Phishing Takedown Service: Send Us the Scam Email, We Report It

1. Save the scam email as a file. The hidden headers inside it show the real sending server, which is what abuse desks need. A normal Forward strips them out.

2. Send it to us. Attach the file to a new email to takedown@cryptoinvestor.ca after you buy a case or start a monthly plan. Tell us the order email you used.

3. We investigate and report. We trace the sending servers, the domains and when they were registered, and where each link leads. Then we send evidence-backed reports to the companies that can act.

4. You get a case report. A short PDF lists what we found, who we reported it to, how they replied, and whether the scam was still online after 7 days.

Abuse desks need the original email file, with its hidden headers, not a screenshot or a plain forward. Here is how to save it as an .eml file in each mail app:

• Gmail (web): open the email, click the three dots ⋮ at the top right, choose Download message. Attach the downloaded .eml file to a new email to us.
• Outlook: select the email and choose More actions > Forward as attachment. In the desktop app you can also use File > Save As.
• Apple Mail (Mac): select the email and choose Message > Forward as Attachment, or drag the email to your desktop to save it as an .eml file.
• Phone only? Send us a screenshot plus the sender address and we will do what we can, but reports are much stronger with the original file.

Don't click any links or reply to the scammer. You don't need to.

Every case is different, but a typical phishing email touches four kinds of company, and each one has an abuse desk:

• The domain registrar that sold the scam domain can suspend it.
• The web host serving the fake login or payment page can take the page down.
• The cloud or email provider whose servers sent the email can shut the account.
• Anti-spam and anti-phishing centres, including Canada's Spam Reporting Centre and the Anti-Phishing Working Group, share the details so browsers and filters block the scam for everyone.

We know which desks act, which ones bounce attachments and which addresses no longer work, so each report is written the way that desk accepts it. We search our own records for the same sender or template, so repeat offenders get flagged as a pattern.

You can try this yourself. It is the same process we follow on every case:

1. Don't click anything in the email. Copy the link address by right-clicking or long-pressing it instead.
2. Find who hosts the site and who sold the domain. A WHOIS or ICANN Lookup search on the domain shows the registrar. The site's IP address shows the hosting company.
3. Find the real sender. The email's full headers show which server actually sent it, which is often a cloud or email provider with its own abuse desk.
4. Report to each abuse desk with the evidence: the link, the headers, and why it is fraudulent. Most registrars and hosts suspend phishing sites once they confirm the report.
5. Report it to the anti-phishing lists (Google Safe Browsing, the Anti-Phishing Working Group) so browsers start warning other people.
6. Follow up. Desks bounce reports, ask for more detail or never answer, and the site moves to a new address.

That usually takes an hour or more per email if you know what you are looking at. Or send it to us for C$49 and we do all of it, then send you the case report.

In Canada, these are the places to report a scam or phishing email, and you should use them whether or not you use our service:

• Canadian Anti-Fraud Centre: report online or call 1-888-495-8501, especially if you lost money or gave out personal information.
• Spam Reporting Centre: forward spam and phishing to the federal Spam Reporting Centre at fightspam.gc.ca, which enforces Canada's Anti-Spam Legislation.
• Scam texts: forward them to 7726 (SPAM) on your phone.
• Your bank: call the number on the back of your card right away if you entered banking details or sent money.
• The company being impersonated: most banks, Canada Post, the CRA and big retailers publish an address for forwarding phishing.

Those reports go into databases and investigations. They don't usually get the scam site removed. That's where we come in: we report to the registrar, host and email provider who can actually take it down. We serve customers across Canada and the United States.

• Not funds recovery. If you lost money, call your bank first, then your local police and the Canadian Anti-Fraud Centre (1-888-495-8501). Anyone promising to get your money back for a fee is very likely another scam.
• Not legal advice and not a law firm. We report scams to the companies whose services they abuse.
• No hacking back. We never attack, contact or threaten the scammer, and we never ask them for money on your behalf.
• No guaranteed takedown. Only the registrar, host or provider can remove a site or account.

Your email is used only for your case and deleted 90 days after the case closes. See our Privacy Policy.