Takedowns

Phishing and Malware Takedown Service

Quickly remove malicious content that is abusing your Brand across Websites, Mobile App Stores, and Social Media Platforms.

Protect Your Brand and Revenue with End-to-End Takedowns

We'll take care of the entire process end-to-end. We handle the drafting of legal documents inline with the ICANN ARR requirements, email and telephonic correspondence, and blocklisting.

We offer a fully managed takedown service to give you peace of mind and let you focus on what you do best.

Eliminate mobile app clones

Detect and takedown phishing websites

Remove fake social media content

Why Phishfort?

Everything we do is based on evidence collection. We know how and what to provide Registrars and Hosting Providers with in order to succesfully execute a takedown request.

Managed Intervention

Our takedown process is totally hands free - we don’t require you to lift a finger.

Legal team on board

We use legal procedures like DMCA.

Real time tracking

You can follow and track the entire process on our dashboard.

Hear from our Clients

"Exodus leverages PhishFort to strengthen the security of Exodus. Together, we work around the clock to protect our customers and stave off malicious actors. Besides removing fake mobile apps and phishing sites, PhishFort has taken down YouTube phishing videos and disrupted email phishing campaigns. We work together closely to ensure a safer crypto ecosystem for everyone. They are always quick to respond to our requests and go above and beyond every time. We are happy to call them our partners."

Exodus

Crypto Wallet

"Proud to say Paxful uses PhishFort for phishing defense! PhishFort have impressed us, they REALLY know the problem they are solving and provide our team with updates super fast. Phishing is one of fintech's biggest challenges and customers in emerging markets are especially vulnerable to phishing."

Ray Youssef

CEO, Paxful

"With security being the #1 priority at IDEX, PhishFort has played a pivotal role in insulating both our new and existing users from increasingly complex phishing attacks. Since we teamed up, they have taken down over 150 imposter sites, and we have seen a huge decrease in the number of user reports of potentially compromised funds. We highly recommend them to any company looking for robust phishing protection."

Forrest Whaling

CMO, IDEX

"In just the first two months working with PhishFort's anti-phishing solution, they've taken down over 188 phishing websites – that’s 3 to 4 websites per day! We are especially appreciative of PhishFort’s continued scouring of both app stores for fakes and impersonators. With PhishFort’s help, our users can be confident that we're committed to making MEW one of the most secure crypto-currency wallets in the space."

Brian Norton

COO, MyEtherWallet

Seamless Client Communication and Tools for Enhanced Security

Elevate your online security experience.

Private communication

You will have an exclusive communication channel shared with our 24/7 operations team. Every query and report is immediately attended to.

Free browser plugin

You can check if we have flagged a site as dangerous and you can report a site to be taken down.

The Dashboard

Access to the place where we show all the information of every incident that we find. You can report incidents and download reports through it.

FAQs

Find answers to commonly asked questions about our all in one services.

What can be taken down?

All domains with phishing content are capable of being taken down. Domains that are only typosquatting sites are usually not taken down by Registrars just because they are a "typosquat". We will submit the report  on your behalf, but we will work with you to get as much information as possible before submitting an incident.  This decision tree may be helpful in case you get stuck:

How Can I Report?

Once the incident is identified, you can submit it through our dashboard. Once logged in, you can go to the left bar and select “Report Incident”.

First, you can add the infringing domain. There must be one domain per report.

💡 There’s no need to post each subdomain separately. For example, if you have a website in the form “[xxxxx].phishingdomain.com”, you just have to report “phishingdomain.com” and it will include all the related subdomains.

Then, you must choose the type of incident you are reporting. It can be domain (default), app:thirdparty, social or browser:extension.

app:thirdparty refers to those apps for Android or iOS that impersonate you and therefore not allowed by your organization.

social refers to all the infringing content posted on social networks.

browser:extension refers to infringing browser extensions (a.k.a. plugins)

Finally, you must decide if you want us to take down the domain or put it on Monitor.

💡 Monitor: is an unique feature that checks periodically for content modifications into the domain and immediately retrieves it back to our attention as soon any change is detected.

Additionally, you can check the “provide additional details” box to add any relevant information or attach any file that you think would help us approach the incident in the best way.

Once an incident is identified, you can submit it through our dashboard. After logging in, navigate to the left sidebar and select "Report Incident."

