Overview

At Divine Intel we often receive requests for assistance in taking down a website that has a client’s information on it such as their name, photos. And most often, untrue information about our clients. This article will explain the basic structure, the pros and cons of different approaches, and some strategic versus tactical decisions that must be made to take down a website. The general steps are:

1. Capture Proof/Evidence
2. Contact Registrar
3. Contact Web-hosting Provider(s)
4. Submit reports to Search Engines (i.e. Google & Bing)

Background

You can skip this section and jump to The Take-Down section if you’re familiar with the key players in the world wide web and how it is organized, DNS, and how websites work between a Registrar, Hosting Provider, and Search Engine.

The Players (click to expand)

There are three key organizations behind the scenes running things by setting standards and coordinating global activities.  A deep discussion into them is outside of the scope of this article, but here’s who they are:

1. Internet Assigned Numbers Authority (IANA) https://www.iana.org/
2. Internet Corporation for Assigned Names and Numbers (ICANN), formed in 1998 as a nonprofit public benefit corporation, and is based in the US https://www.icann.org/en
3. National Telecommunications and Information Administration (NTIA) the entity that ICANN previously coordinated with, but no longer oversees the activities. Reaching out to them for help is a “break glass” kind of situation especially since they no longer have official authority.

The Structure (click to expand)

Before we can take down a website, we first we need to understand a little bit about the basic structure of a website, how content makes it onto the Internet, and how it shows up in search results. In its simplest structure, there are three components:

1. The Registrar
2. The Web-hosting Provider
3. Search Engines

The Registrar is a company that sells (registers) domain names, 71% of the world’s Registrars are in the USA, and as of this writing, there are 2,002 US-based companies while there are only 2,815 worldwide.  A list of accredited Registrars can be found here: https://www.icann.org/en/accredited-Registrars. A URL consists of three parts, the protocol, the domain name, and the top-level domain (TLD).  When you put the domain name and the TLD together you get what is called a fully qualified domain name (FDQN), commonly called a website. A list of TLDs can be found here https://www.iana.org/domains/root/db.

https://website.com
https:// = the protocol	website = the domain name	.com = the TLD

The Hosting Company is the entity that hosts the content of a website, including the graphics, the style sheets, and pages such as a Services, Contact, About Us, and FAQs.  Sometimes the hosting company and the Registrar are one in the same, which makes a takedown much simple, but most often they are separate.

Pages are what you see when you have a slash after the website name, and a word such as https://website.com/contact-us. Other times, you might have something like https://website.com/p/contact-us.html where the /p/ is a directory, or a folder, where the website stores the page. This will be important later.

Search Engines. The more widely known search engines are Google™, Bing™, DuckDuckGo™, and Yandex™

The Take-Down

Take-Down Strategy: Play the Long Game

Naturally, when someone sees a malicious page up, with personal or even libelous content, they are distressed and want it off the Internet as fast as possible. However, acting before documenting the offensive or unacceptable content can actually create more work for you later and even delay officially getting it taken down.

#1 Getting Proof vs Evidence

At minimum, Registrars and Web-hosting Providers, usually require proof and something they can review. They often ask for a link to the pages, the full URL, that has the offending content, and they love a screen capture where you circle or point to the issues. You must make sure to get everything from the h in https to the last character in the URL that has each page.  Depending on the Registrar and Web-hosting Provider you are dealing with, you may need all of them to file the report. This is why you do not start a take-down by report search results to the search engines, or contact the hosting provider for a take-down, especially if it is different from the Registrar.

For a more robust, exact copy of a website, we recommend using HTTrack https://www.httrack.com/.  This tool comes in very handy when you need to make an exact replica, because it saves the copy to your local computer or to a hard drive. Be sure you understand the operational security impacts before using this tool. You could make copies of malware or links to malware. If you do plan to use this, we suggest using a virtual machine and not your local computer.

#2 Contact the Registrar

2A. Why contact the Registrar?

