How domain takedowns work: reporting a phishing domain

When an attacker registers a lookalike of your domain and starts phishing your customers, you want it gone. The reality is that a takedown is less a single button and more a sequence of reports to the parties who actually control the domain and its content. Here is how the process really works, who to contact, and the timelines you can expect.

Step 1: Gather evidence before you report anything

Abuse desks act on clear, documented evidence, not assertions. Malicious sites also disappear or change quickly, so capture proof while it is live. A strong evidence package includes:

• Timestamped screenshots of the phishing page, including any login form, brand logos, or copied content.
• DNS and MX records showing where the domain resolves and whether it is configured to send or receive mail.
• Certificate data from Certificate Transparency logs, which shows when a TLS certificate was issued for the lookalike and on which infrastructure.
• RDAP or WHOIS data identifying the registrar, registration date, and the registrar abuse contact.
• The full URL, the IP address it resolves to, and the hosting provider.

This is the part where continuous monitoring earns its keep. VigilDNS captures dated, SHA-256-hashed screenshots, DNS and mail records, certificate history, change history and RDAP data as it monitors each lookalike, so the evidence already exists when you decide to act, including what a page showed before it changed. To be clear: VigilDNS drafts, you send. It prepares takedown-ready drafts and the evidence behind them; it never files a report, never contacts a registrar, and never sends anything on your behalf. You or your counsel submit the reports.

Step 2: Report to the registrar abuse contact

The registrar sold the domain and can suspend it. Find the registrar and its abuse email in the RDAP or WHOIS record (see RDAP vs WHOIS for how to read these). Send a concise, factual report citing the registrar's own acceptable use policy and the type of abuse: phishing, malware distribution, or trademark infringement. Attach your evidence and the exact URL. Reputable registrars suspend clear phishing within hours to a few days. Some registrars, especially low-cost or offshore ones, are slow or unresponsive, which is why you do not rely on this step alone.

Step 3: Report to the hosting provider

The phishing content physically sits on the hosting provider's servers, so the host can pull it down even if the registrar does nothing. The host is often the faster route. Identify it from the IP address (a reverse lookup or RDAP on the IP block points to the network operator), then send the same evidence to the host's abuse contact. Removing the content kills the phishing page even while the domain itself remains registered.

Step 4: Submit to browser and mail blocklists

Blocklists protect your users immediately, often before the domain or content is removed. When a URL is on these lists, browsers and mail filters warn or block users who try to reach it. Report the URL to:

• Google Safe Browsing, which protects Chrome, Firefox, and many other clients.
• Microsoft Defender SmartScreen, which protects Edge and Windows.

This step is fast, free, and high value. Even if the registrar takes a week, blocklisting can blunt the attack within hours.

Step 5: Report fraud to authorities

For active fraud against your customers, file with law enforcement. In the United States, report to the FBI Internet Crime Complaint Center (IC3). Elsewhere, report to your national CERT or equivalent computer emergency response team. These reports rarely produce a same-week takedown, but they build the record that supports larger investigations and, for repeat offenders, prosecution.

Step 6: UDRP or court as a last resort

If the domain itself is valuable and registered in bad faith, for example a clear lookalike of your trademark being held or used against you, you can pursue the Uniform Domain-Name Dispute-Resolution Policy (UDRP) or litigation. Be realistic about the cost. A standard WIPO UDRP filing for one to five domains before a single panelist runs about $1,500 in filing fees alone, plus attorney fees, and the process takes roughly two months. A UDRP transfers the domain to you rather than simply removing content, so it suits durable brand-protection goals more than an urgent phishing incident. What a panel needs to see, and how to collect it before the site changes, is covered in UDRP evidence for a disputed domain.

