# Brand Protection Toolkit
## Complete Takedown Templates & Guides for Ecommerce Brands

**From Recon** | [getrecon.xyz](https://getrecon.xyz)

---

## Table of Contents

1. [DMCA Takedown Notices](#1-dmca-takedown-notices)
   - [Basic DMCA Takedown Notice](#template-1a-basic-dmca-takedown-notice)
   - [DMCA for Image Theft](#template-1b-dmca-for-image-theft)
   - [DMCA for Content Copying](#template-1c-dmca-for-content-copying)
2. [Registrar Abuse Reports](#2-registrar-abuse-reports)
   - [Phishing/Fraud Report](#template-2a-phishingfraud-report)
   - [Trademark Infringement Report](#template-2b-trademark-infringement-report)
   - [Typosquatting Report](#template-2c-typosquatting-report)
3. [Hosting Provider Reports](#3-hosting-provider-reports)
   - [General Hosting Abuse Report](#template-3a-general-hosting-abuse-report)
   - [Cloudflare-Specific Report](#template-3b-cloudflare-specific-report)
4. [Google Search Removal](#4-google-search-removal)
   - [Google Safe Browsing Report](#template-4a-google-safe-browsing-phishing-report)
   - [Google DMCA Removal Request](#template-4b-google-dmca-removal-request)
5. [Bonus Resources](#5-bonus-resources)
   - [Evidence Checklist](#pre-takedown-evidence-checklist)
   - [Abuse Contact Directory](#major-registrar-abuse-contacts)
   - [Timeline Expectations](#timeline-expectations)

---

## Before You Start: Evidence Gathering

Before filing any takedown request, document everything. Fake sites can disappear quickly, and you need proof.

### Pre-Takedown Evidence Checklist

- [ ] Full URLs of infringing pages (not just the homepage)
- [ ] Screenshots of the fake site showing brand misuse
- [ ] Screenshots of your legitimate site for comparison
- [ ] WHOIS lookup results for the infringing domain
- [ ] Hosting provider identification (IP lookup)
- [ ] Date and time you discovered the threat
- [ ] Archive.org "Save Page Now" snapshot of the fake site
- [ ] Any customer complaints you've received
- [ ] Your trademark registration number (if applicable)

---

## 1. DMCA Takedown Notices

Use DMCA notices when a fake site is using your copyrighted content: product images, website copy, logos, or other creative works.

### Template 1A: Basic DMCA Takedown Notice

**Use when:** A fake site is using your copyrighted images and/or content.
**Send to:** Hosting provider and/or domain registrar abuse contact.

---

**Subject:** DMCA Takedown Notice - [INFRINGING-DOMAIN.COM]

Dear Abuse Team,

I am writing to report copyright infringement on a website hosted/registered through your service pursuant to the Digital Millennium Copyright Act (17 U.S.C. Section 512).

**COPYRIGHTED WORK**

The copyrighted work being infringed is [DESCRIPTION OF YOUR ORIGINAL WORK - e.g., "the website, product images, and marketing content for [YOUR BRAND NAME]"].

Original copyrighted material can be found at:
- [YOUR-WEBSITE.COM]
- [YOUR-WEBSITE.COM/PRODUCTS]
- [YOUR-WEBSITE.COM/ABOUT]

**INFRINGING MATERIAL**

The following URLs contain unauthorized copies of my copyrighted material:
- [FAKE-SITE.COM]
- [FAKE-SITE.COM/PRODUCTS]
- [FAKE-SITE.COM/PAGE-NAME]

Specifically, the infringing site has copied:
- [LIST SPECIFIC ITEMS: Product images, website design, product descriptions, logo, etc.]

**GOOD FAITH STATEMENT**

I have a good faith belief that use of the copyrighted materials described above on the allegedly infringing web pages is not authorized by the copyright owner, its agent, or the law.

**ACCURACY STATEMENT**

I swear, under penalty of perjury, that the information in this notification is accurate and that I am the copyright owner, or am authorized to act on behalf of the owner, of an exclusive right that is allegedly infringed.

