How a takedown runs, from first sighting to a removal we check ourselves.
Software finds lookalikes and drafts the paperwork. A person approves each notice before it is sent. The finding and the notice below are our software's output for a fictional brand, Northlake.
We find the lookalike and say why we flagged it.
We watch certificate logs, new .com, .net and .xyz registrations, and feeds of confirmed-malicious domains for names built from yours.
If we cannot explain a finding in one sentence, we do not show it.
Registered 2 days ago. Also: mail is configured, which a credential-harvest kit needs
- What this tier means
- Strong string + infrastructure signals, no content yet. Usually registered and staged but not yet live
- Customer action
- Watch closely; often the best moment to act
We draft the notice for the party who can act.
We contact the host first and keep the registrar for escalation. Behind a proxy, we first ask it to disclose the host. An unidentified host gets no notice, not a guess.
The notice carries the technical details an abuse desk asks for, and the same reason, word for word, that you read in your findings.
Fictional brand. Our phishing template, filled in from the finding above. The bracketed fields are still blank, so this draft cannot be sent.
- DigitalOcean Droplet suspension and content removal. abuse@digitalocean.com
- NameSilo, LLC Domain suspension, if they act. abuse@namesilo.com
To: abuse@digitalocean.com Date: 2026-10-21 Re: Phishing site hosted on your network: https://northlake-secure-login.top/login We are reporting an active phishing site operating on infrastructure you control. It impersonates Northlake and is being used against that brand's customers. TECHNICAL DETAILS Malicious URL: https://northlake-secure-login.top/login Resolved IP: 203.0.113.42 ASN: AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC, US Nameservers: ns1.digitalocean.com, ns2.digitalocean.com Registrar: NameSilo, LLC Registered: 2026-10-19 Domain status: client transfer prohibited First observed: 2026-10-21 14:07:32 UTC IMPERSONATED BRAND Legitimate site: https://northlake.example Why this was flagged: Registered 2 days ago. Also: mail is configured, which a credential-harvest kit needs EVIDENCE [Screenshot, full HTTP response and captured DOM attached. Include the credential-harvesting form action URL.] REQUESTED ACTION Immediate suspension of the content at the URL above. Active credential harvesting causes ongoing financial harm to consumers with every hour it remains reachable. Reporter: [Name] ([Email]) On behalf of: [Rights holder entity] -- Generated by TakedownHunter. Review before sending. This is a document template, not legal advice, and no attorney-client relationship is created.
Not sendable: 4 fields missing. body_sha256 f8d1f5bb8fede22a0da270164d1bb47d353398b459ea8d007311d790a839a83e
A person approves it before it is sent.
Phishing and malware reports state what we observed and need no signature. Copyright and trademark notices assert that you own the rights, so you sign them. We never sign one for you.
Before a notice is sent
- A person approves it:someone on our side, after you request the takedown.
- No blank fields:a notice with a placeholder left in cannot be sent.
- Fixed at approval:the text is fingerprinted, so a change after approval shows.
We follow up, and escalate if the host does not act.
We wait for the window a desk publishes before chasing it. If the host does not act, we go to the registrar, which can suspend the domain itself.
Desks behind a CAPTCHA get a prefilled report that a person submits.
We check the removal ourselves before we bill.
A desk saying it removed the page is not proof. Our own re-check is, and the page must stay down for seven days.
Where a registry publishes no records, we report the site unreachable and do not bill.
What we will not do
- Defeat a CAPTCHA or bot check:a person submits those reports by hand.
- Bill for a browser warning:a blocklisted page is still live. We report it and never charge for it.
- Act for someone who does not own the brand:we check ownership before we open an account.
- Promise removal:some registrars ignore notices; some hosts require a court order.
Monitoring starts at $49 per brand per month. Takedowns are charged only on a verified removal.