> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Request takedowns of look-alike domains

> Authorize takedowns with a signed power of attorney, create a draft for a look-alike domain your scan found, wait for its evidence to be prepared, then send it to the registrar, the hosting provider and blacklists and track the replies.

A takedown sends abuse reports about a look-alike domain to the organizations that can remove it. You choose the domain's registrar, the hosting provider of its IP address, or both, and you can also report the domain to blacklists. The domain must come from one of your [domain scans](https://wiki.darknetsearch.com/api/guides/domain-monitoring-scans.md), such as `acme-login.com` found by a scan of `acme.com`.

The flow has five steps. You authorize takedowns once with a signed power of attorney. Then, for each domain, you create a draft, wait while its evidence is prepared, send it, and track the replies. The takedown endpoints sit under the **SpoofGuard** tag in the API reference.

**Availability:** Domain Takedowns. You also need Domain Monitoring, because a takedown starts from a domain your scan found.

**Cost:** 1 unit of your yearly Domain Takedowns allowance for each takedown you send. Drafts, previews, edits, retries, deletes and power-of-attorney calls use no units. A send that returns any status other than `2xx` is refunded. The allowance runs per contract year: it resets at 00:00 UTC on each anniversary of your license's start date. Each call also counts toward the per-second [rate limit](https://wiki.darknetsearch.com/api/guides/rate-limits.md) and, when it succeeds, uses one unit of your monthly API Calls allowance.

Without Domain Takedowns, or when your license is not active, every endpoint on this page returns `403`:

```json theme={"dark"}
{
  "detail": "This feature is not included in your plan."
}
```

When the year's allowance is spent, `send` returns `429` and nothing is sent:

```json theme={"dark"}
{
  "detail": "You have reached your Domain Take Down limit for this year.",
  "resource": "domain_take_down",
  "period": "year",
  "limit": 30
}
```

`limit` is your organization's takedowns for the year. This `429` has no `Retry-After` header, and retries fail until the allowance resets. [Plans and quotas](https://wiki.darknetsearch.com/api/guides/plans-and-quotas) explains allowances. No endpoint on this page holds a capacity slot, so none returns the capacity `409`.

Two other kinds of `429` can come back from any endpoint on this page:

* **`"message": "Rate limit exceeded"`** is the per-second rate limit or your API Calls allowance. See [Rate limits](https://wiki.darknetsearch.com/api/guides/rate-limits.md).
* **`"detail": "Request was throttled. Expected available in 12 seconds."`** is the domain monitoring service's own limit of 180 requests a minute. Every API key and dashboard user of your organization shares it. Wait the seconds the message gives. The response has no `Retry-After` header.

### How a takedown moves

| Stage | `status` | `preparation_status` | What you can do |
| - | - | - | - |
| Being prepared | `Draft` | `queued`, then `preparing` | Read it. Edits and send are refused. |
| Ready | `Draft` | `ready` | Review, edit, send or delete it |
| Preparation failed | `Draft` | `failed` | Edit it, retry the preparation or delete it |
| Sent | `In Progress` | `ready` | Track replies and blacklist reports |
| Completed | `Completed` | `ready` | Read the final record |

Preparation captures a screenshot of your website and one of the look-alike, and looks up the abuse contacts of each authority you chose. A draft becomes `ready` only when both screenshots exist and every chosen authority has at least one abuse email address.

### Authorize takedowns

A takedown acts on your organization's behalf, so the authorities receive a signed power of attorney with each report. Upload one before your first draft. Every later takedown can reuse it.

**1. Download the template**

[`spoofguard_powers_of_attorney_template`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/spoofguard/powers_of_attorney/template/) returns the blank template as an ODT file named `blank_takedown_power.odt`.

```bash theme={"dark"}
curl -OJ https://client-api.leak.center/api/spoofguard/powers_of_attorney/template/ \
  -H "X-API-Key: YOUR_API_KEY"
```

**2. Fill it in and sign it**

Complete the template for your organization and sign it.

