Request takedowns of look-alike domains

A takedown sends abuse reports about a look-alike domain to the organizations that can remove it. You choose the domain’s registrar, the hosting provider of its IP address, or both, and you can also report the domain to blacklists. The domain must come from one of your domain scans, such as acme-login.com found by a scan of acme.com. The flow has five steps. You authorize takedowns once with a signed power of attorney. Then, for each domain, you create a draft, wait while its evidence is prepared, send it, and track the replies. The takedown endpoints sit under the SpoofGuard tag in the API reference. Availability: Domain Takedowns. You also need Domain Monitoring, because a takedown starts from a domain your scan found. Cost: 1 unit of your yearly Domain Takedowns allowance for each takedown you send. Drafts, previews, edits, retries, deletes and power-of-attorney calls use no units. A send that returns any status other than 2xx is refunded. The allowance runs per contract year: it resets at 00:00 UTC on each anniversary of your license’s start date. Each call also counts toward the per-second rate limit and, when it succeeds, uses one unit of your monthly API Calls allowance. Without Domain Takedowns, or when your license is not active, every endpoint on this page returns 403:

{
  "detail": "This feature is not included in your plan."
}

When the year’s allowance is spent, send returns 429 and nothing is sent:

{
  "detail": "You have reached your Domain Take Down limit for this year.",
  "resource": "domain_take_down",
  "period": "year",
  "limit": 30
}

limit is your organization’s takedowns for the year. This 429 has no Retry-After header, and retries fail until the allowance resets. Plans and quotas explains allowances. No endpoint on this page holds a capacity slot, so none returns the capacity 409. Two other kinds of 429 can come back from any endpoint on this page:

"message": "Rate limit exceeded" is the per-second rate limit or your API Calls allowance. See Rate limits.
"detail": "Request was throttled. Expected available in 12 seconds." is the domain monitoring service’s own limit of 180 requests a minute. Every API key and dashboard user of your organization shares it. Wait the seconds the message gives. The response has no Retry-After header.

How a takedown moves

Stage	`status`	`preparation_status`	What you can do
Being prepared	`Draft`	`queued`, then `preparing`	Read it. Edits and send are refused.
Ready	`Draft`	`ready`	Review, edit, send or delete it
Preparation failed	`Draft`	`failed`	Edit it, retry the preparation or delete it
Sent	`In Progress`	`ready`	Track replies and blacklist reports
Completed	`Completed`	`ready`	Read the final record

Preparation captures a screenshot of your website and one of the look-alike, and looks up the abuse contacts of each authority you chose. A draft becomes ready only when both screenshots exist and every chosen authority has at least one abuse email address.

Authorize takedowns

A takedown acts on your organization’s behalf, so the authorities receive a signed power of attorney with each report. Upload one before your first draft. Every later takedown can reuse it.

Download the template

spoofguard_powers_of_attorney_template returns the blank template as an ODT file named blank_takedown_power.odt.

curl -OJ https://client-api.leak.center/api/spoofguard/powers_of_attorney/template/ \
  -H "X-API-Key: YOUR_API_KEY"

Fill it in and sign it

Complete the template for your organization and sign it.

Upload the signed file

spoofguard_powers_of_attorney_create takes multipart/form-data with name (up to 100 characters, unique within your organization) and signed_power_file (a PDF, ODT or DOCX file).

curl https://client-api.leak.center/api/spoofguard/powers_of_attorney/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "name=Acme power of attorney 2026" \
  -F "signed_power_file=@acme-power-of-attorney-signed.pdf"

The call returns 201 with the file’s id, name, signed_power_file_link and timestamps. Keep the id: drafts take it as power_of_attorney_id.

The unchanged template is refused. An ODT upload is converted to PDF. To rename a power of attorney or replace its file, send spoofguard_powers_of_attorney_update as multipart/form-data. Both upload calls refuse a JSON body with 415.