Where to report and what it achieves

Abuse reports and trademark claims are different filings

A common mistake is sending every lookalike to the registrar's abuse desk. Abuse desks act on active harm: phishing, malware, counterfeit sales, a live login form. A domain that is confusingly similar to your mark but serves nothing actionable (parked, for sale, or blank) is a trademark matter, pursued under the UDRP or, in the US, the Anticybersquatting Consumer Protection Act (ACPA). Filing a trademark matter as an abuse report invites a refusal, and alleging active abuse that the evidence does not show weakens the claim. Keep the two apart:

• Abuse report: to the registrar's abuse contact (and the host), with evidence of the harm happening now, asking for suspension.
• Trademark claim: a letter that asks the registrar to preserve the registration records and lock the domain against transfer, then a UDRP complaint or court action handled with counsel. Under the UDRP, passive holding of a domain can itself be bad faith, so a parked lookalike is not out of reach.

How VigilDNS prepares the paperwork (you send it)

VigilDNS does not take domains down. It drafts the reports and assembles the evidence so that you, or your counsel, can send them quickly:

• Takedown dossier. The lookalikes your tenant has confirmed as malicious, grouped by the abuse address that handles them rather than by registrar name (the same registrar often appears under several spellings in registration data), and split into abuse reports and trademark claims (UDRP/ACPA). Each group becomes an .eml draft for your own mail client, addressed to the registrar's abuse contact with an evidence PDF attached, or you can download the evidence PDFs alone. You review and send them from your own mail. VigilDNS never sends them and does not hold your correspondence with registrars.
• Evidence bundle for counsel. For names you are taking to a domain dispute, a ZIP laid out in the annex order of the WIPO model complaint: registration data, dated screenshots with SHA-256 digests, a side-by-side comparison with your official site, DNS and mail records, certificates, change history, common control and prior notices, plus CSV and JSON data files and draft complaints in Word for your counsel to review. Drafting aid only; attorney review is required. See UDRP evidence for a disputed domain for what goes into it and why.

If you are dealing with counterfeit storefronts, one takedown rarely ends it; our guide to counterfeit store networks explains how to find and link the rest. For how this fits a brand or legal team, see counterfeit storefront monitoring and VigilDNS for brand and IP counsel.

Why early detection beats takedown speed

Timelines vary from a few hours to never, depending on the registrar, the hosting provider, and the jurisdiction. You cannot control how fast a foreign registrar responds. What you can control is how early you find the threat. A lookalike caught soon after it is registered or gets its first certificate, before it is weaponized, gives you a head start on every step above. That is the case for continuous monitoring: not to take down faster, but to start earlier and limit the damage window. If someone has already registered a lookalike of your brand, read what to do when someone registers a lookalike of your domain.

Frequently asked questions

Can I get a phishing domain taken down myself, or do I need a service?

You can do it yourself. Most takedowns are abuse reports to the registrar and hosting provider, plus submissions to Safe Browsing and SmartScreen, all of which accept reports from anyone. The hard part is assembling solid evidence quickly and knowing where each report goes.

How long does a phishing domain takedown take?

It ranges from hours to never. Hosting providers and major registrars often act within a day on clear phishing, while unresponsive or offshore registrars may never cooperate. Blocklist submissions protect your users fastest, often within hours.

Does VigilDNS take down domains for me?

No. VigilDNS continuously monitors for lookalike domains and prepares the paperwork: a takedown dossier of .eml drafts with evidence PDFs, grouped by abuse address and split into abuse reports and trademark claims, and an evidence bundle with draft complaints for counsel. You or your counsel review and send them. There are no managed takedowns; the value is early detection and takedown-ready drafts.

Should a parked lookalike go to the registrar's abuse desk?

Not as an abuse report. Abuse desks act on active harm such as phishing, malware, or counterfeit sales. A parked or for-sale lookalike of your mark is a trademark matter: the usual route is a trademark claim asking the registrar to preserve records and lock the name, and possibly a UDRP complaint; decide with counsel.

Catching a lookalike early is what makes every takedown step easier. Run a free scan of your domain with our free typosquat checker to see which lookalikes already exist, or compare plans on the pricing page. Related guides: UDRP evidence for a disputed domain and counterfeit store networks.