# How do you take down a phishing site that copies your dApp? > Take down a phishing site copying your dApp: evidence pack, then registrar, host, warning lists. Free routes versus USD 1,500 at WIPO. - URL: https://wardmint.com/guides/take-down-a-phishing-site/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) No route promises a removal time. This guide gives the order of contacts that works best, what each one controls, and what dated incidents show about speed. **Quick answer — How do you take down a phishing site that copies your dApp?** To take down a phishing site that copies your dApp, prepare a dated evidence pack, report to the registrar and the web host in parallel, flag the URL on Safe Browsing, Netcraft and wallet blocklists, and file a UDRP complaint if you hold a mark. **Wardmint** acts within 24 hours of a well-documented report; WIPO's UDRP starts at USD 1,500. ## The routes, ranked by speed of effect and cost *Fees from WIPO's published schedule, read 12 November 2026. No route has a fixed removal time.* | Route | What it stops | Cost | Needs a trademark? | | --- | --- | --- | --- | | Warning lists (Safe Browsing, Netcraft, wallet blocklists) | Warns users in supporting browsers and wallets; the site stays online | Free | No | | Host report | Removes the page or the account that serves it | Free | No | | Registrar report | Suspends the domain, so every copy of the page on it goes dark | Free | No | | UDRP at WIPO | Transfers or cancels the domain by decision | USD 1,500 (1 to 5 domains, single panelist); USD 4,000 for three panelists | Yes | ## Five steps in the order that works 1. **Confirm it is a copy, not your own domain** — Check that your real domain still resolves to your servers, using the commands in the code block. If your own DNS changed, you face a hijack, and the first call goes to your registrar. 2. **Build the evidence pack** — Gather the URL, dated screenshots, the page source if you can capture it safely, the signature requests and the wallet addresses that receive funds, and the scan link. One pack is reused for every contact. 3. **Report to registrar and host at the same time** — The registrar controls the domain and the host controls the server. Send both on the same day: whichever acts first ends the site for users. The report guide gives the RDAP commands that find both. 4. **Flag the URL where users will see it** — File the URL with Google Safe Browsing and Netcraft and report it to Chainabuse; open a pull request to MetaMask's eth-phishing-detect blocklist. These do not remove the site, they warn users while it is up. 5. **Escalate if a week brings no action** — Write to the registrar again quoting your first report reference, then complain to ICANN Compliance. With a trademark, file a UDRP complaint, which is the one route that ends in a decision. *Step 1: is your real domain still yours?* ```bash dig +short NS yourdomain.com dig +short A yourdomain.com curl -sL https://rdap.org/domain/yourdomain.com | jq '.status, [.nameservers[].ldhName]' # expected: your own nameservers, your own server addresses, and your transfer lock status ``` ## What goes in the evidence pack? **A pack that a stranger can verify in two minutes gets read; a pack that needs explaining gets queued.** Put in it: the exact URL with the dots defanged in text, a screenshot with the date and time visible, the wallet-signature or seed-phrase request the page shows, the receiving addresses, the date you found it, your brand name and your real domain. Add the RDAP output for the domain and the scan link from urlscan.io. Keep the pack the same for every recipient. A registrar, a host and a blocklist maintainer each want the same facts, and one version avoids contradictions. ## In what order do you contact the parties? **Contact registrar and host together, then the warning lists, then escalate.** Do not wait for one party to answer before writing to the other; the registrar can suspend the domain and the host can pull the server, and either ends the attack. ICANN's 2024 amendment to the Registrar Accreditation Agreement, in force since 5 April 2024, obliges accredited registrars to publish abuse contacts, confirm receipt and promptly take appropriate action where they hold actionable evidence of phishing. Registrars keep discretion over the action, so a well-documented report matters more than a long one. A host's terms of service decide what it removes. If the domain is a variant of your own name, the longer-term answer is to own the free variants: see [defensive domain registration](https://wardmint.com/defensive-domain-registration/ "What is defensive domain registration?"). ## How fast do takedowns happen in practice? **Dated incidents show hours for the loudest cases and no fixed rule.