In-House vs Outsourced Phishing Takedowns

Should you run phishing takedowns in-house or outsource them?

Security teams usually choose between three models: an in-house program, per-incident takedowns bought case by case, or a managed provider that runs detection, takedown and monitoring. The right one depends on your monthly volume, how many domains sit on country-code extensions, how fast cases must be acted on and what regulators expect you to document. Many mid-market teams end up with a hybrid: detection in-house, takedowns outsourced.

At some point, phishing volume grows, the ad-hoc process stops holding, and the CISO or fraud lead has to decide who removes phishing domains from now on. Framing that as build vs buy leaves out the option that fits many teams best, so this guide compares all three models against the same criteria.

The framework applies to financial services, crypto, iGaming and MSPs, and to any brand with a public login page. The thresholds shift by vertical, and a section below covers how.

Quick comparison of the three takedown models

The volume thresholds in this guide are rules of thumb. Check them against your own last 90 days of incidents before deciding.

What does a phishing domain takedown involve?

A phishing domain takedown is the process of getting a fraudulent domain suspended or removed by its registrar, hosting provider or registry. It runs in six steps:

1. Detection: finding the domain through monitoring, abuse reports or open-source intelligence (OSINT).
2. Evidence collection: screenshots, WHOIS records, hosting details and victim reports.
3. Abuse contact routing: finding the right abuse desk for each registrar, host and top-level domain.
4. Submission: structured abuse reports to the registrar, the host and, where needed, upstream providers such as CDNs.
5. Escalation: when the first contact does not respond, going to the domain registry, to ICANN Contractual Compliance for generic top-level domains, to the national registry or CERT for country-code domains, or to legal channels such as a Uniform Domain-Name Dispute-Resolution Policy (UDRP) complaint.
6. Verification: confirming the suspension and closing the case.

For a step-by-step walkthrough, see how the phishing takedown process works.

Which capabilities does each step need?

The six steps rely on three different capabilities, and that split decides which model fits your team:

• Detection is a threat intelligence problem. You need monitoring that finds lookalike domains early.
• Submission is a process problem. You need templates, evidence standards and a queue someone owns.
• Escalation is a relationships problem. You need to know who answers at each registrar, host and registry, and what evidence they accept.

Many teams already cover detection and submission and only struggle with escalation. In that case, keeping detection in-house and outsourcing the takedown itself is usually the best fit.

Model 1: When does an in-house takedown program make sense?

An in-house program works for mature security operations teams with steady, moderate volume, mostly on .com, .net and .org domains, and a monitoring stack already in place. It takes more than an analyst with a list of registrar abuse emails.

What an in-house program needs

• Dedicated analyst time with threat intelligence experience: one analyst, or part of the time of two or three.
• Monitoring tooling or an OSINT toolchain that watches for newly registered lookalike domains.
• A documented escalation path, including legal contacts approved for UDRP filings.
• Time to ramp up. Abuse desks respond better as your team builds a history with them, and phishing domains stay live while that history is built.

Where in-house programs hit a ceiling: country-code domains

Abuse reports to .com and .net registrars follow predictable procedures. Country-code top-level domains (ccTLDs) such as .ng, .ru or .cn are run by national registries with their own rules, languages and response habits, and a first report without a prior relationship often goes unanswered. If a meaningful share of your incidents lands on ccTLDs, plan for that gap before building. More detail in our guide on how ccTLD takedowns work.

How to size the workload

Multiply the analyst time one case takes, from detection to verification, by your monthly incident count. As an example, at one hour per case, 15 cases a month is about two working days of analyst time, and 60 cases is roughly a week and a half. Escalations take longer than first submissions, so add a margin for cases that stall.

In-house is viable when

Model 2: When do per-incident takedowns make sense?

Per-incident takedowns fit teams that see phishing domains sporadically, where volume does not justify an internal program or a managed contract. You submit the domain and the evidence, and the provider handles registrar contact, escalation and verification, with no retainer and no minimum commitment.

This model is a good fit when:

• Volume is low and irregular (as a rule of thumb, under 5 to 10 domains a month).
• You detect internally but lack the registrar relationships for submission and escalation.
• Budget rules out an ongoing contract.
• You are still measuring your incident pattern before committing to a long-term model.

PhishFort Individual Takedown works this way: one-off takedown packages with public prices, bought without a subscription or a sales call. It is a lower-risk way to start than signing a managed contract before you understand your volume.

The limit of per-incident takedowns

Per-incident takedowns include no continuous monitoring, so detection still depends on your team or on customer reports. When one campaign keeps registering new domains, you stay in reactive mode and the cost per case adds up. That is usually the point where teams move to a managed provider or a hybrid.

Model 3: When does a managed takedown provider make sense?

A managed provider fits teams with steady or high volume, campaigns spread across many registrars and countries, or reporting obligations that need documented timelines. The value is not filling in abuse forms. It sits in three areas an internal team struggles to replicate at scale.

