# The CA's Role in Fighting Phishing and Malware

**URL:** <https://community.letsencrypt.org/t/the-cas-role-in-fighting-phishing-and-malware/245086>\
**Category:** Issuance Policy\
**Created:** [February 3, 2026, 2:04pm UTC](https://community.letsencrypt.org/t/the-cas-role-in-fighting-phishing-and-malware/245086 "2026-02-03T14:04:13Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![AtmosphericIgnition](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/atmosphericignition/32/89826_2.png) [@AtmosphericIgnition](https://community.letsencrypt.org/u/AtmosphericIgnition)\
**Post date:** [February 3, 2026, 4:59pm UTC](https://community.letsencrypt.org/t/the-cas-role-in-fighting-phishing-and-malware/245086/5 "2026-02-03T16:59:38Z")

</div>

Hi,

I think this article from the Let's Encrypt [blog post](https://letsencrypt.org/2015/10/29/phishing-and-malware.html) will explain why Let's Encrypt doesn't take action against domains involved in phishing or abuse.

TL;DR: There are better channels to report problematic domains to, including Google Safe Browsing, and Microsoft SmartScreen. They do a much better job getting warnings out than a certificate authority could. At on point, Let's Encrypt even checked domains against Google's API. This is no longer the case (explained in [this forum post](https://community.letsencrypt.org/t/let-s-encrypt-no-longer-checking-google-safe-browsing/82168).)

---

_[View the full topic](https://community.letsencrypt.org/t/the-cas-role-in-fighting-phishing-and-malware/245086)._