# How Long Scam Domains Survive After a Complaint: 2026 Statistics

> Takedown data for 870 scam domains, May–October 2026: median 9 days from the first complaint, how many submissions it takes and which TLDs react fastest.

- Language: en
- Published: 2026-10-18 · Updated: 2026-10-18
- HTML: https://rikidomains.at/en/guides/how-long-scam-domains-survive/
- Markdown: https://rikidomains.at/en/guides/how-long-scam-domains-survive/index.md
- RU version: https://rikidomains.at/ru/guides/skolko-zhivet-moshennicheskiy-domen/

The first question from anyone who has run into a phishing or scam site is how long it takes to get it shut down, and what actually speeds the process up. We went through the log of our [takedown service](https://rikidomains.at/en/guides/phishing-site-takedown-service/) for five months of 2026 and counted, across 870 domains, how many days pass from the first complaint to suspension, how many submissions that takes and how the outcome depends on the TLD. The figures below contain no domain names, brands or complainants.

## What we counted and how

- **Period:** 7 May to 17 October 2026.
- **Sample:** 870 domains from two streams. The main one is 827 phishing domains targeting cryptocurrency services: fake wallets, exchanges, "verification" and "payout" pages. The second is 43 domains of scam storefronts "selling" cars on prepayment.
- **Submissions:** 78,577 over the period. A submission is one complaint sent to one address: a registrar form, an email to the registry's or hosting provider's abuse contact, browser and antivirus blocklists, payment services. They are counted from a line-by-line sending log, so repeat submissions about the same domain count separately.
- **Suspension:** the domain got a [clientHold or serverHold](https://rikidomains.at/en/glossary/clienthold-serverhold/) status, was deleted or stopped resolving. The date comes from the status change log. A reversible quarantine, where the registrar sets clientHold until the owner responds, is a separate category.
- **Time:** the difference in days between the date of the first submission and the date of suspension. For the TLD breakdown we counted from the day the domain was taken into work until suspension.

## Outcomes

| Status on 17.10.2026 | Crypto phishing (827) | Car scam storefronts (43) |
|---|---:|---:|
| Suspended, deleted or dead | 397 (48%) | 38 (88%) |
| Quarantine, reversible clientHold | 57 (7%) | — |
| Alive but without hosting | 14 (2%) | 1 (2%) |
| Alive | 347 (42%) | 4 (9%) |
| Status unknown | 12 (1%) | — |

In the crypto stream 407 domains reached the dead group at some point, and 14 of them came back: the registrar lifted the hold after the owner's "explanations", and the domain had to be taken down again. The gap between the streams comes down to TLDs and observation time: the car storefronts sat almost entirely in .com, while a large share of the crypto domains were in zones that react in weeks.

## How many days until suspension

For the 405 suspended crypto domains with a known date of the first submission:

| From first submission to suspension | Domains |
|---|---:|
| Under one day | 7 |
| 1 to 2 days | 70 |
| 3 to 6 days | 89 |
| 7 to 13 days | 77 |
| 14 to 29 days | 84 |
| 30 days and more | 78 |

The median is **9 days**, the mean 17 days, the 90th percentile 43 days, the maximum 131 days. A control calculation from the date the domain was first detected gives the same 9-day median. For the car storefronts (22 domains with an exact date) the median is 7 days, the mean 11, the maximum 42.

The practical takeaway for anyone waiting for a result: half of the domains are closed within a week and a half, but one in five lives a month or longer. If a site is collecting money right now, hit the hosting provider, the payment gateway and the browser blocklists in parallel with the registrar complaint: they cut off access to the page faster than a registrar takes down the domain.

## How many complaints it takes

35,180 submissions were sent about the suspended crypto domains, 91% of them before the suspension date. Per domain:

| Submissions before suspension | Domains |
|---|---:|
| 1 to 5 | 7 |
| 6 to 10 | 7 |
| 11 to 20 | 54 |
| 21 to 40 | 127 |
| More than 40 | 210 |

The median is **44 submissions** before suspension, the mean 79, one domain in ten needed more than 209, the maximum was 599. There are no domains in the sample that were suspended "on their own" without a single submission. For the car storefronts the median is 29 submissions.

An important caveat: volume does not always speed things up. Some domains received 300 to 600 submissions and stayed up for months, while in responsive TLDs a domain went down after one or two full rounds across all channels, that is after 20 to 40 submissions. Beyond that point the TLD and the quality of evidence decide, not the number of emails.

## Breakdown by TLD

Here the coverage is 100%: the TLD is known for every domain. The suspended share is calculated against all domains of the TLD in work; the median is counted in days from taking the domain into work until suspension.

| TLD | Total | Closed | Share | Days (median) |
|---|---:|---:|---:|---:|
| .sbs | 18 | 16 | 89% | 2.8 |
| .co | 11 | 9 | 82% | 29.9 |
| .beer | 5 | 4 | 80% | 4.4 |
| .co.com | 48 | 38 | 79% | 15.7 |
| .gr.com | 29 | 21 | 72% | 4.0 |
| .ink | 30 | 19 | 63% | 2.4 |
| .com | 215 | 112 | 52% | 7.4 |
| .net | 30 | 15 | 50% | 14.6 |
| .io | 22 | 11 | 50% | 35.9 |
| .org | 102 | 46 | 45% | 13.5 |
| .pro | 16 | 7 | 44% | 1.5 |
| .app | 13 | 4 | 31% | 24.9 |

