DemoSee the dashboard, report widget and takedown live
DE Log in Free fraud scan
Playbooks and productCase study

Takedown case study: from widget report to removal

A fictional but realistic case: an HR team reports a fake verification page through the report widget. Here is the path to removal, step by step.

Malte ZanderWritten with AI, reviewed by the author 7 min read
Contents
  1. The starting point
  2. Day 0, 08:12: the report
  3. Day 0, minutes later: the analysis
  4. Day 0: evidence and framing
  5. Day 0, 09:30: four reports, one click per channel
  6. Days 1 to 3: replies and follow-ups
  7. Day 18: the copy returns
  8. What the academy changed afterwards
  9. What does the case show?
  10. How does AI Fraud Protect help?
  11. FAQ
In short

This fictional case study shows a takedown from start to finish. An HR team uses a language academy's report widget to report the link from the QR code on a B2 certificate a candidate submitted. The page only shows "certificate valid" with that link. With an evidence package, the certificate forgery framing and parallel reports to the host, registrar, DNS provider and Google, it is offline on day three in this example. When the same template returns under a new domain, the second takedown starts the same day.

Key facts
  • According to the German government, forged B1 certificates in naturalization cases became an issue for the large naturalization authorities in 2025 (German Bundestag).
  • In a study of 112,005 phishing sites, 31.3% showed their content only under certain conditions (CrawlPhish).
  • Hosts need the exact URL for a notice under the EU Digital Services Act, among other details (DSA, Article 16).
  • In one study, Google Safe Browsing took 108.73 hours on average to detect phishing pages on its own (Lee et al., WWW 2025).

The starting point

Akademie Muster runs language exams from B1 to C1. Companies, authorities and universities verify its certificates on a dedicated verification page at verify.akademie-muster.example. Since the spring, the report widget has been embedded there, the academy's own domains and those of its partner test centers are on the ignore list, and the domain scanner checks variants of the academy's domains every week.

Important: the academy, all domains, people and times in this example are invented. The process follows patterns that are typical of fake verification pages.

Day 0, 08:12: the report

An HR specialist is reviewing an application for a job that requires German at B2 level. The QR code on the certificate leads to a page with the academy's logo and the message "certificate valid". Something bothers her: the address starts with akademie-muster but ends in an unfamiliar domain. She types the verification address from the academy's website herself, finds the report widget and reports the link:

akademie-muster.result-check.[random].com/results?cid=K7Q2MX9AP4LW

She also uploads the certificate as a PDF and writes: "Application document, check shows valid." The report needs nothing more.

Day 0, minutes later: the analysis

The AI opens the link with all its parameters and captures a screenshot. The page shows "certificate valid", the academy's logo and the details from the certificate. Without the parameters, the same address shows a neutral page with no logo, which is typical of hidden fakes, see Hidden fakes.

The comparison with the real verification page names what was copied: the logo and wordmark, the heading "Verify certificate" and the fields for candidate ID and date of birth. Risk: critical. In parallel, the exam office confirms that the certificate number in the PDF does not exist in its records. The report becomes a new case.

Day 0: evidence and framing

The evidence package is compiled automatically: screenshots on desktop and mobile, with and without the parameters, the full link from the report, registration data including the domain's registration date, DNS records, hosting with Muster Hosting B.V. in the Netherlands, the TLS certificate, the AI analysis report and the academy's trademark evidence. The case is framed as certificate forgery, because the page confirms forged certificates. Takedown framing explains why the framing matters.

Day 0, 09:30: four reports, one click per channel

The academy's responsible staff member reviews the prepared reports and sends them:

ChannelRouteGrounds
HostEmail to the abuse contactNotice under Article 16 of the Digital Services Act, with the exact URL and parameters
RegistrarEmail to the abuse contactFraud using a fake verification page that misuses the brand
DNS providerAbuse formNotice of the fake with the evidence package
Google Safe BrowsingReport formProtect visitors while the page is online

At the same time, the HR specialist gets a reply: the certificate is forged, and the correct verification address is verify.akademie-muster.example.

Days 1 to 3: replies and follow-ups

On day one, the DNS provider replies that it has forwarded the report to the host. The host opens a ticket. Google Safe Browsing lists the page, and browsers now warn about it, including for anyone scanning the QR code on another forged certificate. The registrar doesn't respond, so a follow-up goes out on day two. On day three, the host confirms removal and the registrar suspends the domain. The live status shows all four channels as confirmed, and the case is closed but stays under watch.

The times are an example. How long a real takedown takes depends mainly on the host, the registrar and the country, see How long does a website takedown take?.

Day 18: the copy returns

An authority reports a new link through the same widget: akademie-muster-certificate.[random].com/check?nr=B2-0417. The AI recognizes the same template as in the first case, and the report is linked to the existing case. The evidence from the first case is already there, the new evidence package is completed within minutes, and the second takedown starts the same day. Linking cases shows how such links help.

What the academy changed afterwards

  • QR codes now only lead to its own domain, with the verification address printed in plain text next to the code.

  • One line on every certificate: "Only verify this certificate at verify.akademie-muster.example."

  • HR teams and authorities were informed with a short note on the verification route and the report widget.

  • Obvious variants of the verification domain were registered.

  • Digitally signed certificates are planned, so that authenticity no longer depends on a web page.

What does the case show?

Five lessons that carry over to real cases:

  1. A person delivered the finding, not a scan. The page was invisible without its parameters. See Report widget.

  2. The full link was decisive, for the analysis and for the host.

  3. Parallel reports saved time, and the browser warning protected visitors while the host was reviewing.

  4. Human approval took seconds, because everything was prepared.

  5. A closed case is not a finished case. The copy came back and was recognized quickly.

How does AI Fraud Protect help?

The process in this example matches what AI Fraud Protect does: the report widget accepts links and PDFs, the AI analyzes every report with a screenshot and compares the page with your real one, and the evidence package with screenshots, WHOIS, DNS, hosting, the TLS certificate, the AI analysis report and trademark evidence is compiled automatically. The reports to host, registrar, DNS provider and Google are prepared to fit the framing, every message is reviewed and sent by a person, and the live status shows per channel what has been sent, acknowledged or is still open. Closed cases keep being scanned, and a new takedown can be started right away with the evidence already on file.

See a complete case in the app.

Start the free fraud scan for a short report within 48 hours, or request a demo to see the dashboard, the report widget and a takedown from report to removal.

Start the free fraud scanRequest a demo

FAQ

Is this a real case?

No. The academy, the domains, the people and the times are invented. But the process follows the patterns typical of fake verification pages and the steps real takedowns require.

How long does a real takedown take?

That depends mainly on the host, the registrar and the country. Parallel reports and complete evidence shorten the time, and a browser warning protects visitors even before that.

What if the host doesn't respond?

Then you follow up and escalate, for example via the registrar, the upstream provider or a complaint. See What to do when a host ignores your abuse report.

What happens to the person who submitted the forged certificate?

That is for the company and, where relevant, the academy to decide with their legal teams, for example on a criminal complaint. This is not legal advice.

Sources

More in this series

Back to the blogAuf Deutsch lesen