What is the process for requesting takedown of malicious domains?

Someone's using a fake domain that looks just like yours to send phishing emails. It's infuriating. Here's what actually works, step by step.

Step 1: Find the registrar. Look up the domain on WHOIS to see who registered it. This tells you which registrar's holding it. Every domain's got one, even the sketchy ones.

Step 2: File an abuse complaint with the registrar. Most registrars have an abuse@ email address or an online complaint form on their site. You'll want to include: screenshots of the phishing emails, proof that it's impersonating your brand (your trademark, your real domain name, side-by-side comparison), and a clear explanation of what they're doing wrong. Be specific. "They're impersonating us" gets more traction than vague complaints. Expect a response in 3 to 14 days (yeah, it's slow).

Step 3: Check if they're actually responsive. The registrar might suspend the domain, delete it, or do nothing. If they do nothing and don't respond after 7 days, you've got a choice to make.

Step 4: Escalate if needed. If the registrar ignores you, file a compliance complaint with ICANN. ICANN can't directly pull the domain, but it can pressure the registrar to follow policy. Response times are slow (weeks to months).

For trademark disputes: the UDRP route. If this is a clear trademark infringement, you can file a Uniform Domain-Name Dispute-Resolution Policy (UDRP) complaint. It's formal arbitration, costs a few thousand dollars, but gives you binding resolution. Skip this unless it's serious trademark theft. Related: email spoofing. Related: DMARC.

Realistic expectations: registrar response usually works. ICANN escalation works but takes forever. The phishing domain might stay up for a week or two even after you report it (expect some urgency from your side). If you're being actively impersonated right now and need help fast, the Review My Emails SOS hotline can guide you through registrar complaints and help you build your case. Next step: find your domain registrar and check their abuse reporting process.