Malte ZanderContents
Brand monitoring finds fakes and alerts you; a takedown makes them disappear. A finding without a takedown protects no one: the page stays online, customers keep landing on it and a replacement domain is quickly registered. Brand protection only works when every relevant finding is carried through to removal: assess, capture evidence, report in parallel, follow up and keep watching afterwards.
- In a study of 286,237 phishing URLs, the median lifespan was 5.46 hours. Pages with more than 100 visible changes, however, stayed online for a median of 17 days (Lee et al., WWW 2025).
- In the same study, Google Safe Browsing took 108.73 hours on average to detect a page (Lee et al., WWW 2025).
- Between April 2024 and August 2025, ICANN investigations led to around 20,000 domains being mitigated for DNS abuse. Many complaints were incomplete (ICANN).
- In January 2025, Germany's financial regulator BaFin warned about a website that was almost identical to a site it had warned about twelve days earlier (BaFin).
What is the difference between monitoring and takedown?
Monitoring answers the question "Is there a fake?", a takedown the question "Is it gone?". They belong together, but they do completely different jobs:
| Monitoring | Takedown | |
|---|---|---|
| Goal | Find fakes | Remove fakes |
| Result | An alert, a list, a report | A page or domain that is offline |
| Who acts | Tools that search and compare | Host, registrar, DNS provider, Google, in response to your report |
| What remains | An open task | A closed case that stays under watch |
Many programs invest heavily in the left column and little in the right. The result is long lists of findings, very few of which ever disappear.
Why isn't a finding enough?
Because a fake you know about does just as much damage as one you don't. Only a report to the providers sets anything in motion, and only a complete report leads to a decision. ICANN reports that many complaints to registrars were incomplete.
On top of that, well-organized attackers stay. The study by Lee and colleagues shows two worlds: most phishing pages vanish after a few hours, but pages that are continuously maintained and changed stay online for a median of 17 days. Those are exactly the campaigns that hit brands hardest. And when a page falls, the next one is often already waiting, as the case behind the BaFin warning shows. The resurfacing problem explains more.
What does a finding without a takedown cost?
More than it seems at first:
Customers keep landing on the fake and lose money, credentials or trust.
Your support team becomes a complaints desk for fraud you didn't commit.
Your reputation suffers when victims confuse the fake's name with yours.
Regulators, partners and the press ask what you did about it. An alert without a next step is a poor answer.
Your team becomes numb. Anyone who sees alerts every day that lead nowhere stops taking the next one seriously.
What belongs between finding and removal?
A case that goes through the same steps every time:
Assess: is it a fake, a partner or something harmless? How critical is it?
Capture evidence before the page disappears or changes. See Securing evidence of a fake website.
Frame it: phishing, brand forgery or certificate forgery. See Takedown framing.
Report in parallel: host, registrar, DNS provider and Google Safe Browsing. One find, many reports shows why that works faster.
Follow up where a response is missing, and escalate if necessary. See What to do when a host ignores your abuse report.
Check that the page is really offline, and only then close the case.
Keep watching, because the same template often returns under a new domain.
When is monitoring enough?
For domains that are a risk but are not yet causing harm. A parked domain with your name, a domain for sale or a page under construction with your favicon is often not yet a case for a takedown. A watchlist is right for these: the domain is reassessed with every scan, and as soon as content or mail servers appear or the risk rises, it becomes a case.
What matters is that this transition works. A watchlist without a path to a takedown is just a longer list.
How can you tell whether your program works?
With metrics that measure the end of a case, not its beginning. Three are especially telling: the share of relevant findings that were actually removed, the time from finding to removal, and the share of cases that come back after removal. Measuring takedown success shows how to calculate them.
How does AI Fraud Protect help?
AI Fraud Protect carries every case forward instead of stopping at the finding. The AI assesses each finding against your real page, the evidence package is compiled automatically, reports go out through several channels at once, and the live status shows where a response is missing until the page is offline. Domains without content but with risk stay on the watchlist and are rescanned. Closed cases keep being scanned too, and if a domain reappears, the takedown can be initiated again right away with the evidence already on file.
Start the free fraud scan for a short report within 48 hours, or request a demo to see a complete case in the app.
FAQ
Is monitoring alone worthless?
No. It is the first step, and the right answer for risky but still empty domains. It becomes worthless when relevant findings never lead to takedowns.
How quickly does a copy come back after a takedown?
That varies widely. In the case behind the BaFin warning, an almost identical site appeared twelve days after the first warning. That is why closed cases should stay under watch.
Can takedowns be fully automated?
Detection, assessment and preparation, yes; a person should approve the sending. Human in the loop takedowns explains why.
Do we need two providers for monitoring and takedown?
Not necessarily. What matters is that there is no break between finding and report, for example when evidence has to be transferred. The brand protection RFP checklist shows what to look for.
Sources
Lee et al.: study on the lifespan of phishing pages, The Web Conference 2025
ICANN: progress and next steps in enforcing DNS abuse mitigation requirements, 20 October 2025
BaFin: warning about kersten-anlageberatung.de, 29 January 2025