A phishing takedown is the process of getting a phishing site removed or blocked by reporting it to registrars, hosts, CDNs and browser blocklists.
A phishing takedown is the process of getting a phishing website removed from the internet, or at least made unreachable and flagged, by reporting it to the companies that make it work. A complete takedown usually combines removal at the source (registrar or host) with blocking in browsers and security products, so people are protected while the removal is in progress.
How it works
- Verify: confirm the site is genuinely malicious and impersonates the brand, and capture evidence as victims see it.
- Map the infrastructure: identify the registrar, hosting provider, any proxy or CDN such as Cloudflare, and related domains.
- Report at the source: send abuse reports to the registrar and host. Cloudflare does not host content itself; it forwards complete reports to the hosting provider and site owner, and can show a warning page in front of confirmed phishing.
- Block in parallel: submit the URL to Google Safe Browsing, Microsoft SmartScreen, Netcraft and APWG, and in Türkiye to USOM.
- Follow up and monitor: chase open tickets, confirm the site is down and watch for it to reappear on new domains.
Example
As an illustration, a fake parcel-tracking page on examplecargo-track[.]com is reported by several customers. After verification, the domain is reported to its registrar, the server's host and Cloudflare, and the URL is submitted to browser blocklists. Browser warnings appear first, and the registrar suspends the domain after reviewing the evidence. Two days later, the same kit appears on a new domain and the process starts again, faster this time.
When to use it
- A live site imitates your brand to collect logins, payments or personal data.
- Customers or employees report receiving links to a site that is not yours.
- A monitored lookalike domain starts serving phishing content.
- A cloned page of your site appears on someone else's server.
What brands can do
Decide in advance who handles takedowns, what evidence is required and who signs authorizations. Provide a letter of authorization if a partner files on your behalf, and give customers an easy way to report suspicious sites. Track how long each provider takes, and use blocklists to protect users during the wait. Phishvoid's team verifies sites and files takedowns across all of these channels; you can report a site or contact us.
Read more: The Phishing Site Takedown Process, Step by Step
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.