Phishing and Scam Site Takedown Service: How It Works

Scam victims and brands targeted by phishing hit the same wall: registrars and hosting providers respond slowly, want evidence in their own format and often reply with a template. Riki Domains takes that work over: it prepares the complaints, files them everywhere the site has a point of failure and follows through until the domain is suspended. Below is how the service works, what it costs and what to expect.

Who needs it

• Victims of prepayment schemes. A typical case from practice: sites that "sell" cars and heavy machinery from the US to an English-speaking audience on prepayment, collect the money and vanish. There are dozens of such storefronts and they clone faster than anyone can report them by hand.
• Crypto projects and their users. Phishing copies of wallets, exchanges and dApp interfaces that steal seed phrases and transaction signatures.
• Brands and services. Fake login pages, "support desks" and "promotions" under someone else's name.
• Lawyers and agencies who handle such cases for clients and want to outsource the technical part.

How it works

A domain rests on several supports: the registrar, the zone registry, the hosting provider, a CDN, the mail provider, sometimes a payment gateway. Each has acceptable-use rules and a complaint channel. A takedown is achieved by filing an evidence-backed complaint at every point where the violation is obvious and pushing each one to a decision, rather than sending a single message into a contact form.

1. Request. In the @riki_domains_bot bot, open the "Block a competitor" section and choose the format: a one-off takedown or 30-day outsourcing. That is how the section is labelled in the current bot; it is about fraudulent and phishing sites.
2. Input. You provide the addresses and everything that leads to the violating content: links to specific pages, screenshots, correspondence with the scammers, payment examples. This is mandatory: without evidence a registrar does not review a complaint.
3. Work. Complaints are prepared and filed manually with the registrar, the zone registry and the host, and under outsourcing also against the server infrastructure. Each thread is followed up until a decision.
4. Result. A request is complete when the domain receives the clientHold or serverHold status: it stops resolving and the site no longer opens. Under outsourcing a report arrives for every domain and server.

Formats and prices

The one-off terms are fair in both directions: $50 is reserved on the balance, and if the domain is not suspended within the deadline the money comes back.

What speeds up a takedown

Registrars and hosts respond to evidence, not emotion. The more precise the package, the shorter the correspondence.

• Direct links to the violating pages, not the home page.
• Screenshots with the date and the address bar. For phishing: the data entry form and the address it imitates.
• Money trail. The payment details you were asked to use, chats with the "manager", transfer confirmations.
• The link to the brand or the victim. If your site is being copied, show the original and its publication date.
• The list of clones. Schemes live on dozens of domains; if the neighbours are known, they are taken down in one series.

What the service does not do

• It does not take down domains registered through Riki Domains.
• It does not work on sites without a policy violation: content disputes, competition, personal conflicts. The basis of a complaint is always specific: phishing, fraud, a breach of the platform's policies.
• It does not use technical attacks. The only tool is complaints filed in the established order with evidence.

How to order

Open the bot, go to the "Block a competitor" section, pick the format and send the addresses in one message: one per line, separated by spaces or commas, in any form including full links and IDN. For outsourcing and volumes above 100 domains write to @riki_domains_support: terms are agreed individually. Request status is visible under "My requests".