Phishing takedown is the process of getting a phishing website, or its hosting, removed or blocked. A team collects proof, reports the page to the registrar, the hosting provider and browser blocklists, and follows up until the page is offline. The aim is to shorten the time victims can reach it.
- Also Called2other namesphishing site takedown · domain takedown
- Related Terms3linked entriesPhishing · Lookalike domain · Typosquatting
- Read Next1guide on the same topic
How does a phishing takedown work?
Speed and proof decide the result. A typical takedown runs in six steps.
- Detect the page through monitoring, user reports or new-domain feeds.
- Capture evidence: screenshots, the full address, page source and time stamps.
- Find who can act: the host, the registrar, the registry or the platform.
- Send abuse reports with the evidence attached.
- Report the page to browser blocklists, so visitors see a warning while the takedown runs.
- Check that the page is gone, and watch for it to return.
The rules help. Since 5 April 2024, ICANN has required gTLD registries and registrars to take action to stop or disrupt well-evidenced cases of DNS abuse, which includes phishing. Country-code domains follow their own policies. For who controls each step, the ICANN duties and how to escalate, read how the phishing takedown process works.
Why does it matter in the EU, APAC and the US?
The Anti-Phishing Working Group counted about 3.8 million phishing attacks in 2025. Every hour a fake page stays up gives more people the chance to type in a password or a card number.
Fake pages are often hosted far from their victims. A page that targets customers in Germany may sit with a host in Asia and a registrar in the US. Each provider has its own form, language and response time, so teams that work across regions need contacts and templates for each.
How does takedown compare with related steps?
| Step | What it does | Question it answers |
|---|---|---|
| Phishing takedown | Removes or blocks a live fake page. | Can this site go offline? |
| Phishing monitoring | Finds fake pages early. | Is anyone copying us? |
| Domain dispute (UDRP) | Moves a domain to its rightful owner. | Who should own this domain? |
| Email filtering | Blocks phishing mail before it arrives. | Does the lure reach our staff? |
Brandefense runs takedowns as part of its phishing takedown service, from evidence to confirmed removal.
What makes evidence strong?
- Screenshots taken from a normal visitor's view.
- The full address, plus the date and time you saw it.
- Proof that the page copies your brand or your login form.
- Proof that you own the rights, such as a trademark number.
What can go wrong?
Attackers often register a new domain after one is removed. Some pages show harmless content to anyone who is not a target, which can make a reviewer think the report is wrong. Some hosts answer slowly. Keep monitoring after a takedown so a repeat is caught early.
See also
Also Called.
- Namephishing site takedown
- Namedomain takedown
Questions.
-
How long does a phishing takedown take?
It varies from hours to days or longer. It depends on the host, the registrar and how strong your evidence is.
-
Who can request a takedown?
Usually the brand owner or an agent it has authorized. Some providers also act on reports from any person if the evidence is clear.
-
Is a takedown the same as blocking a site?
No. Blocking warns visitors in a browser or filter, but the page stays online. A takedown removes the page or the domain.
-
What if the host ignores the report?
You can escalate to the registrar, the registry or the CDN in front of the site, and report the page to blocklists meanwhile.