How to report to Google Safe Browsing: a step-by-step guide

A listing puts a full-page warning in front of the site in browsers that use Safe Browsing, and Google may also flag the URL in Search. It does not delete anything: the server, the domain and the content stay exactly where they are. Visitors can click through the warning, and links opened in apps or browsers that do not check Safe Browsing are unaffected.

That is why we treat a listing as damage control while the host and registrar act, not as the end of a case. You can check whether a URL is currently listed with Google's Transparency Report site status tool.

A phishing domain reported to Fraudpol on 18 September 2026 at 09:54 UTC was picked up by our team 23 minutes later. The registrar of record was Dynadot, and the same day the case was filed with the browser blocklists and the registrar. Our monitoring recorded the domain as no longer resolving at 23:20 UTC — about 13 and a half hours after the report. No written reply from the provider was recorded, so we cannot say which report triggered the action; the offline state is what we observed.

For the other side of the process, see reporting abuse to a hosting provider and finding the abuse contact.

Safe Browsing is a blocklist, not a takedown service. When Google confirms a URL is phishing, malware or unwanted software, it adds the URL to a list that Chrome, Firefox, Safari and Android check before loading a page. Users see a full-screen warning and most abandon the visit.

Key limitation: the site stays online. Safe Browsing blocks browsers from reaching it, but the server, domain and hosting account remain active. A user on an unprotected browser, a mobile app WebView or a direct API call can still reach the site. For complete removal, you need a hosting-provider or registrar takedown.

Report when you encounter:

• Phishing pages that imitate a brand to steal credentials or payment data.
• Malware distribution sites that trigger unwanted downloads or exploit kits.
• Unwanted software that changes browser settings, injects ads or collects data without clear consent.
• Social engineering pages that use deceptive tactics (fake system warnings, prize scams) to manipulate users.

Do not report for copyright infringement, defamation or non-criminal abuse: Google ignores these categories in Safe Browsing.

1. Navigate to the Google Safe Browsing phishing report form.
2. Enter the exact URL of the phishing page, including any query parameters. Avoid shortened links: expand them first.
3. Add a comment if the page is part of a larger campaign or targets a specific brand. This context helps Google's analysts prioritise the case.
4. Complete the CAPTCHA and submit.
5. Save the confirmation reference number. Google does not send email updates, but the blocklist status is visible within Chrome's internal security check.

1. Use the Google Safe Browsing malware report form.
2. Enter the URL that initiates the download or hosts the exploit kit.
3. Describe the behaviour: "Auto-downloads a .zip that Windows Defender flags as Trojan:Win32", or "Redirects through three domains before serving a fake Flash update."
4. If you have a malware sample hash (SHA-256), include it. Google correlates URL reports with VirusTotal intelligence.

Google's automated systems evaluate most reports within a few hours. Human review adds 24-72 hours for edge cases. You can verify the result:

• Chrome: Visit the URL in an incognito window. A red warning page means the blocklist entry is live.
• Google Search Console: If you own the site (for false-positive appeals), the Security Issues report shows the status.
• VirusTotal: Search the URL: Safe Browsing status is displayed in the community score.

If the site is still accessible after 72 hours, it may have evaded detection via cloaking (showing different content to Googlebot than to real users). In that case, escalate to Fraudpol for a forensic capture and direct hosting-provider abuse report.

Safe Browsing is a speed bump, not a wall. Escalate when:

• The campaign uses dozens of rotating subdomains or URL paths, outrunning the blocklist.
• The site is promoted through ads, email or SMS and reaches non-technical users who may ignore browser warnings.
• The site hosts active malware that infects visitors automatically: a browser warning is too late for drive-by downloads.
• You need the domain suspended or the registrant exposed for legal action.

Fraudpol combines Safe Browsing submission with direct abuse reports to the host, registrar and upstream ASN, plus blocklist coverage for Microsoft SmartScreen, PhishTank and SURBL. The result is removal, not just a warning.