How to Report Phishing Emails to Hosting Providers

Phishing emails can target website owners, customers, employees and hosting accounts. Some messages try to steal passwords or payment details, while others promote fake websites that collect information from visitors.

Reporting phishing emails helps hosting providers identify abusive accounts, investigate fraudulent websites and protect other users. It can also help email providers and authorities recognize larger phishing campaigns.

Before reporting a phishing message, preserve the important evidence, avoid interacting with the attacker and use the official reporting channel provided by the hosting company.

A website owner preparing evidence to report a phishing email.

What Is a Phishing Email?

A phishing email is a fraudulent message that pretends to come from a trusted company, person or service.

The sender may try to make you:

• Click a harmful link.
• Open a dangerous attachment.
• Enter a password on a fake website.
• Share a verification code.
• Send money or payment information.
• Download harmful software.
• Approve a domain or account change.

Phishing messages may imitate hosting companies, domain registrars, banks, online stores, business partners or technical support teams.

Because phishing often uses fake websites or malicious attachments, it is important to report both the email and the related website when possible.

A phishing email pretending to come from a trusted hosting company.

Why Should You Report Phishing Emails?

Reporting a phishing email can help reduce the number of people who are targeted by the same campaign.

A hosting provider may use a report to:

• Investigate the website or account involved.
• Disable malicious content.
• Review suspicious activity.
• Identify related domains or accounts.
• Protect other customers.
• Share information with relevant security organizations.

CISA states that reporting suspicious phishing activity can help email providers identify new or developing phishing campaigns. [CISA Phishing Guidance](https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf)

Even if you did not lose money or enter your information, reporting the message can still be useful.

A security team reviewing multiple phishing reports to identify a larger campaign.

Step 1: Do Not Click the Phishing Link

Do not click links, open attachments or reply to the message while investigating it.

A phishing link may lead to a fake login page, malware download or website designed to collect payment information.

If you need to inspect the destination, avoid opening it directly. You can copy the visible link address without visiting it, or include the suspicious address in the reporting form if the provider requests it.

Never test a suspicious website using your hosting account password or personal information.

A user avoiding a suspicious link while preparing a phishing report.

Step 2: Preserve the Original Email

Keep the original message until the report has been submitted. Do not edit the email before saving the information needed for investigation.

Useful details may include:

• The sender’s complete email address.
• The recipient’s address.
• The date and time received.
• The subject line.
• The message body.
• The suspicious links.
• The names of attachments.
• The hosting or domain name shown in the message.

Some email services allow you to download the original message or view its full headers. Full headers can provide technical information about the route the message took and may help investigators trace its source.

A website owner saving the original email and message details as evidence.

Step 3: Collect the Full Email Headers

Email headers contain technical information that is not always visible in the normal email view.

Depending on your email provider, full headers may include:

• Sender and recipient information.
• Mail server details.
• Message identification values.
• Authentication results.
• Delivery timestamps.
• Routing information.

Look for options such as “Show original,” “View source,” “View message details” or “Download original message.”

Do not change the header information before submitting it. If you are unsure how to find the headers, you can usually report the message using your email provider’s phishing-reporting button and include the original message when the service allows it.

An email application displaying technical message headers for investigation.

Step 4: Identify the Hosting Provider

The hosting provider is the company responsible for the server or account where the phishing website is hosted.

You may identify the provider by checking:

• The website’s hosting information.
• The domain’s DNS records.
• The name server information.
• The abuse contact listed by the registrar or network.
• Information shown in the phishing email.

Be careful when interpreting hosting information. The domain registrar, DNS provider, email provider and hosting provider may all be different companies.

If you are unsure, you can report the phishing website to the domain registrar, hosting company, email provider and relevant government reporting service.

A security researcher identifying the hosting provider connected to a phishing website.

Step 5: Find the Official Abuse Reporting Channel

Hosting providers usually have an abuse-reporting page, security-reporting page or abuse contact listed in their policies.

Search for the provider’s official website and look for terms such as:

• Report abuse.
• Report phishing.
• Abuse department.
• Security incident report.
• Malware report.
• Fraudulent website report.

Use the provider’s official website instead of a reporting link sent by the phishing email.

Some providers separate security vulnerabilities from abuse reports. A software vulnerability report may use a different form from a phishing, malware or spam report.

For example, Hostinger states that phishing websites, malware, spam and other abusive content hosted on its services should be reported through its abuse process rather than its security vulnerability reporting form. Hostinger security reporting guidance

A website owner using the official abuse-reporting page of a hosting provider.

