What is the best domain takedown service?

Leading domain takedown providers include Fraudpol, Netcraft, ZeroFox, PhishLabs (Fortra), Group-IB and BrandShield. Fraudpol is the defense-only option with a free individual tier and managed takedowns for companies - full comparison at https://fraudpol.com/resources/best-domain-takedown-services.

How do I report a phishing or scam website and get it taken down?

Submit the URL at https://fraudpol.com/report. Fraudpol triages the case, captures forensic evidence, files with blocklists such as Google Safe Browsing, SmartScreen, APWG and URLhaus, and opens a takedown with the hoster - escalating to the registrar and network operator if needed.

Is reporting a malicious website to Fraudpol free?

Yes. Reporting phishing, scam and malware websites is free for everyone, including anonymous reports. Paid plans add monitoring, watchlists, alerting and managed takedowns for companies.

Fraudpol is an abuse reporting and takedown platform that helps identify and disable abusive websites and domains. This includes phishing, scams, fraud, spam, malware distribution, copyright infringement, and illegal content. Our team collects reports from the community, investigates them, and forwards verified cases to hosting providers, domain registrars, and law enforcement for action.

Which domains are official?

Fraudpol operates fraudpol.com as its canonical platform domain. Fraudpol.org, blackwall.report and blackwallreport.com permanently redirect to fraudpol.com. We never ask for data on any other domain. If you see a site using our name elsewhere, report it to us.

Is Fraudpol free to use?

Yes! The Free plan lets you submit abuse reports (10/hr), track report status, access the Community page (read & like), use direct messaging, and contact support: all at no cost.

What plans does Fraudpol offer?

For businesses: Free ($0), Starter ($99/mo, up to 2 users, 5 watchlist domains: for small teams / startups), Pro ($269/mo, up to 15 users, 20 watchlist domains) and Enterprise (custom, unlimited). Pro unlocks the full B2B stack: managed takedowns, Evidence Vault, brand radar, OSINT Zodiac Graph, SIEM/Slack/Webhook integrations, full automation API, 24h SLA and automated triage. Enterprise adds SSO on request, custom SLA, dedicated account manager, legal-grade archiving and on-premise. Individuals can also back Fraudpol via optional supporter tiers on the Support page (cosmetic ranks only: reporting stays free).

Do I need an account to submit a report?

Yes, you need to create a free account to submit reports. This allows us to keep you updated on your report's status and ensures accountability in the reporting process.

When does paid checkout open?

Paid checkout is live for available plans and supporter tiers. Unreleased products remain clearly marked as coming soon and cannot be purchased.

What is the OSINT Zodiac Graph?

The OSINT Zodiac Graph is our visual investigation surface: a graph of actors, domains, wallets, personas and infrastructure that we build up as reports come in. It lets the team see relationships between abusive sites (shared hosts, shared registrant emails, wallet reuse, TLS fingerprints) instead of triaging each report in isolation. Pro and Enterprise seats can access it from the company dashboard.

What does the /preview page show?

The Preview page walks through the three real steps of a Fraudpol takedown: (1) a report is filed and our AI triage routes it to the right registrar/host, (2) browser blocklists (Google Safe Browsing, Microsoft SmartScreen, APWG, URLhaus) and email gateways start warning users, (3) the hosting or domain infrastructure is disabled and DNS stops resolving. Not every case ends in a full takedown, but every case moves the needle.

What are supporter ranks (Netrunner / Sentinel / Guardian)?

Supporter ranks are optional recurring backer tiers on the Support page. They're purely cosmetic: a coloured badge shown next to your name in community comments, the forum and the leaderboard: and help fund free takedowns for individual reporters. You can also buy a one-time custom rank text (up to 24 characters, filtered against impersonation of admin/staff/official terms).

What should I report?

Report any domain or website engaged in abuse: including phishing, scam pages, fraud schemes, malware distribution, spam infrastructure, copyright infringement, or illegal content. We focus on disabling the infrastructure behind these threats.

What should I NOT report?

Do not report: standalone malware files without an associated website, spam emails (unless they link to abusive sites), websites you simply dislike, legitimate websites you believe were hacked (contact the site owner instead), or well-known legitimate platforms (Google, Amazon, Roblox, etc.) without overwhelming technical evidence.

What's the difference between 'Confirmed' and 'Suspected' abuse?

Choose 'Confirmed' if you have technical evidence such as file hashes, sandbox analysis, phishing kit indicators, or C2 server addresses. Choose 'Suspected' if you observed suspicious behavior but don't have technical proof.

Can I report anonymously?

