Malte ZanderContents
You measure takedown success with a few clearly defined time spans and rates: time to detection, to the first report, to the browser warning and to removal, plus response rate per channel, success rate, recurrence rate and false positive rate. Report times as medians, not just averages, because a few stubborn cases distort the average badly.
- In a study of 286,237 phishing URLs, the median lifespan after detection was 5.46 hours and the average 54 hours (Lee et al., WWW 2025).
- In the same study, Google Safe Browsing detected phishing pages after 108.73 hours on average and 5.80 hours at the median (Lee et al., WWW 2025).
- Hosts in the EU must confirm receipt of a notice when you give electronic contact details and must tell you their decision. Both give you timestamps for your measurement (DSA, Article 16).
Which metrics really matter?
The ones that show how long people are exposed to the fake and how well your process works:
| Metric | From | To | Why it matters |
|---|---|---|---|
| Time to detection | First signal, such as a certificate or registration | Find in your system | Shows how early you look |
| Time to report | Find | First report sent | Shows how fast your team acts |
| Time to protection | First report | Browser warning or first suspension | From here, visitors are protected |
| Time to removal | First report | Page permanently unreachable | The actual goal |
| Response rate per channel | Reports to a provider | Confirmations and decisions | Shows where to escalate |
| Success rate | Reported cases | Removed cases | The program's overall effect |
| Recurrence rate | Removed cases | Cases that came back | Shows whether monitoring is needed |
| False positive rate | Reported finds | Finds that weren't fakes | Protects your reputation with providers |
When is a page really removed?
Only when it is permanently unreachable. Many pages go down briefly and come back, for example when a host deletes a file but the operator uploads it again. So distinguish between the first outage and final removal. For your report, final removal counts: check the address again after a few days before closing a case.
Protection before removal matters just as much. A browser warning or a domain suspension can protect visitors while content still sits on a server. Measure that moment separately, because it shows how quickly your reports actually take effect.
Why the median rather than the average?
Because takedown times are extremely skewed. In the study above, half the phishing pages were offline after 5.46 hours, but the average was 54 hours (Lee et al., WWW 2025). A single case that stays open for three weeks can double a month's average. So report the median and show the slowest cases separately, such as the five oldest open cases with their reasons. That way management sees both the typical case and the problem cases.
How do you capture timestamps cleanly?
With a case log in which every status change gets a timestamp:
Found: date and time, source of the tip, such as monitoring, a customer or the report widget.
Confirmed: who checked that it's a fake.
Reported: for each channel, the time, recipient and ticket number.
Confirmation received: for each channel, from the provider's confirmation of receipt.
Protection: time of the browser warning, domain suspension or first removal.
Removed: the time from which the page is permanently unreachable.
Comeback: the new address with a reference to the old case.
Use the same time zone everywhere. Without such a log, metrics can only be estimated later, and estimates convince neither management nor the legal team.
Which metrics belong in the monthly report?
A few that trigger decisions. What works: the number of new cases, the median time to removal, the success rate, the number of open cases with their age and the recurrence rate. Add a list of the providers with the worst response rate, because that's where escalation or another channel pays off. A template for the report is in Reporting to leadership: a monthly brand protection dashboard.
Which mistakes distort the numbers?
Four common ones:
Inconsistent start points: measuring once from the find and once from the report compares apples with oranges.
Closing cases too early: a page that returns after two days wasn't removed.
Counting only successes: open and failed cases belong in every analysis.
Ignoring false positives: a high false positive rate costs trust with providers and slows future reports.
How does AI Fraud Protect help?
AI Fraud Protect logs every case from the find through the reports to removal, with timestamps for each channel. Open cases stay on the follow-up list, comebacks are linked to earlier cases and partners on the ignore list keep the false positive rate low. A person reviews and sends every report. The numbers for your report build up as you work.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Which metric matters most?
The median time from the first report to protection. It shows how long people are exposed to the fake without protection.
How often should I report?
Monthly for management, weekly within the team. During an acute incident, report additionally until the case is closed.
What is a good success rate?
That depends on the type of cases. More important than a target value is the trend over time and an explanation for every case that stays open.
Should we compare our times with other companies?
Only with care. Providers and studies measure from different start points. Compare yourself mainly with your own previous months.
Sources
Lee, Lim, Kim, Kwon, Kim: 7 Days Later, Analyzing Phishing-Site Lifespan After Detected, ACM Web Conference 2025
Digital Services Act, Article 16, with the official text on EUR-Lex