# Request a takedown

> How to turn a confirmed threat into a takedown case and follow it through to resolution.

This guide walks you through requesting a takedown against a genuine impersonation, and following the case until it closes. The red numbers in the screenshots match the numbers in each step.

## Before you start

You need a finding you have already reviewed and confirmed as a **Threat**, for example a look-alike domain. If you have not triaged the finding yet, start with [Review a suspicious domain](https://docs.nebty-id.com/guides/review-a-suspicious-domain/) or [Review your first finding](https://docs.nebty-id.com/getting-started/review-your-first-finding/).

## Steps

1. **Start the takedown.** Open the domain and select **Request Takedown** (1). On a social profile or an ad, mark the finding as **Threat** instead. Both open the takedown request form.

   ![Domain detail page with the Request Takedown button marked as 1](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/1-request-button.webp)

2. **Complete and submit the request.** The form already contains the domain’s details.

   - (1) **Website URL:** the address of the site to take down. It is filled in for you.
   - (2) **Additional Comments:** optional. Add anything that helps, for example that customers already received a phishing mail.
   - (3) Tick the box to authorize nebty to act on your behalf. This is required.
   - (4) Select **Submit Takedown Request**.

   ![Request Takedown form with URL field, comment field, authorization checkbox and submit button marked 1 to 4](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/2-request-form.webp)

   For a brand with active monitoring, the case starts as **Open** and the nebty team starts work. Otherwise, nebty reviews the request first.

3. **Track the case on the Takedowns page.** Every case has a **Status** (1), for example Open, In Progress, Pending Response or Closed. Closed cases also show an **Outcome** (2).

   ![Takedowns list with the Status column marked 1 and the Outcome column marked 2](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/3-takedowns-list.webp)

   Open a case to see its current status (1) at the top right.

   ![Takedown detail page with the In Progress status marked as 1](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/4-takedown-status.webp)

   The **Activity Timeline** (1) lists everything that happened in the case: status changes, collected evidence, abuse reports and blacklist submissions.

   ![Activity Timeline of a takedown case marked as 1](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/5-takedown-timeline.webp)

4. **Wait for the case to close.** A closed case shows the status **Closed** (1) and a **Resolution** (2) that tells you how it ended, for example Domain Suspended, Content Removed or No Infringement.

   ![Closed takedown case with the Closed status marked 1 and the resolution Domain Suspended marked 2](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/6-takedown-closed.webp)

## What happens next

Once a case is open, the nebty team works it: contacting the relevant registrar, host, or platform through the Abuse Contact, and filing a Blacklist Submission where that applies. You do not author either of these yourself; you simply follow their status on the case.

How long a case takes to close depends on the registrar, host, or platform involved, so there is no fixed timeline to expect. The Activity Timeline on the case is the most reliable way to see what has happened so far.

Related: [Takedowns](https://docs.nebty-id.com/features/takedowns/).

[Track a takedown case in the demo (opens the public demo with sample data)](https://dash.nebty.de/demo/takedowns/td-1)