Phish.Report vs OpenBait
Phish.Report is a takedown workbench for a security team: it finds phishing sites, works out who really hosts them, and guides the team through reporting them. OpenBait starts with the customer who saw the fake site first — a public report page under your brand, an answer in seconds, and the reports filed for you. They solve the same problem from opposite ends, and OpenBait uses Phish.Report's API as one of its channels.
Phish.Report
$500 per month, one plan
For the security team that runs takedowns itself. Rapid detection, a verified abuse-contact database, guided reporting, a shared case timeline, and Slack / TheHive / API integrations. As of September 20, 2026.
OpenBait
Free report page; takedowns from $299 a month
For the brand whose customers see the fake site first. A public report page, an answer for the reporter in seconds, reports filed under OpenBait's own identity, and a case that keeps the record. English, Japanese and Chinese.
Where they overlap, where they don't
We submit through Phish.Report's API ourselves, so this is not an attempt to talk anyone out of it. Everything in its column comes from phish.report's own public pages as read on September 20, 2026; "No" means "not offered on its public site".
Built for your security team, not for your customers
openbait.com/report/your-brand — the link that replaces phishing@ on a help page
A verdict in seconds, what to do if they already typed something, and updates until the site is gone
"Rapid detection", plus an open-source signature language for phishing kits
Certificate Transparency logs, newly registered domains and lookalike permutations
Its core strength: a verified abuse-contact database and step-by-step guidance
RDAP and hosting lookups per case; also submits through Phish.Report's API
Guides your team through sending them, and tracks what was sent
Sent as OpenBait on the brand's behalf; hosts and registrars only after the brand confirms
Through threat-intelligence partnerships
Google Web Risk / Safe Browsing and VirusTotal, once a site is confirmed as phishing
Every report sent and each provider's response
One case per site: who was told, when, and when it stopped answering
Slack, TheHive and an API
Outbound webhooks
An alert when your site is cloned
English
English, Japanese and Chinese
One plan, $500 a month; a proof-of-value period instead of a free tier
Free report page for one brand; takedowns from $299 a month
Phish.Report fits if...
- • You have a security team that wants to run takedowns itself
- • You need depth on each site: who really hosts it, how it hides from analysis, which kit it is
- • You want it wired into Slack, TheHive or a SOAR
- • $500 a month is in budget
OpenBait fits if...
- • Reports reach you from customers, through a phishing@ mailbox nobody can keep up with
- • You want the person who reported to get an answer, not silence
- • You want the reports sent for you, with nothing going to a host or registrar until you confirm
- • You want to start with a free report page and pay for takedowns when you need them
- • You want the interface in English, Japanese or Chinese
FAQ
- Is Phish.Report a competitor to OpenBait?
- Partly. Both exist to get phishing sites taken down. Phish.Report is a workbench for a security team: it detects new sites, works out who really hosts them, guides the team through sending reports and keeps the timeline, for $500 a month as of September 20, 2026. OpenBait starts somewhere else — with the customer who saw the fake site first. It gives a brand a public report page, answers the reporter in seconds, and files the reports itself. OpenBait also submits to Phish.Report's API as one of its channels.
- When is Phish.Report the better choice?
- When you have a security team that wants to run takedowns itself and needs depth: hosting analysis that goes past WHOIS, detection of anti-analysis tricks, signatures for phishing kits, and integration with Slack, TheHive or a SOAR. That is what it is built for, and OpenBait does not try to match it there.
- When is OpenBait the better choice?
- When the reports reach you from customers — through a phishing@ mailbox nobody can keep up with — and there is no one whose job is to chase each site. OpenBait replaces the mailbox with a page, answers the person who reported, and sends the reports for you under its own reporter identity, with nothing going to a host or registrar until you confirm. The report page is free for one brand; filing with hosts and registrars starts on Pro.
- Can I use both?
- Yes. OpenBait already submits confirmed phishing sites through Phish.Report's API, and the two do not overlap much in who uses them: one is for the security team, the other is what you put in front of customers.
See what your customers would see
The open report form on the homepage is the same one a brand puts under its own name. Paste a link you do not trust — no account, no cost — and follow it from the answer to the status page.