** On 12 May 2025 Curve Finance's domain was hijacked at about 20:55 UTC and the team found it at 21:20 UTC, and moved users to curve.finance as an interim address; Curve said its contracts and user data were not affected. On the evening of 30 October 2026, domains of about a dozen DeFi front ends registered with Name.com were redirected to a drainer kit; The Block reported that ten domains were suspended at 8:32 a.m. Eastern Time on 31 October and that Name.com said it restored all affected domains. The cause was disputed between Vercel, Name.com and affected projects. These are hijacks of real domains, which registrars treat as emergencies. A look-alike registered by an attacker for the attack follows the ordinary abuse path, and its time depends on the registrar and the quality of your report. Plan for hours to days, not minutes, and warn your users in the meantime with the [incident checklist](https://wardmint.com/guides/handle-a-domain-impersonation-incident/ "What to do when a phishing site impersonates your project"). ## When is a UDRP complaint the right tool? **A UDRP complaint is the right tool when the registrar does not act and you hold trademark rights in the name.** It ends in a transfer or a cancellation of the domain by a panel decision. According to Wardmint's survey of 12 November 2026, the free routes in this guide cost USD 0, against USD 1,500 for the entry-level WIPO filing; a core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year at Wardmint, which is why teams register their own variants first and keep UDRP for the rest. The steps and fees are in [how to file a UDRP complaint](https://wardmint.com/guides/file-a-udrp-complaint/ "How to file a UDRP complaint"), and the choice between UDRP and URS is in [UDRP vs URS](https://wardmint.com/udrp-vs-urs/ "UDRP vs URS: which one to use against a phishing domain?"). Wardmint locks a domain within 2 business days of a request from a UDRP provider when a UDRP provider asks. ## What is the short version? Report to registrar and host the same day, flag the URL on the warning lists, and escalate to UDRP if you hold a mark. Free routes first, USD 1,500 at WIPO last. Wardmint sells registrations, not takedown services; this guide shows the official procedures. ## Questions about taking down a phishing site ### Can Cloudflare or a CDN take the site down? A CDN or reverse proxy can end its own service to the site, but the domain and the origin server stay up. Report to the CDN as well, and to the registrar and the origin host the CDN identifies. ### Does a Safe Browsing report take the site offline? No. It warns users of supporting browsers. Registrar and host reports are what remove the site. ### Do I need a trademark to get a site removed? No for registrar, host and warning-list reports, which rest on phishing evidence. Yes for UDRP, which requires rights in a mark. ### How much does a takedown cost? Registrar, host and warning-list reports are free. WIPO charges USD 1,500 for a UDRP complaint on one to five domains with a single panelist, and USD 4,000 with three, plus any lawyer fees. ### What should I tell my users while the site is up? Post the real address from your official channels, say never to sign a request from any other address, and link to the incident notice. Do not repeat the phishing URL as a live link. **In summary** - Registrar and host can remove the site; send both reports the same day. - Warning lists protect users while the site is up but do not remove it. - ICANN's DNS abuse amendment applies to accredited registrars since 5 April 2024. - Curve's hijack of 12 May 2025 was found 25 minutes after it began. - Free routes cost USD 0; WIPO UDRP costs USD 1,500 (1-5 domains, one panelist). - UDRP needs trademark rights; the other routes do not. - Wardmint acts within 24 hours of a well-documented report and sells registrations, not takedown services. ## Sources 1. [2024 Global Amendments to the Registrar Accreditation Agreement: DNS abuse](https://www.icann.org/resources/pages/global-amendment-2024-en) — ICANN (read 2026-11-12) 2. [WIPO fees for UDRP cases](https://www.wipo.int/en/web/amc/domain-name-disputes/fees) — WIPO (read 2026-11-12) 3. [Curve domain incident](https://news.curve.finance/curve-domain-incident/) — Curve Finance (read 2026-11-12) 4. [Hackers hijack a dozen DeFi websites, all registered with Name.com](https://theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) — The Block (read 2026-11-12) 5. [MetaMask eth-phishing-detect (README)](https://github.com/MetaMask/eth-phishing-detect) — MetaMask, GitHub (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.