The window closes — Brand Protection

The moment anyone acts on a phishing site, the evidence of what it was begins to disappear — and the parties you need to convince next will ask for exactly what is now gone.

What disappears, and when

Host suspends the site
   -> content gone. A registrar asked to act now sees
      a domain serving nothing, and declines.

Attacker suspects detection
   -> content swapped for something benign, or the site
      pointed elsewhere. DNS changes within minutes.

Domain suspended by the registrar
   -> nameservers replaced. All DNS evidence gone.

Certificate revoked
   -> the CT log entry survives. This is the one thing
      that does not disappear.

Domain expires or is deleted
   -> RDAP record changes or empties.

Only the CT entry is permanent, and it establishes that a certificate existed for the name on a date — not what the site contained. Everything about the content is yours to capture or lose.

Why this compounds

Takedown is usually multi-party. The host acts, and then you want the registrar to suspend the domain so it cannot simply be rehosted. The registrar asks for evidence of abuse, and the host has already removed it.
Registrars are the right party for the durable fix and the slower one, so they are almost always asked second.
Nobody will take your word for it. An abuse desk receives a very large number of unfounded reports, and “it was there yesterday” is what every one of them says.

The rule

Capture before you act, on every finding, including the ones you expect to close. It costs a minute at detection and it is unrecoverable afterwards. A finding captured and then closed as benign has cost you nothing; a finding reported and then escalated without evidence has cost you the escalation.

This also applies to your own remediation

If the finding is a takeover of one of your own subdomains, the instinct is to remove the dangling record immediately. Capture first — the record pointing at attacker-controlled infrastructure is the evidence that the takeover occurred, and removing it destroys the proof while the attacker keeps the certificate they obtained.

Knowledge check

A host suspends a phishing site after your report. You now want the registrar to suspend the domain. What is the problem?

The registrar sees a domain serving nothing, and will decline to act without evidence of what it was — which the suspension removed.
Registrars do not act on phishing reports.
The domain can no longer be suspended once the host has acted.
The certificate was revoked, so there is no record of the site.

Correct — The registrar sees a domain serving nothing, and will decline to act without evidence of what it was — which the suspension removed. Takedown is usually multi-party and the registrar is almost always asked second, because they are the durable fix and the slower route. Your capture at detection is the only thing that survives the first party acting.

Not this — Registrars do not act on phishing reports. Many do, on well-evidenced ones. The obstacle here is the missing evidence.

Not this — The domain can no longer be suspended once the host has acted. Nothing prevents it technically. The registrar simply needs grounds.

Not this — The certificate was revoked, so there is no record of the site. The CT log entry is permanent and survives revocation — and it evidences the name and date, not the content.