Digital risk protection · Takedown
Removal, not just alerts
Most tools stop at telling you a phishing site exists, or sell takedowns in packages you end up rationing. Here the takedown is the service. Every approved takedown is filed with evidence and followed up until the provider acts, the address is watched in case it comes back, and there is no cap on how many we file.
Three layers of remediation
| Layer | What happens | What it achieves |
|---|---|---|
| 1 · Block | The site is reported to Google Safe Browsing and Cloudflare, and shared with URLscan, VirusTotal and security vendors. Browsers start showing a warning page. | Browsers and security tools that use these lists can warn users within hours, before the site is removed. |
| 2 · Take down | An abuse report goes to the registrar and the hosting provider, with the evidence generated automatically. The analysts have established contacts with more than 600 registrars and more than 200 app stores. | The content is removed at the source. |
| 3 · Escalate | If the site stays up, trademark and copyright claims follow, with repeated escalation until it is resolved. | Pressure through intellectual property rights, where an abuse report was not enough. |
After removal, the address is monitored around the clock for reactivation.
Blocking buys time; takedown removes the threat
| Blocking | Server-level takedown | |
|---|---|---|
| How | Browser vendors and security providers flag the site | The registrar suspends the domain, or the host removes the content |
| Speed | Fast, often within hours | Depends on how cooperative the provider is |
| Permanence | The site stays online for anyone whose browser or tools do not use the warning | The content is removed at the source |
| Obstacles | Coverage depends on the user’s browser and tools | Offshore hosting, registrar hopping, re-registration |
Some services sell blocking alone and call it a takedown. Blocking protects the users whose browser or security software uses the warning lists; the phishing site is still there for everyone else, including customers on older devices and partners on other networks. That is why every confirmed phishing site is reported for blocking straight away and pursued for removal in parallel.
The procedure, by threat type
Phishing websites
- Your approval, or a standing takedown order already in place.
- The registrar and hosting provider are identified.
- A takedown request goes to both, written to each provider’s requirements.
- In parallel, the site is reported to Google Safe Browsing and Cloudflare so browsers show a warning.
- If it stays up, a trademark report to the host and escalation to the registrar.
- Repeated follow-up with both.
- Monitored around the clock; you are told when it is gone.
Fake social media accounts
- Trademark documents and a certificate of authority, provided once at onboarding.
- Your approval, or a standing order.
- The account is reported through the platform’s impersonation process with your documents.
- Without documents, it is reported through the platform’s ordinary menu from several designated accounts.
- Repeated follow-up.
- Monitored around the clock; you are told when it is gone.
Rogue mobile apps
- Your approval, or a standing order.
- A removal request to the app store, written to that store’s requirements.
- Repeated follow-up until it is removed.
- Monitored around the clock; you are told when it is gone.
Your effort, for all three: provide trademark documents once, and approve a standing takedown order or each case.
What we commit to, and what nobody can
What we commit to. Takedown requests are acknowledged by email or through the ticketing system, and the abuse complaint goes to the relevant registrar, host or platform within one business day of the acknowledgement, with the evidence assembled. With a standing order, analysts typically act within hours. They work business hours, and at weekends when a case is urgent. You can see the state of every case in the portal at any time.
What nobody can commit to. The removal itself. Whether a domain is suspended is the registrar’s decision, and whether a profile is removed is the platform’s. Anyone who promises a guaranteed takedown time is promising someone else’s decision.
What the record shows, across BlueVoyant’s client base over a 12-month measurement period:
18 hours
Median takedown time for phishing websites
250,000
Successful web takedowns
667
Distinct registrars handled
Over 95%
Takedown success rate
BlueVoyant, across its client base over 12 months.
Unlimited, and why that matters
Takedowns are included in the annual fee, with no limit on the number, across web, social media and apps. Elsewhere they are often sold in packages, for example of 50, and a single campaign can use a package up in days.
One bank faced a phishing campaign distributed by SMS in which 492 phishing websites were detected and taken down. On packages of 50, if each takedown uses one unit, that one campaign would have needed ten packages. Under a flat fee, the takedowns themselves add nothing to it.
The point is not only the money. A service you hesitate to use because each use costs something is not protection; it is a meter. Unlimited takedowns mean nobody on your side is deciding whether a phishing site is worth removing.
What can and cannot be removed
Yes, on your approval
A live phishing site, a page using your brand, code or design, a fake profile, a rogue app.
Lower success rate
A domain that only redirects to a phishing site or to your own site. A takedown can be requested, but there is often no content to point to.
Not yet
A parked domain, a blank page, a domain for sale or under construction. There is nothing to report. It is watched instead, and when it comes to life a new alert is raised and the takedown can start.
No takedown exists
Data on criminal forums and in chat groups. There is no takedown for a Telegram message. What you get instead is early warning, so you can reset the credential or block the card before it is used.
Where the domain is registered also matters. Nearly half of phishing domain registrars are in North America, about a fifth in East Asia and the Pacific, and about an eighth in Western Europe. Pursuing a registrar outside the EU and the US takes multilingual analysts and established access, and it is part of why the record above takes a dedicated team to achieve. The chart shows selected regions, so the figures do not add up to 100%.
BlueVoyant, “The Phishing Threat – A Takedown Tale”.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
Only if you want to. You can approve case by case, or give a standing takedown order once, within limits you set. With a standing order, analysts typically act within hours, during their working hours, and you see the result in the portal.
Every removed address is monitored around the clock. If it reactivates, or the same content reappears elsewhere, a new alert is raised and the takedown starts again, at no extra cost.
There is no limit on the number of takedowns, and it is not a pricing variable. What is counted in a package is the brands and executives in scope, not the takedowns filed for them.
The rest of the service
Validation
Every finding is reviewed by an analyst: false positives removed, evidence attached, an action recommended.
Reporting
Phishing and credential alerts within 30 minutes of detection, weekly indicator lists, intelligence summaries and monthly KPIs.
Use cases
Four cases and five attack patterns, from lookalike invoice domains to search-ad phishing.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.