How it works
You report the malicious URL to the relevant blocklists with evidence. Once listed, major browsers show a warning interstitial and many email filters block links to it. Blacklisting does not delete the site, but it cuts off most of the traffic that makes it profitable.
It is fast and works in parallel with a full takedown, protecting users during the window before the host removes the content.
How it relates to brand impersonation
A phishing or impersonation site only works if victims can reach it. Blacklisting shrinks its audience immediately, which is why it belongs in the takedown flow rather than as an afterthought.
How nebty helps
nebty submits confirmed threats to the relevant blocklists as part of every takedown, so customers are protected even before the page is fully removed.
What blacklisting does and does not do
Blacklisting is fast and wide, but it is not the same as removal. Listing a URL on Safe Browsing, the APWG feed, or similar blocklists means most mainstream browsers show a red warning screen and many mail providers block links to it, which cuts off the bulk of a phishing campaign within minutes. What it does not do is take the content offline: the page still exists for anyone who ignores the warning or uses a tool that does not check the list, and the attacker can move the same kit to a fresh domain. That is why blacklisting is a first move rather than the finish line. Run it in parallel with a host or registrar takedown so users are protected immediately while the slower work of actually removing the page plays out.
