Malte ZanderContents
Running takedowns yourself makes sense when you have a few cases a year and someone on the team knows DNS, evidence handling and the rules of hosts and registrars. Once cases come regularly, several brands are affected or a fast reaction counts in the evening too, a service provider or software with your own team is usually cheaper. Most of the effort isn't in the report itself, but in detection, evidence, follow-up and documentation.
- In the fourth quarter of 2025 alone, phishing campaigns targeted 866 different brands (APWG).
- Half the phishing pages in a large study were offline again after 5.46 hours, while a small share stayed far longer (Lee et al., WWW 2025).
- In the first two months of ICANN's new rules, most complaints were closed because the reporters had not contacted the registrar first (ICANN).
- Online platforms in the EU must give priority to notices from trusted flaggers. The status is awarded by the national Digital Services Coordinators (European Commission).
What does a takedown actually involve?
More than an email to the host. A complete case has nine steps, and each one takes time:
Detect: review new domains, certificates, ads and customer tips.
Check: is it really a fake, or a partner, a reseller, a fan page?
Classify: phishing, fake shop, fake support or fake verification page.
Secure evidence: screenshots, page source, registration, DNS, hosting and certificate data.
Identify the parties: host, registrar, DNS provider, CDN, platform.
Report: each channel with the right grounds, often in English.
Follow up: track ticket numbers, send reminders, escalate.
Watch: spot comebacks on new domains.
Report back: metrics for management and the legal team.
If you only plan for step 6, you will underestimate the effort every time.
Which skills does an in-house team need?
A mix of technology, law and judgment:
Technology: reading DNS, RDAP, IP networks, CDNs and TLS certificates.
Evidence handling: clean documentation with timestamps, checksums and a log.
Provider rules: Article 16 DSA, ICANN's registrar obligations and the forms of CDNs, ad platforms and social networks.
Judgment: telling real fakes apart from partner sites, so no legitimate site gets reported.
Persistence: following cases over days without losing them in the daily routine.
If one of these is missing, cases take longer. ICANN's figures show how often the process itself fails: many complaints were closed because the registrar had never been contacted first.
When does an in-house team make sense?
When three things come together: few cases, existing know-how and clear ownership. A company with one brand and a handful of finds a year can handle takedowns well itself, provided one person knows the process and has a deputy. The benefits are full control, direct coordination with legal and communications, and knowing which sites belong to partners.
When does a service provider make sense?
When volume, speed or reach overwhelms the team:
Regular cases: with several finds a week, follow-up becomes a full-time job.
Several brands or countries: every brand, language and country-code domain brings its own rules.
Response outside office hours: phishing pages don't only appear on weekdays, and in a large study half were gone after just over five hours. If you react on Monday, many victims are already lost.
Missing expertise: evidence handling and escalation paths aren't learned on the side.
Some specialised organisations hold trusted flagger status in the EU. Online platforms must handle their notices with priority. If your fakes often run through platforms, ask providers about it.
With service providers, check whether they report in your name with written authorization, how they avoid false positives and whether a person reviews every report. The selection questions are in Brand protection RFP checklist.
Is there a middle way?
Yes, and for many companies it's the best one: software that handles detection, evidence and the preparation of reports, with your own team as the decision-maker. The machine does the legwork, people review and approve. Control stays in-house without anyone searching certificate logs by hand. Why the human review is essential is explained in Human in the loop.
| Model | Control | Speed | Team effort | Fits |
|---|---|---|---|---|
| In-house team | Full | Depends on availability | High | Few cases, existing know-how |
| Service provider | Through contract and reports | High, often around the clock | Low | Many cases, several brands |
| Software with your own team | Full, with approval per report | High for detection and preparation | Medium | Regular cases, a wish for control |
How do you calculate the cost?
With a simple monthly calculation. Count the cases, estimate the hours per case across all nine steps and multiply by your internal hourly cost. Add deputies, tools and the time spent by legal and communications. Compare that with the cost of a service or software. Don't forget the other side: every day a fake stays online costs trust, support requests and, at worst, customers' money.
How does AI Fraud Protect help?
AI Fraud Protect is built for the middle way: it finds lookalike domains, cloned websites, phishing pages and fake verification pages, builds the evidence package and prepares the reports to the host, registrar, DNS provider and Google Safe Browsing. A person reviews and sends every message. Open cases stay on a follow-up list, and comebacks are linked to earlier cases.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
May a service provider report in our name?
Yes, if it discloses that it acts on your behalf and can show written authorization. Agree in advance which channels it may use and who approves reports.
How many cases can one person handle?
That depends on how much legwork is involved. Without tools, a complete case with evidence, reports and follow-up easily takes several hours. With automation for detection and evidence, mainly the review remains.
Is a service provider faster than an in-house team?
Often, because it already has the processes, contacts and availability. What matters most, though, is the quality of the reports, not just the speed of sending them.
What happens to our data?
Ask about storage location, retention periods and access rights. Evidence often contains personal data, for example from registration records or emails.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
Lee, Lim, Kim, Kwon, Kim: 7 Days Later, Analyzing Phishing-Site Lifespan After Detected, ACM Web Conference 2025
ICANN: enforcement of DNS abuse requirements, the first two months, 7 June 2024
European Commission: trusted flaggers under the Digital Services Act