**CONTACT INFORMATION**

Name: [YOUR FULL LEGAL NAME]
Company: [YOUR COMPANY NAME]
Position: [YOUR TITLE - e.g., Owner, CEO]
Address: [YOUR BUSINESS ADDRESS]
Email: [YOUR EMAIL]
Phone: [YOUR PHONE NUMBER]

**ELECTRONIC SIGNATURE**

/s/ [YOUR FULL NAME]
Date: [TODAY'S DATE]

---

### Template 1B: DMCA for Image Theft

**Use when:** A fake site is specifically using your product photos.
**Send to:** Hosting provider abuse contact.

---

**Subject:** DMCA Takedown - Unauthorized Use of Copyrighted Product Images

Dear Abuse Team,

I am the [owner/authorized representative] of [YOUR COMPANY NAME], and I am submitting this DMCA takedown notice for unauthorized use of our copyrighted product photography.

**ORIGINAL COPYRIGHTED IMAGES**

The following product images are owned by [YOUR COMPANY NAME] and appear on our official website:

| Image Description | Original URL |
|-------------------|--------------|
| [Product 1 Name] | [YOUR-SITE.COM/IMAGE-URL-1] |
| [Product 2 Name] | [YOUR-SITE.COM/IMAGE-URL-2] |
| [Product 3 Name] | [YOUR-SITE.COM/IMAGE-URL-3] |

These images were created by/for [YOUR COMPANY NAME] on [APPROXIMATE DATE] and have never been licensed for third-party use.

**INFRINGING COPIES**

The same images appear without authorization at:

| Infringing URL | Status |
|----------------|--------|
| [FAKE-SITE.COM/IMAGE-1] | Active |
| [FAKE-SITE.COM/IMAGE-2] | Active |
| [FAKE-SITE.COM/IMAGE-3] | Active |

**EVIDENCE**

I have attached:
1. Screenshots of the infringing pages
2. Screenshots of our original pages for comparison
3. WHOIS information for the infringing domain

**DMCA REQUIRED STATEMENTS**

I have a good faith belief that use of the copyrighted materials described above is not authorized by the copyright owner, its agent, or the law.

I swear, under penalty of perjury, that the information in this notification is accurate and that I am the copyright owner, or am authorized to act on behalf of the copyright owner.

**CONTACT INFORMATION**

Name: [YOUR FULL NAME]
Company: [YOUR COMPANY NAME]
Address: [YOUR ADDRESS]
Email: [YOUR EMAIL]
Phone: [YOUR PHONE]

/s/ [YOUR FULL NAME]
Date: [DATE]

---

### Template 1C: DMCA for Content Copying

**Use when:** A fake site has copied your product descriptions, about page, policies, or other written content.
**Send to:** Hosting provider abuse contact.

---

**Subject:** DMCA Takedown Notice - Copied Website Content

Dear Abuse Team,

I am reporting wholesale copying of copyrighted written content from my website to a fraudulent domain.

**ORIGINAL CONTENT**

[YOUR COMPANY NAME] owns all written content on [YOUR-WEBSITE.COM], including but not limited to:
- Product descriptions
- About page content
- Blog articles
- FAQ content
- Policy pages

This content was originally created and published by [YOUR COMPANY NAME] beginning on [DATE YOUR SITE LAUNCHED OR CONTENT WAS CREATED].

**INFRINGING CONTENT**

The website [FAKE-SITE.COM] has copied substantial portions of our written content, including:

1. **Product Descriptions**
   - Original: [YOUR-SITE.COM/PRODUCT-1]
   - Copied to: [FAKE-SITE.COM/PRODUCT-1]

2. **About Page**
   - Original: [YOUR-SITE.COM/ABOUT]
   - Copied to: [FAKE-SITE.COM/ABOUT]

3. **[Other pages as applicable]**

**ATTACHED EVIDENCE**

- Side-by-side screenshots showing identical text
- WHOIS records showing the infringing domain was registered after our content was published
- URL list of all infringing pages

**REQUIRED DMCA STATEMENTS**

I have a good faith belief that use of the copyrighted materials described above is not authorized by the copyright owner, its agent, or the law.

