Brand Protection — assessment

Sample question

A hosting provider suspends a phishing site after your report. You now want the registrar to suspend the domain so it cannot simply be rehosted. What is the obstacle?

• The registrar sees a domain serving nothing and will decline without evidence of what it was — which the suspension removed.Takedown is usually multi-party, and the registrar is almost always asked second because they are the durable fix and the slower route. Your capture at detection is the only thing that survives the first party acting.
• Registrars do not act on phishing reports.Many do, on well-evidenced ones. The obstacle here is the missing evidence rather than the policy.
• A domain cannot be suspended once the host has acted.Nothing prevents it technically. The registrar simply needs grounds to act on.
• The certificate was revoked, so no record of the site remains.The CT entry is permanent and survives revocation — and it evidences the name and date rather than the content.

Every option carries an explanation, including the wrong ones.