Malte ZanderContents
A takedown takes anything from a few hours to several weeks. Many phishing pages disappear within a day, while a small share stays online far longer. There is no fixed deadline: hosts in the EU must decide in a timely way, and registrars of generic domains must act promptly. Three things decide most of the time: how complete your report is, whether it reaches the right party and whether you use several channels at once.
- A study of 286,237 phishing URLs over five months measured an average lifespan after detection of 54 hours, with a median of 5.46 hours (Lee et al., WWW 2025).
- Pages whose appearance changed more than 100 times stayed online for a median of 17 days, compared with 1.93 hours for pages with few changes (Lee et al., WWW 2025).
- ICANN's advisory gives the example of a suspension within two business days for a domain registered only for phishing, explicitly not as a contractual deadline (ICANN).
- Hosts in the EU must process notices in a timely, diligent, non-arbitrary and objective manner (DSA, Article 16).
Is there a fixed deadline for a takedown?
No. Neither the Digital Services Act nor ICANN's agreements set hours or days. The DSA requires hosts to decide in a timely way and to confirm receipt when you give electronic contact details. ICANN requires registrars to act promptly on actionable evidence and gives examples, not deadlines.
In practice, every provider sets its own targets. Large hosts and registrars run abuse teams that often handle phishing reports the same day. Small providers have an inbox someone reads once a week. And some providers ignore reports on purpose because their business depends on it.
How long do phishing pages actually stay online?
Usually briefly, sometimes for a very long time. The distribution is heavily skewed. In a study presented at the ACM Web Conference 2025, the median lifespan of phishing pages after detection was 5.46 hours, but the average was 54 hours (Lee et al., WWW 2025). Half the pages were gone within hours, while a small share lasted for days and pulled the average up.
What stands out is which pages survive: the ones that keep changing their appearance. Pages with more than 100 visible changes stayed online for a median of 17 days. Operators who maintain their pages and adapt them to avoid detection are the stubborn cases, and those are the ones that need your report.
What slows a takedown down?
Almost always one of these:
| Reason | What happens | What helps |
|---|---|---|
| Incomplete report | Follow-up questions or a quiet close | Full URL, screenshots, a clear reason |
| Wrong recipient | Forwarding or rejection | Check first: host, registrar, DNS or CDN |
| Page shows nothing to the reviewer | Report closed as unfounded | Send the full link with parameters and the evidence |
| Hacked legitimate website | The host has to reach the owner first | Inform the owner directly, request a browser warning |
| Country-code domain | ICANN's rules don't apply | Contact the host and the managing registrar |
| Uncooperative host | No answer | Report to the registrar, the upstream network and browsers in parallel |
Most causes sit in the report itself. In October 2025, ICANN reported that many complaints are invalid or incomplete or lack the detail needed to act (ICANN). The errors that cost the most are in Why takedowns fail.
What makes a takedown fast?
Four things, all within your control:
A complete report on the first try. A reason, the exact URL, evidence, your name and contact details. A reviewer should be able to decide without asking.
The right framing. Phishing, a fake shop or a fake verification page each need different grounds and channels.
Parallel reports. Host, registrar and Google Safe Browsing on the same day. The fastest channel ends the harm.
Consistent follow-up. A reminder with the ticket number after one or two business days without a reaction gets many cases moving.
What does a typical timeline look like?
This is how a well-reported case runs in its first days:
Hour 0 to 1: Secure evidence, identify the responsible parties, send reports to the host, registrar, DNS provider and Google Safe Browsing.
Hour 1 to 24: Confirmations arrive. In clear phishing cases, active registrars or hosts often suspend already.
Day 2 to 3: Follow up on every channel that hasn't reacted. A browser warning protects visitors if the page is still reachable.
From day 4: Escalate, for example to the upstream network, the registry or ICANN's complaint process. Guidance is in What to do when a host ignores your abuse report.
After that: Keep watching the case, because copies often return on new domains.
How long does legal action take?
Much longer. An expedited UDRP procedure at WIPO promises a decision within one month for USD 4,000. The standard procedure starts at USD 1,500 and takes longer (WIPO). Court cases take months. For active phishing, a takedown is the right route; legal action serves to recover a domain for good. The comparison is in Takedown or legal action.
How does AI Fraud Protect help?
AI Fraud Protect shortens the part of the timeline you control: finds come with a complete evidence package, the responsible parties are identified and the reports for all channels are prepared at once. A person reviews and sends every message. Each channel gets its own follow-up date, and new copies are linked to earlier cases.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
How fast must a host respond to an abuse report?
There is no fixed deadline. In the EU, a host must confirm receipt promptly when you give electronic contact details and must decide in a timely way. Many hosts handle clear phishing cases within one business day.
Why is my report still open after a week?
Often the evidence is missing, the report went to the wrong party or the page shows no content to the reviewer. Check these points, send a reminder with the ticket number and use the other channels in parallel.
Is a page with a browser warning already removed?
No. The warning protects visitors in browsers that use Google Safe Browsing, but the page stays reachable until the host or registrar acts.
Can a takedown work at the weekend?
Yes, many large providers handle phishing reports around the clock. Smaller ones often react on the next business day. Send the report right away anyway, so it sits at the front of the queue.
Sources
Lee, Lim, Kim, Kwon, Kim: 7 Days Later, Analyzing Phishing-Site Lifespan After Detected, ACM Web Conference 2025
ICANN advisory: DNS abuse obligations in the registrar and registry agreements, 5 February 2024
ICANN: progress and next steps in enforcing DNS abuse mitigation requirements, 20 October 2025
Digital Services Act, Article 16, with the official text on EUR-Lex