I swear, under penalty of perjury, that the information in this notification is accurate and that I am the copyright owner or authorized to act on behalf of the copyright owner.

**CONTACT**

Name: [YOUR NAME]
Company: [COMPANY]
Email: [EMAIL]
Phone: [PHONE]
Address: [ADDRESS]

/s/ [YOUR NAME]
Date: [DATE]

---

## 2. Registrar Abuse Reports

Domain registrars can suspend domains being used for fraud, phishing, or trademark infringement. These reports go to the company where the domain was registered (GoDaddy, Namecheap, Cloudflare, etc.).

### Template 2A: Phishing/Fraud Report

**Use when:** A domain is actively collecting payment information or credentials from your customers.
**Send to:** Domain registrar abuse contact.

---

**Subject:** URGENT: Phishing/Fraud Domain Report - [FAKE-DOMAIN.COM]

Dear Abuse Team,

I am reporting a domain registered through your service that is being used for phishing and consumer fraud.

**DOMAIN INFORMATION**

- Domain: [FAKE-DOMAIN.COM]
- Registrar: [REGISTRAR NAME]
- Registration Date: [DATE IF KNOWN FROM WHOIS]
- WHOIS Privacy: [Yes/No]

**NATURE OF ABUSE**

This domain is being used for phishing/fraud targeting customers of our legitimate business:

1. **Impersonation:** The site impersonates [YOUR COMPANY NAME], a legitimate [TYPE OF BUSINESS - e.g., ecommerce store, SaaS company]
2. **Fraud:** The site contains fake [checkout pages/login forms] designed to steal [payment information/credentials]
3. **Consumer Harm:** Customers are being deceived into providing sensitive information to criminals

**EVIDENCE OF FRAUD**

- The domain closely resembles our legitimate domain: [YOUR-DOMAIN.COM]
- The site uses our brand name, logo, and product images without authorization
- The site includes functional payment forms that do not connect to legitimate payment processors
- [Any customer complaints or reports you have received]

**OUR LEGITIMATE BUSINESS**

- Company Name: [YOUR COMPANY NAME]
- Official Domain: [YOUR-DOMAIN.COM]
- Business Type: [DESCRIPTION]
- Trademark Registration: [NUMBER IF APPLICABLE]

**REQUESTED ACTION**

Please immediately suspend this domain to prevent further consumer harm. This is an active threat to consumers and our business reputation.

**CONTACT INFORMATION**

Name: [YOUR NAME]
Title: [YOUR TITLE]
Company: [COMPANY NAME]
Email: [EMAIL]
Phone: [PHONE]

I am available to provide any additional information needed.

---

### Template 2B: Trademark Infringement Report

**Use when:** A domain incorporates your registered trademark.
**Send to:** Domain registrar abuse contact.

---

**Subject:** Domain Trademark Infringement Report - [INFRINGING-DOMAIN.COM]

Dear Abuse Team,

I am reporting a domain that infringes on our registered trademark.

**TRADEMARK INFORMATION**

- Trademark: [YOUR TRADEMARK - e.g., "BRANDNAME"]
- Registration Number: [USPTO/OTHER REGISTRATION NUMBER]
- Registration Date: [DATE]
- Goods/Services: [CLASSES COVERED]
- Registration Office: [USPTO, EUIPO, etc.]

**INFRINGING DOMAIN**

- Domain: [INFRINGING-DOMAIN.COM]
- How it infringes: [EXPLAIN - e.g., "Domain incorporates our exact trademark", "Domain is confusingly similar typosquat of our trademark"]

**EVIDENCE OF INFRINGEMENT**

1. The domain contains our exact trademark / a confusingly similar variation
2. The domain was registered AFTER our trademark registration
3. The domain is being used to [sell competing products/commit fraud/mislead consumers]
4. There is no relationship between the domain registrant and our trademark

**ATTACHED DOCUMENTATION**

- Trademark registration certificate
- Screenshots of the infringing website
- Screenshots of our legitimate website
- WHOIS records

**REQUESTED ACTION**

We request that you suspend this domain pursuant to your abuse policies and ICANN's Uniform Domain-Name Dispute-Resolution Policy.

**CONTACT**

Name: [NAME]
Company: [COMPANY]
Email: [EMAIL]
Phone: [PHONE]

/s/ [NAME]

---

### Template 2C: Typosquatting Report

**Use when:** Someone has registered a typo variant of your domain for malicious purposes.
**Send to:** Domain registrar abuse contact.

---

**Subject:** Typosquatting/Bad Faith Domain Report - [TYPO-DOMAIN.COM]

Dear Abuse Team,

I am reporting a typosquatting domain registered in bad faith to deceive customers of our legitimate business.

**TYPOSQUATTING DETAILS**

| Our Domain | Typosquatting Domain | Type of Typo |
|------------|---------------------|--------------|
| [YOUR-BRAND.COM] | [YOUR-BRADN.COM] | Letter transposition |
| [YOUR-BRAND.COM] | [YOURBRAND.COM] | Missing hyphen |
| [YOUR-BRAND.COM] | [YOUR-BRAND.CO] | Wrong TLD |

**EVIDENCE OF BAD FAITH**

1. **Targeting our customers:** The domain is clearly designed to capture traffic from users who mistype our domain
2. **Commercial use:** The domain [redirects to competitor/shows ads/hosts fake storefront]
3. **No legitimate interest:** The registrant has no connection to this name and registered it solely to exploit our brand
4. **Pattern of abuse:** [If applicable: The same registrant has registered multiple variations of our domain]

**OUR LEGITIMATE BUSINESS**

- Business: [YOUR COMPANY]
- Domain: [YOUR-DOMAIN.COM] (registered since [DATE])
- Trademark: [IF APPLICABLE]

**CONSUMER HARM**

- Customers are being redirected to [fraudulent checkout/malware/competitor]
- This is causing confusion and potential financial harm to consumers
- Our brand reputation is being damaged

**REQUESTED ACTION**

Please suspend this domain pursuant to your abuse policies. Typosquatting for commercial gain constitutes bad faith registration under ICANN policy.

**CONTACT**

[YOUR CONTACT INFO]

---

## 3. Hosting Provider Reports

If the registrar is unresponsive, or you've identified the hosting provider, send a report directly to where the site is hosted.

### Template 3A: General Hosting Abuse Report

**Use when:** You've identified the hosting provider and need the site taken down.
**Send to:** Hosting provider abuse email (abuse@provider.com).

---

**Subject:** Fraudulent Website Abuse Report - Immediate Action Requested

Dear Abuse Team,

I am reporting a fraudulent website hosted on your infrastructure that is impersonating our legitimate business.

**WEBSITE INFORMATION**

- URL: [FAKE-SITE.COM]
- IP Address: [IP ADDRESS FROM DNS LOOKUP]
- Hosted content: Fraudulent ecommerce site impersonating [YOUR BRAND]

**DESCRIPTION OF ABUSE**

This website is committing consumer fraud by:

1. **Impersonation:** Copying our brand name, logo, product images, and website design
2. **Payment fraud:** Operating a fake checkout that collects payment information for orders that will never ship
3. **Brand damage:** Deceiving consumers into believing they are purchasing from our legitimate business

**EVIDENCE PACKAGE**

Attached to this report:
- Screenshots of the fraudulent site
- Screenshots of our legitimate site ([YOUR-SITE.COM]) for comparison
- WHOIS records showing recent registration
- [Customer complaints, if available]

**OUR LEGITIMATE BUSINESS**

- Company: [YOUR COMPANY]
- Website: [YOUR-SITE.COM]
- Business type: [DESCRIPTION]
- Operating since: [DATE]

**REQUESTED ACTION**

Please remove this fraudulent website from your hosting platform immediately. The site is actively harming consumers and damaging our business reputation.

