Malte ZanderContents
Contact the party that controls the abuse first. If the domain was registered only to impersonate you, the registrar is your strongest lever because it can suspend the whole domain. If the fake sits on a hacked but otherwise legitimate website, the hosting provider is the right first contact. DNS and CDN providers help you forward reports and find the real host. You get the fastest result by reporting to every responsible party on the same day.
- Since 5 April 2024, registrars of generic domains such as .com must act promptly on actionable evidence of phishing (ICANN).
- Hosting services in the EU must offer a notice and action mechanism and decide on notices in a timely, diligent, non-arbitrary and objective manner (DSA, Article 16).
- Cloudflare does not remove content it does not host. It forwards reports to the website operator and the hosting provider and gives the host the origin IP (Cloudflare).
- DENIC, the registry for .de, says it cannot remove phishing pages (DENIC).
Who can actually remove a fake website?
Four parties, each at a different point. The hosting provider controls the content on its servers. The registrar controls the domain. The DNS provider controls the records that point a domain to a server. A CDN only delivers the site and does not host it.
| Party | What it can do | What it can't do |
|---|---|---|
| Hosting provider | Remove the page, the files or the whole account | Suspend the domain |
| Registrar | Suspend the domain so it no longer resolves anywhere | Delete single files on someone else's server |
| DNS provider | Remove records or switch off the zone | Delete content at the host |
| CDN | Forward reports, name the host, end its services | Remove content it doesn't host |
That leads to the most important rule: ask each party only for what it can do. A request to a CDN to delete a page ends up with the host anyway. A request to a registrar to remove a single subpage is one it can't fulfil.
When is the registrar the strongest lever?
When the domain itself is part of the fraud. Typical examples are lookalike domains such as your-brand-login.com, typo domains and addresses with confusable characters. These domains have no legitimate purpose, and a suspension at the registrar takes the site offline in one step, whichever host it uses and however often it moves.
For generic domains such as .com, .net or .shop, the obligations in ICANN's registrar agreement have applied since April 2024. Registrars must act promptly on actionable evidence of phishing. ICANN's advisory gives the example of a suspension within two business days for a domain registered only for phishing and stresses that this is not a contractual deadline (ICANN).
For country-code domains such as .de, .uk or .ch, the rules of each registry apply. For .de, your contacts are the host and the registrar that manages the domain for its holder. DENIC itself does not remove phishing pages.
When is the hosting provider the right first contact?
When the domain belongs to an uninvolved third party. Criminals often upload phishing kits to hacked websites, such as a blog or a small shop running outdated software. The domain is legitimate, only one folder on it is not. Suspending the domain would hurt an owner who is a victim too. Here the report goes to the host and, if you can reach them, to the site owner.
For hosting providers in the EU, Article 16 of the Digital Services Act applies. A notice with a reason, the exact URL, your name and email address and a statement of good faith obliges the host to decide in a timely and diligent way. It must confirm receipt if you give electronic contact details, and it must tell you its decision (DSA, Article 16).
The host is also a strong lever for fake shops and fake verification pages on servers rented for the purpose. It can close the operator's whole account, not just one page.
What role do DNS and CDN providers play?
They are signposts, rarely the final stop. The DNS provider appears in the domain's name server records. Often it is the registrar itself, sometimes a separate service. A DNS provider can remove the records, and the site is then unreachable under that domain. That helps when the registrar is slow.
A CDN such as Cloudflare sits between visitors and the actual server. The domain's IP address then belongs to the CDN, not to the host. Cloudflare forwards complete reports to the website operator and the hosting provider and gives the host the origin IP so it can find the content (Cloudflare). The details are in Taking down a site behind Cloudflare or another CDN.
How do you tell which case you have?
With five questions you can answer in a few minutes:
How old is the domain? The creation date is in the RDAP data, for example in ICANN's lookup tool. A domain registered a few days ago was usually set up for the fraud.
Does the name resemble your brand? Typos, additions such as -login or -support and confusable characters point to an abusive registration.
Is there other content on the domain? A genuine blog with the fake in a subfolder points to a hacked website.
Where does the IP address point? If it belongs to a CDN, you need the host behind it. If it belongs to a host, its abuse contact is in the network records.
Who runs the DNS? The name servers show whether the registrar or a separate provider is responsible.
| Finding | First contact | Report in parallel |
|---|---|---|
| Lookalike domain, registered for the fraud | Registrar | Host, Google Safe Browsing |
| Hacked legitimate website | Host and site owner | Google Safe Browsing, no suspension request to the registrar |
| Site behind Cloudflare | Cloudflare to forward, the host once known | Registrar for a lookalike domain, Safe Browsing |
| Free website builder or cloud storage | The platform itself | Safe Browsing |
Why not just report to everyone at once?
That is exactly what you should do, with the right request to each party. Each one works through its own queue, and the fastest channel ends the harm. If you wait for the host's answer before writing to the registrar, you lose days. A report to Google Safe Browsing always belongs in the set, because a browser warning protects visitors before the site is removed.
The exception is the hacked website. There you don't ask the registrar for a suspension. You inform the host and the owner. The reasoning is in One find, many reports: why parallel takedowns work faster.
How does AI Fraud Protect help?
AI Fraud Protect identifies the registrar, host, DNS provider and CDN for every find and builds the evidence package automatically. It prepares the report for each channel with the right framing: a suspension at the registrar for abusive domains, removal at the host for hacked sites. A person reviews and sends every message, and open cases stay on a follow-up list until the fake is gone.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Can a registrar remove a page on a hacked website?
No. It can only suspend the whole domain, which hurts the uninvolved owner. Hosts and site owners are responsible for hacked websites.
Where do I find a registrar's abuse contact?
In the domain's RDAP data. ICANN's lookup tool shows the registrar and its abuse contact for generic domains. For country-code domains, use the WHOIS or RDAP service of the registry concerned.
Do I have to contact the site operator first?
Not for domains registered for the fraud: the operator is the criminal, and a message only warns them. For hacked websites, the owner is often grateful for the tip.
What if the host and the registrar are the same company?
Then one report to its abuse team, which controls both levers, is often enough. Still state clearly whether you want the domain suspended, the content removed or both.
Sources
ICANN advisory: DNS abuse obligations in the registrar and registry agreements, 5 February 2024
Digital Services Act, Article 16, with the official text on EUR-Lex