Guide · 4 min read

What a registrar actually needs before they will suspend a domain

Most takedown notices fail because they assert resemblance. Abuse desks act on reproduction, and the difference is four specific checks.

A notice that says "this domain looks like ours" gets filed and forgotten. Registrars receive thousands of those, most from automated tools, and a large share name domains that turn out to belong to unrelated businesses.

What moves an abuse desk is evidence that the page *reproduces* something of yours. Four things establish that, and all four are checkable without any cooperation from the other side.

The four checks

Text reproduction. How much of the page body is your copy, verbatim. A percentage with the matched passage quoted is far stronger than an assertion of similarity.

Asset hotlinking. Whether the page loads images, logos or stylesheets directly from *your* servers. This is common, because rebuilding assets is work, and it is close to conclusive — a business with a coincidentally similar name has no reason to serve your logo off your own infrastructure.

Favicon match. The same icon file, byte for byte. Cheap to check and hard to explain away.

A credential form posting off-site. A password field whose form action points at a different domain. Rarely innocent, and it converts a trademark complaint into a phishing report, which is a faster queue at every registrar.

Seal it before you send it

All four require the page to be live when you look. Clone pages usually are not, by the time anyone reads your notice — so the capture has to happen at discovery, hashed and timestamped, or the abuse desk opens a dead link and closes the ticket.

What not to send

Do not send a notice you have not verified, and do not send one on resemblance alone. A wrongful notice against a real business is a liability that lands on you, not on the tool that generated it — and the abuse desk that receives two bad notices from you will treat the third accordingly.