Firstly, input the infringing domain, ensuring there is only one domain per report. No need to list each subdomain separately. For example, if your website has subdomains like "[xxxxx].phishingdomain.com," simply report "phishingdomain.com," and it will cover all related subdomains.

Next, choose the type of incident you're reporting. Options include domain (default), app:thirdparty, social, or browser:extension.

  • app:thirdparty is for apps on Android or iOS impersonating your organization, which is not allowed.
  • social pertains to infringing content posted on social networks.
  • browser:extension concerns infringing browser extensions (a.k.a. plugins).

Finally, decide if you want us to take down the domain or put it on Monitor.

  • Monitor: This unique feature periodically checks for content modifications within the domain and immediately brings it back to our attention upon detecting any changes.

Additionally, you can check the "provide additional details" box to add any relevant information or attach files that you believe would assist us in addressing the incident effectively.

Do you cover procedures like URDP?

Yes, we handle the UDRP process. Please be aware that UDRP specifically addresses domain name abuse and bad faith in the use of the domain name. This requires the presence of at least one of your brand's trademarked names in the reported domain name.

Furthermore, for pursuing a UDRP, consider the following:

  1. Payments for UDRP complaints are non-refundable, and no decision from a Provider will include any monetary reward (e.g., damages, legal fees, etc.).
  2. If you wish to contest the decision of the UDRP Provider, you must file a lawsuit within 10 days of receiving the Provider's decision. PhishFort cannot assist with this, and you will need to consult with a law firm or legal practitioner.
  3. There's no guarantee that the Panel will decide in your favor.
  4. If the Panel rules in your favor, ownership of the domain will be transferred to you.
Do you cover DMCA takedowns?

Yes, we do DMCA takedowns. In that case, we need a Letter of Authorization letting PhishFort to act as agents on behalf of your brand.

What happens if a new attack is set on the same URL that you took down?

There are two reasons the site may become available again:

  1. The domain suspension can be reversed if the website owner demonstrates good faith in the use of the domain name or if the domain suspension reaches the ClientHold period. The duration of the ClientHold period varies for each Registrar. However, the domain usually remains suspended, preventing threat actors from reusing the domain.
  2. If Registrars become unresponsive and recognizing the business-critical nature of the report, our Analysts may attempt the takedown through the Hosting Provider instead of the domain Registrar when the takedown was performed over the IP. This typically deters threat actors from persistently setting up new IPs to maintain the availability of phishing content. However, there is a chance that threat actors may use a new Hosting Provider and set up the website again.

In both cases, our Analysts will initiate the takedown again, and no additional charges will be applied.

What does it means to monitor a typosquat website?

Our monitoring system will periodically check for new domain registrations typosquatting your legitimate domain names. Once a typosquat domain is detected, if no infringing content is found, will be placed under monitoring status. ****Our systems will periodically check for changes in the domain content and DNS records and bring the monitored domain back to our attention in case any suspicious movement is detected.

What differentiates Phishfort from other vendors?

Phishfort is brand reputation and phishing prevention platform.

Our cutting-edge detection engine powered by AI, combined with rotating teams of trained professionals working 24/7 across the world forms an impenetrable shield against digital threats.

Targeted attacks, scams, malware, via websites, social media or apps, we stop them all.

We offer fast and comprehensive takedowns, through a combination of automation with industry expertise. 

The entire process is managed through the platform where reports and summary are provided where you have a dedicated team working for you.

How long does a takedown take

Takedown times will depend firstly on the type of incident. Typically phishing websites will require minutes to 24/48 hours. Cases involving trademarks or scams can take a few days, also impersonators on social media platforms take longer.

Our Research and Announcements

Stay informed with our latest blog posts.

Phishing as a service kit
Phishing as a Service (PhaaS) kits used to target Microsoft 365 credentials

Phishing as a Service (PhaaS) kits used to target Microsoft 365 credentials

PhishFort recently identified a marked resurgence in Microsoft 365 credential-harvesting attempts, echoing tactics once prevalent in the now-defunct Phishing as a Service (PhaaS) operation known as Caffeine Store. While Microsoft 365 is a common target for credential-harvesting attacks, the recent spike is notable for its sheer volume and distinct characteristics.