🛡️ Sherlocked Security – Phishing Domain Takedown Services
Disable Malicious Domains Before They Harm Your Brand or Users
📄 1. Statement of Work (SOW)
Service Name: Phishing Domain Takedown Services
Client Type: Financial Institutions, SaaS, eCommerce, Enterprises, Government
Service Model: 24/7 Monitoring + Legal Escalation + Registrar Coordination
Compliance Coverage: ISO 27001, GDPR, DMCA, APWG Guidelines
Takedown Types:
- Phishing Sites Mimicking Your Brand
- Typosquatted or Lookalike Domains
- Email Spoofing and Login Clones
- Fake Mobile Apps or Hosted Pages
🧠 2. Our Approach (with Visual)
🔹 Real-Time Domain Discovery
🔹 Legal and Technical Escalation
🔹 Registrar and Host Takedown Coordination
generate one Picture with AI with color code below
[Phishing Detection] → [Domain Investigation] → [Evidence Collection] → [Legal Notice Preparation] → [Registrar/Host Contact] → [Takedown Execution] → [Client Notification & Monitoring]
Color Code:
- Discovery & Validation: #064d52
- Escalation Process: #8b0505
- Takedown & Closure: #0f5c5a
🧪 3. Methodology (with Visual)
plaintext
CopyEdit
[Client Brand Mapping] → [Phishing Site Detection (24/7)] → [Domain Registration Lookup] → [Hosting & DNS Investigation] → [Legal Takedown Packet Prep] → [Registrar/Hosting Provider Outreach] → [Takedown Confirmation & Follow-Up] → [Client Reporting + Risk Advisory]
Visual Color Flow:
- 🔹 Blue (Detection & Research: #064d52)
- 🔸 Red (Escalation & Takedown: #8b0505)
- ✅ Green (Closure & Client Reporting: #0f5c5a)
📦 4. Deliverables to the Client
- ✅ Phishing Site Detection Reports
- 🧾 Domain Ownership & WHOIS Details
- 🧭 Hosting Infrastructure & DNS Mapping
- 📘 Takedown Dossier including:
- URL & Domain Screenshots
- WHOIS & Host Evidence
- Abuse Contacts & Timelines
- DMCA/Registrar Notices
- Risk Assessment & Exposure
- Recommendations
- 📊 Phishing Domain Trends & Metrics
- 📽️ Optional Takedown Status Dashboard
- 🧑💻 Legal Advisory for Jurisdictional Escalation
- 🔁 Continuous Brand Watch & Rescans
- 🎓 Monthly Anti-Phishing Risk Summary
🤝 5. What We Need from You (Client Requirements)
- ✅ List of official domains & brand keywords
- ✅ Logos and brand style references (for visual spoof detection)
- ✅ Point-of-contact for emergency alerts
- ✅ Legal authorization letter (if needed for registrar escalation)
- ✅ Timezone and jurisdiction priorities
- ✅ DMARC/DKIM/SPF configurations (optional)
🧰 6. Tools & Technology Stack
- 🌍 Domain Monitoring Tools (urlscan.io, DNSTwist, PhishTank, OpenPhish)
- 🔍 WHOIS & DNS Lookup Services
- 🛡️ Abuse API Integrations (registrars, cloud providers)
- 📡 Passive DNS & SSL Cert Scanners
- 🧾 Legal Takedown Templates (DMCA, UDRP)
- 📊 Dashboarding Tools (Kibana, Power BI)
- 💬 Slack/Teams Notification Integration
🚀 7. Engagement Lifecycle (Lead → Closure)
plaintext
CopyEdit
1. Discovery Call 2. Client Brand Input 3. Domain Monitoring Setup 4. Detection & Alerting (24/7) 5. Evidence Compilation 6. Legal Takedown Filing 7. Registrar/Host Follow-Up 8. Client Reporting 9. Rescan & Trend Review
🌟 8. Why Sherlocked Security? (Our USP)
| Feature | Sherlocked Advantage |
|---|---|
| 🌐 24/7 Domain Monitoring | Real-time scanning and alerting on phishing clones |
| 📘 Legal-Ready Takedown Packs | Pre-formatted notices for fast response |
| ⚙️ Multi-Jurisdiction Expertise | Global registrar & hosting provider coverage |
| 📊 Metrics Dashboard | Track volume, impact, and remediation effectiveness |
| 🧑💻 Brand Protection Guidance | Recommendations to harden brand infrastructure |
📚 9. Real-World Case Studies
🛒 Phishing Site Takedown for eCommerce Client
Issue: Fake “deal” landing page mimicking checkout process
Action Taken:
- Domain and host identified in 15 minutes
- DMCA filed and removed in under 12 hours
- Domain blacklisted by safe browsing services
💳 Banking Clone Site on Russian Hosting
Client: Private Bank (India)
Findings: Login phishing site hosted in obscure TLD
Outcome:
- Partnered with registrar and CERT team
- Site taken down despite non-cooperative hosting
- Implemented DMARC enforcement and brand logo protection
🛡️ 10. SOP – Standard Operating Procedure
- Initial brand intel and authorized domain collection
- Deploy 24/7 phishing domain monitors
- Triage and verify spoofed sites
- Gather evidence and hosting trail
- Create legal takedown dossier
- Notify registrar and hosting provider
- Follow up for status and verification
- Update client dashboard/report
- Perform recheck and log takedown
- Issue anti-phishing risk summary
📋 11. Sample Phishing Domain Report (Preview)
- Detect phishing and typosquat domains.
- Validate phishing activity via sandbox or screenshots.
- Document hosting and registrar information.
- Generate takedown requests to ISPs/registrars.
- Escalate to CERTs or legal as needed.
- Track takedown status and resolution times.
- Monitor reappearance of domains.
- Maintain domain blacklist for detection tools.
- Provide phishing impact reports.
- Integrate with brand monitoring workflows.
Would you like this saved as a .md file, or shall we continue with the next service?