**3. Upload the signed file**

[`spoofguard_powers_of_attorney_create`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/powers_of_attorney/) takes `multipart/form-data` with `name` (up to 100 characters, unique within your organization) and `signed_power_file` (a PDF, ODT or DOCX file).

```bash theme={"dark"}
curl https://client-api.leak.center/api/spoofguard/powers_of_attorney/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "name=Acme power of attorney 2026" \
  -F "signed_power_file=@acme-power-of-attorney-signed.pdf"
```

The call returns `201` with the file's `id`, `name`, `signed_power_file_link` and timestamps. Keep the `id`: drafts take it as `power_of_attorney_id`.

The unchanged template is refused. An ODT upload is converted to PDF. To rename a power of attorney or replace its file, send [`spoofguard_powers_of_attorney_update`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/PATCH/api/spoofguard/powers_of_attorney/\{power_of_attorney_id}/) as `multipart/form-data`. Both upload calls refuse a JSON body with `415`.

### Create a draft

[`spoofguard_takedowns_create`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/takedowns/) takes a JSON body:

| Field | Required | Meaning |
| - | - | - |
| `analysis_id` | Yes | The scan that found the domain |
| `domain` | Yes | The look-alike, exactly as it appears in the scan's results |
| `power_of_attorney_id` | Yes | The `id` of your signed power of attorney |
| `registrar` | One of the two | `true` reports the domain to its registrar |
| `hosting` | One of the two | `true` reports the domain to the hosting provider of its IP address |
| `blacklists` | No | Blacklists to report the domain to: `google`, `microsoft`, `spamhaus`, `openphish`, `netcraft`, `phishtank`, `norton` |
| `additional_notes` | No | Up to 2,048 characters, included in the abuse reports |
| `reply_email_recipient` | No | The address that receives progress emails for this takedown |

```bash theme={"dark"}
curl https://client-api.leak.center/api/spoofguard/takedowns/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "analysis_id": "7c1e2d3f-5a6b-4c8d-9e0f-1a2b3c4d5e6f",
    "domain": "acme-login.com",
    "power_of_attorney_id": 3,
    "registrar": true,
    "hosting": true,
    "blacklists": ["google", "netcraft"],
    "reply_email_recipient": "security@acme.com"
  }'
```

The call returns `201` with the draft. This shortened example shows the fields you act on:

```json theme={"dark"}
{
  "uid": "b2f4e6a8-1c3d-4e5f-8a9b-0c1d2e3f4a5b",
  "analysis_id": "7c1e2d3f-5a6b-4c8d-9e0f-1a2b3c4d5e6f",
  "status": "Draft",
  "preparation_status": "queued",
  "original_domain": "acme.com",
  "malicious_domain": "acme-login.com",
  "malicious_ip": "203.0.113.10",
  "malicious_http_open": true,
  "malicious_https_open": true,
  "blacklists": ["google", "netcraft"],
  "reply_email_recipient": "security@acme.com",
  "authority_takedown_requests": [],
  "logs": []
}
```

> [!NOTE]
>
> **Set `reply_email_recipient`.** That address receives an email when the draft's preparation finishes, when each request is sent, when the website or domain is taken down, and when the takedown completes. Without it, the emails go to an internal address that no one reads. You cannot change it after the draft is created.

The draft is checked before it is saved. Each check that fails returns `400` with a `details` message:

* `registrar` or `hosting` is `true`.
* The power of attorney and the scan exist in your organization.
* Every blacklist code is valid.
* `domain` is one of the scan's results.
* `domain` resolves to an IP address, and port 80 or 443 is open on it.
* Your scanned domain, `acme.com`, resolves to an IP address.

### Wait for preparation

Poll [`spoofguard_takedowns_detail`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/spoofguard/takedowns/\{takedown_id}/) until `preparation_status` is `ready` or `failed`.

```bash theme={"dark"}
curl https://client-api.leak.center/api/spoofguard/takedowns/b2f4e6a8-1c3d-4e5f-8a9b-0c1d2e3f4a5b/ \
  -H "X-API-Key: YOUR_API_KEY"
```

When the draft is `ready`, review what will be sent:

* `original_screenshot_link` and `malicious_screenshot_link`: the two screenshots attached to every report.
* `authority_takedown_requests`: one entry per chosen authority, with `authority_type` (`Domain Registrar` or `Hosting Provider`), `abuse_name`, `abuse_emails` and `email_preview_link`, an image of the email.

