# Managed Takedown Services

URL: https://www.deepinfo.com/solutions/use-cases/managed-takedown-services/

## Turn Every Confirmed Lookalike Into a Filed Takedown.

Finding a lookalike domain is the quick part. Getting it suspended takes evidence, the right recipient and patience with abuse desks. Your team confirms what [Brand Risk Protection](https://www.deepinfo.com/platform/brp/) finds, Deepinfo’s takedown desk files it, and monitoring shows the result.

[Request demo](https://www.deepinfo.com/request-demo/) · [Talk to us about takedown](https://www.deepinfo.com/contact/)

A lookalike that nobody reports *keeps working.*

### From Finding to Filing to Verified.

1. **Detect**

   [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) matches newly seen domains against your brand names and queues candidates for review.
2. **Confirm**

   Your team approves the ones that are fraudulent. Approved domains are monitored for DNS, mail, certificate and web activity from then on.
3. **File**

   The desk builds the case from the monitoring record and sends it to the registrar, the host or both.
4. **Follow up**

   Abuse desks ask questions and answer at their own pace. The desk handles the back and forth until there is an answer.
5. **Verify**

   The domain’s own indicators show whether it still resolves, receives mail or serves a page. An on-demand scan confirms it whenever you ask.

### Each Finding Has a Right Recipient.

A request only works when it reaches a party with the power to act on it.

- **Lookalike domain**: The registrar, asked to suspend the registration.
- **Phishing page on a lookalike**: The hosting provider, asked to remove the content.
- **Impersonation account**: The social platform, under its impersonation policy.
- **Fake app listing**: The store that lists it, under its publishing policy.
- **Malicious ad or result**: The search engine, under its ad or content policy.

Domains come from Fraudulent Domain Monitoring. Social, app-store and search coverage is confirmed per engagement.

### One Confirmed Domain May Have Siblings.

Whoever registered one lookalike may have registered more. From a confirmed domain, the domains its registrant registered around the same time, or that share its name servers, are one query away in [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/).

Your team reviews the siblings like any other candidate, and the confirmed ones join the takedown queue.

[Same-Time Registered Domain Finder](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/)

Same-time:

```bash
# Domains the same registrant registered within 10 minutes
curl "https://api.deepinfo.com/v1/discovery/sametime-domain-finder?domain=acrne.example&interval=10" \
  -H "apikey: YOUR_API_KEY"
```

Shared NS:

```bash
# Every domain on the lookalike’s name server
curl "https://api.deepinfo.com/v1/discovery/reverse-ns?ns=ns1.hosting-provider.example" \
  -H "apikey: YOUR_API_KEY"
```

### Takedown as a Standing Routine.

#### Alert on New Lookalikes

A notification rule on `new_fraudulent_domain_detected` emails the reviewers when a new fraudulent domain turns up, instantly or as an hourly, daily, weekly or monthly digest.

#### Review on a Cadence

Approve or ignore candidates in bulk by filter, and revert a decision if it turns out wrong.

#### Watch the Calendar

Review more often around the moments customers expect to hear from you, such as filing deadlines, enrollment windows, sales and launches.

#### File Some Cases Yourself

Fraudulent domains export in bulk with their monitoring indicators, risk score and detection history, so in-house filings start from the same record.

#### Report the Queue

That export also gives brand, legal and fraud stakeholders the state of each domain in one file.

### Takedown in Real Programs.

- [A metropolitan municipality](https://www.deepinfo.com/customers/municipal-government/) (Customer story): Lookalikes of citizen-facing services, removed through Managed Takedown around tax and enrollment periods.
- [A research university](https://www.deepinfo.com/customers/research-university/) (Customer story): Application-cycle phishing across departments, routed to Managed Takedown.
- [An academic publisher](https://www.deepinfo.com/customers/academic-publisher/) (Customer story): Domains impersonating its journals, caught by Fraudulent Domain Monitoring and sent to takedown.

### Questions About Managed Takedown Services

**How long does a takedown take?**

It depends on who receives the request. Registrars, hosting providers and platforms each run their own abuse process on their own schedule, so we don’t publish a turnaround time we can’t control.

**Do you guarantee removal?**

No. The recipient decides. The desk makes sure each request is complete, reaches the right party and is followed up until there is an answer.

**What evidence does a filing start from?**

The domain’s monitoring record: the rule and match type that found it, whether it resolves, takes mail, serves a certificate or answers on the web, its DNS, SSL, WHOIS, web data and port scan history, and its risk score timeline.

**What happens if a domain comes back?**

A fraudulent domain stays under monitoring until your team removes it from the list. If it starts resolving or serving content again, its indicators show it on the next scan, and it can go back to the desk.

**Which findings can go to takedown?**

Confirmed fraudulent domains from Fraudulent Domain Monitoring. Impersonation on social platforms, app stores and search engines joins this workflow where that monitoring is in scope for you. See [Managed Takedown](https://www.deepinfo.com/platform/brp/managed-takedown/).

### Hand the Filing to the Desk.

Book a walk-through of the takedown workflow with our team.

[Request demo](https://www.deepinfo.com/request-demo/)