APWG Report Submission: A Practical Guide to Phishing Takedowns

An APWG report submission involves sending malicious phishing URLs, email headers, and threat data to the Anti-Phishing Working Group to trigger global blocklists. By submitting these reports to [email protected] or via the eCrime Exchange (eCX) API, you ensure that major browsers like Chrome and Safari, along with top-tier security vendors, flag the threat within minutes. This community-driven defense is one of the most effective ways to protect your customers from brand impersonation and credential theft.

If you've ever dealt with a sudden spike in customer support tickets about "weird emails," you know the feeling of being behind the curve. You find the phishing link, but it's still live. Every minute it stays up, another handful of users might hand over their login details. This is where the Anti-Phishing Working Group (APWG) becomes your best friend. They aren't just a non-profit; they are the central nervous system of global phishing intelligence. When you submit a report to them, you aren't just shouting into the void—you're updating the blocklists that protect billions of people.

How to Perform a Manual APWG Report Submission

Most small businesses and solo SOC analysts start with manual reporting. It’s the easiest way to get a single malicious site flagged without writing a line of code. The APWG maintains a dedicated email address specifically for this purpose. However, simply forwarding an email isn't enough. You need to provide the raw data so their automated systems can parse the headers and find the source.

To submit a phishing email, you should forward the original message as an attachment to [email protected]. Why as an attachment? Because if you just "forward" the email, your mail client might strip out the RFC 5322 headers that contain the sender's true IP address and the routing history. These headers are the "fingerprints" the APWG needs to identify the infrastructure behind the attack.

If you've found a phishing URL through your own brand monitoring software, you can also report the URL directly. While the email address is the primary channel for the general public, members of the APWG often use the eCrime Exchange (eCX) for bulk submissions. For a one-off threat, the email method is surprisingly fast. I've seen sites get blocked by Google Safe Browsing in under 40 minutes after a well-formatted APWG submission.

Key Takeaway: Always forward phishing emails as attachments to preserve headers. This gives the APWG the metadata they need to track the attacker's origin and hosting provider.

Automating APWG Report Submissions via API

Manual reporting is fine for one or two threats a week. But if you’re running a SaaS brand, you might be dealing with dozens of lookalike domain detections every day. Manual work won't scale. This is where the APWG eCrime Exchange (eCX) comes in. The eCX is a data-sharing platform that uses a RESTful API to allow for high-volume, automated submissions.

To use the API, your organization needs to be a member of the APWG. Once you have your API key, you can integrate the submission process directly into your security orchestration, automation, and response (SOAR) playbooks. Most teams use a Python script to handle this. The API accepts data in STIX (Structured Threat Information eXpression) format, which is the industry standard for sharing cyber threat intelligence.

Here is a simplified example of how you might structure a Python function to submit a malicious URL to a generic reporting endpoint (similar to how you would interact with a threat exchange):

import requests
import json

def report_malicious_url(api_key, target_url, threat_type="phishing"):
    endpoint = "https://api.ecrimeexchange.org/v1/report"
    headers = {
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json"
    }
    payload = {
        "url": target_url,
        "threat_category": threat_type,
        "confidence": "high",
        "description": "Brand impersonation targeting SaaS login credentials."
    }
    
    response = requests.post(endpoint, headers=headers, data=json.dumps(payload))
    
    if response.status_code == 201:
        print(f"Successfully reported {target_url}")
    else:
        print(f"Failed to report. Status code: {response.status_code}")

# Example usage
# report_malicious_url("your_api_key_here", "http://secure-login-brand.com/update")

By automating this, you close the gap between detection and protection. As soon as your monitoring tools pick up a typosquatting domain, the script can fire off a report to the APWG, PhishTank, and Google Safe Browsing simultaneously. This "shotgun" approach to reporting ensures the widest possible coverage in the shortest amount of time.

Comparing APWG with Other Reporting Platforms

APWG isn't the only player in the game. When a new threat emerges, you should know where to send your data for the most impact. Different platforms serve different parts of the security ecosystem. For example, reporting to Google directly helps Chrome users, while reporting to Microsoft helps those using Outlook and Edge.

In my experience, an APWG report submission is the most "bang for your buck" because their member list includes almost every major security vendor. When you report to them, you are effectively reporting to dozens of companies at once. This includes antivirus makers, firewall vendors, and mail gateway providers. It’s a force multiplier for your brand protection efforts.

Integrating APWG into Your Takedown Playbook

Reporting a site is just step one. If you want that site gone—not just blocked, but deleted from the internet—you need a full phishing takedown service or a very disciplined manual process. A report to the APWG alerts the "watchers," but it doesn't always force the "owner" (the hosting provider) to pull the plug.