### Edit a draft

[`spoofguard_takedowns_update`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/PATCH/api/spoofguard/takedowns/\{takedown_id}/) accepts `multipart/form-data` only. A JSON body returns `415`. You can edit a draft that is `ready` or `failed`, but not one that is still `queued` or `preparing`, and not one already sent.

| Field | Meaning |
| - | - |
| `original_screenshot`, `malicious_screenshot` | Replacement screenshots: JPEG, PNG or GIF, up to 20 MB |
| `registrar`, `hosting` | `true` or `false`. Turning one on adds that authority and looks up its contacts. Turning it off removes it. One must stay on. |
| `blacklists` | Repeat the field once per blacklist code |
| `additional_notes` | Up to 2,048 characters |

```bash theme={"dark"}
curl https://client-api.leak.center/api/spoofguard/takedowns/b2f4e6a8-1c3d-4e5f-8a9b-0c1d2e3f4a5b/ \
  -X PATCH \
  -H "X-API-Key: YOUR_API_KEY" \
  -F "malicious_screenshot=@acme-login-screenshot.png" \
  -F "registrar=true" \
  -F "hosting=true"
```

> [!WARNING]
>
> **Send `registrar` and `hosting` with every screenshot upload.** In a request that carries a file, a missing `registrar` or `hosting` counts as `false`. One missing value drops that authority from the draft, and two missing values refuse the request.

The call returns the updated draft.

### Retry a failed preparation

A draft fails when a screenshot cannot be captured, or when no abuse email address is found for an authority you chose. Fix the cause, then start the preparation again:

**1. Find what is missing**

An empty `original_screenshot_link` or `malicious_screenshot_link` is a missing screenshot. An entry in `authority_takedown_requests` with an empty `abuse_emails` list is a missing contact. So is an authority you chose, `registrar` or `hosting` set to `true`, that has no entry in `authority_takedown_requests`.

**2. Fix the draft**

Upload the missing screenshot, or turn off the authority that has no contact. Both are [edits](#edit-a-draft).

**3. Retry**

Call [`spoofguard_takedowns_retry_preparation`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/takedowns/\{takedown_id}/retry_preparation/). It returns `202` with an empty body, and the draft goes back to `queued`. Poll the draft again. Screenshots and contacts already stored are reused.

A retry returns `409` when the draft cannot be retried yet:

```json theme={"dark"}
{
  "details": "The takedown draft preparation cannot be retried yet."
}
```

You can retry a `failed` draft at any time. A draft that has stayed `queued` or `preparing` for 15 minutes without changing can be retried too. A `ready` draft or a sent takedown cannot.

### Send the takedown

[`spoofguard_takedowns_send`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/takedowns/\{takedown_id}/send/) takes no body and uses one unit of your yearly allowance.

```bash theme={"dark"}
curl https://client-api.leak.center/api/spoofguard/takedowns/b2f4e6a8-1c3d-4e5f-8a9b-0c1d2e3f4a5b/send/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY"
```

Each chosen authority receives an abuse report by email, with your signed power of attorney and both screenshots attached. The domain is also reported to the blacklists you chose. The call returns `200` with the takedown. `status` is `In Progress` once at least one report is sent. A `status` still at `Draft` means no report went out. Check `status` and `logs` in the response. A `200` uses the unit either way.

A send is refused, and its unit refunded, in two cases:

* The draft is not `ready`: `{"details": "The takedown draft preparation is not ready."}`
* It was already sent: `{"details": "The takedown request has already been sent to the authorities for this domain."}`

### Track progress

Read one takedown with [`spoofguard_takedowns_detail`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/spoofguard/takedowns/\{takedown_id}/), or all of them with [`spoofguard_takedowns_list`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/spoofguard/takedowns/).