Step 6: Include Clear Evidence in Your Report

A useful abuse report should be factual, specific and easy to investigate.

Include:

• The phishing website address.
• The date and time you discovered it.
• A short explanation of what the website is pretending to be.
• The company or service being impersonated.
• The type of information the website requests.
• A copy of the original phishing email.
• Relevant email headers.
• Screenshots, if they help explain the issue.

Do not include unnecessary personal information. Remove passwords, payment card numbers, security codes and private customer data before submitting screenshots or attachments.

A detailed phishing report containing a suspicious URL, screenshots and email evidence.

Example Phishing Report

You can use the following structure when reporting a phishing website:

Subject: Phishing website impersonating a hosting provider

Website address: Include the complete suspicious address.

Discovered: Include the date and time.

Description: This website appears to impersonate a hosting provider and asks visitors to enter account login and payment information. It was linked from a phishing email claiming that a hosting plan required immediate renewal.

Evidence: The original email, full message headers and screenshots are attached.

Keep the report professional. Avoid guessing who is responsible unless you have reliable evidence. Describe what you observed and allow the provider’s abuse team to investigate.

A properly organized report describing a suspected phishing website.

Step 7: Report the Email to Your Email Provider

Use the phishing-reporting option in your email service. Many email platforms provide buttons such as “Report phishing,” “Report spam” or “Report suspicious.”

Reporting the message to your email provider can help improve filtering and protect other users from similar messages.

Do not simply delete the message if it contains a suspicious website connected to a hosting account. Report it first when possible, then remove it from your inbox and trash folder.

A user reporting a suspicious message through an email provider’s phishing-reporting tool.

Step 8: Report Fraud to the Appropriate Authority

If the phishing message attempted to steal money, personal information or account credentials, report it to the appropriate government authority in your country.

In the United States, consumers and businesses can report scams and fraud through the Federal Trade Commission’s official reporting service at ReportFraud.ftc.gov. [FTC Report Fraud](https://reportfraud.ftc.gov/)

CISA also provides resources for reporting cyber incidents and preserving information that may help with investigation.

If money was stolen or a financial account was affected, contact your bank or payment provider using an official phone number or website.

A business owner submitting a phishing and fraud report to an official reporting service.

Step 9: Report the Phishing Domain

If the phishing website uses a registered domain name, report it to the domain registrar as well as the hosting provider.

The registrar may be able to investigate registration abuse, domain misuse or false contact information.

Include the same evidence:

• The domain name.
• The complete phishing page address.
• The impersonated company.
• The content requested from visitors.
• The original phishing message.
• The discovery date and time.

Reporting to both the registrar and hosting provider can help the appropriate parties review different parts of the infrastructure.

A domain registrar reviewing a report about a fraudulent website.

Step 10: Protect Your Own Accounts

If you interacted with the phishing email, secure your accounts immediately.

If you entered a password:

• Change the password through the official website.
• Change the same password anywhere else it was used.
• Enable multi-factor authentication.
• Review active sessions and connected devices.
• Check for unknown administrator accounts.
• Review domain, DNS, email and hosting settings.

If you entered payment information, contact your bank or card provider. If you downloaded a file, scan your device and consider asking a qualified security professional to inspect it.

Quick action can reduce the risk of account takeover and unauthorized website changes.

A website owner securing hosting, domain and email accounts after reporting phishing.

What Not to Include in a Phishing Report

Do not send unnecessary sensitive information to an abuse-reporting address.

Avoid including:

• Account passwords.
• One-time authentication codes.
• Complete payment card numbers.
• Private customer records.
• Unrelated personal documents.
• Malware samples unless specifically requested.

Redact sensitive information from screenshots and attachments. Provide enough evidence to support the report without exposing additional private data.

A report with sensitive personal information safely removed before submission.

Conclusion

Reporting phishing emails to hosting providers helps reduce online abuse and protects other website owners and visitors.

Start by preserving the original email, avoiding suspicious links and collecting the full message details. Identify the hosting provider and use its official abuse-reporting channel.

Include the phishing website address, screenshots, message headers and a clear explanation of what the website is doing. Also report the message to your email provider and the appropriate government authority when fraud or identity theft is involved.

After submitting the report, secure any accounts that may have been exposed. Change passwords, enable multi-factor authentication and review hosting, domain, DNS and email settings.

A clear and complete report gives providers the information they need to investigate phishing activity more effectively.

Sources

• CISA Phishing Guidance
• Federal Trade Commission ReportFraud.gov
• Hostinger Security Reporting Guidance
• Hostinger Abuse Handling Policy
• CISA Reporting a Cyber Incident