Segurança

How to report a fake website and request its removal

branddi · Published on July 10, 2024 · Updated on October 18, 2026

To request removal of a fake website using your company's name and logo, collect evidence of impersonation, identify the infrastructure providers and report the incident through the appropriate channels. Then track each report and verify the outcome at the affected URL. Submitting a report does not mean the website has been removed.

This guide covers a company's response to a page that presents itself as an official channel. The goal is to build a case that can be checked: which page is misleading people, how it uses the brand's identity and which action could interrupt that exposure.

What should you confirm before reporting a fake website?

Start with the relationship between the page and your company. Check internally whether the domain belongs to your operation, an agency or an authorized partner. Compare the page's presentation with your official channels. A similar name, a low price or poor design alone does not establish impersonation.

Look for observable facts: your logo alongside an “official store” claim, a form presented as company support or an unauthorized payment request attributed to the brand. Describe what you observed without assuming who controls the website.

HTTPS protects the connection; it does not establish that a store belongs to your brand. The Chrome documentation on secure connections, accessed on October 17, 2026, recommends checking the address even with a protected connection. Do not treat a padlock, certificate or professional design as proof of authenticity.

If the incident involves attempts to collect passwords or personal data, our article on phishing and brand protection provides context. Keep this response focused on the specific page and the incident being investigated.

How can you build a case the recipient can review?

We recommend maintaining one case record per incident. It should allow another person to understand the problem without relying on the memory of whoever received the alert. Organize it into three parts:

• Identification: the exact page address, the official channel used for comparison and the internal case owner.
• Demonstration: readable captures showing the false association with the company, including the date, time and observation context.
• Representation: a corporate contact and the documents the reporting channel requests to establish the reporter's relationship with the brand.

Explain the difference between the original and the copy in a few sentences. For multiple pages, connect each address to its evidence. A homepage screenshot alone does not explain a problem with a form at a different path on the website.

Preserve original files and prepare copies with unnecessary personal information concealed. Do not ask customers to make test purchases, enter passwords or continue speaking with a suspected fraudster to complete the documentation. Refer technical verification to a team equipped to handle that material.

As an internal control, separate “report received” from “fact verified.” For example, a customer message can indicate where to investigate, but it does not automatically establish that every page on the domain behaves the same way.

Who should receive the removal request?

The recipient depends on the service involved. Domain registration and website hosting can be managed by different companies. A registration lookup does not necessarily identify the server storing the content.

• Recipient — What they review — Outcome to track
• Hosting provider — Content served through its infrastructure — Removal or blocking of the page on its service
• Registrar — Abusive use of a registered domain — A measure affecting the domain, where applicable
• Safe browsing service — A potentially dangerous URL — A risk classification or warning
• Search engine — The address appearing in search results — An action affecting the search result

The CERT.br incident reporting recommendations, dated November 14, 2025, distinguish a domain created for fraud from a compromised legitimate website. In the first scenario, avoid notifying the possible fraudster through the registrant contact: approach the infrastructure and registration providers. This distinction helps avoid treating a compromised site's owner as the perpetrator.

To identify the registrar, use a service such as ICANN Lookup and check the abuse channel on the named company's official website. ICANN's guidance on registrar abuse reports, accessed on October 17, 2026, describes contact and report-handling obligations for accredited registrars. These obligations do not guarantee suspension of every reported domain.

Ask the technical team to confirm the hosting provider. If an intermediary network is involved, do not assume it stores the content. Record which service was identified and which official channel will be contacted, so that the history remains clear when the case passes between teams.

How do you write a clear abuse report?

Use the recipient's reporting form or abuse channel and adapt your request to its role. Avoid sending the same generic request to everyone. A useful report connects the evidence to the action requested.

The following outline is an editorial template for organizing a report, not an official form:

• Who represents the company: identify the organization and the sender's role.
• Which address is involved: provide the exact URL under review.
• What is happening: describe where the page claims to be official and what supports that conclusion.
• What the comparison shows: identify the genuine channel and the relevant attachments.
• What you are requesting: ask for an abuse review and the appropriate action within that service, with a response through the case reference.

Before submission, a second reader should be able to answer: “Which page is this, and why does it appear to impersonate the company?” If answering requires interpreting dozens of attachments, simplify the presentation. Preserve the complete material and highlight the evidence that explains the case.

Does reporting a website to Google take it offline?

Not necessarily. Google Safe Browsing provides warnings about dangerous pages. Suspected phishing can be submitted through its dedicated reporting form. A browser warning does not mean the content has been removed from its hosting service.

Likewise, removing a search result does not remove the page from the internet. The Google Search Help Center explains this distinction. That page concerns personal information; it is not a universal reporting form for fake websites. Select the procedure that matches the issue. These sources were accessed on October 17, 2026.

Track these outcomes separately in the case record. “Warning displayed,” “search result removed” and “page unavailable” represent different changes in consumer exposure.

How do you track the case and verify the outcome?

Assign an owner and a next review to each incident. Use clear states: internal review, submitted, awaiting additional information, decision received and outcome verified. Keep the reference number and the reason for every status change.

When a response arrives, compare the reported action with the purpose of the request. An automated receipt does not close the case. A rejection calls for reviewing the grounds and evidence; our guide to rejected removal requests covers that stage.

Ask the responsible team to recheck the address and the recorded paths. Document what is unavailable and what remains exposed. A temporary loading error alone does not establish that the provider carried out a removal. If the conclusion remains uncertain, keep that limitation in the record.

Then watch for new addresses related to the case. Connect repeat incidents to the previous history without assuming that a similar appearance establishes a common operator. Our digital takedown guide explains how this workflow fits with other channels.

How can Branddi support this operation?

Branddi organizes incident identification and evidence and supports the removal workflow according to the channel, documentation and agreed strategy. When evaluating this support, bring the addresses already identified and decide who will follow up on cases. Agree on the monitoring scope and the criteria for confirming an outcome.

What are the most common questions about reporting fake websites?

Can removal within 48 hours be guaranteed?

Do not treat that period as a general guarantee. The decision depends on the recipient and the circumstances. Record observed processing times and distinguish the time to respond, review and take effective action.

Does a domain registration record identify the hosting provider?

Not necessarily. It helps identify the registrar and registration information. Hosting requires a separate check, especially when intermediary services are involved.

Should I open several identical reports?

Avoid duplicating the same request to the same recipient. Use the existing case reference for additional information when the channel allows it. Actions involving different services should have separate records linked to the incident.

When can I mark the case as resolved?

Once the relevant action for that address has been verified and recorded. State the scope of the confirmation: page removal, domain suspension or another outcome. Keep tracking outstanding issues and new incidents.

To organize this work within your company, explore Branddi's digital fraud protection solution.

Back to blog