Malte ZanderContents
- What does it mean to take down a fake website?
- Who should you contact first: host, registrar or DNS?
- How do you find the right contacts?
- How do you take down a fake website, step by step?
- What should a takedown report contain?
- How long does a takedown take?
- What if nobody reacts?
- When is legal action the better path?
- How do you stop a fake site from coming back?
- How does AI Fraud Protect help?
- FAQ
To take down a fake website, secure evidence first. Then report it at the same time to the hosting provider, the domain registrar, the DNS or CDN provider and Google Safe Browsing, each with the exact URL, proof and a clear reason. Follow up on every report and watch for the copy to return on a new domain.
- Since 5 April 2024, registrars for generic domains such as .com must promptly act on actionable evidence of phishing (ICANN).
- In the EU, hosting providers must run a notice-and-action mechanism and decide on notices in a timely, diligent and objective manner (DSA, Article 16).
- Since 28 January 2025, RDAP has been the definitive source for registration data of generic domains, replacing WHOIS (ICANN).
- A UDRP complaint at WIPO costs USD 1,500 for one to five domains decided by a single panelist. An expedited track promises a decision within one month for USD 4,000 (WIPO).
What does it mean to take down a fake website?
Taking down a fake website means ending its ability to reach people. That can happen at four points: the content, the domain, the delivery and the browser. Each point has its own gatekeeper, its own rules and its own speed, which is why a strong takedown uses several of them at once.
| Lever | Who acts | What happens | Typical ground |
|---|---|---|---|
| Content | Hosting provider | The page or account is removed or disabled | Phishing, fraud, illegal content under the host's terms or Article 16 DSA |
| Domain | Registrar or registry | The domain is suspended and stops resolving | DNS abuse such as phishing, under the registrar's ICANN obligations |
| Delivery | DNS provider or CDN | Records are removed, or the report is forwarded to the real host | Terms of service, abuse policy |
| Browser | Google Safe Browsing, Microsoft SmartScreen | Visitors see a red warning before the page loads | Phishing or deceptive site |
| Ownership | UDRP panel or court | The domain is transferred or cancelled | Trademark rights and bad faith |
The first four levers stop harm. The last one stops the same domain from coming back, but it takes weeks rather than days.
Who should you contact first: host, registrar or DNS?
Contact all of them at the same time. If you have to choose an order, start where the abuse lives. A domain registered only to imitate you, such as a lookalike with a typo, is itself abusive, so the registrar is your strongest lever. A real website that was hacked to host a phishing kit is a different case: the domain owner is a victim too, so the hosting provider and the site owner are the right first contacts.
Two mistakes cost the most time. The first is reporting to only one party and waiting for an answer before trying the next. The second is reporting to the wrong one, for example asking a registrar to remove a page on a hacked site, or asking a CDN to delete content it does not host. The guide Clone sites vs phishing pages explains how the framing of a case picks the right channel.
How do you find the right contacts?
You find them in public registration and network data. It takes five minutes once you know where to look:
Registrar: look up the domain in ICANN's lookup tool, which queries RDAP. The result names the registrar and, for generic domains, its abuse contact.
Hosting provider: resolve the domain to its IP address and check which network the address belongs to. The regional internet registry for Europe, RIPE NCC, lists the network owner and its abuse mailbox.
DNS provider: the name server records (NS) show who runs the domain's DNS. Often that is the registrar, sometimes a separate provider.
CDN: if the IP belongs to Cloudflare or another proxy, the CDN is not the host. Cloudflare forwards complete abuse reports to the website operator and the hosting provider and gives the host the origin IP (Cloudflare). That is how you can still report a phishing site behind Cloudflare, even though the real host is hidden.
Country-code domains: ICANN's rules cover generic domains only. DENIC, the registry for .de, says it cannot remove phishing sites, so the host and the registrar that manages the domain are your levers (DENIC).
How do you take down a fake website, step by step?
You take it down by running the same eight steps every time, in this order:
Confirm and frame the case. Is it phishing, a cloned shop, fake support, a fake verification page? The framing decides the legal ground and the channels.
Secure evidence. Capture the full URL, screenshots on desktop and mobile, registration, DNS, hosting and certificate data before you report, because a warned operator can move the page. The checklist is in Securing evidence of a fake website.
Identify every party. Host, registrar, DNS provider, CDN, and where it applies the ad platform or social network that carries the lure.
Report in parallel. Send complete reports to all of them on the same day. The fastest channel ends the harm, and you do not lose days waiting for the slowest.
Protect visitors right away. Report the URL to Google Safe Browsing and Microsoft. A browser warning can protect people before the page is gone.
Warn the people at risk. If customers have already received links, tell them which address is real. How to warn customers about a fake website includes a template.
Follow up. Note each reference number and set a follow-up date per channel. A short reminder that cites the first report often moves a stalled case.
Watch for the comeback. Copies return on new domains. Keep the case open, link new finds to it and report again with the old case as reference.
What should a takedown report contain?
A good report lets a reviewer decide without a legal examination. Hosts in the EU are bound by Article 16 of the Digital Services Act, which lists four elements of a valid notice: the reasons, the exact URL, your name and email address, and a statement that you act in good faith (DSA, Article 16). Registrars need actionable evidence: ICANN names a screenshot and the complete URL as useful evidence (ICANN). This structure works for both:
Subject: Phishing page impersonating [Brand] at [exact URL]
Hello [provider] abuse team,
the page at [exact URL, including path and parameters] impersonates [Brand], a registered trademark of [company] ([registration number]). It copies our login page and asks visitors for their credentials. Our official site is [official URL].
