Both misclassifications cost something, and they cost different things to different people. Knowing which direction to err in requires knowing what each one actually does.
The two errors
| Missing a live phishing domain | Reporting a legitimate business | |
|---|---|---|
| Who bears it | Your customers, and then you | A third party who has done nothing wrong |
| Immediate effect | Credentials harvested, payments diverted | Their site suspended by a host acting on your report |
| Duration | Until detected — days to weeks | Hours to days to reverse, if they can reach anyone |
| Reversible | No. Losses have occurred. | Partly. The disruption already happened. |
| Second-order effect | Reputational damage, regulatory interest | Your future reports weighted lower by that abuse desk |
| Legal exposure | Limited — you were the target | Real. Interference with a legitimate business is actionable. |
Which way to err
Err toward investigating, and against reporting. Those are different actions with very different costs.
- Investigating a legitimate business costs you an hour and costs them nothing, because they never learn you looked.
- Reporting one costs them their site, and costs you credibility with an abuse desk you will need again.
- So the threshold for looking should be low and the threshold for acting should be high, and confusing the two is what produces automated takedown requests against real companies.
Before sending any report
Have I seen the content myself? Not a screenshot from a tool. The actual page. Does the content impersonate us, specifically? A similar name with unrelated content is not impersonation. Would I defend this in writing to their lawyer? The test that catches the reports that should not be sent. Is there a plausible innocent explanation? A real business with a similar name. A reseller. A former partner. A coincidence.
Every one of those questions has stopped a report that should not have been sent. None of them can be answered by a scoring engine.
Automated takedown requests are where this goes wrong
A pipeline that files abuse reports on a score, without a human reading the content, will eventually file against a legitimate business — and repeatedly, because the rule that matched once matches every cycle. Automate detection and triage as far as you like; keep a person between the queue and the report.