Someone registered a domain that looks like yours and pointed it at a fake login page. A domain takedown gets that domain suspended at the registrar or the registry, so the address stops working everywhere at once. Core Sentinel does it for a flat $499 USD, neutralized within 48 hours of analyst approval or your money back. Start a takedown now →
What is a domain takedown?
A domain takedown removes a malicious domain name from service. The registrar that sold the domain, or the registry that runs its top-level domain, suspends it, so it no longer resolves and every page on it goes dark together. That is different from a content takedown, where the host deletes one page and the domain stays live for the next attempt. Most phishing cases need both: the host removes the page fast, and the registrar suspends the domain so the same address can’t be pointed at a new server tomorrow. Core Sentinel reports to both, plus the registry, the CDN and the major browsers’ safe-browsing services, and tells you which of them acted.
Which domains can be taken down?
- Lookalike domains that swap or add a character: yourbrand-login.com, y0urbrand.com.
- Typosquatting domains registered to catch a mistyped address.
- Combosquatting domains that bolt a word onto your brand: yourbrand-secure.net, yourbrand-support.com.
- Different top-level domains that copy your name exactly: yourbrand.co, yourbrand.app.
What gets a domain suspended is how it is used, not how it looks. A lookalike domain hosting a phishing page, a fake login or malware is a clear case for suspension. A lookalike that sits parked with no content usually isn’t, and a trademark dispute over an unused domain is a different, slower process.
Why do registrars act on phishing domains?
Because their contracts require it. Since 5 April 2024, ICANN’s agreements with accredited registrars and with generic top-level domain registries require them to act promptly to stop or disrupt well-evidenced DNS abuse, and phishing is named in the definition. The words that matter are well-evidenced: a report with a working URL, captured evidence and the impersonation clearly shown gets actioned, and a vague complaint often doesn’t. Country-code domains such as .uk or .au follow their own registry’s policies, which differ from country to country.
How are .uk phishing domains suspended?
Through the registrar and host first, and through Nominet, the .uk registry, when UK law enforcement asks. Under its Criminal Practices Policy, Nominet suspends a .uk domain when a listed UK law enforcement agency certifies in writing that the domain is being used for criminal activity, normally after giving the registrant at least 48 hours’ notice. Nominet doesn’t assess reports of criminal activity itself, so for a business the route is the registrar, the host and the NCSC, which can investigate and remove scam websites. Core Sentinel handles .uk cases for the same flat $499 USD.
How Core Sentinel takes down a phishing domain
- Submit the URL. Paste the address and a few details. It takes about a minute and you don’t need an account.
- We build the evidence. A senior analyst captures the page, identifies the real registrar, registry, host and CDN, and documents the impersonation.
- We report it everywhere that can act. The registrar, the registry, the host, the CDN and the safe-browsing services each get a report in the form they act on.
- You see the result. You follow progress on a private dashboard and get an evidence report when the domain is neutralized.
How long does a domain takedown take?
Your customers are usually protected within hours, because browsers start showing a warning once safe-browsing services action the report. Suspension at the registrar depends on the registrar, and some move faster than others. Core Sentinel guarantees the site is neutralized within 48 hours of analyst approval, or you get a full refund. A small number of abuse-resistant registrars and hosts ignore every report. If your case sits with one of them, we tell you before you pay.
Frequently asked questions
Is a domain takedown the same as a UDRP complaint?
No. A UDRP complaint transfers a domain to you after a trademark dispute and usually takes weeks. A domain takedown suspends a domain that is being used for phishing or fraud, which is about the abuse, not about who owns the name.
Can you take down a domain that isn’t hosting anything yet?
Usually not through an abuse report, because registrars act on evidence of abuse and a parked domain has none yet. Keep watching it. If it goes live with a fake page, report it straight away.
Do you handle any top-level domain?
Yes. We work globally, with any registrar, registry and top-level domain, for a flat $499 USD per incident with no subscription.
Start a domain takedown
Report the domain and a senior analyst gets to work. Flat $499 USD, neutralized within 48 hours of analyst approval, or your money back.
Not sure who registered or hosts it? Run the free phishing site lookup first.