Evidence: screenshots on desktop and mobile taken on [date, time, time zone], the page source and the registration and hosting data are attached.
Please disable access to the content and suspend the account involved. For the hosting provider: this is a notice under Article 16 of the Digital Services Act. I confirm that the information in this notice is accurate and complete to the best of my knowledge and that I act in good faith.
[Name, role, company, email, phone]
Country-specific channels for the EU, the UK and Switzerland are listed in How to report a phishing website in Europe.
How long does a takedown take?
There is no fixed deadline. The DSA asks hosts to decide in a timely manner, and ICANN asks registrars to act promptly. ICANN's guidance gives suspension within two business days as an example for a domain registered only for phishing, and stresses that its examples are not fixed contractual timelines (ICANN).
What you control is the input. Complete evidence, the right framing and parallel reports remove the most common reasons for delay. A browser warning usually protects visitors before the page itself is removed, which is why the Safe Browsing report belongs in the first hour, not the last.
What if nobody reacts?
Escalate one level at a time, and document each step:
Remind with reference. Reply to your first report with its reference number, the date and a short note that the page is still live.
Go up the chain. If a host ignores you, report to its upstream network provider. For generic domains, the registry operator is the next level above the registrar.
Use ICANN Compliance. For generic domains, ICANN accepts complaints about registrars, but only after you reported to the registrar first. In the first two months of its new abuse rules, ICANN enforcement led registrars to suspend 2,528 malicious domains and disable 328 phishing websites (ICANN).
Choose a legal route. If the domain itself is the problem and you hold a trademark, a dispute procedure can transfer it. Your legal team decides on cease-and-desist letters and court action.
A case often stalls because the host does not respond to your abuse report. Keep a record of when you reported to each host and when you sent a reminder.
When is legal action the better path?
Legal action is the better path when the same domain keeps hurting you, when the operator is identifiable, or when you need damages. A takedown notice is faster for active phishing. This overview is not legal advice.
| Route | What it achieves | Prerequisite | Cost and time |
|---|---|---|---|
| Abuse report | Content removed, domain suspended, browser warning | Evidence and a clear ground | Free; depends on the provider |
| UDRP | Domain transferred to you or cancelled | Trademark rights, no legitimate interest of the registrant, bad faith | From USD 1,500 at WIPO; standard cases take longer than the one-month expedited track (WIPO) |
| Court | Injunction, damages, information about the operator | A legal claim and a reachable defendant | Highest cost, slowest route |
A UDRP decision does not take a page offline on the day you file. Use it to win the domain back after the takedown, so the address cannot be reused. That makes the UDRP process a tool for domains that keep hurting you, not for the acute emergency.
How do you stop a fake site from coming back?
You stop it by watching the places a new copy has to pass. Operators reuse their kits, templates and hosting, so the next copy often looks like the last one:
New domains: watch registrations that contain your name, common typos and lookalike characters.
Certificates: almost every fake uses HTTPS, and publicly trusted certificates must be logged in Certificate Transparency to be trusted by Chrome (Chrome). New certificates for lookalike names are an early signal.
Reports from outside: customers, partners and verifiers see links your monitoring never sees. Give them one place to report.
Closed cases: keep the evidence of every case, so a new find can be linked to the old one and reported faster.
If the fake website comes back anyway, report the new address with a reference to the old case. That makes the review easier for the host and the registrar.
How does AI Fraud Protect help?
AI Fraud Protect finds lookalike domains, cloned websites, phishing pages and fake verification pages that use your name, and builds the evidence package for each case automatically. It prepares the reports for the host, the registrar, the DNS provider and Google Safe Browsing with the right framing, and a person reviews and sends every message. Open cases stay on a follow-up list until the fake is gone, and new copies are linked to earlier cases.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Can I take down a fake website myself?
Yes. Abuse reports to hosts, registrars and browsers are open to anyone, and the rights holder's report carries the most weight. What makes it hard is the volume of channels and follow-ups, not access.
Do I need a lawyer to take down a fake website?
Not for abuse reports. A complete notice with evidence is enough for hosts, registrars and browser blocklists. A lawyer becomes useful for dispute procedures, cease-and-desist letters, court action or when the operator is known.
Is it free to report a phishing website?
Yes. Abuse reports to hosts and registrars and reports to Google Safe Browsing and Microsoft cost nothing. Fees apply to legal routes such as a UDRP complaint, which starts at USD 1,500 at WIPO.
What if the fake site is hosted outside the EU?
You can still act. Registrars of generic domains are bound by ICANN's abuse rules wherever they are based, and browser warnings work worldwide. Article 16 DSA applies to hosting services offered in the EU.
Can a takedown hit a legitimate site by mistake?
Yes, if a report is wrong. Check that the page really impersonates you, keep partners and resellers on an ignore list and let a person review every report before it goes out.
Sources
ICANN advisory: DNS abuse obligations in the registrar and registry agreements, 5 February 2024
ICANN: enforcement of DNS abuse requirements, the first two months, 7 June 2024
ICANN: launching RDAP, sunsetting WHOIS, 27 January 2025
Digital Services Act, Article 16, with the official text on EUR-Lex