Takedown statuses
What each status on the Threats list and the case page means, how we decide it, what happens next, and how your monthly limit is counted.
The status on the Threats list and on a case tells you how far a fake site has got. Here is the whole flow first, then each status on its own.
Each status
Needs confirmation
A site our scan found, or one reported to you. Nothing has been sent to anyone yet.
- Next
- It stays here until you choose Take it down or Not a fake.
Confirmed as a fake, but no case is open yet — for example, this month's limit is used up.
- Next
- It can start once the limit frees up or you upgrade.
Being taken down
The case is open and reports are going out. The site still loads.
- Based on
- An hourly check of the site.
- Next
- We keep reporting to the registrar, the host and the blocklists.
Google lists the site as phishing or malware, so Chrome, Safari and Firefox show a full-page warning before it opens. The site itself is still online.
- Based on
- Google Web Risk, checked every four hours.
- Next
- We keep reporting to get the site taken down.
Offline
The site no longer loads.
- Based on
- Three failed hourly checks in a row, or every region we check from failing.
- Next
- We keep checking every hour and move it back to Reporting if it loads again.
The site stayed offline for seven days and the case closed on its own.
- Based on
- Seven days of Offline.
- Next
- We check daily for 90 more days and reopen the case if the site comes back.
Closed
Closed without a takedown — you asked us to stop, or on review it isn't tied to your brand.
- Next
- No more checks or reports.
You marked the site as not a fake.
- Next
- Not reported. You can reactivate it at any time.
Warned is not offline
Browsers warn, but the site itself is still running
- A visitor can click past the warning and open the site.
- Edge uses Microsoft's SmartScreen, not Google's list, so it may show no warning. In-app browsers may not either.
- Google can drop a site from its list. If two checks at least four hours apart find it no longer listed, the status goes back to Reporting.
If Google already listed the site before we took the case on, the case page says so, and we don't count the warning as our result.
Why an offline site can come back
Unless the domain is deleted, the site can return
- Its DNS records were removed. The domain is still registered and can point back within minutes.
- The host took it down. It can come back on another server under the same domain.
- The registrar suspended the domain. A suspension can be lifted, for example once the registrant's details are verified.
That is why we keep checking after Offline and Case closed, and reopen the case if the site loads again.
Why the domain isn't simply deleted
People often ask why the domain isn't just deleted, so the site can never come back. That isn't our decision or yours: the rules are explicit.
What can happen to a domain depends on the kind of problem
- Phishing, malware and other "DNS abuse": with solid evidence, the registrar must act. Its contract with ICANN requires it to stop or disrupt the abuse, and the action ICANN gives as its example is suspending the domain, not deleting it.
- Cloned sites, fake shops and scams: the registrars' group at ICANN (RrSG) classes these as website content abuse, to be reported to the hosting provider. For content problems that aren't DNS abuse, a registrar will usually want a court order before it acts. If there is evidence a cloned site takes card numbers or passwords, it counts as phishing and falls under the first point.
- The domain name itself infringing a trademark: neither the registrar nor the registry decides this. Only a UDRP decision, which the trademark owner has to file for, or a court order can cancel the domain or transfer it. The faster URS process can only suspend it until it expires.
Deleting wouldn't necessarily be better anyway: after a while a deleted domain can be registered again by anyone, including the person who had it.
Sources: ICANN's advisory on section 3.18.2 of the Registrar Accreditation Agreement, RrSG Abuse Reporting Guide (2025), UDRP paragraph 4(i), URS Procedure section 10.
How your monthly limit is counted
One fake-site domain counts as one
It counts from the moment we send its first report. Five cloned stores are five.
- Watching the site, or reporting it again if it comes back, never counts again.
- If the fake site moves to a new domain, that is a new one.
For each plan's limit and how extras work, see Billing and refunds.