Skip to content
nebtynebtynebty Docs

Request a takedown

This guide walks you through requesting a takedown against a genuine impersonation, and following the case until it closes. The red numbers in the screenshots match the numbers in each step.

Before you start

Section titled “Before you start”

You need a finding you have already reviewed and confirmed as a Threat, for example a look-alike domain. If you have not triaged the finding yet, start with Review a suspicious domain or Review your first finding.

Steps

Section titled “Steps”

  1. Start the takedown. Open the domain and select Request Takedown (1). On a social profile or an ad, mark the finding as Threat instead. Both open the takedown request form.

    Domain detail page with the Request Takedown button marked as 1

  2. Complete and submit the request. The form already contains the domain’s details.

    • (1) Website URL: the address of the site to take down. It is filled in for you.
    • (2) Additional Comments: optional. Add anything that helps, for example that customers already received a phishing mail.
    • (3) Tick the box to authorize nebty to act on your behalf. This is required.
    • (4) Select Submit Takedown Request.
    Request Takedown form with URL field, comment field, authorization checkbox and submit button marked 1 to 4

    For a brand with active monitoring, the case starts as Open and the nebty team starts work. Otherwise, nebty reviews the request first.

  3. Track the case on the Takedowns page. Every case has a Status (1), for example Open, In Progress, Pending Response or Closed. Closed cases also show an Outcome (2).

    Takedowns list with the Status column marked 1 and the Outcome column marked 2

    Open a case to see its current status (1) at the top right.

    Takedown detail page with the In Progress status marked as 1

    The Activity Timeline (1) lists everything that happened in the case: status changes, collected evidence, abuse reports and blacklist submissions.

    Activity Timeline of a takedown case marked as 1

  4. Wait for the case to close. A closed case shows the status Closed (1) and a Resolution (2) that tells you how it ended, for example Domain Suspended, Content Removed or No Infringement.

    Closed takedown case with the Closed status marked 1 and the resolution Domain Suspended marked 2

What happens next

Section titled “What happens next”

Once a case is open, the nebty team works it: contacting the relevant registrar, host, or platform through the Abuse Contact, and filing a Blacklist Submission where that applies. You do not author either of these yourself; you simply follow their status on the case.

How long a case takes to close depends on the registrar, host, or platform involved, so there is no fixed timeline to expect. The Activity Timeline on the case is the most reliable way to see what has happened so far.

Related: Takedowns.

Track a takedown case in the demo(opens the public demo with sample data)