| Field | Meaning |
| - | - |
| `status` | `Draft`, `In Progress` or `Completed`. A takedown completes when a registrar or hosting provider has taken the domain or website down. `completed_at` records when. |
| `authority_takedown_requests[].status` | `Draft`, `In Progress`, `Replied` or `Completed`, per authority |
| `authority_takedown_requests[].replies` | The authority's replies, with `from_email`, `to_email`, `subject` and `text` |
| `blacklist_data` | One entry per blacklist, with `blacklist`, `status` (`Draft`, `In Progress` or `Completed`), `last_check` and `completed_at` |
| `blacklists_status` | A summary of the blacklist reports: `N/A`, `Draft`, `In Progress`, `Partially Completed` or `Completed` |
| `logs` | Each step with its `action` and `created_at`, for example "Takedown request sent to domain registrar" or "Domain taken down by registrar". The entry with `is_last: true` closes the takedown. |

Takedowns also set the triage status of the domain in the scan's results: `td_in_progress` once sent, and `td_completed` when complete.

The list returns every takedown of your organization in one array, newest first. It takes these filters:

| Parameter | Meaning |
| - | - |
| `analysis_id` | Takedowns from one scan |
| `monitor_id` | Takedowns linked to one [monitor](https://wiki.darknetsearch.com/api/guides/domain-monitoring-alerts.md) |
| `domain` | Your scanned domain contains this text |
| `malicious_domain` | The look-alike contains this text |
| `status` | `Draft`, `In Progress` or `Completed`. URL-encode the space. |

Leave out `date_sort`: the default order is newest first.

```bash theme={"dark"}
curl -G https://client-api.leak.center/api/spoofguard/takedowns/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "status=In Progress"
```

### Delete a takedown

[`spoofguard_takedowns_delete`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/DELETE/api/spoofguard/takedowns/\{takedown_id}/) returns `204` and removes the takedown from your list. It does not withdraw reports already sent, and it does not return the allowance unit. The domain's triage status in the scan returns to `reviewed`.

### Errors

Errors from the API itself carry `detail`. Errors from the domain monitoring service carry `details`, except its own `429`, which carries `detail`. The per-second rate limit and the API Calls allowance carry `message`. Read the first of `detail`, `details` and `message` that the body contains. Every status is explained once in [Handle API errors](https://wiki.darknetsearch.com/api/guides/errors.md).

| Status | When | Body |
| - | - | - |
| `400` | A field fails validation, such as a missing `analysis_id` or notes over 2,048 characters | The field name with its messages |
| `400` | A draft check fails: no authority chosen, unknown power of attorney or scan, invalid blacklist code, domain not in the scan, no IP address, no open web port | `details`, for example `{"details": "The domain acme-login.com does not have a running webserver. No takedown request can be sent."}` |
| `400` | Reading, editing or sending a takedown that is not one of yours | `{"takedown_id": "..."}` |
| `400` | Listing with an `analysis_id` or `monitor_id` that is not yours | `{"details": "Analysis with the given ID does not exist."}` or `{"details": "Monitor with the given ID does not exist."}` |
| `400` | Editing a takedown that was sent, or a draft still being prepared | `{"details": "Only takedown requests in Draft mode can be edited."}` or `{"details": "The takedown draft is still preparing."}` |
| `400` | Sending a draft that is not ready, or a takedown already sent | See [Send the takedown](#send-the-takedown) |
| `400` | Uploading the unchanged template, or a file that is not PDF, ODT or DOCX | `{"signed_power_file": [...]}` |
| `400` | A power-of-attorney name you already use | `{"details": ["A power of attorney file with the name 'Acme power of attorney 2026' already exists."]}` |
| `403` | Your plan lacks Domain Takedowns, or your license is not active | `{"detail": "This feature is not included in your plan."}` |
| `404` | Deleting or retrying a takedown that does not exist, an unknown power of attorney, or a path ID that is not a UUID | — |
| `409` | Retrying a preparation that cannot be retried yet | `{"details": "The takedown draft preparation cannot be retried yet."}` |
| `415` | An edit or power-of-attorney upload sent as JSON | `{"detail": "Unsupported media type \"application/json\" in request."}` |
| `429` | `send` when the yearly Domain Takedowns allowance is spent | `{"detail": "You have reached your Domain Take Down limit for this year.", "resource": "domain_take_down", "period": "year", "limit": 30}` |
| `429` | The domain monitoring service's limit of 180 requests a minute for your organization | `detail` starts with `Request was throttled. