What registrars did with our phishing domain reports

A phishing site has several layers, and a different kind of company controls each one. The registrar controls the domain itself and can take it away. The hosting provider controls the server the site runs on. Browser blocklists put warnings in front of visitors, and search engines control listings. Of these, the registrar is the layer that decides whether the name stays dead.

This article explains how that division works in practice, why it is slow, and what we saw in the cases we can document: a .cn phishing page in April 2026 and five clone-shop domains in September 2026, including two mistakes we made ourselves. A report that gets acted on depends on details that vary by case, and we handle that for brands.

Who can act on which layer

The registrar is the company where the domain was bought. It can suspend the domain, and a suspended domain stays gone until the attacker registers a new name. A hosting provider can remove a server, but the attacker can point the same domain at a different one. That is why the hosting layer alone rarely ends anything.

We learned this the hard way. In September 2026 we handled five clone-shop domains imitating a US home-products retailer: all .shop, all at one registrar, all on one hosting network. At checkout, each one loaded a card-entry form from a separate collector domain, and nothing the visitor typed went to a payment provider. On 2026-09-16 we reported them. Within hours the shops stopped answering our probes, and we wrongly concluded the host had pulled them and told the retailer so.

That conclusion was wrong. Our checks had all come from one place. When we looked again from elsewhere a day later, one shop was still serving a complete storefront to some visitors while ignoring others, and the networks we had used were among the ones it ignored. The servers hadn't been cleaned up. They were declining to answer some networks, ours among them. What did disappear for good disappeared at the DNS layer, where only a registrar or registry can act. The servers were disposable; the domains were the asset.

Why it is slow and hard

• Abuse teams are slow and unevenly staffed. Response times range from hours to nothing at all, and companies rarely say what they did or why.
• Sites hide from whoever reported them. A phishing site often shows nothing to the people checking on it, so "it looks gone" isn't the same as "it is gone".
• Copies come back. A suspended domain is replaced by a new one, often on the same kit, so one takedown is rarely the end.
• Abuse teams verify things themselves. A company won't act on a claim it can't confirm on its own, and what counts as enough differs by company and by case.

What we measured

In the cases we can document, response times run from under an hour to no visible reaction at all. These are the only measurements we have, and a handful of cases isn't a statistic:

We got no confirmation for any of the September actions. The first nameserver change came less than an hour after our second report. That fits, but timing doesn't prove cause, and we don't claim it. Two of the shop domains lost their DNS records on 2026-09-17, and from the outside we can't tell whether the attacker or a provider did that.

The .cn case is written up in full in our Tencent case study, and the September case hour by hour in a store cloned five times. Browser blocklists run on their own clock; see the browser blocklist guide.

Who acted in our cases

Three parties acted on domains we were tracking, and none wrote back to say so. This covers only what we reported or observed ourselves:

• The registrar, September 2026. All five clone-shop domains were registered at one registrar. It placed one clientHold on the day of the first report and switched the nameservers of two domains about an hour after the second one. We saw no reply.
• The .shop registry, September 2026. The registry put a serverHold on one card-form domain on 2026-09-17. We had never reported it to the registry, so we don't know what triggered it.
• Tencent / DNSPod, April 2026. Acknowledged within one working day; the site was gone about 24 hours later.
• Hosting providers. We can't prove a single takedown by a host. The one we believed in turned out to be the selective filtering described above.

FAQ

Should this go through a UDRP or URS instead?

Not for phishing. UDRP and URS are paid proceedings that decide who is entitled to a domain name, and both start from trademark rights. They fit a squatter holding a brand's name. A page stealing credentials is a fraud matter, not a naming dispute.

Where OpenBait fits

For brands, OpenBait handles this work: finding which companies sit behind a fake site, reporting to them, following up and recording what happened. See how it works.

---

Related

• How a report becomes a takedown in OpenBait
• The first 48 hours of a phishing incident: where this sits in the wider response
• Browser blocklist reporting: the layer that protects visitors while the domain is still up
• Free typosquat checker: find lookalike domains before someone reports them to you