Found a Site Impersonating Your Brand? The First 24 Hours

A practical first-day playbook for brand and security teams: capture evidence, assess impact, get the site blocklisted, request takedown and protect customers.

Someone in your team, or worse, a customer, has just sent you a link to a website that looks exactly like yours. It may be a cloned login page, a fake checkout or a “support” portal asking for card details. What you do in the next 24 hours largely decides how many people it reaches. This playbook is written for brand, security and marketing managers who need a clear order of operations.

First hour: preserve evidence before anything changes

Phishing sites are short-lived and often change or disappear once reported. Before you file a single complaint, capture what you are seeing.

• Full URLs, including paths and parameters, of every page in the flow: landing page, login form, card form, “success” page.
• Screenshots with timestamps, ideally from a mobile and a desktop browser, since many kits only show content to phones or to visitors from a specific country.
• The lure: the SMS, e-mail (with full headers), ad or social post that pointed to the site.
• Technical data: WHOIS or RDAP for the domain, the IP address it resolves to, the network (ASN) that owns that IP, and any CDN in front of it.

Use an isolated browser profile or a virtual machine, and never type real credentials into the forms. If you need to see the next step, use obviously fake test data.

Hours 1 to 3: understand what you are dealing with

A quick assessment helps you prioritize and makes your reports more convincing.

• What does it collect? Passwords, card numbers, one-time codes and ID numbers each carry a different level of risk and require different internal responses.
• How is it distributed? An SMS campaign, a paid search ad and a single forum post call for very different reach estimates.
• Is it part of a cluster? Sites built from the same kit often share an IP address, a registrar, a page title or file names. Finding siblings now saves time later.

Hours 2 to 6: get it blocklisted

Takedown can take time, but browser warnings can protect people much sooner. Report the URLs to Google Safe Browsing, Microsoft SmartScreen, Netcraft, APWG and PhishTank. Once a URL is listed, major browsers and many security products display a full-page warning instead of the fake site. In Türkiye, also report it to USOM, whose list of malicious links is used for blocking at the network level.

Do not forget your own perimeter: add the domain to your e-mail gateway, web proxy and DNS filtering so employees are protected too.

Hours 3 to 12: request the takedown

Now contact the parties that can actually remove the site:

1. The hosting provider, through its abuse contact, to remove the content.
2. The domain registrar, to suspend the domain, which also kills any e-mail sent from it. For some country-code domains the registry itself has an abuse process.
3. The CDN or proxy, if the site hides behind one. See our guide to taking down a phishing site behind Cloudflare.

Keep each report short and factual: what the site impersonates, which URLs, what it collects, and your evidence. If an agency reports on your behalf, providers may ask for proof that it is authorized to act for the brand, usually a signed letter of authorization.

In parallel: protect customers and the business

• Brief your contact center and social media team so they recognize related complaints and give consistent answers.
• Alert fraud and identity teams to watch for suspicious logins, password resets or card transactions linked to the campaign, and to force resets on accounts known to be exposed.
• Decide on communication. A short warning on your site or social channels can help, but never publish the live phishing link as a clickable address.
• Involve legal and privacy colleagues early if customer data may have been captured, as notification duties under KVKK, GDPR or sector rules may apply.

Hours 12 to 24: follow up and watch for the next one

Many reports receive only an automated reply at first. Check whether the site is still reachable from different locations and devices, and follow up with new evidence where needed. Confirm that blocklist warnings are showing. Then start monitoring: phishing kits are routinely redeployed on fresh domains, often within days, so a single takedown rarely ends a campaign. Our article on the takedown process step by step covers this in more depth.

Make the next 24 hours easier

The teams that respond best have already decided who owns the process, where evidence is stored and who signs off on customer messages. Write it down once, and the next incident becomes routine rather than a scramble.

Phishvoid can take this whole workflow off your plate, acting under your signed letter of authorization, with unlimited takedowns in one subscription. Report a phishing site now, or book a free exposure scan to find out what else is targeting your brand.