Create a draft

spoofguard_takedowns_create takes a JSON body:

Field	Required	Meaning
`analysis_id`	Yes	The scan that found the domain
`domain`	Yes	The look-alike, exactly as it appears in the scan’s results
`power_of_attorney_id`	Yes	The `id` of your signed power of attorney
`registrar`	One of the two	`true` reports the domain to its registrar
`hosting`	One of the two	`true` reports the domain to the hosting provider of its IP address
`blacklists`	No	Blacklists to report the domain to: `google`, `microsoft`, `spamhaus`, `openphish`, `netcraft`, `phishtank`, `norton`
`additional_notes`	No	Up to 2,048 characters, included in the abuse reports
`reply_email_recipient`	No	The address that receives progress emails for this takedown

curl https://client-api.leak.center/api/spoofguard/takedowns/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "analysis_id": "7c1e2d3f-5a6b-4c8d-9e0f-1a2b3c4d5e6f",
    "domain": "acme-login.com",
    "power_of_attorney_id": 3,
    "registrar": true,
    "hosting": true,
    "blacklists": ["google", "netcraft"],
    "reply_email_recipient": "security@acme.com"
  }'

The call returns 201 with the draft. This shortened example shows the fields you act on:

{
  "uid": "b2f4e6a8-1c3d-4e5f-8a9b-0c1d2e3f4a5b",
  "analysis_id": "7c1e2d3f-5a6b-4c8d-9e0f-1a2b3c4d5e6f",
  "status": "Draft",
  "preparation_status": "queued",
  "original_domain": "acme.com",
  "malicious_domain": "acme-login.com",
  "malicious_ip": "203.0.113.10",
  "malicious_http_open": true,
  "malicious_https_open": true,
  "blacklists": ["google", "netcraft"],
  "reply_email_recipient": "security@acme.com",
  "authority_takedown_requests": [],
  "logs": []
}

Set reply_email_recipient. That address receives an email when the draft’s preparation finishes, when each request is sent, when the website or domain is taken down, and when the takedown completes. Without it, the emails go to an internal address that no one reads. You cannot change it after the draft is created.

The draft is checked before it is saved. Each check that fails returns 400 with a details message:

registrar or hosting is true.
The power of attorney and the scan exist in your organization.
Every blacklist code is valid.
domain is one of the scan’s results.
domain resolves to an IP address, and port 80 or 443 is open on it.
Your scanned domain, acme.com, resolves to an IP address.

Wait for preparation

Poll spoofguard_takedowns_detail until preparation_status is ready or failed.

curl https://client-api.leak.center/api/spoofguard/takedowns/b2f4e6a8-1c3d-4e5f-8a9b-0c1d2e3f4a5b/ \
  -H "X-API-Key: YOUR_API_KEY"

When the draft is ready, review what will be sent:

original_screenshot_link and malicious_screenshot_link: the two screenshots attached to every report.
authority_takedown_requests: one entry per chosen authority, with authority_type (Domain Registrar or Hosting Provider), abuse_name, abuse_emails and email_preview_link, an image of the email.

Edit a draft

spoofguard_takedowns_update accepts multipart/form-data only. A JSON body returns 415. You can edit a draft that is ready or failed, but not one that is still queued or preparing, and not one already sent.

Field	Meaning
`original_screenshot`, `malicious_screenshot`	Replacement screenshots: JPEG, PNG or GIF, up to 20 MB
`registrar`, `hosting`	`true` or `false`. Turning one on adds that authority and looks up its contacts. Turning it off removes it. One must stay on.
`blacklists`	Repeat the field once per blacklist code
`additional_notes`	Up to 2,048 characters

curl https://client-api.leak.center/api/spoofguard/takedowns/b2f4e6a8-1c3d-4e5f-8a9b-0c1d2e3f4a5b/ \
  -X PATCH \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "malicious_screenshot=@acme-login-screenshot.png" \
  -F "registrar=true" \
  -F "hosting=true"

Send registrar and hosting with every screenshot upload. In a request that carries a file, a missing registrar or hosting counts as false. One missing value drops that authority from the draft, and two missing values refuse the request.

The call returns the updated draft.

