---
title: "How long a takedown takes, layer by layer"
description: "Takedown time is set by the layer: hours to days at a host, a day to a week at a registrar, days to weeks at an app store, about two months for a UDRP."
date: "2026-08-31"
author: "Fraudox Team"
tags: ["Takedowns", "Escalation"]
canonical: "https://fraudox.com/blogs/how-long-a-takedown-takes"
publisher: "Fraudox"
publisher_url: "https://fraudox.com"
license: "Free to quote with attribution to the canonical URL."
---

# How long a takedown takes, layer by layer

> Takedown time is set by the layer: hours to days at a host, a day to a week at a registrar, days to weeks at an app store, about two months for a UDRP.

*Published August 31, 2026 by Fraudox Team. Canonical version: https://fraudox.com/blogs/how-long-a-takedown-takes*

Takedown speed is set by the layer you file against. A cooperative hosting provider often pulls a phishing page within hours to a couple of days, because removing one file costs it nothing and serving known phishing creates exposure of its own. A registrar suspension usually runs a day to a week, because suspension disables every service on the domain and the evidence bar rises to match. Social platforms range from hours to two weeks, driven mostly by whether they ask for identity or rights documents first. App stores take days to weeks, because a person reviews the case and the developer can appeal. A [UDRP](https://fraudox.com/glossary/udrp) trademark dispute runs about two months undefended, because it is a formal procedure with a filing schedule rather than an abuse queue. Inside every one of those ranges, the largest variable is how complete your first report was.

## What "fast" is measuring

Numbers get quoted without saying which measurement produced them, so separate the three before comparing any two.

- **Response time.** How long until an acknowledgement arrives, human or automated. Sometimes minutes. On its own it means nothing.
- **Action time.** How long until the provider decides and pulls the content, suspends the account or disables the domain.
- **Verified-removal time.** How long until the URL returns a not-found state or the profile is gone, checked from outside the provider's own ticket view.

> A provider that replies in an hour and acts in a week has a one-hour response time and a one-week removal. Only one of those numbers belongs to you.

## What each layer takes

| Target | Typical verified removal | What slows it |
| --- | --- | --- |
| Hosting provider | Hours to a few days | Reseller chains that add a hop, unmonitored abuse contacts, business-hours-only abuse desks |
| Registrar suspension | A day to a week for clear phishing, longer for anything arguable | Suspension kills every service on the domain, so the evidence bar is higher; privacy or proxy registration adds a forwarding step |
| CDN or reverse proxy | Hours to days | Many treat themselves as a conduit and pass the report to the origin host, restarting the count one layer down |
| Social platforms | Hours to two weeks | Automated triage misroutes reports, and impersonation claims often need identity or proof of rights before a human looks |
| App stores | Days to weeks | Human review, plus a developer appeal process you never see |
| Messaging apps | Hours to weeks | Telegram and Discord take in-app and email reports on scam channels; WhatsApp enforces at account level, since message content is end-to-end encrypted |
| Marketplaces | Faster inside a rights-holder programme than outside one | Without registered rights on file, the report joins the general queue |
| [UDRP](https://fraudox.com/blogs/takedown-suspension-udrp-or-lawsuit) | About two months undefended, longer when contested | A fixed response window, panel appointment and written decision, with transfer or cancellation as the only remedies |

## Why the spread exists

Three forces set the pace, and they apply the same way to [every channel a report can be filed with](https://fraudox.com/platforms). Who carries the liability: a host still serving a live phishing page inherits the problem, which is why the hosting layer is usually fastest. Whether identity is demanded: every request for a government ID or a trademark record on an [impersonation report](https://fraudox.com/social-media-takedown) costs a round trip. How automated the queue is: machine triage acts in minutes on an obvious signal and stalls for days on anything it cannot classify, because a misrouted report waits for a person.

## The part of the timeline you own

Providers do not work in hours. They work in cycles, and every question a reviewer has to put back to you costs a whole one: their reply, your response, then their queue again. A complete [abuse report](https://fraudox.com/glossary/abuse-report) carrying the live URL, the credential-harvesting endpoint, WHOIS and DNS records and the policy clause it breaches is decided in a single cycle. One missing attachment turns that case into three, and the cycles run on the provider's business days rather than yours. That arithmetic, not the difficulty of the case, is why two identical [phishing takedowns](https://fraudox.com/phishing-takedown) can land a week apart, and it is the argument for [assembling the pack before you file](https://fraudox.com/blogs/the-evidence-pack-what-platforms-need).

## When nothing moves

Silence past a provider's published window is a routing failure rather than a verdict. The case moves up: the upstream provider, the registrar for [a full domain suspension](https://fraudox.com/scam-domain-takedown), the relevant CERT, or the store's rights channel for [counterfeit app listings](https://fraudox.com/app-takedown). Escalation does not resume the wait you have already served, it starts a fresh one at the next layer, which is why [reading the silence and moving on a schedule](https://fraudox.com/blogs/why-takedowns-stall-and-how-escalation-works) decides more of the total than the day you first filed.

Anyone quoting one number for every layer is quoting a response time or a hope. The honest answer is a range per target, a reason attached to each, and a verification step that stops only when the content is gone.

---

Published by Fraudox (https://fraudox.com), a brand protection takedown service that
removes phishing sites, impersonating pages, fake social accounts, counterfeit apps,
scam domains and stolen content, and bills only for confirmed removals.