A standard takedown playbook should look something like this:

1. Detection: Your monitoring tools flag a suspicious domain via Certificate Transparency logs or DNS changes.
2. Verification: A human or sandbox confirms the site is indeed malicious and targets your brand.
3. Reporting: Execute an APWG report submission and notify Google/Microsoft. This protects users immediately by showing them a red warning screen.
4. Host Notification: Identify the hosting provider using a WHOIS lookup and send a formal abuse complaint. If the site is behind a CDN, you might need to use a Cloudflare abuse report to reach the origin host.
5. Registrar Takedown: If the host is unresponsive, contact the domain registrar to have the domain suspended for violating Terms of Service.

When you contact a host or registrar, mentioning that you have already filed an APWG report adds weight to your claim. It shows that the threat is recognized by the global security community and isn't just a private dispute. For more details on this process, check out our guide on how to takedown a phishing site.

Dealing with Complex Attacks: Homoglyphs and Typosquats

Not all phishing is as simple as a weird URL. We are seeing a massive rise in homoglyph attacks, where attackers use international characters (like the Cyrillic "а" instead of the Latin "a") to create domains that look identical to yours. These are particularly dangerous because they bypass the "visual check" most users perform.

When performing an APWG report submission for a homoglyph attack, it is vital to include the Punycode version of the domain. For example, if the domain looks like apple.com but uses a Cyrillic 'a', the Punycode would be xn--pple-43d.com. Security systems and blocklists rely on Punycode to differentiate these domains. If you only send the "pretty" version, the automated parsers might get confused or ignore the report as a false positive.

Similarly, for typosquatting, where an attacker registers gogle.com instead of google.com, you should provide context in your report. Tell the APWG which brand is being targeted. This helps their analysts prioritize the report. High-traffic brands often get prioritized because the potential "victim pool" is much larger.

Expert Tip: When reporting homoglyph domains, always include both the visual URL and the Punycode version in your report description. This ensures the blocklist entries are accurate and prevents any ambiguity.

Why Some Reports Fail (and How to Fix Them)

I've seen many SOC analysts get frustrated when their reports don't seem to result in a block. Usually, it's because of a few common mistakes. First is the "Live Site" requirement. Most blocklists, including those fueled by the APWG, will only ingest a URL if their crawlers can verify the site is currently live and malicious. If the attacker is using "cloaking" (showing a 404 to non-victims or security IPs), the APWG's automated tools might not see the phishing page.

To combat this, include a screenshot or the raw HTML source of the phishing page in your submission if possible. This provides "proof of life" for the threat. Another common issue is reporting URLs that are already "dead." There is no point in reporting a site that has already been taken down; it just clutters the database and slows down the processing of active threats.

Finally, avoid "over-reporting." If you report every single login page on the internet as a phish, your reputation as a reporter will drop. APWG and other exchanges use a "reporter reputation" score. If you consistently provide high-quality, verified data, your reports will be processed almost instantly. If you send too many false positives, your data might be moved to a manual review queue that takes days to process.

The Role of Data in Brand Protection

According to the APWG's Phishing Activity Trends Report, the number of phishing attacks has reached record highs in recent years, with over a million attacks detected per quarter. This volume is why community sharing is no longer optional—it's a requirement for modern brand safety.

By contributing to the APWG report submission pool, you are participating in a reciprocal ecosystem. You provide data about threats targeting your brand, and in return, you get access to data about threats targeting everyone else. This shared intelligence allows you to move from a reactive posture (waiting for an attack) to a proactive one (blocking known malicious infrastructure before it even hits your users).

For example, if the APWG identifies a new IP range being used by a specific phishing kit, you can proactively block that IP range in your corporate firewall. This is the essence of digital risk protection. You aren't just playing whack-a-mole with URLs; you are eroding the attacker's ability to operate.

Final Checklist for a High-Quality APWG Submission

Before you hit send on your next report, run through this quick checklist to ensure it’s effective:

• Is the URL live? (Verify it in a safe, isolated environment or sandbox).
• Are the headers included? (For email reports, ensure the full RFC 5322 headers are attached).
• Is the brand identified? (State clearly which company is being impersonated).
• Is Punycode provided? (Only necessary for homoglyph/IDN domains).
• Is there a Phishing Kit? (If you've found the underlying .zip file, mention it—this is "gold" for researchers).

If you follow these steps, your reports will have a much higher success rate, and you'll become a valued contributor to the global security community. Remember, phishing is a volume game. The faster we share data, the more expensive we make it for attackers to stay in business.

Frequently Asked Questions

What is the email address for APWG report submission?

The primary email address for reporting phishing to the APWG is [email protected]. Ensure you send the phishing message as an attachment to preserve the original email headers.

How long does it take for a reported site to be blocked?

While times vary, a report to the APWG can trigger blocks in major browsers like Chrome within 30 to 60 minutes. The speed depends on the quality of the report and the verification process of the receiving vendors.

Do I need to be a member of APWG to report phishing?

No, the public email address is open to everyone. However, joining the APWG as a member provides access to the eCrime Exchange (eCX) API for automated, high-volume reporting and data consumption.

What happens after I submit a report to APWG?

The data is ingested into the eCrime Exchange, where it is shared with security companies, internet service providers, and law enforcement. These entities use the data to update blocklists, take down sites, and track cybercrime trends.