Confirm the block
Verify that the exact hostname is present in a current Phishing Army feed.
Reports are reviewed by a human
Investigate first. Request review second.
A legitimate domain can still host malicious content. Before requesting removal, check your website carefully and make sure it no longer contains malicious material.
Checking only the homepage may not be enough. Malicious material can be hidden in an uploaded file, an unexpected path, a customer-controlled page or a vulnerable redirect on an otherwise legitimate domain.
Required review process
Complete these steps before emailing
Check and clean the website
Make sure your website does not contain malicious material. Contact your hosting provider, review any abuse notices you may have received, scan the site with appropriate security or antivirus tools, and remove any malicious content you find.
Return the right status
Removed resources should return a real 404 Not Found or, when appropriate, 410 Gone instead of a soft 404 with HTTP 200.
Remediation means finding the cause
Deleting one reported file may leave the attacker able to return. For a compromised CMS such as WordPress, review plugins, themes, administrator accounts, hosting and FTP/SFTP credentials, modified files, scheduled jobs, logs, webshells and backdoors. Identify and close the original entry point.
For an Open Redirect, fix the vulnerable endpoint and test the original URL again. Removing only the final phishing destination does not remediate the trusted domain being abused as a redirector.
A visible 404 must also be an HTTP 404
A page can display “404 Not Found” while its server still returns 200 OK. Automated systems may interpret that soft 404 as a resource that still exists. Check both normal retrieval and, when supported, the HEAD response:
curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/reported-path
curl -I https://example.com/reported-path