# Phishing and Scam Site Takedown Service: How It Works

> How Riki Domains gets phishing and scam domains suspended through complaints to registrars and hosts: formats, prices, timelines and what the client provides.

- Language: en
- Published: 2026-10-18 · Updated: 2026-10-18
- HTML: https://rikidomains.at/en/guides/phishing-site-takedown-service/
- Markdown: https://rikidomains.at/en/guides/phishing-site-takedown-service/index.md
- RU version: https://rikidomains.at/ru/guides/blokirovka-fishingovyh-saytov/

Scam victims and brands targeted by phishing hit the same wall: registrars and hosting providers respond slowly, want evidence in their own format and often reply with a template. Riki Domains takes that work over: it prepares the complaints, files them everywhere the site has a point of failure and follows through until the domain is suspended. Below is how the service works, what it costs and what to expect.

## Who needs it

- **Victims of prepayment schemes.** A typical case from practice: sites that "sell" cars and heavy machinery from the US to an English-speaking audience on prepayment, collect the money and vanish. There are dozens of such storefronts and they clone faster than anyone can report them by hand.
- **Crypto projects and their users.** Phishing copies of wallets, exchanges and dApp interfaces that steal seed phrases and transaction signatures.
- **Brands and services.** Fake login pages, "support desks" and "promotions" under someone else's name.
- **Lawyers and agencies** who handle such cases for clients and want to outsource the technical part.

## How it works

A domain rests on several supports: the registrar, the zone registry, the hosting provider, a CDN, the mail provider, sometimes a payment gateway. Each has acceptable-use rules and a complaint channel. A takedown is achieved by filing an evidence-backed complaint at every point where the violation is obvious and pushing each one to a decision, rather than sending a single message into a contact form.

1. **Request.** In the [@riki_domains_bot](https://t.me/riki_domains_bot?start=g10) bot, open the "Block a competitor" section and choose the format: a one-off takedown or 30-day outsourcing. That is how the section is labelled in the current bot; it is about fraudulent and phishing sites.
2. **Input.** You provide the addresses and everything that leads to the violating content: links to specific pages, screenshots, correspondence with the scammers, payment examples. This is mandatory: without evidence a registrar does not review a complaint.
3. **Work.** Complaints are prepared and filed manually with the registrar, the zone registry and the host, and under outsourcing also against the server infrastructure. Each thread is followed up until a decision.
4. **Result.** A request is complete when the domain receives the clientHold or serverHold status: it stops resolving and the site no longer opens. Under outsourcing a report arrives for every domain and server.

![The service section in the bot: one-off takedown, 30-day outsourcing, my requests](https://rikidomains.at/assets/img/guides/ru-27-block-menu.webp "Two service formats and the status of your requests (bot interface shown in Russian)")

## Formats and prices

| | One-off takedown | 30-day outsourcing |
|---|---|---|
| For | one domain or a few separate ones | a stream of domains, clones that keep appearing |
| Price | $50 per domain | $1,000 per 30 days |
| Volume | per domain | up to 100 domains, more by agreement |
| Deadline | 14 working days per domain | a month of work |
| Included | complaints to the registrar, registry and host until a result | the same plus complaints against server infrastructure and a report per domain and server |
| If it fails | the amount returns to your balance | — |

The one-off terms are fair in both directions: $50 is reserved on the balance, and if the domain is not suspended within the deadline the money comes back.

> [Open the bot](https://t.me/riki_domains_bot?start=g10)

## What speeds up a takedown

Registrars and hosts respond to evidence, not emotion. The more precise the package, the shorter the correspondence.

- **Direct links** to the violating pages, not the home page.
- **Screenshots with the date and the address bar.** For phishing: the data entry form and the address it imitates.
- **Money trail.** The payment details you were asked to use, chats with the "manager", transfer confirmations.
- **The link to the brand or the victim.** If your site is being copied, show the original and its publication date.
- **The list of clones.** Schemes live on dozens of domains; if the neighbours are known, they are taken down in one series.

## What the service does not do

- It does not take down domains registered through Riki Domains.
- It does not work on sites without a policy violation: content disputes, competition, personal conflicts. The basis of a complaint is always specific: phishing, fraud, a breach of the platform's policies.
- It does not use technical attacks. The only tool is complaints filed in the established order with evidence.

## How to order

Open the bot, go to the "Block a competitor" section, pick the format and send the addresses in one message: one per line, separated by spaces or commas, in any form including full links and IDN. For outsourcing and volumes above 100 domains write to [@riki_domains_support](https://t.me/riki_domains_support): terms are agreed individually. Request status is visible under "My requests".

## FAQ

**Which sites do you take down?**

Phishing pages, scam schemes and other resources that violate registrar and hosting policies: fake bank and service logins, goods sold on prepayment and never delivered, crypto theft through fake forms. Domains registered through Riki Domains are out of scope.

**How much does one domain cost?**

A one-off takedown is $50 per domain. The amount is reserved on your balance for the duration of the work: if the domain is suspended within the deadline it is charged, otherwise it is returned to the balance.

**How long does it take?**

The deadline for a one-off request is 14 working days. In practice it depends on the registrar and host: some react within a day, others take weeks, which is why complaints go to several addresses at once.

**What do clientHold and serverHold mean?**

They are domain statuses at the registrar and the registry under which the domain stops resolving, so the site on it no longer opens. That outcome counts as a completed request.

**What do you need from me?**

The site addresses and the details that lead to the violating content: links to specific pages, screenshots, correspondence, examples of the fraud. The more complete the evidence, the faster registrars respond.