Website Takedown: How to Get a Fake or Phishing Site Removed

Phishing has not slowed down. The Anti-Phishing Working Group counted 971,181 phishing attacks in the first quarter of 2026, up from 853,244 in the last quarter of 2025, after 3.8 million attacks across all of 2025. Most of them run on domains bought for the purpose: Interisle's Phishing Landscape 2025 found that 77% of the domain names used for phishing between May 2024 and April 2025 were registered by the criminals themselves, not hacked.

That second number is good news for anyone who wants a site removed. A domain registered for fraud has no legitimate owner to protect, so the registrar can suspend it outright. This guide shows who can act, how to find them, what to send, and where self-service stops working. It reflects the rules in force in October 2026, including ICANN's 2024 abuse obligations, the EU Digital Services Act and the new DENIC WHOIS for .de.

Who can actually take a fake website offline?

The person behind the site is almost never within reach. The companies it depends on are. Each of them controls a different layer, and each can switch off a different part.

Why do providers act on abuse reports?

Three sets of rules give a well documented report weight. For generic TLDs such as .com, .shop or .online, ICANN's contract amendments in force since 5 April 2024 require registrars to publish an abuse contact on their homepage, confirm receipt of each report, and take "appropriate mitigation action" once they have actionable evidence that a domain is used for phishing, malware, botnets or pharming. ICANN enforces this: in the first two years it opened nearly 530 investigations, and about two thirds ended with the registrar or registry acting on the domain.

In the EU, the Digital Services Act has applied to all hosting providers since 17 February 2024. Article 16 requires them to offer an electronic notice mechanism, and a precise, substantiated notice can give them the "actual knowledge" that ends their liability shield under Article 6 unless they act quickly. Everywhere else, the provider's own terms of service do the work: no mainstream host or registrar allows phishing or fraud on its platform.

Step 1: Preserve the evidence before you report

Fake sites change or disappear as soon as their operator feels pressure, and some show different content depending on the visitor's country or device. Capture the evidence first, and do it without opening the site in your normal work browser: our guide to investigating a suspicious website safely explains why and how.

• The exact URLs, not only the domain: the login form, the checkout, the page that asks for payment.
• A full-page screenshot with date, time and visible URL.
• The HTML source, which shows copied assets, form targets and tracking IDs.
• How people reached the site: the phishing email with headers, the SMS, the ad or the search result.
• Proof of your rights: trademark registration number, your official domain, the original images or texts that were copied.
• Customer complaints that show actual harm, with personal data removed.

Step 2: Find the host, the registrar and any CDN in front

You need three answers: who registered the domain for the operator, which network serves the content, and whether a proxy sits in between. Our free Who is hosting lookup returns the hosting provider, IP, ASN, registrar, nameservers, mail servers and the known abuse contact in one query. To do it by hand:

• Registrar: look the domain up in ICANN Lookup. Since 28 January 2025, RDAP has replaced WHOIS as the authoritative source for gTLD registration data. The registrant is usually redacted, but the registrar and its abuse email are listed.
• .de domains: the DENIC WHOIS names the managing DENIC member, which is the registrar. Since 28 January 2026 it also shows name and contact details of registrants that are companies, a result of the German NIS2 implementation.
• Host: resolve the A and AAAA records (with dig or nslookup), then look up the IP at the regional internet registry (RIPE, ARIN and so on) to see which organisation and autonomous system (ASN) it belongs to.
• Proxy: if that organisation is Cloudflare or another CDN, you have found the front door, not the host. Report to the CDN, which can name the host.

Sometimes the host and the registrar are the same company, which saves a report. If the domain looks harmless and the fake page sits in a subfolder, a legitimate site has probably been hacked. Then the host and the site owner are the right contacts, not the registrar. Our article on the Domain Name System explains the record types behind these lookups.

Step 3: Send abuse reports to the host and the registrar

An abuse report is read by a support agent with a queue, and the first pass is often automated. Write it so the agent can verify the fraud in a minute without taking your word for anything.

Use the provider's abuse form where one exists; Cloudflare, for example, does not reliably process complaints sent by email. Its phishing reports need the domain and the specific phishing link, and Cloudflare passes complete reports to the host and to the site owner. Assume the operator will read whatever you send, so leave out internal details.

For registrars, the free NetBeacon Reporter run by the NetBeacon Institute sends phishing and malware reports in a standard format to the registrars that subscribe to it. Keep the tone factual. Threats and long legal arguments slow the review down.

Step 4: Report the URL to browser blocklists

Blocklisting does not delete anything, but it puts a full-screen warning between the site and your customers, often before the host has replied.

• Google Safe Browsing via the phishing report form (up to 10 URLs per report). Google says Safe Browsing protects more than five billion devices; Chrome, Firefox and Safari use its lists.
• Microsoft SmartScreen via Report an unsafe site, which covers Edge and Windows.
• APWG: forward phishing emails to [email protected].
• Ads and search: report the ad on Google or Meta directly. Our research on fake shops in Google Ads shows how often paid ads carry the traffic.

Step 5: Follow up, escalate and watch for the next domain

If nothing happens within two to three business days, reply to the ticket and ask for the status. When a provider stays silent, escalate one level up:

• Registrar of a gTLD ignores you: file a complaint with ICANN Contractual Compliance under the category for a registrar that failed to investigate or respond to an abuse report. Attach your report and the confirmation of receipt.
• Host ignores you: contact the upstream network provider that routes the host's IP range, and the registry of the TLD.
• ccTLD domains follow the rules of their registry, not ICANN. Check the registry's abuse page first.

A takedown ends one site. The people behind it often register the next domain the following week, sometimes dozens at once. Our DoppelCart investigation traced one fake shop network to around 119,000 domains. Watch new registrations around your name with domain monitoring, register the obvious variants of your own domain, and publish a list of your official domains so customers and support staff can check.

Which reporting channel fits which incident?

The right first contact depends on what the fake site is and how people reach it.

How long does a website takedown take?

There is no public dataset on takedown times across providers. The ranges below come from our own casework and from the published UDRP timelines, so read them as orientation, not a promise.

The biggest factor you control is the first report. A report the agent can verify in a minute gets handled; a vague one gets a template reply asking for more information, and the clock starts again.

Abuse report, UDRP or cease and desist: which route fits?

Abuse reports and legal routes answer different questions. The abuse report asks a provider to stop a fraud on its platform. The legal routes decide who owns a domain or who has to stop doing something, and they need either a reachable opponent or a dispute procedure.

Under the UDRP you have to show that the domain is identical or confusingly similar to your trademark, that the holder has no legitimate interest in it, and that it was registered and is used in bad faith. WIPO handled more than 6,200 domain cases in 2025, its highest caseload so far, and only 5% of complaints were denied. The filing fee is 1,500 USD for one to five domains with a single panelist and 4,000 USD with three.

.de domains are not covered by the UDRP. DENIC offers a DISPUTE entry instead: the holder keeps using the domain but cannot transfer it, and if they release it, it passes to you. DENIC itself states that it is not able to remove phishing sites, so for a live .de phishing page the host and the registrar are the contacts. Our cybersquatting guide covers the legal routes in more depth. This article is not legal advice.

Should you report it yourself or hire a takedown service?

One clear phishing page at a responsive registrar is a job you can do yourself in an hour with this guide. It gets harder when a proxy hides the host, when the provider sits in a jurisdiction that ignores email, or when the site is one of twenty.

nebty runs website and domain takedowns and phishing takedowns on demand. According to our pricing, a successful takedown costs 400 euros on demand or 300 euros for monitoring customers, and you pay nothing if the site stays up.

Frequently asked questions