How We Verify and Take Down Phishing Sites

Principles

• A person decides. Automated tools help us find sites, but a human verifies every one before a report goes out.
• Evidence first. Every report we file is backed by evidence that the provider receiving it can check for itself.
• Authorization before action. We only file notices in a brand’s name when the brand owner has authorized us in writing.
• Accuracy over volume. We report what we can show, nothing more. A wrong report harms a real site owner and wastes the time of the people who act on abuse reports.
• Openness. This page describes how we work, and anyone who believes we made a mistake can appeal.

How a site reaches us

Suspicious sites come to us in three ways:

• Client monitoring. For each client we watch for new sites and domains that imitate their brand.
• Client reports. Clients forward sites they have found themselves or that their customers have sent them.
• Public reports. Anyone can report a site on our website, whether or not the brand it imitates is one of our clients.

Every site becomes a case with the status New, whatever the source.

Manual verification and evidence

A member of our team reviews each site by hand and decides whether it really is phishing: whether it impersonates a brand and tries to collect logins, card or bank details, one-time codes or other personal data, or to trick people into paying or installing something. Sites that only mention a brand, criticize it, or resell its products legitimately are not phishing.

For every verified case we capture:

• the full URL and any redirect chain;
• screenshots of the pages;
• the page source, where it is safe to collect it;
• timestamps of when we observed the site;
• DNS records and IP addresses;
• the hosting network;
• the registrar, looked up through RDAP;
• whether the site sits behind Cloudflare.

This evidence travels with every report we file, so the provider can confirm the problem without having to reproduce it. If a site is not phishing or falls outside our scope, we mark it Invalid and take no action against it. If we cannot yet show that a site is phishing, we do not report it.

Authorization

Before we file any notice in a brand’s name, such as a takedown request to a host or a copyright notice, the brand owner signs a letter of authorization (LoA). It confirms that we may act on their behalf and for which brands and marks.

When someone reports a site that imitates a brand we do not work for, we do not claim to speak for that brand. We only submit the site to public blocklists and CERTs, which evaluate it independently and decide for themselves.

Channels and order

For a verified client case we file through every channel that applies, in this order:

1. Browser and security blocklists: Google Safe Browsing, Microsoft SmartScreen, Netcraft, APWG (reportphishing@apwg.org) and PhishTank.
2. Infrastructure: Cloudflare abuse when the site is behind Cloudflare, the hosting provider’s abuse desk, and the registrar’s abuse contact.
3. Copyright notices: DMCA notices to hosts and CDNs, and to Google Search to remove the page from results, when the site copies the brand’s content.
4. National CERTs: USOM (Cyber Security Presidency of Türkiye) for .tr domains and sites that target people in Türkiye.
5. Platforms: social media and app store reporting forms, when the scam runs on or is promoted through a platform.

Why blocklists come first. Removing a site at the source depends on a host or registrar reviewing the report, and that can take longer. Blocklists usually act within hours, and once a site is listed, major browsers and security tools warn people before the page loads. That protects users while the host and registrar do their part. In practice we file with all the relevant channels on the same day; the order simply reflects what protects people fastest.

Follow-up and re-checks

Filing a report is not the end of a case. We re-check each site, follow up with providers that have not acted, and escalate where the provider offers a way to do so, until the site is offline. After that we keep watching: phishing sites often return on the same domain, a new path or a new host. If one comes back, we reopen the case and report it again with the new evidence. The result of every re-check is added to the case record, so we can show when a site went offline and whether it returned.

Case statuses

New

The site has reached us and is waiting for manual review.

Verified

A team member has confirmed it is phishing and captured the evidence.

Reported

Reports have been filed with the relevant channels and we are following up.

Taken down

The site is offline or no longer serves the phishing content. We keep watching for its return.

Invalid

The site is not phishing or is outside our scope. No action is taken.

What we never do

• We never launch DDoS attacks or any other attack against a site.
• We never “hack back” or try to break into the infrastructure behind a phishing site.
• We never submit false or exaggerated reports.
• We never pay anyone to remove content.
• We never file notices in a brand’s name without its authorization.

Mistakes and appeals

We work carefully, but no process is perfect. If you run a site and believe we reported it by mistake, you can appeal or write to abuse@phishvoid.com. A person reviews every appeal. If we got it wrong, we withdraw our reports, tell every provider and blocklist we contacted that the report was a mistake, ask them to reverse their action, and remove any public record of the case.

Reporting to clients

Each client receives a monthly brand report listing every case: what we found, the evidence, which channels we reported to and when, and when each site went offline. Clients can see exactly what was done in their name and how long each step took.