2B. How to find the current Registrar

To find out who the current Registrar is, you need to perform a whois search (sometimes written as WhoIs). There are many services out there that will charge you, but this information is free. Our #1 resource for whois information is DomainTools, not only because they have current information, but they the largest, richest historical repository of data on websites and domain names that we’ve found (and they’re super awesome people). The DomainTools whois tool is here.  With DomainTools, it is also quick, and easy to buy a report if you need admissible evidence.  Alternatively, you can try who.is.  

Below is an example of the DomainTools result for a whois search of divineintel.com.  Notice, it gives you the Registry Domain ID, Registrar information, as well as the Registrar Abuse Contact email and phone number.

2C. File an abuse complaint with the Registrar

Now it is time to file an abuse complaint with the Registrar.  The easiest thing to do is to search for the Registrar name and the phrase “file abuse complaint.” Some Registrars have a link in the footer of their website.  Most of them have an online submission process, so you don’t specifically have to send an email. The key to a takedown with a Registrar is to cite the section(s) of their Acceptable Use Policy or Community Standards that the website is violating.

If there is/are legal statute(s) the content violates, it is good to have those in hand as well. Some states have improved their privacy laws to prohibit someone from using a person’s name and likeness without their consent, it’s worth looking into as support for your request.

Now here is where those screenshots, URLs, and archive.org links are required. The Registrar must investigate your complaint, so you’ll need to provide them the proof/evidence you captured earlier. If you have it all collected and organized in a document, we recommend saving it as a PDF and attaching it as well.  The easier you make their job, the faster the domain name gets disabled.  Make sure you mention if you plan to submit an evidence preservation order or may need to submit a subpoena later for the account owner information.

#3 Contact the Web-hosting Provider(s)

If you skip to this step, and you haven’t captured evidence properly in a document with screenshots, you will hurt your chances of getting the registrar to disable the bad actor’s account, which means they can simply change the DNS settings and put the website up somewhere else.  This is what we call a tactical win, but a strategic loss.

If you’re using DomainTools, figuring out who is hosting the website is easy. At the bottom of the record you will find the Name Servers section.  The two examples below, show a site that is hosted on googledomains.com (which recently moved to Squarespace) and the other shows wixdns.net. If you type in wixdns.net you’ll find the company that hosts the site is Wix.com. 

Once you’ve identified the Web-hosting Provider, you’ll want to do the same search for the Registrar.  Using your favorite search engine, enter the company name, in this case WIX, and the phrase “acceptable use” or “community (guide OR rules)” and leave the parenthesis and capital letters OR.  Once you find their policy, review it, and update your document to list the violations at the Web-hosting Provider. Next search for the company name and the phrase “report abuse”. You will likely find an online submission process. 

In the case that the Web-hosting Provider is not a company, and it is a private person, you may need to contact whoever owns the IP address to request their assistance. You can find out who owns the block of IP addresses using this tool: https://bgp.he.net/.   You can also just skip this part and move on to contacting the search engines.

#4 Submit take-down requests to search engines

4A. Bing

4B. Google

4C. Verify the Results

Check back with the search engines in 36 to 48 hours, and you should see Bing report that your request was “processed” and Google will tell you “accepted”.  To verify the results, go to each search engines search page and type in :site:website.com replacing website.com with the domain you are reporting.  There is no space between the colon and the first letter of the domain name.  You should get 0 results found.  If you do get results, repeat the process of submitting the full URL to include the page.

Summary

Taking down malicious websites requires planning, preparation of resources (phones & emails), established objectives (proof vs admissible evidence), and an extremely specific order of execution for maximum success. Understanding and identifying the Registrar and Web-hosting Provider are critical, as well as ensuring your take-down request (i.e. complaint) cites specific violations of acceptable use policies (community standards) or violations of state and federal laws. Finally, to protect your client’s interest, you should also submit URL refresh/removal requests to major search engines to and follow up with verification that the removal was successful.

Divine Intel is experienced in this type of work and we stand ready to support your requests. 
Please schedule a consultation with us using the Book Now button.