Getting a fake site taken down: the takedown process
Updated on August 5, 2026 · LegalBrandGuard
Quick answer
A takedown means notifying a domain’s registrar and its host to obtain its suspension. Today it’s the fastest and least costly route against a fake site: a matter of days, against roughly three months for a UDRP proceeding, and with no arbitration fees.
What a takedown actually is
A takedown is not a judicial procedure. It is a notice sent to the technical intermediaries that make the site accessible: the domain name’s registrar, and the host of the content. Each has means of action you don’t have — suspending the domain, cutting off the server — and obligations that push them to use them.
The outcome sought is for the domain to move to clientHold status. The domain stays registered in the fraudster’s name, but stops working: no website, no mail. It’s the administrative freeze a registrar applies once it finds abusive use.
Why not a UDRP proceeding?
The UDRP is the long-standing arbitration procedure for domain name disputes. It remains relevant for recovering a domain you intend to use, but it is poorly suited to fake storefronts, for three reasons.
| Criterion | Takedown | UDRP |
|---|---|---|
| Timeline | A few days | About three months |
| Cost | None to low | Arbitration fees + counsel |
| Domain name without the brand | Handled — the basis is the content | Ineffective — the basis is the name |
| Outcome | Domain suspension | Transfer or cancellation |
Detailed comparison, with the cases where each route wins out: takedown or UDRP, which to choose?
The third point is decisive. Fake-storefront networks deliberately use generic domain names, with no reference to the copied brand, precisely to escape the UDRP. A domain like cyclingwear-shop.com displaying a French brand escapes arbitration, but remains vulnerable to a notice.
Four levers, worked in parallel
An effective takedown isn’t one action but four, run in parallel. Each has its own timeline and success rate.
| Lever | Effect | Observed timeline |
|---|---|---|
| Registrar | Domain suspension (clientHold) | 48 hours to several weeks |
| Host or CDN | Content takedown | A few days |
| Browsers (Safe Browsing, SmartScreen) | Red warning screen, traffic cut off | 24 to 72 hours |
| Ad networks | Product ads stopped | Variable |
Browser reports are often overlooked even though they produce the fastest effect. A site flagged as dangerous by Google Safe Browsing loses most of its traffic within hours, well before the domain itself is suspended.
Go deeper on each step
Each of these steps has its own pitfalls. The guides below cover them, with the real cases we’ve encountered.
- The takedown process, step by step
From identifying the registrar to verifying the domain freeze: the full sequence, with the timelines actually observed.
- Finding the registrar and its real abuse contact
WHOIS, RDAP, and the trap of a guessed address: how to reliably identify who to notify, and why some registrars never read their own abuse address.
- DSA Article 16: the argument that forces a host to act
A notice compliant with Article 16 strips the provider's liability exemption. It's the most forceful legal lever a trademark holder has today.
- CIMALP case: a fake site suspended in under 48 hours
The full sequence of a real takedown, from spotting the domain to its suspension, including what a reader can independently re-verify at the registry.
- How long does it take to get a fake site taken down
Delays actually observed depending on the route taken, what decides them, and why none of the official reporting mechanisms shut the site down themselves.