Five different parties can affect a phishing site, each with a different scope of action, a different threshold and a very different speed. Knowing which is which is most of running a takedown well.
The chain
| Party | Can do | Acts on | Typical speed |
|---|---|---|---|
| Hosting provider | Remove the content, suspend the account | Clear evidence of phishing on their infrastructure | Hours to a day, for a provider with a real abuse process |
| CDN or proxy in front | Stop proxying, sometimes disclose the origin | Varies widely. Some act quickly; some consider themselves a neutral conduit | Hours to never |
| Registrar | Suspend the domain — the durable fix, since it survives rehosting | Evidence of abuse, usually a higher bar than the host applies | A day to a week |
| Certificate authority | Revoke the certificate | Misissuance, or issuance to a domain used for fraud | Days, and revocation rarely stops the attack |
| Registry | Suspend at the registry level, above the registrar | Only when the registrar will not act, and usually only for their own TLD policy breaches | Days to weeks |
Host stops it, registrar ends it
Host suspension: fast, and the attacker rehosts the same domain somewhere else in an hour. Registrar suspension: slower, and the domain stops resolving entirely. Rehosting does not help them. So: host first for speed, registrar for permanence — and capture evidence before either, because the first one to act destroys what the second one needs.
Why revocation rarely helps
Certificate revocation is widely requested and does very little. Browsers check revocation inconsistently, a revoked certificate often continues to work in practice, and the attacker can obtain another in minutes from any CA. Request it when there is a genuine misissuance to report, and do not treat it as a takedown route.
The registry is a last resort, not an escalation ladder
Registries generally decline to intervene in matters between a registrar and its customer, and reserve action for breaches of their own policies. Going to them first because it sounds more authoritative wastes a week and irritates the party you will ultimately need.