Request demo

Managed Takedown

Hand Over the Finding. We File the Takedown.

Managed Takedown is the part of Brand Risk Protection where Deepinfo’s team does the reporting: it assembles the evidence, files the request with the party that can act, follows it up and checks the result. Your team decides what is fraudulent, and the takedown desk does the paperwork.

Request demoTalk to us about takedown

fraudulent domainacme-login.example

Indicators dns off dns_mx off ssl off http off

  1. Approved

    2026-09-14 · rule “acme” · contains · risk score 0

  2. Went live

    2026-09-21 · risk score 50 · dns, dns_mx, ssl, http on

  3. Reported

    WHOIS, DNS and MX records, the certificate, web content with history

    • registrar: suspend the registration
    • host: remove the content

  4. Asked for more

    the registrar asks for more evidence · the desk answers

  5. Gone

    next scan: http, ssl, dns_mx and dns off

Every Step From Confirmed to Gone.

  1. 01

    Confirm

    Your team marks a finding as fraudulent. For a domain, that is the approval step in Fraudulent Domain Monitoring.

  2. 02

    Assemble

    The desk builds the case from the record: registration details, DNS and mail records, the certificate, and the web content with its history.

  3. 03

    File

    The request goes to the party that can act on it. For a domain that is the registrar, the hosting provider, or both.

  4. 04

    Follow up

    Abuse desks answer at their own pace and sometimes ask for more. The takedown desk handles the back and forth, so your team doesn’t have to.

  5. 05

    Check

    Monitoring continues after the request. When the domain stops resolving or answering on the web, the next scan shows it, and an on-demand scan confirms it whenever you ask.

Who Can Act on Each Finding.

A takedown request only works when it reaches someone with the power to act on it. This is who that is, channel by channel.

Lookalike domainThe registrar, asked to suspend the registration
Phishing site on a lookalikeThe hosting provider, asked to remove the content
Impersonation accountThe social platform, asked to remove it under its impersonation policy
Fake app listingThe store that lists it, asked to remove it under its publishing policy
Malicious ad or resultThe search engine, asked to remove it under its ad or content policy

Domains come from Fraudulent Domain Monitoring. Social, app-store and search coverage is confirmed per engagement.

What the Desk Controls and What It Doesn’t.

We don’t quote turnaround times or success rates. The decision belongs to the registrar, host or platform that receives the request, and each one works to its own schedule.

We control

The Request

Complete evidence, the right recipient, the policy the abuse breaks, and follow-up until there is an answer.

They control

The Decision

Whether to act, and when. Registrars, hosts and platforms each run their own abuse process.

You see

The Outcome

The domain itself. Its DNS, mail, certificate and web indicators show whether it still answers, whatever any email says.

In-House Filings Use the Same Record.

Some teams file their own reports, either all of them or only the cases their legal team wants to handle directly. Fraudulent domains export in bulk as JSON or CSV, using the filters you search with, and each one’s layer history is a request away.

  • The name in both forms, and its type
  • The rules that matched, with detection dates
  • Monitoring indicators and the current risk score
  • DNS, WHOIS, SSL, web data and port scan history, per domain
Fraudulent Domain Export reference
Export the ones still answering 
curl -X POST \
  "https://api.deepinfo.com/v1/brp/fraudulent-domains/search:export?format=json" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "monitoring_indicator.http",
          "type": "eq", "value": true }
      ]
    }
  }'

Where Takedown Cases Come From.

BRP Fraudulent Domain Monitoring Lookalike domains matched against your brand keywords, confirmed by your team, then monitored. Read Use case Managed Takedown Services How brand and fraud teams run takedown as an ongoing program. Read Use case Brand Impersonation Protection Domains, accounts, apps and search results handled as one program. Read

Query This Data Through the API

Lookalike matching runs over the domains the index sees each day. Data teams can take these domains as a feed and run their own matching.

Questions About Managed Takedown

How long does a takedown take?

It depends on who receives the request. Registrars, hosting providers and platforms each run their own abuse process on their own schedule, so we don’t publish a turnaround time we can’t control.

Which findings can go to takedown?

Confirmed fraudulent domains from Fraudulent Domain Monitoring. Impersonation on social platforms, app stores and search engines joins this workflow where that monitoring is in scope for you.

What about a lookalike that isn’t live yet?

It stays under watch. Its indicators show when it starts resolving, receiving mail, serving a certificate or answering on the web, and once it turns abusive the case can go to the desk.

Can a takedown request be refused?

Yes. The registrar, host or platform decides under its own abuse process, and it may ask for more evidence or decline. The desk handles that exchange, and the domain stays under monitoring whatever the answer.

What happens if a domain comes back?

A fraudulent domain stays under monitoring until your team removes it from the list. If it starts resolving or serving content again, its indicators show it on the next scan, and it can go back to the desk.

See the Takedown Desk at Work.

Book a walk-through of the workflow with our team.

Request demo