A domain takedown service gets a malicious domain suspended at the registrar. See when suspension works, when UDRP fits better and what results to expect.
Quick answer: A domain takedown service gets a malicious domain name switched off at the registrar or registry, so every page and email address on it stops working at once. It works best when the domain is actively used for phishing or malware, which accredited registrars are contractually required to act on. When a domain only uses your trademark without hosting anything harmful, a suspension is unlikely, and the usual routes are a UDRP or URS complaint, normally filed with the help of trademark counsel.
Removing content from a host fixes one website; suspending the domain fixes everything that depends on it, including copies on other servers and email sent from it. This article covers that domain layer specifically: what a suspension is, when registrars grant one, when a dispute procedure fits better, and what a service can realistically deliver. For the full workflow around a phishing site, see the phishing site takedown process, step by step.
What taking down a domain actually means
Three parties control a domain name: the registry that runs the extension (such as .com or .shop), the registrar that sold the name, and whoever provides its DNS and hosting. A domain takedown usually means the registrar or the registry places the name on hold, so it is no longer published in the DNS and stops resolving.
ICANN's list of domain status codes describes both versions. clientHold is set by the registrar and tells the registry not to activate the domain in the DNS; serverHold is set by the registry itself (ICANN). You can see either status in a free lookup at ICANN Lookup.
A hold is not a transfer. The domain stays registered to the same person until it expires, and after that it can usually be registered again. If you want to own the name, you need a different route, covered below.
When a registrar will suspend a domain
Since 5 April 2024, ICANN's agreements with gTLD registrars and registries require them to take mitigation action against well-evidenced DNS abuse. ICANN defines DNS abuse as malware, botnets, phishing, pharming, and spam when it is used to deliver those (ICANN). A clear phishing report therefore carries real contractual weight, provided the evidence is good: full URLs, screenshots, what the page collects and why it is not legitimate.
Two limits matter in practice:
- Country-code domains such as .uk, .de or .com.tr are run by national registries under their own policies rather than ICANN contracts. Some act quickly on phishing; others refer complaints to a court, a CERT or the registrant first.
- Compromised domains belong to victims. When a small business's site is hacked and used to host a phishing page, suspending the whole domain would punish the owner. Hosts and registrars usually remove the content or contact the owner instead, and a good service reports it that way.
When suspension is not the right tool
Many lookalike domains are parked, offered for sale or showing ads, with nothing that counts as DNS abuse. ICANN states that trademark infringement complaints about website content and domain names are outside its scope and authority, and points brand owners to the dispute policies instead (ICANN). Those policies are:
- UDRP: available for all gTLDs and adopted by a number of country-code registries. The panel can order the domain transferred or cancelled, but cannot award damages. WIPO says its cases are normally concluded within two months (WIPO), and its fee for one to five domains decided by a single panelist is USD 1,500 (WIPO). See our UDRP glossary entry for the three conditions a complaint must prove.
- URS: a faster procedure for newer gTLDs. Its only remedy is suspension for the rest of the registration period, after which the name becomes available again (ICANN).
- Court action, when the domain is part of a wider dispute or you need remedies the policies cannot give.
| Situation | Best first route | Typical outcome |
|---|---|---|
| Domain hosts a live phishing page | Abuse report to registrar, host and blocklists | Domain put on hold; it stays registered until expiry |
| Hacked legitimate site hosts phishing | Report to host and site owner | Content removed; domain unaffected |
| Lookalike domain parked or for sale | UDRP, or URS for newer gTLDs | Transfer or cancellation (UDRP), suspension (URS) |
| Domain used for a counterfeit store | Host, payment and platform reports, plus UDRP | Varies by host and registrar |
Counterfeit stores sit in between, because selling fakes is not on ICANN's DNS abuse list. Our guide to counterfeit website takedown covers the levers that work there.
What a domain takedown service should do
The paperwork for a single suspension looks simple. The value of a service lies in doing it reliably, at volume and across many registrars:
- Find the right party. Identify the registrar through RDAP, the registry for country-code domains, and any reseller between them.
- Build evidence an abuse desk can verify in minutes. Include notes on cloaking, such as content shown only to mobile visitors or certain countries, so the reviewer sees what victims see.
- Work the other layers in parallel. Blocklist the URLs and report the host and any CDN at the same time; our guide to phishing sites behind Cloudflare explains why the proxy is rarely the host.
- Confirm the result. Check the RDAP status and DNS resolution rather than relying on an emailed promise.
- Watch what comes next. Sibling domains, re-registration after expiry and the same kit on new names.
- Say when abuse is the wrong route. Many takedown providers do not file UDRP complaints themselves; a good one tells you early when a case belongs with your trademark counsel.
Phishvoid covers the abuse route: a human team verifies each domain and reports it to registrars, hosts, CDNs and blocklists under one subscription with unlimited takedowns.
What results to expect
- Suspension ends the attack on that domain, not the campaign. Expect the operator to move to another name, which is why monitoring matters.
- The name stays with the registrant. For your most dangerous variations, a UDRP transfer or a defensive registration may be worth more than repeated suspensions.
- Timing depends on the registrar. Large registrars with staffed abuse desks generally move faster than reseller chains or registries with court-based processes.
- Requests for more information are normal. A registrar may ask for extra evidence or proof that the reporter is authorized by the brand.
To spot candidates before they go live, run your domain through the lookalike domain finder and review new registrations regularly.
FAQ
Can a domain be deleted through a takedown?
Not usually. A takedown puts the domain on hold so it stops resolving. Cancellation comes through a UDRP decision, and otherwise the name simply lapses when its registration expires.
How much does a domain takedown cost?
Filing an abuse report with a registrar is free; you pay for the time or for a service to do it. A UDRP complaint at WIPO costs USD 1,500 in fees for one to five domains with a single panelist, plus any legal fees.
How long does a domain takedown take?
Abuse suspensions depend on the registrar and the strength of the evidence. A UDRP case at WIPO is normally concluded within two months, plus time for the transfer to be carried out.
Can I get the domain transferred to my company?
Only through a UDRP decision or a court order. An abuse suspension and a URS decision both leave the registration with the current holder until it expires.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.