Domain takedown: how to report phishing sites

What is a domain takedown?

A domain takedown is the work of getting a malicious domain, or the site on it, switched off by the parties that control it: the registrar, the registry, the hosting provider or a dispute panel. It usually starts when someone finds a lookalike domain hosting a copy of your login page, sending invoice fraud or serving malware.

There are two broad routes. Abuse reports ask providers to act under their own rules and contracts. Legal procedures such as UDRP and URS are formal complaints decided by an independent panel. Legal takedowns are run by a specialist firm or counsel that you contract with directly.

What evidence should you collect first?

A clear report gets acted on; a vague one waits. Collect evidence from an isolated browser or a separate device, and never enter data on the site.

• The complete URL of the abusive page, not only the domain.
• Screenshots that show the address bar, with the time taken.
• Any emails or messages that point to the page, with full headers.
• The domain's registration data and the IP address it resolves to.
• One line on why it is abusive: which brand it copies and what it asks visitors to do.

ICANN's guidance to registrars gives "the complete URL where the abuse is located" and a screenshot of the suspected phishing attempt as examples of useful evidence, and encourages reporters to provide as much information as possible.^[1]

Who do you report a phishing domain to?

First work out who controls each layer. Registration data now comes through RDAP, which ICANN describes as "the replacement for the WHOIS protocol".^[2] A lookup shows the sponsoring registrar and its abuse contact; an IP lookup shows the network that hosts the site.

Then report to each of them in parallel:

• The registrar. ICANN's Registrar Accreditation Agreement requires an abuse contact and "reasonable and prompt steps to investigate and respond appropriately to any reports of abuse".^[3]
• The hosting provider. Its abuse desk can remove the page even while the domain stays registered.
• Any proxy or CDN in front of the site. Cloudflare, for example, takes reports through its abuse form, lists phishing and malware as a category, and says it is generally unable to process complaints sent by email.^[4]
• The mail provider, if the domain sends email through a large mailbox service.

Keep a log of every report: where it went, when, and the ticket number.

What must registrars do about phishing?

Since the 5 April 2024 amendments to ICANN's contracts, gTLD registrars carry a specific duty. ICANN defines DNS abuse as "malware, botnets, phishing, pharming, and spam", with spam counting only when it is used to deliver one of the others.^[1] Once a registrar has actionable evidence that a domain is used for DNS abuse, it "must promptly take the appropriate mitigation action(s)" reasonably necessary to stop or disrupt it.^[1]

Two limits matter. The duty covers those abuse types, not every brand complaint, so a parked lookalike with no phishing on it is usually a trademark question rather than an abuse report. And country-code domains run under their own registry's policies, so check that registry's abuse page.

Should you report to browser blocklists too?

Yes. A blocklist does not remove the site, but it warns people before they reach it. Google Safe Browsing works by "showing warnings to users when they attempt to navigate to dangerous sites" and says it helps protect "over five billion devices every day".^[5] Its site links to a form for reporting phishing pages.^[5] Microsoft takes unsafe-site reports through its Security Intelligence portal.^[6]

Submit to both once you have the URL and screenshots.

When do UDRP and URS come in?

When the domain itself infringes your trademark, an abuse report may not be enough. These are the formal procedures:

• UDRP. Under ICANN's Uniform Domain Name Dispute Resolution Policy, the complainant must show that the domain is identical or confusingly similar to its mark, that the holder has no rights or legitimate interests in it, and that it was registered and is being used in bad faith. Remedies are limited to cancellation or transfer.^[7]
• URS. ICANN describes the Uniform Rapid Suspension System as a mechanism that complements the UDRP for "the most clear-cut cases of infringement", built for its New gTLD Program.^[8] The burden of proof is clear and convincing evidence, and a successful complaint leads to suspension "for the balance of the registration period" rather than transfer.^[9] It is "not intended for use in any proceedings with open questions of fact".^[9]

Neither procedure closes the door to court: the UDRP says either party can still take the dispute to a court.^[7] Choosing the route, drafting the complaint and any court action are work for counsel or a specialist brand protection firm that you contract with directly. We do not file takedowns or legal actions.

How do you confirm the domain is down?

Check after each response. Confirm that the page no longer loads, that the domain no longer resolves or points to a suspension notice, and that browser warnings appear. Then keep watching, because the same operator may register a new variant soon after. Keep the evidence and correspondence; counsel may need it if the case escalates.

How do you prepare for the next one?

Delays often come from not knowing who does what. Prepare before you need it:

1. Name an owner for brand abuse reports, and a backup.
2. Keep a report template with the evidence list above.
3. Agree in advance which firm or counsel handles UDRP, URS and court work.
4. Watch for new lookalikes, as covered in our guide to typosquatting and domain audits.
5. Lock your own critical domains with registrar and registry locks.
6. Tell staff and customers how to report suspicious messages to you.

Fake domains often travel with fake profiles and executive impersonation, so link this process to your trademark monitoring. Our anti-phishing service covers the detection and reporting preparation as part of our digital asset security work.