I was a victim of a phishing scheme.

I clicked on a link that was sent to me and got to a site that impersonates a bitcoin site. I entered my credentials and the owner of the site used them to steal bitcoin from my account.

I used whoIs to find out where the website was registered, but that doesn't give me the owner's details.

  • Can I get the website's owner details from the registrar?
  • If so, will I be able to make legal action against them?
  • Will reporting to https://www.us-cert.gov/ help? (are there other places?)
  • 2
    I don't think US-CERT is for investigating petty cybercrime. The FBI would probably be a more responsive agency to contact, I think they even have a whole division for it (ic3.gov/default.aspx). Internet crime is difficult to investigate and prosecute, so good luck! Jul 13, 2017 at 7:30
  • You could beg their host for billing info.
    – user115400
    Jul 13, 2017 at 8:07
  • You need to clarify what sort of phishing scam you just encounter. Because some phishing is run by syndicates that crack in a vulnerable server and host content there. The data might redirect to another Command and control server which is the real culprits. Please describe the details.
    – mootmoot
    Jul 13, 2017 at 9:52
  • @mootmoot i added some info
    – Dotan
    Jul 13, 2017 at 12:18
  • 1
    What makes you think that the owner of the website knew anything about the phishing scheme being hosted on it?
    – Simon B
    Jul 13, 2017 at 12:23

3 Answers 3


Unfortunately, you just encounter a typical phishing page that steal you money and run away.

In most of the scenario, the phishing page is hosted under:

  • Free web hosting
  • hacked website
  • Using dynamic DNS(quite rare)

So site owner might be the victims themselves. Even though you can report this to the authority, but most of the time it is impossible to act, i.e. the command and control center might be shut down within days.

Reported phishing URL show in phishtank show you the similar story, many of them already offline.

Nevertheless, you should also send this phishing URL to sites like phishtank, virustotal, or your antivirus vendors. Because sometimes phishers might recycle/reactivate their command and control center, adding these URL into securities vendor database may stop those URL (if you use those tool) permanently.


Using whois.com should give you the owners information. If you cant access them using whois.com, the owner may have hidden the information, an option provided when registering a domain.

  • 1
    This doesn't answer the question. It merely restates part of the question.
    – Chenmunka
    Jul 13, 2017 at 8:23

You personally cannot get the website's owner details from the registrar and, as pointed out earlier, such information often doesn't even exist because of the usual practice of operating phishing websites (free web hosting, hacked websites). The most you can do regarding the legal action is reporting it to the police and provide all the data you have (WHOIS info, screenshots, proxy logs/browsing history). But I wouldn't put much hope in getting any results from it either but it might improve the statistics of cybercrime.

It is certainly not something for US-CERT to investigate as they work on cyberthreats on a bigger scale, not individual attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .