# Request a takedown

> How to turn a confirmed threat into a takedown case and follow it through to resolution.

This guide walks you through requesting a takedown against a genuine impersonation, and following the case until it closes. The red numbers in the screenshots match the numbers in each step.

## Before you start

You need a finding you have already reviewed and confirmed as a **Threat**, for example a look-alike domain. If you have not triaged the finding yet, start with [Review a suspicious domain](https://docs.nebty-id.com/guides/review-a-suspicious-domain/) or [Review your first finding](https://docs.nebty-id.com/getting-started/review-your-first-finding/).

## Steps

1. **Start the takedown.** Open the domain and select **Request Takedown** (1). On a social profile or an ad, mark the finding as **Threat** instead. Both open the takedown request form.

   ![Domain detail page with the Request Takedown button marked as 1](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/1-request-button.webp)

2. **Complete and submit the request.** The form already contains the domain’s details.

   - (1) **Website URL:** the address of the site to take down. It is filled in for you.
   - (2) **Additional Comments:** optional. Add anything that helps, for example that customers already received a phishing mail.
   - (3) Tick the box to authorize nebty to act on your behalf. This is required.
   - (4) Select **Submit Takedown Request**.

   ![Request Takedown form with URL field, comment field, authorization checkbox and submit button marked 1 to 4](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/2-request-form.webp)

   If you signed up on your own, the form also shows the price, for example “€400.00 per successful takedown, net plus VAT. You pay only if it succeeds.” Tick **I order this takedown for €400.00 per successful takedown** to confirm it. You cannot send the request without this tick. If the price changes while the form is open, the tick is removed and the form shows the new price, so that you can confirm it again. For the prices, see [Price of a takedown](https://docs.nebty-id.com/features/takedowns/#price-of-a-takedown).

   If your brand has no monitoring, the form also shows the lower price with monitoring. A brand admin can start or reactivate monitoring from there.

   After you send the request, the case starts as **Open** or as **Pending Review**. With **Open**, the nebty team starts work. With **Pending Review**, nebty checks the request first. The message after you send the request tells you which one applies. If you confirmed a price, you also get a confirmation email with the price. Its subject starts with “Your takedown order”. When work on a checked request starts, you get the email “Work has started on your takedown request”. If nebty does not accept the request, you get an email that starts with “Update on your takedown request”. A request that is not accepted costs nothing.

   You can have only one active case for a website address. If a case for the same address is still Pending Review, Open, In Progress or Pending Response, the form shows “An open case already exists for this address.” Select **View the open case** to follow it. The address is the host name: a different path on the same site counts as the same address, but a subdomain is a different one.

3. **Track the case on the Takedowns page.** Every case has a **Status** (1), for example Open, In Progress, Pending Response or Closed. Closed cases also show an **Outcome** (2).

   ![Takedowns list with the Status column marked 1 and the Outcome column marked 2](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/3-takedowns-list.webp)

   Open a case to see its current status (1) at the top right.

   ![Takedown detail page with the In Progress status marked as 1](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/4-takedown-status.webp)

   The **Activity Timeline** (1) lists everything that happened in the case: status changes, collected evidence, abuse reports and blacklist submissions.

   ![Activity Timeline of a takedown case marked as 1](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/5-takedown-timeline.webp)

4. **Wait for the case to close.** A closed case shows the status **Closed** (1) and a **Resolution** (2) that tells you how it ended, for example Domain Suspended, Content Removed or No Infringement.

   ![Closed takedown case with the Closed status marked 1 and the resolution Domain Suspended marked 2](https://docs.nebty-id.com/images/docs/guides/en/request-a-takedown/6-takedown-closed.webp)

## What happens next

Once a case is open, the nebty team works it: contacting the relevant registrar, host, or platform through the Abuse Contact, and filing a Blacklist Submission where that applies. You do not author either of these yourself; you simply follow their status on the case.

How long a case takes to close depends on the registrar, host, or platform involved, so there is no fixed timeline to expect. The Activity Timeline on the case is the most reliable way to see what has happened so far.

Related: [Takedowns](https://docs.nebty-id.com/features/takedowns/).

[Track a takedown case in the demo (opens the public demo with sample data)](https://dash.nebty.de/demo/takedowns/td-1)