A close friend fell for a phishing scam earlier today. His account's all squared up now, but I decided to do a bit of investigation.
The website he fell for was a very poor imitation of a Remax site hosted on what appears to be a compromised domain. The email address that the captured passwords were being sent to is plainly obvious in the site's script. It's a GMail address, and given the recency of attacks I'd say it is still actively being used to harvest logins.
So, armed with that information, I would like to have the account taken down to prevent the (probable script kiddie) from inflicting any more damage. What's the best way to report a suspected phisher's email address?
I am aware that the email address may (a) belong to a legitimate user who is unaware that it is being used nefariously, or (b) be a very temporary account that is simply used to collect addresses. So I am not about to do anything stupid to the account itself, nor am I going to attempt to contact it. I am simply wondering if anyone has any advice, or if I should just forget about it (though I do wish to prevent this unfortunate thing from happening to others).