**YOUR TERMS OF SERVICE**

This website violates your Terms of Service, specifically:
- [Quote relevant section about fraud/phishing if you can find it]
- [Quote relevant section about impersonation]

**CONTACT**

Name: [NAME]
Email: [EMAIL]
Phone: [PHONE]

I am available to provide any additional information needed and can verify my identity as an authorized representative of [COMPANY].

---

### Template 3B: Cloudflare-Specific Report

**Use when:** The fake site is using Cloudflare (you'll see Cloudflare IPs in DNS lookup).
**Send to:** abuse@cloudflare.com or use their online form at cloudflare.com/abuse

---

**Subject:** Abuse Report - Phishing/Fraud Site Behind Cloudflare

Dear Cloudflare Trust & Safety Team,

I am reporting a phishing/fraud website that is using Cloudflare services.

**REPORTED SITE**

- URL: [FAKE-SITE.COM]
- Cloudflare Ray ID: [IF AVAILABLE FROM PAGE SOURCE]
- Issue Type: Phishing / Brand Impersonation / Fraud

**WHAT THE SITE IS DOING**

This site is impersonating [YOUR COMPANY NAME] and [describe the fraud - collecting payment info, stealing credentials, etc.].

**LEGITIMATE SITE FOR COMPARISON**

Our real website: [YOUR-SITE.COM]

The fraudulent site copies our:
- Brand name and logo
- Product images
- Website design and layout
- [Other elements]

**WHY THIS MATTERS**

- Consumers are being deceived into providing payment information
- Orders placed on this site will never be fulfilled
- Our brand reputation is being damaged
- [Customer complaints if applicable]

**EVIDENCE**

- Screenshots attached showing the fake vs. real site
- WHOIS showing recently registered domain
- [Other evidence]

**REQUESTED ACTION**

Please take appropriate action against this site, which may include:
- Terminating Cloudflare services
- Providing the actual hosting IP so we can contact the origin host
- Issuing a warning page to visitors

**MY CONTACT INFORMATION**

Name: [NAME]
Company: [COMPANY]
Email: [EMAIL]
Website: [YOUR-SITE.COM]

I confirm I am an authorized representative of [COMPANY].

---

## 4. Google Search Removal

Getting fake sites removed from Google search results and flagged by Safe Browsing protects the most people the fastest.

### Template 4A: Google Safe Browsing Phishing Report

**Submit at:** https://safebrowsing.google.com/safebrowsing/report_phish/

This is a form submission, not an email. Here's what to include:

---

**URL of phishing page:**
[FULL URL OF FAKE SITE]

**Additional details:**

This site is impersonating [YOUR COMPANY NAME], a legitimate [ecommerce store/business type] at [YOUR-DOMAIN.COM].

The phishing site:
- Uses our brand name and logo without authorization
- Displays our copyrighted product images
- Contains a fake checkout designed to steal payment information
- Was recently registered (WHOIS shows [DATE])

Our legitimate business has been operating since [DATE]. This site has no affiliation with us and is designed to defraud our customers.

Please flag this site in Safe Browsing to protect Chrome, Firefox, Safari, and Edge users.

Additional evidence available upon request: [YOUR EMAIL]

---

### Template 4B: Google DMCA Removal Request

**Submit at:** https://support.google.com/legal/troubleshooter/1114905

Use this to remove specific infringing URLs from Google search results.

---

**Type of request:** Copyright infringement (DMCA)

**Your copyrighted work:**
The copyrighted work is [DESCRIPTION - e.g., "product images and website content from YOUR-BRAND.COM"]. This content was created by [YOUR COMPANY] and first published at [YOUR-SITE.COM] on [DATE].

**Infringing URLs to be removed from Google Search:**
- [FAKE-SITE.COM/PAGE-1]
- [FAKE-SITE.COM/PAGE-2]
- [FAKE-SITE.COM/PAGE-3]
[List all infringing URLs]

**Location of original content:**
- [YOUR-SITE.COM/ORIGINAL-PAGE-1]
- [YOUR-SITE.COM/ORIGINAL-PAGE-2]

**Sworn statements:**

I have a good faith belief that use of the copyrighted materials described above is not authorized by the copyright owner, its agent, or the law.