What the table shows:

- **The most responsive TLDs:** .pro (1.5 days), .ink (2.4), .sbs (2.8), .gr.com (4.0), .beer (4.4). These are inexpensive zones whose registries suspend a domain on a confirmed complaint directly, without waiting for the registrar.
- **The slowest:** .io (36 days), .co (30), .app (25). With country-code registries and zones that run their own verification rules, the domain goes through correspondence with the owner, response deadlines and repeated checks. The high share in .co combined with the long time means exactly that: almost everything gets closed, but a month later.
- **.com** sits in the middle: 52% in 7.4 days. Here the registrar decides rather than the registry, which is why the spread inside the zone is the widest.
- In the car stream 30 of the 38 suspended domains were in .com, the rest in .gr.com, .co.com and other zones.

For legitimate projects the table has a flip side: in zones with a fast registry a mistaken or malicious complaint also works fast. If you operate in .pro, .ink or .sbs, keep the domain's contact details current and answer the registrar's emails on the day they arrive, otherwise the domain may be put on clientHold until the matter is sorted out. How responsibility is split between the registrar and the registry is explained in the [glossary](https://rikidomains.at/en/glossary/registrar-registry/).

## Registrars

The registrar is known for only 15% of suspended domains in our log (archived records do not keep it), so this breakdown is indicative only: NiceNIC, a median of about 6 days across 20 domains; Openprovider, about 13 days across 16; Dynadot, about 24 days across 12; in the car stream one to four domains each at Namecheap, NiceNIC, PDR, Dynadot, NameSilo, eNom and Dominet. Numbers this small do not support conclusions about "fast" and "slow" registrars; public datasets on thousands of domains exist for that: the [European Commission's DNS abuse study](https://arxiv.org/pdf/2212.08879) with median lifetimes of phishing domains across 20 registrars, the monthly [NetBeacon MAP reports](https://netbeacon.org/map/monthly-analysis/) and the [PhishDestroy escalation log](https://phishdestroy.io/registrar-abuse-response-failure). Our figures agree with them on the main point: the spread between registrars is smaller than the spread between TLDs.

> [Open the bot](https://t.me/riki_domains_bot?start=g12)

## What this means in practice

1. **Count in weeks, not hours.** The 9-day median comes from submitting to every channel at once with a complete evidence package. A single complaint in a registrar form without screenshots and links to the specific pages would not have made it into these statistics at all.
2. **Check the TLD before you wait.** A domain in .sbs or .ink usually closes within days; a domain in .io or .co will take a month of correspondence. For the slow zones, bring in the hosting provider and payment services right away.
3. **Two full rounds, then evidence.** After 20 to 40 submissions across all points, further emails barely speed up the result. New material does: fresh screenshots, payment trails, a list of clones on neighbouring domains.
4. **Verify again later.** 14 of 407 closed domains came back after the clientHold was lifted. A suspension should be confirmed one or two weeks later and the complaint resubmitted if needed.
5. **Do not expect a suspension from the fact of fraud alone.** A registrar does not establish that a scam took place; it checks for a violation of its own rules: a phishing form, brand impersonation, malicious code. The complaint has to show exactly that.

## Other topics missing from the statistics

Besides the two streams, the service took on one-off orders: sites tied to trading in stolen bank cards, shops selling "over-the-counter" testosterone boosters and supplements, phishing aimed at gaming platforms with CS:GO cases, and sites selling phone numbers. These were special orders of two or three domains at a time, with no continuous submission log kept, so they are not in the tables. The procedure for them is the same: complaints to the registrar, the registry and the host with evidence until the result.

## Limitations

- The sample consists of domains from the two topics our service worked on, not a random sample of all scam sites. Other topics will have different TLD proportions and timings.
- For the car stream an exact suspension date exists for 22 of the 38 closed domains; the others went to the archive without a status change event.
- Time is counted by dates, not hours, to remove the time zone offset between the logs.
- The registrar is known for a small share of domains; see the registrar section above.

The figures will be updated as the log grows; the cut-off date is at the top of the article. If you need a specific site taken down, the terms and the request format are on the [service page](https://rikidomains.at/en/guides/phishing-site-takedown-service/).

## FAQ

**How long does it take to get a scam domain suspended?**

In our sample the median is 9 days from the first complaint to suspension, the mean is 17 days. One case in ten took longer than 43 days. The TLD matters most, together with whether the complaint also went to the hosting provider and the registry, not only the registrar.

**How many complaints does it take?**

A median of 44 submissions per domain across all channels: registrar, registry, hosting provider, browser blocklists. Single complaints rarely work: only 7 of 405 domains were suspended after 1 to 5 submissions.

**Which TLDs suspend scam domains fastest?**

.pro, .ink, .sbs, .gr.com and .beer: a median of 1.5 to 4.4 days. The slowest are .io (36 days), .co (30) and .app (25).

**What counts as a suspension?**

A clientHold or serverHold status set by the registrar or the registry, deletion of the domain, or the domain going dead and no longer resolving. A reversible quarantine is counted separately and is not included.

**Does the registrar matter?**

It does, but in our sample the registrar is known for only 15% of suspended domains, so the registrar breakdown is indicative only. Large public datasets exist: the European Commission's 2022 DNS abuse study, the monthly NetBeacon MAP reports and the PhishDestroy escalation table.