Established registrar and hosting relationships

Providers with years of operating history have direct escalation paths to abuse desks at registrars, hosting providers and CDNs, so a submission arrives with context the reviewer already trusts. In a campaign hosted across five different providers, those relationships are the difference between a takedown that starts right away and one that stalls for days.

Parallel processing for multi-domain campaigns

Credential phishing campaigns against banks, exchanges and casinos often run on dozens of domains at once. An internal team tends to work them one by one. A managed provider files them in parallel and tracks each domain as its own case.

Evidence that holds up later

Takedown evidence often feeds fraud recovery, regulatory filings and civil litigation. A structured process documents chain of custody, captures full-page screenshots at several points in time and keeps WHOIS snapshots. Ad-hoc internal processes often miss at least one of these.

How PhishFort runs the managed model

PhishFort runs this model as a managed phishing takedown service: analysts validate each detection, file takedowns through direct channels with registrars, hosts and platforms, and follow every case until the content is offline. PhishFort has a 99%+ takedown success rate over the last year across its clients. While a takedown is in progress, confirmed phishing domains go to the PhishFort Blocklist, which reaches 418M+ users through browsers, DNS providers, antivirus tools and wallets. Resolution times depend on the registrar, host or platform involved.

A managed provider is preferred when

Five questions to answer before you choose a model

1. How quickly do you detect phishing domains today? If you cannot state your mean time to detect (MTTD), you do not have a monitoring program yet, and building takedown capability first is building the second floor before the first. If you rely on customer reports, outsourcing detection and takedown together usually closes cases faster than an internal build.
2. What share of your phishing domains sits on ccTLDs? Pull your last 90 days of incidents and check the domain extensions. If roughly a third or more sit on ccTLDs with inconsistent abuse response, which is common for crypto, Web3 and international banking targets, an internal team will hit a ceiling regardless of process quality.
3. How steady is your volume? A few incidents per quarter points to per-incident takedowns. Consistent high volume points to a managed provider. Between 5 and 20 a month with some predictability is where the in-house vs managed decision gets real.
4. What does each day a phishing site stays live cost you? Credential phishing sites start collecting logins as soon as they go live. Estimate fraud losses, support tickets and chargebacks per day of exposure before accepting a model where escalations can take days.
5. What do your regulators expect you to document? Frameworks such as the Digital Operational Resilience Act (DORA), the revised Payment Services Directive (PSD2) and Office of the Comptroller of the Currency (OCC) guidance expect documented detection-to-remediation timelines. If compliance needs that data and the security team cannot produce it consistently, that argues for a provider with structured reporting.

How does a hybrid takedown model work?

In a hybrid model, the security team keeps detection and triage, and an outside provider handles submission, escalation and legal-channel takedowns. Most mid-market teams end up here rather than with a clean build or buy.

• Internal: threat intelligence, detection and first-pass classification. Your team keeps control of detection quality.
• External: abuse submission, escalation and legal-channel takedowns. The provider brings registrar relationships and parallel processing.

The two sides connect through an API or a shared ticketing queue. The provider receives structured intake (domain, evidence, priority) and returns status updates on each case. The key requirement is that your threat intelligence platform produces output the provider can ingest without manual reformatting, so check that before selecting a vendor.

How do the thresholds change by vertical?

Financial services. Banks, fintechs and payment platforms face the highest regulatory reporting pressure and the highest fraud cost per incident, so most mature teams move to a managed or hybrid model. See brand protection and takedowns for financial services and how phishing domain takedowns work for fintechs.

Crypto and Web3. Exchanges, wallets and Web3 projects see the widest ccTLD spread and the fastest-moving campaigns. In-house programs usually struggle with ccTLD coverage here, and per-incident or managed providers with established non-Western registrar relationships perform better. More on brand protection for crypto and Web3.

iGaming and betting. Online casinos and sportsbooks face high domain volume, mirror sites and very short campaign windows: during live events or promotions, a few hours of exposure drives real fraud. A managed provider with parallel processing is the baseline for this vertical. More on brand protection for online casinos and sportsbooks.

MSPs and MSSPs. When clients ask for takedowns, a managed service provider has to choose between building a takedown team and partnering. The PhishFort MSP Partner Program is a co-branded partnership that lets MSPs and MSSPs offer PhishFort takedowns and brand protection to their clients.

Retail, technology and healthcare. Retailers see seasonal spikes, so per-incident or hybrid models beat an in-house team sized for peak volume. SaaS companies see volume grow with the product and usually outgrow per-incident takedowns. Healthcare organizations value evidence quality, because takedown documentation may feed breach notification processes.

How do you measure a takedown program?

Campaign coverage rate is the metric most teams undertrack. Reducing customer-facing phishing means closing most of the domains in a campaign, not only the ones customers reported. If you only act on reported domains, you are treating symptoms.

Need one phishing domain removed now?

For single incidents or irregular volume, PhishFort’s individual takedown service offers fixed-price takedowns with no subscription required.

For ongoing managed coverage, see our phishing domain takedown service.