Malte ZanderContents
Framing means classifying a case correctly before you report it. Whether a fake is phishing, brand forgery or certificate forgery decides which providers are responsible, which grounds hold up and what evidence you need. For registrars, phishing counts as DNS abuse, which they are contractually obliged to act against. Pure brand forgery, by contrast, needs your trademark evidence and often takes other routes.
- Since April 2024, ICANN-accredited registrars must act against DNS abuse once they have actionable evidence. DNS abuse means malware, botnets, phishing, pharming and spam used to deliver them (ICANN).
- Hosting services in the EU must accept notices about any content the notifier considers illegal, from fraud to intellectual property infringement (DSA, Article 16).
- As actionable evidence of phishing, ICANN cites, for example, a screenshot showing what the page imitates and the complete URL (ICANN).
- DENIC, the registry for .de, says it cannot remove phishing pages (DENIC).
What is framing in a takedown?
The answer to the question "What exactly is the problem here?", asked from the point of view of the provider who is supposed to act. A host, a registrar and Google each check a report against their own rules. A report that explains in their language why the page breaks those rules gets handled faster and more often than one that just says "fake".
The same page can belong in different places depending on the framing. A cloned login page that captures passwords is DNS abuse for the registrar. A cloned homepage without a form looks more like a trademark dispute to the registrar, and it often points you to other procedures.
The three framings at a glance
| Framing | Typical case | Grounds | Main channels | Key evidence |
|---|---|---|---|---|
| Phishing | Cloned login or payment page that asks for data | Fraud, DNS abuse, terms of service | Host, registrar, DNS provider, Google Safe Browsing | Screenshot of the form and the complete URL |
| Brand forgery | Lookalike domain or cloned website without data capture | Trademark law, terms of service, copyright for exact copies | Host, registrar with trademark evidence, UDRP or DENIC dispute for the domain | Trademark evidence and comparison with your page |
| Certificate forgery | Fake verification page that confirms certificates as valid | Fraud, document forgery, trademark law | Host, registrar, DNS provider, Google Safe Browsing | Full link with parameters, screenshots with and without them |
Phishing: when data is being captured
It's phishing when a page is meant to get people to enter credentials, payment details or other sensitive information. This framing has the clearest rules: for registrars, phishing is DNS abuse they have been contractually required to act against since 2024, and hosts generally give phishing reports top priority. What matters is the evidence: a screenshot showing the form and the imitated brand, plus the complete URL. Writing an abuse report that hosts actually act on shows what a good report looks like.
Brand forgery: when your presence is copied
It's brand forgery when a domain or website uses your brand to pose as you without asking for data. Typical examples are cloned websites, fake shops and lookalike domains with content. What counts here is your trademark evidence, such as the registration number, and a clear comparison with your real page. For exact copies of your text and images, copyright comes in as an additional basis.
Expect a registrar not to treat pure trademark infringement as DNS abuse. For the domain itself, procedures such as the UDRP or, for .de domains, a DENIC dispute are available, which you pursue with your law firm. Takedown or legal action? shows when each route pays off.
Certificate forgery: when a page confirms fakes
It's certificate forgery when a page confirms forged certificates, degrees or register entries as valid. These pages often only show their content with the parameters from the QR code. So the most important evidence is the full link with every parameter, plus screenshots with and without them. Without that link, the host cannot find the page. Hidden fakes explains how such pages work.
What about mixed cases?
A case gets one leading framing, and other grounds go into the text of the report. Three typical mixed cases:
A fake shop that asks for card details: phishing leads, because it opens the fastest routes. Trademark and copyright go into the report as additional grounds.
A domain with both a login page and a fake verification page: report both pages with their exact links; the framing follows the most serious abuse.
A parked lookalike domain without content: usually not yet a takedown, but a case for the watchlist until content appears or the risk rises.
Which framing mistakes cost time?
Five mistakes that delay reports or make them fail:
Reporting everything as phishing, even when no form is visible. That costs credibility.
Claiming trademark rights without proving them. Without a registration number, the report stays vague.
Reporting certificate forgery without the full link. The host then sees an empty page.
Threats instead of evidence. Abuse teams need facts, not a cease-and-desist letter.
Many cases in one report. One report per page or domain is easier to process.
Why takedowns fail collects more reasons takedowns go wrong.
How does AI Fraud Protect help?
In AI Fraud Protect, you choose the framing for every case: phishing, brand forgery or certificate forgery. The channels and the grounds for each report follow from that. Depending on the framing, the notice to the host relies on the Digital Services Act, the host's terms of service and, for exact copies, copyright. The registrar is contacted about fraud or phishing, and for brand forgery your trademark rights are added. For DENIC disputes and the UDRP, a draft is prepared that you file with your law firm. Every message is reviewed and sent by a person.
Start the free fraud scan for a short report within 48 hours, or request a demo to see framing and reports in the app.
FAQ
Can a case have several framings?
It has one leading framing that sets the channels and priority. Other grounds, such as trademark rights for a phishing page, go into the text of the report as a supplement.
What happens with the wrong framing?
Usually a rejection or a follow-up question that costs time. Report again, with the right framing and the right evidence.
When does copyright help?
With exact copies of your text, images or design. It is a strong additional basis for the notice to the host, especially for cloned websites. See Clone sites vs phishing pages.
Is a parked lookalike domain already a case?
Usually not for a takedown yet. It belongs on the watchlist and stays under observation. Whether a procedure over the domain itself makes sense is something to decide with your law firm. This is not legal advice.
Sources
ICANN: advisory on compliance with DNS abuse obligations, 5 February 2024