How long does it take to take down a phishing site? See what research shows, why some sites vanish in hours and others last weeks, and what speeds it up.
Quick answer: There is no fixed deadline for taking down a phishing site. Many go offline within hours of being detected, while a minority stay up for days or weeks. A 2025 study of 286,237 phishing URLs found a median lifespan after detection of 5.46 hours but an average of 54 hours, because a long tail of sites survives much longer. How long your case takes depends on who has to act, how strong your evidence is, whether the domain was registered by criminals or hacked, and how responsive the provider is.
This article sets out what the research shows, why nobody can promise a takedown time, and which factors you can influence. For the sequence of steps itself, see the phishing site takedown process, step by step.
What the research shows
Reliable public data on takedown times is scarce, and vendor figures are hard to compare because each one measures something different. The most useful independent source is a peer-reviewed study presented at the ACM Web Conference 2025, "7 Days Later: Analyzing Phishing-Site Lifespan After Detected" by Lee, Lim, Kim, Kwon and Kim. The researchers took 286,237 phishing URLs from the APWG feed over five months and checked each one every 30 minutes until it went offline.
- Median 5.46 hours, average 54 hours. Half the sites were gone within about five and a half hours of appearing in the feed. The average of 54.04 hours (2.25 days) is much higher because a minority of sites lasts far longer.
- The theme matters. Delivery-themed phishing had median lifespans under two hours (1.71 to 1.89 hours for the logistics brands studied), while phishing that imitated a large social network had a median of 8.68 hours.
- Blocklists are not instant. Google Safe Browsing listed only 18.4% of the sites in the dataset, taking an average of 4.5 days. Sites still online when Safe Browsing flagged them stayed up for about 7.2 more days on average.
- Most sites end at the domain level. A DNS resolution failure, meaning the domain stopped resolving, was the most common way sites went offline, at about 67% of takedowns.
- Active operators last longer. Sites whose appearance changed more than 100 times had a median lifespan of 17 days, compared with 1.93 hours for sites with minimal changes.
- Some come back. About 3.2% of URLs became reachable again after being offline for 90 minutes.
One caveat: the clock in this study starts when a URL appeared in the APWG feed, not when the site went live or when you reported it. Real exposure is longer than these figures, and your own report may arrive hours or days after the first victim.
Why nobody can promise a takedown time
A takedown depends on organizations you do not control. Hosting providers, registrars, CDNs and platforms each review abuse reports under their own policies and staffing.
For generic top-level domains, ICANN's 2024 amendments to the registrar and registry agreements, in force since 5 April 2024, require registrars and registry operators to confirm receipt of abuse reports and to promptly take appropriate mitigation action when they have actionable evidence of DNS abuse such as phishing. ICANN states that the amendments do not specify the mitigation actions or their timing, which depend on the circumstances of each case. Enforcement is real: ICANN reported that in the first six months its compliance team opened 192 investigations, leading to the suspension of more than 2,700 abusive domain names and the takedown of more than 350 phishing websites. But there is still no contractual clock you can point to. Country-code domains and hosting providers follow their own rules.
Factors that speed up or slow down a takedown
Malicious domain or hacked website
Interisle's Phishing Landscape 2025 study found that 77% of domain names used in phishing were registered by criminals. For those, the registrar can suspend the whole domain once the evidence is clear. A phishing page planted on a hacked legitimate website is different: the domain belongs to an innocent business, so the host or site owner must remove the page without taking the business offline. That usually means more back and forth.
Quality of the evidence
Reviewers act on what they can verify. Full URLs, timestamped screenshots, the brand being imitated and what the page collects make a report actionable. Phishing kits often use cloaking and show the fake page only to phones or to visitors from one country; if you don't explain how to reproduce it, the reviewer may see a harmless page and close the ticket.
Which layer you report to
The host can remove content, the registrar can suspend the domain, and a CDN usually forwards the complaint to the real host. Reporting only to the CDN adds a step. Our guide to phishing sites behind Cloudflare explains how to run those tracks in parallel.
Provider responsiveness
Some providers handle abuse reports around the clock; others reply slowly or not at all. Sites on bulletproof hosting are built to ignore complaints, which shifts the effort to the registrar, upstream networks and blocklists.
Authority to act
Brand owners and their agents are more convincing than anonymous reporters. An agency acting for a brand may be asked for a letter of authorization, and having it ready avoids a round of email.
Persistence of the operator
The study above shows that actively maintained sites last far longer. Operators who rotate domains, redeploy the same kit and change the page's look keep a campaign alive even after individual URLs fall.
Realistic expectations, stage by stage
- Blocklist warnings can protect visitors before the site is removed. Report every URL to Google Safe Browsing, Microsoft SmartScreen and Netcraft rather than waiting for automatic detection, which the study above shows can lag by days.
- Provider reports often get an automated acknowledgement first. An acknowledgement is not a takedown, so recheck the site from more than one location and device.
- Follow-up matters most for the long tail. Resubmit with fresh evidence if the site changes, and escalate to the registrar or upstream network if the host does not act.
- Search results can linger after the site goes offline. Our guide on how to remove a scam site from Google Search covers clearing them.
- Monitoring continues after the takedown, because some sites come back and many campaigns move to a new domain.
How to shorten the window
- Detect early: watch new lookalike domain registrations and certificates, not just customer complaints.
- Capture evidence once and reuse it in every report.
- Report to blocklists and to the host, registrar and CDN at the same time, not one after another.
- Keep a letter of authorization and trademark details ready.
- Track every ticket and follow up on a schedule until the site is confirmed offline.
Our first 24 hours playbook turns this into an hour-by-hour plan. This parallel, persistent approach is what a managed service adds. Phishvoid's team verifies each site and then reports it to blocklists, hosts, registrars and CDNs together, following up until it is offline, under one subscription with unlimited takedowns and a quote after a demo.
FAQ
Can a phishing site be taken down within hours?
Yes. In the 2025 study of 286,237 phishing URLs, half of the sites were offline within 5.46 hours of appearing in the APWG feed. That is a median, not a promise: the average was 54 hours because some sites lasted days or weeks.
Why is the site still online after I reported it?
Common reasons are an automated acknowledgement that has not reached a reviewer yet, cloaking that hides the page from the reviewer, a hacked legitimate site that needs careful cleanup, or an unresponsive host. Follow up with fresh evidence and report to the registrar and blocklists as well.
Is blocklisting the same as a takedown?
No. Blocklisting makes browsers and security tools warn people or block the link. The site still exists until the host removes it or the registrar suspends the domain. Both are worth doing, because warnings often arrive first.
Do registrars have a legal deadline to act?
Not a fixed one. Since April 2024, ICANN requires registrars of generic top-level domains to act promptly and appropriately on well-evidenced phishing, but it does not specify timing. Country-code registries set their own rules.
Can a taken-down phishing site come back?
Yes. In the 2025 study, about 3.2% of URLs became reachable again after being offline, and operators often redeploy the same kit on new domains. Keep monitoring after the takedown is confirmed.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.