establish that every provider changed its classification.
For an unwanted message, the relevant mailbox action may be the better fit. Gmail distinguishes reporting phishing from correcting a phishing label.4 For abusive infrastructure, the registrar, origin host and intermediary can be different organizations. AWS accepts reports from people who are not customers, while Cloudflare’s handling depends on the service involved.56 The provider’s actual role matters more than a logo seen beside a lookup result.
Use the source-linked directory
Each organization links to official guidance or a read-only intake entrypoint. The table is a route finder, not a recommendation to contact every organization. Its evidence column describes information requested by providers; use what you already have rather than opening a suspicious destination to collect more.
| Organization | Route category | Purpose | Information to retain | Boundary |
|---|---|---|---|---|
| Google Search Console | Browser review | Owner requests review of security issues after correction. | Issue, correction and outcome explanation. | Does not establish a verdict from every browser or remove unrelated content. |
| Microsoft Defender SmartScreen | Browser review | Owner challenges an incorrect SmartScreen site warning. | Reported site and explanation through the documented warning-feedback route. | A file submission portal is not substituted for a URL review. |
| Mozilla Firefox | Browser review | Owner requests removal of an erroneous phishing-list entry. | Site and explanation requested by the linked provider form; fields not audited. | Not a separate independent blocklist or a universal warning appeal. |
| Gmail | Email provider | Recipient reports phishing or corrects a mistaken phishing label. | Existing message; choose the applicable reporting action. | Does not review a website for every browser or block every future sender. |
| Outlook | Email provider | Recipient reports a phishing message. | Selected suspicious message. | Reporting does not itself block the sender; blocking is separate. |
| Yahoo Mail | Email provider | Recipient flags suspicious mail or Yahoo/AOL-origin abuse. | Selected message and the relevant report control. | Filter feedback is not a browser-warning appeal or guaranteed takedown. |
| Apple | Email provider | Report email impersonating Apple. | Suspicious Apple-impersonation email. | iCloud junk/abuse has separate handling; this is not a Safari URL appeal. |
| Namecheap | Registrar | Report phishing associated with a registered domain or hosted content. | Domain, full URL, impersonated target and existing relevant evidence. | Registrar and hosting responsibility differ; one address does not establish both roles. |
| GoDaddy | Registrar | Report phishing involving a GoDaddy-associated domain or service. | Contact email, impersonated brand, URL/domain and explanation; context fields also appear. | An intake/status interface does not promise action or browser-list removal. |
| Tucows Domains | Registrar | Report phishing/pharming involving the registrar family. | Relevant domain and evidence; downstream form requirements not inspected. | Family coverage includes Ascio, Enom, EPAG and OpenSRS; unrelated hosts remain separate. |
| Porkbun | Registrar | Report verifiable DNS abuse. | Definitive, verifiable evidence; retain report ID. | Not a general content, trademark or ownership-dispute arbiter. |
| Amazon Web Services | Host or platform | Report abuse involving AWS resources. | Specific URL and policy concern for content; technical incident reports require relevant logs and timestamps. | No guaranteed outcome or universal abuse-report API. |
| Cloudflare | Host or platform | Report phishing involving a Cloudflare service. | Domain and specific phishing URL; use appropriate complaint category. | A CDN/proxy role does not prove Cloudflare hosts the origin content. |
| GitHub | Host or platform | Report abusive repositories, profiles or eligible content. | Repository/user/content reference and explanation. | Not a general website-warning appeal or a vulnerability-disclosure substitute. |
| WordPress.com | Host or platform | Report abusive content hosted by Automattic services. | Relevant hosted site/content and complaint details. | Does not cover every website running independently hosted WordPress software. |
| DigitalOcean | Host or platform | Report suspected abuse involving DigitalOcean infrastructure. | Select abuse category; remaining required fields were not fully exposed. | Read-only intake discovery does not confirm account requirements, handling time or resolution. |
| Anti-Phishing Working Group | Anti-phishing | Contribute suspected phishing email to shared threat intelligence. | Full phishing email, preferably forwarded as an attachment. | A contribution is not a guaranteed personal response, refund or website takedown. |
| Netcraft | Anti-phishing | Report suspicious URLs or phishing messages for investigation. | URL and existing context; suspicious email can be forwarded. | Provider investigation is not a guaranteed takedown or removal from all browser lists. |
| PhishTank | Anti-phishing | Submit suspected phishing for community verification and sharing. | Suspected phishing URL and supporting message information. | Community classification does not control every warning system or guarantee removal. |
| UK National Cyber Security Centre | Anti-phishing | Report a suspicious scam website. | URL, how it was received and optional explanatory context. | Not an emergency service or a guarantee of removal; no suspicious link needs opening. |
Read requirements without promising an outcome
Some routes require an account or a particular relationship to the affected content. Others provide a public form or email address. WordPress.com documents a direct route without login, while PhishTank’s community reporting depends on registration.78 Neither statement establishes that a current registration attempt, report submission or subsequent response was tested for this edition.
Keep acknowledgement, investigation and resolution separate. Porkbun describes confirmation within twenty-four hours; that is not a promise that a complaint is resolved within that period.9 Google describes review as potentially taking days or weeks.1 Where the selected guidance does not state a time, the full record says so. A blank deadline must not become a countdown based on another provider’s policy.
Provider responsibility also limits the expected result. A host may address content without controlling a browser list. A registrar may control registration without hosting the page. A platform report applies to content within that platform’s scope: WordPress.com’s route does not cover every independently hosted installation of WordPress.7 Record the requested action explicitly so a reply about one layer is not mistaken for confirmation about all layers.
Keep the evidence record proportionate
Retain the original warning wording, affected address, date and any message or case ID already available. Distinguish your observations from the explanation you are asking a provider to assess. For an owner review, record corrections and their verification; for a message report, retain the original message context. This directory does not ask you to bypass a warning or visit the destination.
Reporting itself can disclose information. APWG describes retaining phishing emails in its shared eCrime eXchange, and Gmail notes that manually reported spam can include a copy and attachments for analysis.104 Check the recipient and route before forwarding unrelated personal material. The submission-policy comparison addresses the separate question of what an inspection service says about submitted URLs.
Reuse and check this edition
Use the directory viewer to filter by category or provider. Download the CSV or JSON for the complete requirements, published organizational addresses, unknowns and shared-authority grouping. The method and source ledger retain checked dates and access limits. Original compilation and summaries are CC BY 4.0; attribute the dated edition and identify changes. Provider pages keep their own rights.
Not covered on this page
- Submitting a report, proving ownership or testing response times.
- Incident diagnosis, warning bypasses or a guarantee of removal.
- Every registrar, host, email service or security vendor.
- A legal complaint, emergency route or determination that an address is safe.
Sources
-
Google: Security Issues report, opened 24 October 2026. ↩ ↩2
-
Microsoft: unexpected SmartScreen warnings, opened 24 October 2026. ↩
-
Mozilla: phishing and malware protection, opened 24 October 2026. ↩
-
Google: avoid and report phishing emails, opened 24 October 2026. ↩ ↩2
-
AWS: abuse reporting FAQs, opened 24 October 2026. ↩
-
Cloudflare: submit an abuse report, opened 24 October 2026. ↩
-
WordPress.com: report a site, opened 24 October 2026. ↩ ↩2
-
PhishTank: FAQ, opened 24 October 2026. ↩
-
Porkbun: report abuse, opened 24 October 2026. ↩
-
APWG: report phishing, opened 24 October 2026. ↩
How we test: methodology. Found a mistake? Corrections.