Guide · Operations
What the fastest brand-protection teams do differently — a step-by-step workflow for getting phishing sites offline in under an hour, with the evidence templates and escalation paths to back it up.
The half-life of a phishing kit's victim conversion is roughly 4-6 hours from launch. By hour 12 the attacker has typically harvested the bulk of the credentials the campaign will ever capture; everything after that is residual. Taking a kit down at hour 1 prevents an order of magnitude more harm than taking it down at hour 6. This is why every minute of triage friction matters and why pre-built playbooks beat improvised responses every time.
Fetch the live page through a sandbox (urlscan, Any.Run, Joe Sandbox) — never your corporate browser. Record the full URL, all redirect hops, the rendered HTML, screenshots at desktop and mobile breakpoints, the favicon hash, certificate details (CT log entry, issuer, serial), DNS records (A, MX, NS), and the WHOIS snapshot. Resolve the IP to a hosting provider and the nameserver to a DNS provider — these may be different parties and both may need contacting.
Match the page against your known-kit fingerprint library (HTML structure, JS variables, image hashes, exfiltration endpoints). Identifying the kit tells you the typical attacker behaviour (single domain or rotating, hosted credentials or Telegram exfil, kit author's reuse patterns) and lets you preemptively register the next likely sibling domains for monitoring. If the kit is new, fingerprint it and add it to the library — every new fingerprint pays back across future incidents.
Send abuse notifications in parallel to: the hosting provider (abuse@<host>), the registrar (use the WHOIS abuse contact), the CDN if one fronts the site (Cloudflare /abuse, Akamai abuse@), the certificate authority (request revocation), the search engines (Google Safe Browsing, Microsoft SmartScreen), the browser vendors (Chrome via Safe Browsing, Firefox via Mozilla Phish Tank), and the impersonated brand if it's not yours. Every notification uses a pre-built template with the evidence pack attached.
Publish a public alert (the /security/alerts page on your site), push it to the relevant customer segment via email or in-app banner, and submit the URL to APWG, PhishTank, OpenPhish, and your industry ISAC. Update internal blocklists — email gateway, web proxy, EDR — so even if the takedown is slow your own users and partners are protected immediately.
Every notification has an SLA. After 1 hour with no response from a tier-1 provider, escalate to a named contact (most majors have a brand-protection desk; build this contact list before you need it). After 4 hours, escalate to the registry. After 24 hours, file with ICANN contractual compliance (gTLDs) or the relevant ccTLD authority. Document every step — escalations are 10x more effective when they include a complete timeline of prior unanswered requests.
Confirm the site is offline from multiple geographies (the attacker may have geofenced takedowns). Confirm the domain is null-routed at the registrar. Confirm DNS no longer resolves. Submit the certificate for revocation if it hasn't been. Add the WHOIS fingerprint, hosting fingerprint, and kit fingerprint to your monitoring rules so the next deployment by the same actor is flagged automatically. File an after-action note: what worked, what was slow, what evidence was missing.
Maintain a single PDF template that every takedown request gets. Page 1: the abuse summary (URL, hosting provider, brand impersonated, attack type, evidence of customer harm). Page 2: visual comparison (real brand site vs the phishing page side by side). Page 3: technical evidence (WHOIS, DNS, certificate, hosting). Page 4: brand-ownership proof (trademark registration). Page 5: prior-takedown record at this provider if any. A consistent pack cuts the average abuse-desk handling time in half.
Tier 1 (sub-hour typical): Cloudflare, Google, Microsoft, AWS, Namecheap (URS-eligible). Tier 2 (4-24 hours): OVH, Hetzner, Hostinger, GoDaddy, Bluehost. Tier 3 (1-7 days, often needs escalation): smaller VPS providers, certain ccTLD registries. Tier 4 (rarely responsive without legal action): bulletproof hosts, some offshore registrars. Tier matters more than geography — keep your own list and update it monthly based on real response times.
For active campaigns with material customer impact, parallel-track a referral to Action Fraud (UK), IC3 (US), Europol (EU cross-border), or your national CSIRT. Law enforcement won't take the site down faster than the registrar route, but they can preserve evidence, trace exfiltration infrastructure, and coordinate with foreign authorities for actors operating beyond civil-takedown reach. Make sure your evidence pack is forensically sound — original captures, timestamps, hashes — not edited screenshots.
Sending one notification at a time waiting for replies; using a generic 'this site is fake' message without evidence; contacting marketing@ instead of abuse@; not following up on the 1-hour and 4-hour SLAs; failing to include trademark proof when the impersonated brand isn't yours; forgetting to also revoke the TLS certificate (some kits resurrect with the same domain on a new IP).