• If you forward that sort of email to (not an infallible rule but generally true) phishing@whateverthelegitdomainwouldbe.com then the fraud team will get in touch with the ISP hosting the compromised site and take the page down

About

Avatar for Dammit @Dammit started