Malte ZanderContents
Report a confirmed fake on the same day to every party that can stop it: the host, the registrar, the DNS provider or CDN, and Google Safe Browsing. Each one works through its own queue, and the fastest channel alone ends the harm. If you report one after the other and wait for each answer, you give away days. The important exception is a hacked but otherwise legitimate website: there you don't ask the registrar to suspend the domain.
- In a study of 286,237 phishing URLs, half the pages were offline after 5.46 hours. For most fakes, time is measured in hours, not days (Lee et al., WWW 2025).
- In the same study, Google Safe Browsing detected only 18.41 percent of the phishing URLs on its own, after 108.73 hours on average (Lee et al., WWW 2025).
- Registrars of generic domains must act promptly on actionable evidence of phishing, whatever the host does (ICANN).
- Hosts in the EU must decide on complete notices in a timely and diligent way (DSA, Article 16).
What does reporting in parallel mean?
One find, one evidence package, several reports on the same day. Instead of writing to the host and waiting before you contact the registrar, you send every responsible party its own report at the same time, with the request only it can fulfil. The host removes content, the registrar suspends the abusive domain, Google Safe Browsing shows a warning. Which party can do what is explained in Host, registrar or DNS.
Why does it work faster?
For three reasons.
First, the channels don't depend on each other. Every provider has its own abuse team, its own queue and its own pace. A registrar that suspends a lookalike domain takes the site offline whether or not the host has read its email. A browser warning protects visitors whether or not the domain still resolves. Each lever on its own is enough to stop the harm.
Second, every hour counts. If half the phishing pages in a large study were gone after just over five hours, then for those pages all the harm happens within that window. A process that waits days for answers comes too late for many victims.
Third, redundancy absorbs failures. Some hosts don't respond, some registrars are slow, some reports get lost. If you report in parallel, you don't depend on the weakest link.
Isn't that double work for the providers?
No, as long as each report goes to the right party with the right request. Double work would be writing to the same provider through several forms and inboxes at once. Avoid that, because it creates several tickets for the same case and slows things down. One report per provider, referring to the same evidence, is the right way. If the host and the registrar are the same company, one report that names both requests is enough.
When shouldn't you report everything at once?
In three situations, restraint is right:
Hacked legitimate website: the domain belongs to an uninvolved third party. Don't ask the registrar for a suspension; inform the host and the site owner. You can still report to Google Safe Browsing, because the warning applies to the specific address.
Unclear case: could the page belong to a partner, reseller or fan? Check first, then report. A wrong report to five parties does five times the damage.
Domain without content: a parked lookalike domain without a fake is a case for monitoring, not a takedown. Report as soon as content appears.
How do you organize parallel reports?
With a fixed process that fits into the first hour:
Secure the evidence. One package for all channels: screenshots, full URL, page source, registration, DNS, hosting and certificate data. The list is in Securing evidence of a fake website.
Identify the parties. Host, registrar, DNS provider, CDN and, if needed, the ad platform or social network.
Write a report per channel. Same facts, different request. Templates for each channel are in Writing an abuse report that hosts actually act on.
Send everything on the same day. Record time, recipient and ticket number for each channel.
Follow up per channel. Each channel gets its own follow-up date.
| Channel | Request | Key evidence |
|---|---|---|
| Host | Remove content, close the account | Screenshots, URL, IP in the host's network |
| Registrar | Suspend the domain (only for abusive registrations) | Creation date, name similarity, screenshots |
| DNS provider | Remove the records | Name servers, screenshots |
| CDN | Forward to the host | Full URL, screenshots |
| Google Safe Browsing | Browser warning | Full URL |
What changes in the outcome?
Above all, the time to protection. Final removal may still depend on the slowest provider, but visitors are protected as soon as the fastest channel takes effect. So measure both separately: the time to first protection and the time to final removal. How is explained in Measuring takedown success.
How does AI Fraud Protect help?
AI Fraud Protect is designed for parallel takedowns. For every find it identifies the host, registrar, DNS provider, CDN and Google Safe Browsing, builds the evidence package once and prepares each channel's report with the right framing. For hacked websites, the registrar isn't asked for a suspension. A person reviews and sends every message, and each channel has its own follow-up date.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Should I tell providers that I've reported to others too?
It isn't necessary, but it does no harm. What matters more is that each report is complete on its own.
What if one channel is faster than the others?
Then the harm has stopped. Let the other reports run anyway, because a suspended domain doesn't stop the operator from reusing the content at the host.
Can I report in parallel if I'm short on time?
Yes. With templates and a ready evidence package, a report per channel takes a few minutes. The biggest effort is identifying the responsible parties.
Does this apply to fake ads and social media too?
Yes. Report the ad to the ad platform and the landing page to the host, registrar and browsers at the same time.
Sources
Lee, Lim, Kim, Kwon, Kim: 7 Days Later, Analyzing Phishing-Site Lifespan After Detected, ACM Web Conference 2025
ICANN advisory: DNS abuse obligations in the registrar and registry agreements, 5 February 2024
Digital Services Act, Article 16, with the official text on EUR-Lex