A phishing takedown is a chain of reports, not one request. You show that a page is abuse, find who runs its domain and its server, ask each of them to act, and check that the page stays gone. This post walks through that process and shows where it usually stalls. For the short version, read the glossary definition of phishing takedown.
Who Can Remove a Phishing Page?
Several parties sit between a fake page and the internet, and each controls a different piece. The registrar manages the domain name, and the hosting provider runs the server.
A browser blocklist decides whether visitors see a warning. Knowing who does what saves days.
| Party | What it can do | What it cannot do |
|---|---|---|
| Hosting provider | Take the page or the account offline | Release or suspend the domain name |
| Domain registrar | Suspend the domain so it stops resolving | Delete files on the server |
| Registry operator | Suspend any domain in its top-level domain; generic top-level domain (gTLD) registries must act on well-evidenced DNS abuse under their ICANN agreement | Delete files on the server |
| Browser blocklist | Show visitors a warning page | Take the page offline |
ICANN defines DNS abuse as botnets, malware, pharming, phishing and spam used to deliver them. Since 5 April 2024, its agreements with gTLD registries and registrars require them to take mitigation action against well-evidenced DNS abuse. ICANN’s Compliance team cannot enforce those rules on country-code domains.
The Six Steps From Sighting to Removal
Most takedowns follow the same order. The first three steps decide how fast the rest goes, because every report depends on them.
- DetectLog how it was found: a monitoring alert, a user report or a feed
- Capture proofSave screenshots, the exact address, the page source and a time stamp
- Find who can actRecord the registrar, the host and any content delivery network (CDN)
- Send abuse reportsOne report per party, evidence attached, date logged
- Warn visitorsSubmit the address to browser blocklists
- Verify and watchConfirm it is offline, then watch the domain and its variants
Step three is where teams lose time. A page on a .com domain can have a registrar in one country and a host in another. A CDN in front of the site can also hide the real server. Look up the registrar with the ICANN Lookup tool, then trace the host from the page’s IP address.
Registrars are easier to reach than they used to be. The 2024 amendments call for abuse contacts that are easy to find on the registrar’s webpage and for a confirmation to the person who reports. Registrars may use a web form instead of email.
What Should the Evidence Hold?
A reviewer at a registrar or host sees many reports a day. A report that proves its case in one read gets acted on first. Include:
- Screenshots of the page as an ordinary visitor sees it.
- The exact address and a time stamp for when you saw it.
- A side-by-side with your real login page, to show the copy.
- Documents that show you own the brand, such as a trademark number.
- The page source and any redirect chain, because some pages show a harmless site to visitors who do not match the target.
Capture it once and keep it with the case. You may need the same file for the registrar, the host and a blocklist, and again if the page returns.
Where Does the Process Stall?
In ICANN’s own data, the most common reason a complaint went nowhere was missing proof that the registrar or registry had been asked first. ICANN published figures from the first two months after the new rules began. In April and May 2024 it received 1,558 complaints about DNS and other types of abuse. It closed 1,382 of them as unactionable, and the majority of those lacked evidence that the complainant had first reported to the registrar or registry.
The second stall is waiting. The registrar, host or platform decides how fast to act, so no one can promise a removal time. While you wait, report the address to Google Safe Browsing. A blocklist entry warns visitors, but the page stays online until a host or registrar acts.
What Happens After the Page Goes Down?
A removed page is often replaced by a new domain. Close the case only after you check that the page and the domain no longer load, and keep watching the old address and its close variants.
To see how exposed your own name is, try the free Phishing Domain Watch tool in Brandefense ATLAS. It counts lookalike domains seen in public sources such as certificate logs, and masks their names. Our guide to responding to lookalike and phishing domains and the post on how one mistyped letter becomes a phishing site cover the detection side.
Handle It In-House or Use a Service?
Doing it yourself works for a few cases. It gets slow when you need contacts and templates for registrars and hosts in several regions, follow-ups on each case and watch after removal.
Brandefense runs this work in its takedown service: it collects the evidence and contacts registrars and hosts. Customers can also export the evidence and pursue a case themselves. The phishing monitoring and domain abuse product finds the pages first, and the takedown service evaluation checklist lists what to ask any provider.