The information in this notification is accurate, and under penalty of perjury, I am the owner, or an agent authorized to act on behalf of the owner, of an exclusive right that is allegedly infringed.

**Your information:**
Name: [FULL NAME]
Company: [COMPANY]
Email: [EMAIL]
Country: [COUNTRY]

Electronic signature: [YOUR NAME]

---

## 5. Bonus Resources

### Major Registrar Abuse Contacts

| Registrar | Abuse Email | Notes |
|-----------|-------------|-------|
| GoDaddy | abuse@godaddy.com | Large portfolio, responds within 48-72 hrs |
| Namecheap | abuse@namecheap.com | Generally responsive |
| Cloudflare Registrar | registrar-abuse@cloudflare.com | Use their web form preferably |
| Google Domains | domain-abuse@google.com | Now Squarespace |
| Name.com | abuse@name.com | Responds quickly |
| Tucows/Hover | domainabuse@tucows.com | |
| Porkbun | abuse@porkbun.com | |
| Dynadot | abuse@dynadot.com | |
| Gandi | abuse@gandi.net | |
| OVH | abuse@ovh.net | |

### Major Hosting Provider Abuse Contacts

| Provider | Abuse Email | Notes |
|----------|-------------|-------|
| Amazon AWS | abuse@amazonaws.com | Include IP address |
| Cloudflare | abuse@cloudflare.com | Use web form |
| DigitalOcean | abuse@digitalocean.com | |
| Google Cloud | cloud-abuse@google.com | |
| Microsoft Azure | cert@microsoft.com | |
| OVH | abuse@ovh.com | |
| Hetzner | abuse@hetzner.com | |
| Vultr | abuse@vultr.com | |
| Linode (Akamai) | abuse@linode.com | |
| Hostinger | abuse@hostinger.com | |

### SSL Certificate Authorities

Revoking the SSL certificate removes the padlock icon and may trigger browser warnings.

| CA | Abuse Contact |
|----|---------------|
| Let's Encrypt | abuse@letsencrypt.org |
| DigiCert | revoke@digicert.com |
| Sectigo | signedmalwarealert@sectigo.com |
| GlobalSign | report-abuse@globalsign.com |

### Timeline Expectations

| Report Type | Typical Response Time | Success Rate |
|-------------|----------------------|--------------|
| Google Safe Browsing | Hours to 2 days | Very high for clear phishing |
| Major hosting (AWS, Cloudflare) | 24-72 hours | High for documented abuse |
| Major registrars | 48 hours - 1 week | Moderate to high |
| DMCA to hosting | 24-72 hours | High with proper documentation |
| DMCA to Google Search | 1-2 weeks | High with proper documentation |
| Offshore/bulletproof hosting | May never respond | Low |
| UDRP complaint | 45-60 days | ~90% for trademark holders |

### Follow-Up Schedule

If you don't hear back:

| Time Since Report | Action |
|-------------------|--------|
| 24 hours | Check if site is still live |
| 48 hours | Send follow-up email |
| 72 hours | Report to additional channels (registrar + host + Google) |
| 1 week | Escalate within the organization, consider UDRP |
| 2 weeks | Consult with attorney if high-value case |

---

## Need Proactive Protection?

These templates help you respond to threats you've already discovered. But what about the threats you haven't found yet?

**Recon keeps checking for domain threats** — daily on the paid plan, monthly on Free — so you can act before customers get scammed.

- Detects typosquats, lookalikes, and phishing sites automatically
- Emails you when a copy of your store goes live (paid plan; Free reports it in the monthly digest)
- Provides threat intelligence with registrar info and evidence

**[Add Recon to Shopify](https://apps.shopify.com/recon-bot)**

---

*This toolkit is provided by Recon for informational purposes. It does not constitute legal advice. For complex cases or significant financial exposure, consult with an attorney specializing in intellectual property or cybercrime.*

**Questions?** Email us at hello@getrecon.xyz

---

Version 1.0 | January 2025 | [getrecon.xyz](https://getrecon.xyz)