Skip to main content
DefendDomain
Under attack?

What it takes to report a fake site by hand

To get a fake site or domain switched off, you report it to several companies, each with its own form and its own rules for evidence. We send the evidence to up to 12 places at once and follow up automatically.

A common assumption

“If a fake site appears, we will report it to the host.”

The host is one of several companies that can act. A lookalike that only sends email has no page for a host to remove; the blocklists and the email provider matter more.

Already happening?

Report a live attack

Free to report. No account needed. One of our team calls you back, usually the same working day.

Check for lookalike domains

Checks 150+ lookalikes of your domain in a couple of minutes. No account, no card. We email the report to a work address, not Gmail or Outlook.com.

Out of hours, email security@defenddomain.com.

What a complete report involves

Getting a fake site switched off means several reports, not one. Each company left out can still let the fake site, or its emails, reach people.

What a quick report covers

  • One browser warning service
  • An email to the host or the registrar
  • A check back in a day or two

What it leaves out

  • The other browser warning service
  • Spam blocklists, which stop the domain’s email arriving
  • The email provider the domain sends through
  • Search engines, so the fake site still shows in results
  • Follow-ups when nobody replies

All of this starts with finding the fake. We re-check around 500 lookalikes of your domain every hour and watch the public certificate logs as entries appear, so the alert reaches you with the evidence already gathered.

Reporting a fake site by hand

Each step is done by someone on your team, one company at a time. In our recruitment-scam case, each time the company got one fake site removed, new ones appeared. We send the takedowns now, so its own staff no longer do.

  1. Step 1

    You spot a live attack

    A fake copy of your login page is collecting your customers’ passwords, or a lookalike is emailing them new bank details.

  2. Step 2

    Working out who to tell

    Someone finds out who registered the domain, who hosts it and who handles its email, and how each one takes reports.

  3. Step 3

    Writing the reports

    Each report is rewritten for whoever receives it, with screenshots and details attached. It takes someone away from their own work.

  4. Step 4

    Waiting

    Some reply. Some ask for more evidence. The site or the emails may still be reaching people.

  5. Step 5

    Chasing

    Someone has to remember to follow up, and to keep checking whether the site is down.

One click, up to 12 places at once

When you confirm a live attack and approve the takedown, the evidence goes at the same time to the registrar, the host and the email provider, an abuse-report network, blocklists and threat feeds, browser warning lists and search engines.

yourcompany-login.com
Evidence sentExample

Can switch it off

Registrar · Hosting provider · Email provider · Abuse-report networkSent

Blocklists and threat feeds

Spam blocklist · Abuse database · Phishing feedSent
Malware feedSkipped: no malware

Browser warnings and search

Browser warning lists (2) · Search engines (2)Sent

11 of the 12 places applied. If nothing happens, we chase at 48 and 96 hours.

Which places apply depends on the attack. A lookalike that only sends email has no page for a host or a search engine to remove, so those are skipped, and each report sent is recorded, place by place.

What each group does

  • The companies running it

    The registrar (the company that sold the domain), the host and the email provider it sends through. An abuse-report network also reaches the abuse desk of the network the attacker uses.

  • Blocklists

    Spam and abuse blocklists, plus phishing and malware feeds when the attack involves them. Spam filters and security tools use these.

  • Browser warnings

    Browser warning lists, which put the red warning screen in front of visitors.

  • Search engines

    Search engines, to drop the fake site from their results. Skipped for a domain with no website.

Case study, mid-2026

A fake-invoice domain on the blocklists the same day, then offline

A lookalike of an e-commerce and wholesale products company’s domain, set up only to send email, told trade customers that payments had moved to a “factoring” company. The same day, the domain was put on major anti-phishing blocklists, which cut delivery of its emails, and reports went to ten places: the email platforms it sent through, the mailbox collecting replies, the registrar, the DNS provider and blocklists. When the attacker added another email platform, we reported that too.

This case used ten places. We can now report to up to 12, depending on the attack.

Read the case study
What happened
Offline
  1. Lookalike set up to send email, no website
  2. Same dayOn anti-phishing blocklists, which cut delivery of its emails
  3. Same dayReports to ten places: the email platforms, the reply mailbox, the registrar, the DNS provider and blocklists
  4. LaterThe attacker added another email platform. We reported that too.
  5. The registrar took the domain offline

From the case. Names changed.

If the site stays up

If a company has not acted, we chase the host and registrar again at 48 and 96 hours, then go to the registry, which runs the domain ending, at 120 and 168 hours. For a domain that only sends email, the blocklists are what cut delivery of its emails while the registrar decides.

Follow-up, while it is still online

Example

  1. Day 0Reports sent to every place that applies

  2. 48 hHost and registrar chased

  3. 96 hHost and registrar chased again

  4. 120 hRegistry contacted

  5. 168 hRegistry chased again

  6. 30 daysStalled notice to you, with the options left

Checked every hour. When it goes offline, you are told and the chasing stops.

How a takedown works

No report goes to a registrar, host or blocklist until someone on your side approves it.

  1. Step 1

    Confirm it is a live attack

    Mark the alert as a live attack when you are sure it is real.

  2. Step 2

    Approve the takedown

    Type the domain to confirm. The evidence is saved at that moment.

  3. Step 3

    Reports go out

    The same evidence pack goes to every place that applies, addressed to its abuse contact. Nothing is rewritten by hand.

  4. Step 4

    Follow-up and tracking

    See each report’s progress, place by place. We check every hour whether it is still online and tell you when it goes down. After that we keep watching and alert you if it comes back.

Related pages

Questions about takedowns

Yes. The reports go out as soon as you approve, instead of after hours of research and writing. Most takedowns then take between 2 and 96 hours, depending on the registrar and host involved. In our fake-invoice case, the lookalike was on anti-phishing blocklists the same day, before the registrar had acted.

The chasing runs on the schedule above until it is offline, and you can see each report’s status in the meantime. If nothing has moved after 30 days, we tell you, with the options left. A lawyer helps if you want the domain itself transferred to you, through a domain dispute (UDRP).

See how a takedown goes out

In a 30-minute demo we show you a takedown from confirmation to the reports going out, and the follow-up schedule.

  • Which places a takedown goes to, and which apply to an email-only domain
  • What the follow-up schedule looks like
  • A clear annual price for your domains

A fake site already live? Report a live attack