How long does a phishing takedown actually take?
There is no single answer, and anyone quoting one flat number is guessing. What can be described honestly is the shape of the process: which step moves in hours, which moves in days, and which factors reliably make a case slow.
The three phases, and how fast each one moves
A takedown is not one action. It is three, running in parallel at different speeds.
- Warning users (hours). Browser and security blocklists evaluate a submitted URL automatically. Once a site is flagged, most visitors get a full-page warning. The page is still online, but its reach collapses. See reporting to Safe Browsing.
- Removing the content (one to several days). The hosting provider takes the files down. Fast when the provider is cooperative and the evidence is clear.
- Suspending the domain (days to weeks). The registrar disables the name itself. This is the most complete outcome and the slowest, because it affects their paying customer.
What reliably makes a case slow
- A thin report. No screenshot, no timestamp, no explanation of what the page does. The abuse desk has to reproduce your work before they can act.
- The wrong recipient. A report to general support instead of the abuse address often adds days before it is routed correctly.
- A compromised legitimate site. The provider has to contact their own customer first, which is correct but slower.
- A permissive provider. Some providers simply do not act. Blocklists are the realistic protection in those cases.
- Evidence that expired. If the page is already gone when the report is read, there is nothing left to verify.
How Fraudpol measures its own durations
Published timings should be checkable, so ours are defined narrowly. The clock starts when the case is opened with the provider. "Offline" means an automated liveness check found the address no longer answering. We report medians rather than averages so a single outlier cannot flatter the figure, and we always show the sample size.
Cases entered more than 24 hours after the original report are historical records and are excluded from every median, because their timings describe our back-filling, not our response. And an observed disappearance is recorded as an outcome, not as something Fraudpol necessarily caused.
The live figures are on the results page, broken down per provider on the provider response pages.
What you can do to make it faster
- Capture evidence before you report, while the page is still live.
- Send to the published abuse address, not to support. Find it with the abuse contact lookup.
- Report to the registrar, the host and the blocklists in parallel rather than one after another.
- State plainly what you are asking for and why the page is harmful.
- Re-check with the site status check and escalate to the registry after about three days of silence.
Have a URL to report right now?
Fraudpol triages the case, files with the right blocklists and opens a takedown with the hosting provider: usually within minutes.
Report a website to FraudpolRelated guides
Frequently asked questions
What is a realistic expectation for a straightforward phishing domain?
Browser blocklisting is usually the fastest protection and can take effect within hours of a well-evidenced submission. Domain suspension by a cooperative registrar commonly lands within one to three business days. Cases involving an unresponsive provider, a disputed report or a hacked legitimate site routinely run longer.
Why does blocklisting happen faster than suspension?
Blocklists are automated systems that evaluate a URL and warn users. Suspension is a human decision by a registrar or host with contractual and legal consequences for their customer, so it goes through review. That is why both routes are used in parallel.
Does a site disappearing mean the report worked?
Not necessarily. Phishing infrastructure is often rotated by the operator after a few days regardless of any report. Fraudpol records an observed disappearance as an outcome, never as proof that our report caused it.