The right first contact depends on what you want to happen and how fast. Starting at the top of the chain because it sounds more decisive is the most common way to lose a week.
Deciding
Is the site actively harvesting credentials right now?
yes -> HOST first. Speed matters more than permanence.
Then the registrar, with the evidence you captured.
Is the domain prepared but not yet serving (MX, certificate,
no content)?
-> REGISTRAR first. There is no content for a host to
remove, and the durable fix is the only one available.
Is it behind a CDN with no origin visible?
-> The CDN, and simultaneously the registrar. Do not wait
on the CDN before starting the slower route.
Is the domain a lookalike whose content is benign but whose
MX is receiving mail as you?
-> REGISTRAR. No content to report; the abuse is the
domain itself.
Is it a compromised legitimate site?
-> The site owner, first and politely. They are a victim.
Then their host if they do not respond.Run routes in parallel
| Approach | Effect |
|---|---|
| Sequential — host, wait, registrar, wait, registry | Each wait is days. A campaign lasting two weeks is a campaign you did not shorten. |
| Parallel — host and registrar at the same time | The fast route runs while the durable one is considered. This is the default. |
| Everything at once, including the registry | Wastes goodwill with the party who was going to act, and registries decline early escalations. |
Two in parallel, the third held in reserve as an escalation. The reserve matters: having somewhere to go next is what makes a follow-up message credible.
A compromised legitimate site is a different conversation
When a phishing page is hosted on a real business’s own domain, that business is a victim who does not yet know it. Reporting them to their host as an abuser gets their site suspended and makes an enemy. Contact them directly, describe what you found and where, and give them a day before escalating.