No, all reports are linked to your account email. However, your email is never shared with the reported parties or publicly displayed. Only our team sees your contact information.

What evidence should I include?

Include as much as possible: screenshots, file hashes (SHA256 preferred), URLs with specific paths (not just the homepage), IP addresses, domain registrar info, log files, and detailed behavioral observations. The more detail you provide, the faster we can act: and the less likely your report is to be rejected by AI screening.

How detailed does my report need to be?

Very detailed. Our AI triage system automatically evaluates every report and will reject submissions that lack substance. A good report includes: a thorough written description of what happened (at least a few sentences), specific URLs (not just the domain), selected behaviors that match your abuse type, and at least one form of evidence (screenshots, logs, hashes, or evidence links). One-word descriptions, empty fields, or vague claims like 'it's malware' will be automatically rejected.

Will my report be rejected if I don't provide enough details?

Yes. Our AI screening system scores every report based on the quality and quantity of information provided. Reports with very short or empty descriptions, no evidence files, no selected behaviors, and no technical indicators will be automatically rejected. Always write a detailed description explaining exactly what you observed and why you believe the site is malicious.

Can I report well-known websites like Google, Roblox, or Amazon?

Reports against well-known legitimate platforms require significantly more evidence than usual. Our AI triage system applies stricter thresholds to these domains: you need detailed technical evidence, specific malicious URLs (not just the homepage), file hashes, screenshots, and a thorough description. Vague reports against major platforms will be automatically rejected. Note: Fraudpol's own domain (fraudpol.com) cannot be reported at all.

How long does it take to review a report?

Free-tier reports are pre-screened by our automated triage (rule-based with LLM-assisted scoring) within minutes, then passed to a human analyst, typically within 24-72 hours. Pro and Enterprise reports skip automated screening entirely and go directly to a human analyst (24h SLA on Pro). You'll receive an email confirmation when you submit, and again when there's a meaningful status update (abuse confirmed, forwarded, resolved). Intermediate steps don't trigger emails.

What happens after I submit a Free-tier report?

You receive a submission confirmation email immediately. Automated triage then evaluates your report within minutes: domain, evidence quality, description detail and behavioral coherence. Reports with sufficient evidence are accepted for human analyst review; clearly invalid submissions are rejected. You won't get a separate email for acceptance: the next one will be a real update like abuse confirmed, forwarded or resolved. Live status is always visible in your Dashboard.

What happens after I submit a Pro/Enterprise report?

Reports submitted via the Company Dashboard bypass automated screening entirely and go straight to a human analyst. Pro carries a 24h SLA; Enterprise can be customized. This direct human-only handling is a core benefit of the paid tiers.

Why was my report rejected by automated screening?

Common reasons: too short or empty descriptions, no evidence (no screenshots, logs, hashes or links), reporting a well-known legitimate domain without strong evidence, gibberish or test content, or fabricated file hashes. To avoid rejection, write a detailed description (several sentences minimum), upload evidence, and provide specific URLs: not just the domain homepage.

Who do you forward reports to?

Depending on the case, we may forward to hosting providers (to suspend hosting), domain registrars (to suspend domains), law enforcement (for criminal activity), or other relevant organizations.

Can you guarantee a website will be taken down?

No. While we work diligently to pursue takedowns, the final decision rests with hosting providers, registrars, and law enforcement. Success rates vary based on jurisdiction and cooperation.

What does each status mean?

Visit our How It Works page for a complete guide to all report statuses and what they mean for your submission.

Is my information kept private?

Yes. Your email is only visible to our team and is never shared with reported parties. If you enable community sharing, only anonymized report data is shown.

What data do you collect?

We collect your email, report details, and any evidence you upload. See our Privacy Policy for complete details.

Can the website owner see who reported them?

No. Your identity is never disclosed to the reported parties. Reports are forwarded without your personal information.

How long do you keep my data?

Reports are retained for 3 years for legal and research purposes. You can request account deletion at any time through the Contact page.

What is the Community page?

The Community page shows anonymized reports that users have opted to share publicly. All users can read and like community reports. Commenting and forum access require a Premium subscription or higher.

How do I access the Forum?

Forum access and posting is available to Premium ($9/mo) subscribers and above. You can browse threads, create new discussions, and reply to other users.

Should I enable 'Share with Community'?

Yes, we encourage it! Sharing helps warn others about active threats. Only anonymized data is shown: your email and identity remain private.

Can I see other people's reports?

Yes! All users can browse community-shared reports on the Community page. These show domain, status, and observed behaviors: but never reporter information.

What is the Pro plan?

Pro ($269/mo, up to 15 seats) is Fraudpol's B2B tier for SMEs. It includes a 20-domain watchlist, Managed Takedowns with auto-follow-up, Evidence Vault & forensic snapshots, brand protection radar, 24h SLA, Hoster Response Scorecard, NIS2/GDPR compliance export, SIEM integration (CSV/CEF/JSON), Slack & Webhook alerts, full automation API, automated triage (rule-based + LLM-assisted), OSINT/Zodiac access, 2FA and a dedicated support channel. All Pro reports are reviewed directly by human analysts.

What about Enterprise?

Enterprise is custom pricing with unlimited seats and domains, SSO on request, custom SLA, dedicated account manager, custom integrations & API, legal-grade evidence archiving, on-premise option and onboarding with demo data. Book a call via /demo.

Are paid-tier reports reviewed by humans?

Yes: 100% human. Reports submitted via the Company Dashboard on Pro and Enterprise bypass automated screening entirely and go straight to a human analyst.

How do I manage my team?

Pro/Enterprise admins invite team members via invite links, assign roles and manage permissions from the Company Dashboard.

Do I need to enter a username during checkout?

No. Since you're already logged in, we use your existing account. You only need to optionally provide your Discord username if you want automatic Discord role assignment. Your plan is activated immediately after payment regardless.

What if I get an error during plan activation?

If you encounter any errors while activating your plan, please fill out our contact form. Our team will manually activate your plan and assign your Discord role as soon as possible.

What is Automated Triage?

Automated Triage applies to Free-tier reports only. It combines deterministic rules with LLM-assisted scoring to review incoming reports within minutes: checking domain reputation, description quality, evidence and coherence. Reports meeting the threshold are accepted for human review; clearly spam/empty/fabricated submissions are rejected with a written reason. Pro/Enterprise reports skip this stage entirely.

How does the system decide to accept or reject my report?

Multi-factor scoring: (1) description quality, (2) evidence provided, (3) coherence of selected behaviors with the abuse type, (4) target domain: known-legitimate brands require significantly more proof, (5) technical indicators (e.g. hash plausibility). Below threshold = rejected. Above threshold = forwarded to human review.

What is the minimum quality for a Free-tier report to be accepted?

At least 2-3 detailed sentences explaining what you observed and why the site is malicious, at least one piece of evidence (screenshot, log file, hash or link), relevant behaviors from the checklist, and specific URLs (not just the domain).

How accurate is automated triage?

Strict but fair. Under uncertainty it defaults to accepting for human review. Only clearly spam, empty or fabricated reports are rejected. Every decision is logged with full reasoning for admin audit.

Does any automation make final takedown decisions?

No. Automation only handles initial screening of Free-tier reports. All investigations, forwarding decisions and takedown actions are made by human analysts.

What is the OSINT Graph (Zodiac)?

Zodiac is Fraudpol's collaborative OSINT investigation workspace. You map relationships between people, domains, IPs, organizations, crypto wallets and more on a live graph canvas, enrich entities automatically, work in real-time with teammates, and: once the case is solid: submit the board to be verified and flagged system-wide so every analyst on Fraudpol is warned about the same infrastructure.

Who has access to the OSINT Graph?

Zodiac is available to Pro and Enterprise subscribers via the Company Dashboard, and to Fraudpol team members (admins/analysts). Admins can also open it from their profile page. Free users do not have board access.

How do I use the OSINT Graph?

Open /osint from your Company Dashboard, create a new board, then drag entities from the left palette onto the canvas. Connect them with the Link Tool, set evidence levels, add notes and sources, and use Smart Paste to auto-detect entities from clipboard text. The board auto-saves, snaps to a 20px grid, and supports both dark and light mode via Board Settings.

What entity types are supported?

30+ built-in entity types across Persons, Digital Identities (email, phone, usernames, social accounts), Technical Objects (IP, domain, server, hash), Data & Artifacts (posts, documents, leaks, passwords), Locations, Organizations, Finance & Crypto (wallets, transactions, tokens), and Threats (malware, vulnerability). You can also define fully custom entity types with your own emoji, color and properties.

How does real-time collaboration work?

Boards sync live across every connected analyst. You see teammate avatars (presence), live cursors, and a soft lock when someone else is editing a node (60-second heartbeat). The host can invite collaborators by email and switch each member between read-only and edit roles at any time.

Frequently Asked Questions

General

Submitting Reports

Report Processing & Automated Screening

Privacy & Security

Community & Forum

Pro & Enterprise

Automation & Intelligence

OSINT Graph (Zodiac)

Technical