Retry a failed preparation

A draft fails when a screenshot cannot be captured, or when no abuse email address is found for an authority you chose. Fix the cause, then start the preparation again:

Find what is missing

An empty original_screenshot_link or malicious_screenshot_link is a missing screenshot. An entry in authority_takedown_requests with an empty abuse_emails list is a missing contact. So is an authority you chose, registrar or hosting set to true, that has no entry in authority_takedown_requests.

Fix the draft

Upload the missing screenshot, or turn off the authority that has no contact. Both are edits.

Retry

Call spoofguard_takedowns_retry_preparation. It returns 202 with an empty body, and the draft goes back to queued. Poll the draft again. Screenshots and contacts already stored are reused.

A retry returns 409 when the draft cannot be retried yet:

{
  "details": "The takedown draft preparation cannot be retried yet."
}

You can retry a failed draft at any time. A draft that has stayed queued or preparing for 15 minutes without changing can be retried too. A ready draft or a sent takedown cannot.

Send the takedown

spoofguard_takedowns_send takes no body and uses one unit of your yearly allowance.

curl https://client-api.leak.center/api/spoofguard/takedowns/b2f4e6a8-1c3d-4e5f-8a9b-0c1d2e3f4a5b/send/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY"

Each chosen authority receives an abuse report by email, with your signed power of attorney and both screenshots attached. The domain is also reported to the blacklists you chose. The call returns 200 with the takedown. status is In Progress once at least one report is sent. A status still at Draft means no report went out. Check status and logs in the response. A 200 uses the unit either way. A send is refused, and its unit refunded, in two cases:

The draft is not ready: {"details": "The takedown draft preparation is not ready."}
It was already sent: {"details": "The takedown request has already been sent to the authorities for this domain."}

Track progress

Read one takedown with spoofguard_takedowns_detail, or all of them with spoofguard_takedowns_list.

Field	Meaning
`status`	`Draft`, `In Progress` or `Completed`. A takedown completes when a registrar or hosting provider has taken the domain or website down. `completed_at` records when.
`authority_takedown_requests[].status`	`Draft`, `In Progress`, `Replied` or `Completed`, per authority
`authority_takedown_requests[].replies`	The authority’s replies, with `from_email`, `to_email`, `subject` and `text`
`blacklist_data`	One entry per blacklist, with `blacklist`, `status` (`Draft`, `In Progress` or `Completed`), `last_check` and `completed_at`
`blacklists_status`	A summary of the blacklist reports: `N/A`, `Draft`, `In Progress`, `Partially Completed` or `Completed`
`logs`	Each step with its `action` and `created_at`, for example “Takedown request sent to domain registrar” or “Domain taken down by registrar”. The entry with `is_last: true` closes the takedown.

Takedowns also set the triage status of the domain in the scan’s results: td_in_progress once sent, and td_completed when complete. The list returns every takedown of your organization in one array, newest first. It takes these filters:

Parameter	Meaning
`analysis_id`	Takedowns from one scan
`monitor_id`	Takedowns linked to one monitor
`domain`	Your scanned domain contains this text
`malicious_domain`	The look-alike contains this text
`status`	`Draft`, `In Progress` or `Completed`. URL-encode the space.

Leave out date_sort: the default order is newest first.

curl -G https://client-api.leak.center/api/spoofguard/takedowns/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "status=In Progress"

Delete a takedown

spoofguard_takedowns_delete returns 204 and removes the takedown from your list. It does not withdraw reports already sent, and it does not return the allowance unit. The domain’s triage status in the scan returns to reviewed.

Errors

Errors from the API itself carry detail. Errors from the domain monitoring service carry details, except its own 429, which carries detail. The per-second rate limit and the API Calls allowance carry message. Read the first of detail, details and message that the body contains. Every status is explained once in Handle API errors.

