A daily report is already stale
A vendor emailing you tomorrow morning is describing a page that has moved. The finding is true and useless.
Takedowns
Finding it is the demo. Removing it is the product.
Most monitoring tools hand you a list and call it a day. A list is not a result. This is the machinery that turns a confirmed copy into a dead URL, and what we do when an abuse desk ignores us.
The clock
Why parallel, and why within the hour
When we attributed live phishing pages across a public feed and went back to preserve the evidence, every single page was already gone. Not taken down — moved. Clone infrastructure lives for hours, not weeks.
Evidence first, notice second
We seal the capture before we send anything, because the abuse desk will open the link after the operator has deleted it.
Browser warnings beat host replies
Safe Browsing can be showing a red interstitial in under an hour. The host may take days. So we do not wait on the host.
Escalation
Three waves, and we tell you when to stop
Every authority below is a real destination in the routing engine, not a category. Wave three costs money and often is not worth it — we will say so.
- Wave 1
Everyone at once
Within one hour of your approvalSequential notices are how a clone stays up for three weeks. Every first-line authority is notified in parallel, because we do not know which one will answer and the clone does not wait while we find out.
Authority What it does Typical speed Domain registrar abuse desk Suspends the name outright — the fastest complete kill. Hours to days Hosting provider abuse desk Pulls the content even when the registrar declines. Hours to days Google Safe Browsing A full-page red warning in Chrome. Kills most of the traffic long before anyone takes the page down. Under an hour Microsoft SmartScreen The same interstitial for Edge and Windows users. Hours CDN abuse (Cloudflare and peers) Forwards the report to the origin and frequently reveals the real host. Hours PhishTank, APWG, URLhaus Propagates to browsers, mail filters, and security vendors industry-wide. Hours - Wave 2
Cut off the supply
If wave one has not produced a removal in its windowThe page is still up, so stop arguing with the host and take away what the operation actually needs: search traffic and the ability to get paid.
Authority What it does Typical speed Google Search legal removal De-indexes the clone so it stops ranking for your brand. Days Payment processor notice Removes the ability to take money. This is what ends repeat listings rather than one listing. Days Platform escalation (Telegram DMCA, marketplace IP, registry DMCA) The second desk at a platform whose first desk did nothing. Days - Wave 3
Force it
When an authority has refused and the domain is worth the fightGenuinely a last resort. It costs money and takes weeks, so we tell you the honest expected value before you spend it — and we say when it is not worth it.
Authority What it does Typical speed UDRP / URS domain dispute Transfers or suspends a bad-faith domain over the registrar’s objection. Weeks Outside counsel referral We are not a law firm. Persistent, high-value infringement goes to a lawyer with the evidence package already prepared. Your counsel’s timeline
Mechanics
What happens around the notice
Evidence sealed before anything moves
The page is captured, hashed with SHA-256, and timestamped at the moment we find it. Clones are deleted within hours; an abuse desk that opens a dead link closes the ticket. The hash is what makes the capture hold up after the page is gone.
You approve every notice
Nothing leaves under your name until you have seen the match and the evidence. A wrong notice sent to a real business is a worse outcome than a clone left up, so the approval is not a formality we can skip.
Re-verified until it is actually gone
We re-check the URL on a schedule, follow redirects, and only close the case when the content is confirmed down — not when the abuse desk replies saying it will be.
Reopened when it comes back
Operators redeploy the same kit on a new domain. A closed case that reappears is reopened against the new host with the evidence already built.
You get the removal numbers
Time-to-removal, removal rate, and which authority actually acted — per case and per month. If an escalation path stops working, you see it in your own data before we tell you.
Limits
What we will not claim
- We are not a law firm and nothing here is legal advice. We prepare evidence and notices; a lawyer files a lawsuit.
- No guaranteed removal. Registrars in some jurisdictions ignore notices, and bulletproof hosts exist to. What we commit to is speed, escalation depth, and telling you the truth about which cases are stuck.
- We will not send a notice you have not approved, and we will argue with you if we think a target is a legitimate business with a similar name. A wrongful notice is a liability you would be carrying, not us.
- Anyone who receives a notice can dispute it at abuse@alphaguard.live, and that address does not route through the person who sent it.