Build abuse reports for registrars, hosting providers and CDNs, as an email and as JSON.
New
Evidence Record
Runs locallyNew
Use Evidence Record
What it does
Write down a phishing sighting the way an abuse desk can use it: the URL, where it reached you, the UTC time, the SHA-256 of a screenshot or file, and notes, in one JSON record that can be checked later.
It runs entirely in your browser: nothing you enter is uploaded.
Example
A toll-scam link from an SMS
hxxps://ezpass-pay[.]example/tollsRecord created. Keep the JSON with the original file: the record SHA-256 is computed over the record without that field (keys sorted, no spaces), so anyone can recompute it and see the record was not changed.
{
"type": "phishdestroy-evidence",
"version": 1,
"recorded_at": "2026-10-20T17:10:08Z",
"observed_at": "2026-10-20T08:30:00Z",
"url": "https://ezpass-pay.example/tolls",
"url_defanged": "hxxps://ezpass-pay[.]example/tolls",
"host": "ezpass-pay.example",
"source": "sms",
"source_label": "SMS",
"source_detail": "sender +1 555 0100",
"file": null,
"notes": "Unpaid toll text; the page asks for card details.",
"record_sha256": "181a29e8971293fb3c4f341e3e817bca96b5fc6991c8de62e645447bb5650b5a"
}Builds a record with the URL refanged and defanged, source SMS with the sender, the time 2026-10-20T08:30:00Z and a note, plus record_sha256 over the canonical JSON. Send to Abuse Report Generator fills the URL, first-seen time, hash and description of a report.
FAQ
What is the record SHA-256 for?
It is computed over the record itself (without that field, keys sorted, no spaces). Anyone who receives the JSON can recompute it and see that the URL, the time and the file hash were not changed after the record was made.
Is the screenshot or file uploaded?
No. The file is read and hashed with SHA-256 in your browser; only its name, size, type and hash go into the record. Keep the original file together with the JSON.
Why are times in UTC?
Abuse desks, registrars and the police work across time zones. A UTC timestamp written as 2026-10-20T08:30:00Z cannot be misread; the Seen at field is read as UTC, and Now fills in the current UTC time.