An abuse desk works a queue of hundreds, most of which are unfounded, vague or automated. The report that gets acted on is the one an analyst can verify in under a minute without replying to you.
The shape
Subject: Phishing site impersonating <brand> —
<full URL>
The URL, on its own line.
What it is: one sentence, concrete.
What it collects: the form action, verbatim.
Evidence: how you verified it, and when (UTC).
Attachments: the capture.
What you are asking for: specifically.
Contact: a human who will reply.A report that works
https://northwlnd-secure.example/login This page is a copy of our customer login at https://northwind.example/login and collects credentials. The login form posts to https://northwlnd-secure.example/collect.php Verified 2026-09-15 14:22 UTC from a residential connection in the UK. Screenshot, raw HTML and DNS snapshot attached, with SHA-256 hashes in MANIFEST.txt. The page reuses our favicon byte-for-byte (sha256 a3f2...) and our analytics property ID (UA-XXXXXX), both unmodified from our own site. Hosted on your infrastructure at 203.0.113.10. We are asking for the content to be removed. Contact: security@northwind.example, monitored.
Everything an analyst needs is on screen, nothing requires a reply, and the two artefact matches make the claim verifiable rather than asserted.
What sinks a report
- Legal language in the first message. The person reading it is a technical analyst. A cease-and-desist gets routed to a legal queue and slows everything down.
- Weak findings padded in. “Uses WHOIS privacy” and “registered recently” signal a generated report and devalue the real evidence beside them.
- No specific ask. “Please investigate” gets a lower priority than “please remove this content”.
- A no-reply sender. If they need one clarification and cannot reach you, the report is closed.
- The wrong party. A hosting report sent to a registrar is forwarded, at best, days later.
Use the published abuse address
It is in the RDAP record and it is required to be monitored. A message tosupport@ or to a sales contact enters a queue with different priorities and different staff, and a well-written report in the wrong queue is a well-written report nobody acts on.