How to Take Down a Website That Targets or Copies You

To take down a website, first identify who controls it: look up the domain’s registrar with an RDAP (formerly WHOIS) lookup and find the hosting company from its IP address. Then send an abuse report to the host and registrar that matches a problem they act on, such as phishing, malware, copyright infringement (a DMCA notice) or trademark-infringing impersonation. For a domain name that infringes your trademark, the UDRP process can transfer it to you. Sites that simply criticize you are often lawful and usually stay up without a court order.

The key is knowing what each company in the chain will and won’t act on. Hosts and registrars are not judges of whether a site is fair. They respond to clear rule-breaking, legal notices and court orders.

What kind of website are you dealing with?

Your route depends almost entirely on what the site does. Be precise before you contact anyone.

Type of site	Main routes	Realistic chance
Phishing or fake checkout site pretending to be your business	Abuse reports to host, registrar and CDN; report phishing to Google	Often good, because phishing breaks almost every provider’s terms
Site that copies your text, photos or product images	DMCA notice to the host; Google copyright removal	Often good if you clearly own the content
Domain using your trademark, such as a lookalike of your brand name	Trademark complaint to host; UDRP complaint	Depends on how the domain is used and your trademark rights
Site posting your private information	Abuse report to host; Google personal information removal	Varies by host; Google removal is often the more reliable route
Gripe or criticism site about you or your company	Legal review; reply, rebut and outrank	Usually low, because opinion and criticism are generally lawful
Site making false factual claims about you	Lawyer; court order; then host and Google	Possible with a court order, but slow

Step 1: Find the registrar and host

Every website has at least two companies behind it: the registrar that sold the domain name, and the host whose servers store the site. Many also sit behind a content delivery network (CDN) or security proxy.

1. Look up the domain. Use ICANN’s lookup tool at lookup.icann.org. ICANN says that since January 28, 2025, RDAP has replaced WHOIS as the definitive source of registration data for generic top-level domains like .com and .net. The result shows the registrar, the registration and expiry dates, and usually the registrar’s abuse email and phone number.
2. Expect the owner’s details to be hidden. Privacy protection or redaction is common, so the registrant’s name and address often won’t appear. That’s normal and doesn’t stop you reporting abuse to the registrar.
3. Find the host. Look up the site’s IP address with any DNS lookup tool, then run an IP lookup to see which company owns that address. The result usually names the hosting company and its abuse contact.
4. Check for a CDN. If the IP belongs to a CDN or security company, such as Cloudflare, the real host is hidden behind it. See the next section.

Record everything: the domain, the IP, the registrar, the host, the abuse contacts and the date you checked. Save screenshots of the pages you’re reporting, with their full URLs.

When the site is behind Cloudflare or another CDN

A CDN passes traffic to the website but usually doesn’t host it. Cloudflare says it can’t remove content it doesn’t host. Instead, when you submit a report through its abuse form about a site using its proxy and CDN services, Cloudflare forwards your complaint to the website operator and the hosting provider, and gives the host the site’s origin IP address so it can locate the content.

In practice, a report to the CDN is how you reach a host you otherwise couldn’t identify. Once Cloudflare replies with the host’s details, you can follow up with that host directly. Other CDNs have their own processes, so check each provider’s abuse page.

Step 2: Send an abuse report the provider can act on

Hosts and registrars have acceptable use policies that prohibit things like phishing, malware, spam and illegal content. Accredited registrars are also required by their agreement with ICANN to keep an abuse contact and respond to reports. What they won’t do is rule on whether a site is fair to you.

A strong abuse report is short and specific:

• The exact URLs, not just the domain.
• Which of the provider’s rules or which law it breaks, in one sentence.
• Evidence: screenshots, the page where it copies your login form, the original of your copied content.
• Who you are and your connection to the problem.
• What you’re asking for: removal of the pages or suspension of the site.

Subject: Phishing site impersonating Northgate Supply, [domain]. We are Northgate Supply, and this site copies our logo, product pages and checkout, and collects card details from customers who think they are buying from us. It is not operated by us or with our permission. Screenshots and the URLs of our genuine pages are attached. This appears to breach your acceptable use policy on phishing and fraud. Please suspend the site. Contact: [name, role, email].

For phishing, also report the URL to Google Safe Browsing, which can trigger browser warnings for visitors while the takedown is pending.

Copied content: DMCA notices

If a site has copied your text, photos or videos, you can send a DMCA takedown notice to the host. Under US copyright law, hosts that want the safe harbor protection generally remove material after receiving a valid notice. A valid notice identifies your work, the infringing URLs, your contact details, a good-faith statement, a statement under penalty of perjury that you are authorized to act, and your signature. Most hosts publish a designated DMCA agent or form.

Only send a DMCA notice for work you actually own. Misusing the process to remove criticism can make you liable for damages, and the site owner can file a counter-notice. You can also ask Google to remove infringing pages from search results through its copyright removal process. Hosts outside the US may not follow the DMCA, though many have similar copyright procedures.

Domain names that use your trademark: UDRP

If the problem is the domain name itself, for example a lookalike of your brand used to deceive customers, the Uniform Domain-Name Dispute-Resolution Policy (UDRP) may help. Under ICANN’s policy, the complainant must show all three of these:

1. The domain is identical or confusingly similar to a trademark in which you have rights.
2. The registrant has no rights or legitimate interests in the domain.
3. The domain was registered and is being used in bad faith.

The only remedies are cancellation of the domain or transfer to you. There are no money damages, and either side can still go to court. The policy also recognizes legitimate noncommercial or fair use as a defense, which is why a genuine criticism site that isn’t trying to divert customers may survive a complaint. UDRP cases are filed with approved dispute resolution providers and involve fees and formal pleadings. Talk to a trademark lawyer before filing.

Court orders

When a site makes false statements of fact about you, or keeps publishing after abuse reports fail, a court order is often the only thing that will move a host or registrar. A judgment finding specific content defamatory or unlawful gives providers and Google something concrete to act on. A lawyer can advise on whether you have a claim and how to identify an anonymous operator. Our guide to defamation vs. opinion explains why harsh opinions usually don’t qualify.

Getting it out of Google

Even if the site stays up, you may be able to keep some of its pages out of Google Search:

• Copyright: Google’s legal removal process for copied content.
• Personal information: Google’s tools for doxxing and personal contact details, including Results about you.
• Court orders: Google’s legal request process for content a court has found unlawful.
• Removed pages: once a site is gone, Google’s Refresh Outdated Content tool can clear stale results faster.

A worked example

This is an illustrative scenario, not a real case.

A regional furniture retailer finds a site on a lookalike domain, its name with an extra word, running ads for “clearance sales” at prices far below its own. The site copies its product photos and collects card details. Customers start calling to ask why their orders never arrived.

1. The retailer saves screenshots and a list of URLs, and posts a short warning on its own website and social accounts.
2. An RDAP lookup shows a registrar and privacy-protected owner details. The IP lookup shows a CDN.
3. It reports the site to the CDN as phishing and fraud. The CDN forwards the report and replies with the host’s name.
4. It sends abuse reports to the registrar and the host, each pointing to the fraud clause in their policies, and a DMCA notice to the host for the copied photos.
5. It reports the site to Google Safe Browsing and files a police report for the affected customers.
6. Its lawyer prepares a UDRP complaint in case the domain is re-used with a new host.

A site like this often comes down once the host or registrar sees clear fraud, but timing depends on the providers. The warning to customers matters just as much as the takedown. For the communications side, our crisis management service covers what to say while it’s happening.

Gripe sites: set realistic expectations

A site built to criticize you, even harshly and even using your name in its domain, is often lawful. Hosts rarely remove criticism, and UDRP recognizes legitimate noncommercial use. Aggressive takedown attempts can also draw more attention to the site.

What usually works better: check whether any specific statements are false and worth legal review, fix whatever caused the complaint if it’s real, and make sure strong, accurate pages about you rank above it. Our content removal service assesses which pages have a real removal route and which need a different approach. If the site is posing as you rather than criticizing you, see our guide on what to do if someone is impersonating you online.

Frequently asked questions

Can I find out who owns a website?

Sometimes. An RDAP lookup shows the registrar and dates, but owner details are often hidden by privacy protection or redaction. Registrars generally disclose them only in limited cases, such as a valid legal request or court order. A lawyer can advise on whether a subpoena is realistic.

Will a hosting company take down a website because it's defamatory?

Rarely on your word alone. Hosts aren’t in a position to decide whether statements are true. Many will act on a court order that finds specific content unlawful, which is why defamation cases usually need a lawyer.

How long does it take to get a website taken down?

It depends on the problem and the providers. Clear phishing or malware is often handled faster than copyright or trademark disputes, and UDRP and court routes take considerably longer. There’s no fixed timeline.

What if the host is in another country?

Abuse reports still work with many overseas hosts, especially for phishing and malware. US copyright notices may not apply, but many hosts have similar procedures. The registrar, the CDN and Google’s removal routes are also worth pursuing in parallel.