Takedown only

You already find the fake sites. We handle the takedowns.

OpenBait is a takedown service for brands and security teams that already have their own monitoring. You send the URLs your tools found, by API or in the dashboard, with your evidence attached. We work each site until it's offline. If a site only copies your pages, we file to have those pages removed from Google search results instead. Enterprise starts at $899 a month for 20 takedowns across 3 brands.

From $899/mo
Enterprise: 20 takedowns a month across 3 brands
API
Send URLs and evidence from your own systems
Every hour
Sites that take passwords or card numbers, rechecked until they're down

Finding fake sites is only the start

The hard part comes after: staying on each site until it's gone, following up when a report goes nowhere, and catching it when it comes back. That's what this plan is priced on: takedowns, not monitoring.

What we do depends on what the site does

It takes passwords or card numbers

We report it with evidence to the companies that can take it offline. No authorization letter needed. We stay on it until it stops loading.

It only copies your pages

A copy that takes nothing from visitors is a copyright matter. We file a DMCA copyright notice to have its pages removed from Google search. You sign a letter of authorization once in your dashboard, and it's valid for one year. The site itself stays up.

It's promoted with ads

Paste a link to the Meta or TikTok ad, plus the site it leads to, in the dashboard, and we'll ask the platform to remove the ad. Ads don't count as extra takedowns.

It comes back

If a site we took offline comes back on the same domain, we go after it again once you confirm, at no extra charge. A new domain counts as a new takedown.

How it works when you bring your own list

  1. Send the URL

    One API call per URL, or paste it in the dashboard. A URL you send by API counts as confirmed by you. If the site already has an open case, you get that case back and it doesn't use a takedown.

  2. Attach your evidence

    Screenshots or PDFs from your own tools, by API or in the dashboard. They stay on the case, marked as yours.

  3. We report and follow up

    Automated reports are sent when you confirm the site. If a site that takes passwords or card numbers is still up 48 hours after our report, a person on our team takes over the case and follows up.

  4. We verify and report back

    We check each site every hour, and before we count it as down, we verify from other locations too. A webhook tells your systems when a case changes status.

What counts as one takedown?

Each fake-site domain counts as one takedown. A site that comes back on a domain we already took down doesn't count again, and neither do the ads on its case.

If a site is still online 14 days after our first report and hasn't received a browser warning since we took it on, it no longer counts against your monthly takedowns, and we keep working the case. A site that holds out won't eat into the takedowns you need for new ones.

Beyond the 20 included each month, each extra takedown is $199. Higher monthly volumes and additional brands are available on request.

What you'll see

Every case has a timeline: each report, the kind of company it went to, when it was sent and what came of it. For a site that only copies your pages, the timeline shows Google's response to the notice.

The monthly report lists every site you confirmed that month, when it was first reported, its current status and, for sites now offline, how long they took to go down. Download it as CSV or save it as PDF.

The API also returns each case's status and, once a site is offline, when it went down.

How is this different from a brand protection platform?

Most enterprise brand protection platforms sell monitoring and takedown together, and most don't publish their prices (see our comparison of 12 platforms). If your monitoring is already paid for, a bundle means paying for it twice.

This plan is priced on takedowns, and the price is published on this page. Daily scans are included at no extra cost. For a single fake site rather than a list, see sites that steal passwords or card numbers or copied pages removed from Google.

Takedown-only FAQ

What is a takedown-only service?

A takedown-only service handles takedowns of fake sites you've already found, without requiring you to use its monitoring. OpenBait works each fake site your tools or monitoring vendor found until it's offline; if a site only copies your pages, OpenBait files to have those pages removed from Google search results. Enterprise starts at $899 a month for 20 takedowns across 3 brands, with higher volumes or more brands on request.

Can we send sites from our own monitoring tool?

Yes. The API comes with Enterprise: one call per URL opens a case and draws from the same monthly takedowns as the dashboard. Once this month's takedowns are used up, the API stops opening new cases and never charges you; you can add more in the dashboard at $199 each. Webhooks tell your systems when a case changes status. The API documentation is public at openbait.com/docs/api.

Can we use the evidence our own tools collected?

Yes. Add screenshots or PDFs to a case by API or in the dashboard: PNG, JPEG, WebP or PDF, up to 8 MB each and 20 per case. When someone on our team writes to the companies involved, the message references your files and notes that they came from you. Automated reports don't include them.

Who do you report a fake site to?

It depends on what the site does. A site that takes passwords or card numbers is reported, with evidence, to the companies that can take it offline. For a copy that takes nothing from visitors, we file a copyright notice to have its pages removed from Google search instead, and the site stays up.

What happens when a report doesn't work?

If a site that takes passwords or card numbers is still up 48 hours after our report, a person on our team takes over the case and follows up. If a site is still online 14 days after our first report and hasn't received a browser warning since we took it on, it no longer counts against your monthly takedowns, and we keep working the case.

How fast do you start?

These are targets, not guarantees. Reports that go out automatically are sent when you confirm. On Enterprise, the first report that needs a person goes out within 1 business day of your confirmation (for a site that needs an authorization letter, from when the letter is in). That target covers three new, unrelated groups of fake sites a month; work on further unrelated groups that month starts within 5 business days.

Do you handle fake ads on Meta and TikTok?

We ask the platform to remove ads that lead to a fake site. In the dashboard, paste the ad's link and the site it leads to; the ad doesn't count as an extra takedown. Meta ads need your letter of authorization. The platform makes the final call, so we can't promise that an ad comes down, or how fast.

Do we have to use your monitoring?

No. Daily scans come with the plan, and you can use them as a second check or ignore them. A site you send us is handled the same way as one the scans found.

What does it cost?

Enterprise starts at $899 a month for 20 takedowns across 3 brands, with higher volumes or more brands on request. Beyond your monthly takedowns, each extra one is $199. Each fake-site domain counts as one takedown.

Can you guarantee the site will be taken down?

No one can promise that, because the companies that can take a site offline make the final call. On a monthly plan, if none of the sites or listings we took on has gone offline, been suspended, received a browser warning, had its pages removed from Google's search results or been removed by the marketplace within 30 days of our first report, we refund your first payment. It applies once, must be requested within 30 days, and doesn't apply if we couldn't start because your authorization letter was missing.

Is there a contract?

No minimum term. Enterprise is billed monthly, you can cancel any time, and you keep access until the end of the period you've paid for.

What about single sign-on and access control?

SAML single sign-on and unlimited seats come with Enterprise. Each API key can be scoped to reading cases or to opening them, and restricted to a list of up to 20 IP addresses or ranges.

Have a list of fake sites waiting?

Tell us how many sites and brands you're dealing with. If you'd rather look first, the API documentation is public.