Status	When	Body
`400`	A field fails validation, such as a missing `analysis_id` or notes over 2,048 characters	The field name with its messages
`400`	A draft check fails: no authority chosen, unknown power of attorney or scan, invalid blacklist code, domain not in the scan, no IP address, no open web port	`details`, for example `{"details": "The domain acme-login.com does not have a running webserver. No takedown request can be sent."}`
`400`	Reading, editing or sending a takedown that is not one of yours	`{"takedown_id": "..."}`
`400`	Listing with an `analysis_id` or `monitor_id` that is not yours	`{"details": "Analysis with the given ID does not exist."}` or `{"details": "Monitor with the given ID does not exist."}`
`400`	Editing a takedown that was sent, or a draft still being prepared	`{"details": "Only takedown requests in Draft mode can be edited."}` or `{"details": "The takedown draft is still preparing."}`
`400`	Sending a draft that is not ready, or a takedown already sent	See Send the takedown
`400`	Uploading the unchanged template, or a file that is not PDF, ODT or DOCX	`{"signed_power_file": [...]}`
`400`	A power-of-attorney name you already use	`{"details": ["A power of attorney file with the name 'Acme power of attorney 2026' already exists."]}`
`403`	Your plan lacks Domain Takedowns, or your license is not active	`{"detail": "This feature is not included in your plan."}`
`404`	Deleting or retrying a takedown that does not exist, an unknown power of attorney, or a path ID that is not a UUID	—
`409`	Retrying a preparation that cannot be retried yet	`{"details": "The takedown draft preparation cannot be retried yet."}`
`415`	An edit or power-of-attorney upload sent as JSON	`{"detail": "Unsupported media type \"application/json\" in request."}`
`429`	`send` when the yearly Domain Takedowns allowance is spent	`{"detail": "You have reached your Domain Take Down limit for this year.", "resource": "domain_take_down", "period": "year", "limit": 30}`
`429`	The domain monitoring service’s limit of 180 requests a minute for your organization	`detail` starts with `Request was throttled. Expected available in`, then the wait in seconds
`429`	The per-second rate limit or the API Calls allowance	`{"message": "Rate limit exceeded", ...}`. See Rate limits.
`502`	The domain monitoring service failed	`{"detail": "The requested service is temporarily unavailable."}`
`504`	The domain monitoring service timed out	`{"detail": "The requested service timed out."}`

Endpoints

Action	Endpoint
Download the power of attorney template	`GET /api/spoofguard/powers_of_attorney/template/`
List powers of attorney	`GET /api/spoofguard/powers_of_attorney/`
Upload a signed power of attorney	`POST /api/spoofguard/powers_of_attorney/`
Get a power of attorney	`GET /api/spoofguard/powers_of_attorney/{power_of_attorney_id}/`
Rename or replace a power of attorney	`PATCH /api/spoofguard/powers_of_attorney/{power_of_attorney_id}/`
Delete a power of attorney	`DELETE /api/spoofguard/powers_of_attorney/{power_of_attorney_id}/`
List takedowns	`GET /api/spoofguard/takedowns/`
Create a draft	`POST /api/spoofguard/takedowns/`
Get a takedown	`GET /api/spoofguard/takedowns/{takedown_id}/`
Edit a draft	`PATCH /api/spoofguard/takedowns/{takedown_id}/`
Delete a takedown	`DELETE /api/spoofguard/takedowns/{takedown_id}/`
Send a takedown	`POST /api/spoofguard/takedowns/{takedown_id}/send/`
Retry a failed preparation	`POST /api/spoofguard/takedowns/{takedown_id}/retry_preparation/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Request takedowns of look-alike domains

How a takedown moves

Authorize takedowns

Create a draft

Wait for preparation

Edit a draft

Retry a failed preparation

Send the takedown

Track progress

Delete a takedown

Errors

Endpoints

​How a takedown moves

​Authorize takedowns

​Create a draft

​Wait for preparation

​Edit a draft

​Retry a failed preparation

​Send the takedown

​Track progress

​Delete a takedown

​Errors

​Endpoints

How a takedown moves

Authorize takedowns

Create a draft

Wait for preparation

Edit a draft

Retry a failed preparation

Send the takedown

Track progress

Delete a takedown

Errors

Endpoints