The first 48 hours of a phishing incident: 7 steps

The phone call usually starts: "We found a fake site impersonating us." From that moment, the quality of your response is decided in the next 48 hours. Act inside the window and the damage stays small. Stretch it past 72 hours and you end up explaining to your executive team why an active phishing site stayed live across an entire weekend.

What goes wrong, repeatedly, is process. Not technology. Communications drafts a customer email at hour 14, legal evaluates options at hour 22, and meanwhile the phishing site keeps converting. Each function moves competently in isolation; the gap is the coordination layer.

This article describes the order of work when someone reports a site impersonating your brand. Seven steps, each with an owner and an output. Some are internal and stay with you. The ones that involve outside companies are the slow, fiddly part, and that is the part OpenBait handles for brands.

Step 1 — Scope the incident (within hour 1)

Owner: SOC analyst or security lead Output: a one-page incident summary

The first hour is fact-finding only. No outside reports yet, no customer-facing comms, because those will be wrong if the facts are wrong. The summary should settle:

• The address of the fake page, including any redirects along the way
• When it appeared and who runs the domain and the server behind it
• Which brand assets are being copied: logo, copy, layout, login form
• A rough idea of how many people may already be affected, from support tickets and social mentions
• The apparent objective: credential harvesting, a fake checkout, a fake delivery notice. The objective shapes the customer warning

Be careful how you look at the page. Some kits notice visitors from corporate networks and change their behavior, so scoping is better done from an ordinary outside connection than from the office.

Teams running continuous monitoring skip most of this step, because the scoping data is already in the alert. The typosquat detection guide covers how detection works.

Step 2 — Notify internal stakeholders (within hour 2)

Owner: security lead or CSIRT manager Output: a single message to a single distribution list

The most common failure in 48-hour response is "we kept it inside security too long." Within two hours, bring in the following six functions:

Anti-pattern to avoid: "I'm not sure if PR needs to know yet, I'll loop them in later." PR should have a say in whether PR gets involved. The 30 minutes you save by not deciding for them can be the difference between a customer warning at hour 12 and one at hour 36.

Step 3 — Preserve evidence (within hour 4)

Owner: SOC or incident handler Output: a timestamped folder with the evidence package

The package gets used later in outside reports, in any formal proceeding, in customer communications and in the post-incident review, so it is worth building before the page disappears. Kits often go dark mid-incident if the attacker spots a takedown attempt.

One thing worth knowing. In a clone-shop case we handled in September 2026, the sites began refusing connections from some visitors within hours of the first report. A reviewer at a company that could have acted could no longer load them. Evidence that outside parties can check for themselves matters more than evidence that only you hold. We won't go into the details here.

Step 4 — Warn customers (within hours 6–12)

Owner: PR + customer support + security, jointly Output: a notice on your site, an email to the customer base, and a social post

The deliberation window for "should we tell customers" is short. There is usually no legal duty to announce a fake site that someone else built. Breach-notification rules such as GDPR Article 34 and Japan's APPI are about your own data being compromised, and a third party's fake site is not that. You warn customers because they are being robbed in your name. A legal duty does arise if your own systems or customer data were breached along the way; that is a question for counsel, not for this article.

The notice covers:

• The fake domain name, written so it cannot be clicked by accident
• Your real address, prominently, so readers know what the genuine brand looks like
• What to do if they already entered credentials or payment details: password reset, card cancellation, your support contact
• What you are doing about it, in plain terms
• Where to follow updates

Do not hold the notice back waiting for a browser warning to appear. Browser vendors don't publish turnaround times, and in our one timed case nothing showed for three days. Publish the notice either way.

Step 5 — Reports to the companies that can act (hours 12–24)

Owner: security + legal, jointly Output: reports delivered to the right outside companies, with a record of each

Different companies control different layers of a phishing site:

• The registrar controls the domain name. Only the registrar can take the name itself away.
• The hosting provider controls the server. A host-level "takedown" can turn out to be the server refusing some visitors while still serving everyone else.
• Browser and security blocklists control warnings shown to visitors. They do not remove anything.
• Search engines control whether the page is listed.

None of these companies owes you a fast answer, and each wants something different before it acts. Reports sent to the wrong company, or ones the recipient can't verify, tend to sit. This is the stage where most in-house responses lose days. OpenBait does this for brands, and tracks each report to an outcome.

Legal escalation beyond these reports, such as formal domain proceedings or court orders, is a lawyer's call and depends on the case.

Step 6 — Check that protection took effect (hours 24–36)

Owner: security Output: a dated note in the incident ticket on what changed

Reports are not results. Look again at whether the page is still reachable, whether visitors see a warning, and whether the domain still resolves. Write down what you see and when. Auditors and post-incident reviews will ask. As our case study shows, the channels differ a lot in how fast they act, and whether they act at all.

Step 7 — Reduce the cost of the next one (hours 24–48)

Owner: security + CISO Output: a decision on monitoring, and a routing rule for the next alert

Do not close the incident before you have reduced the cost of the next one. Without continuous monitoring, you repeat this 48-hour scramble by hand every time. Useful monitoring watches new certificates, newly registered domains, lookalike names and social channels for your brand.

Running this in-house is a standing job, not a project, and that is the real argument for handing part of it over. Where in-house, agency and SaaS each win is laid out in the takedown service comparison.

The 48-hour overview

Hour 1:      scope the incident, write the one-page summary
Hour 2:      notify engineering, PR, legal, support, business unit, CISO
Hour 4:      evidence package preserved
Hours 6-12:  customer notice, email and social post
Hours 12-24: reports to the companies that can act on each layer
Hours 24-48: confirm what changed, decide on monitoring, schedule review

After the incident: write it down, even if nobody was harmed

"We caught it before any customer entered anything" is exactly the case where the process gets better, and the one most likely to go unrecorded. Write down what the kit was, which page it copied, the timeline from detection to the site going dark, and which parties acted and which stayed silent. Six months of those notes will tell you where to spend next year more accurately than any vendor's RFP answer.

What OpenBait handles inside this process

We don't pretend the platform replaces incident judgment. It handles the deterministic steps; steps 2 and 4 stay with you:

• Step 1 (scoping): continuous monitoring means the alert lands pre-scoped
• Step 3 (evidence): captured per detection
• Steps 5 and 6 (outside reports and follow-up): this is the work OpenBait does for brands, tracked to an outcome
• Step 7 (monitoring): the platform's core product

What it doesn't take over, on purpose: which roles you involve (Step 2), the tone, language and legal review of customer notices (Step 4), and formal legal escalation, which a lawyer needs to size case by case.

The biggest lever in a 48-hour response is shrinking time-to-detection from hour 1 to hour 0. You can evaluate that on your own domain on the Free plan before committing.

Related reading

• Phishing takedown services: in-house, agency, or SaaS?
• Typosquat detection: 5 methods and their trade-offs
• A .cn phishing site: Tencent took it down in a day

Sources

• APWG Phishing Activity Trends Reports
• Interisle Phishing Landscape 2024
• GDPR Article 34 — Communication of personal data breach
• FTC business guidance on data breach response (Data Breach Response: A Guide for Business)
• Japan APPI guidance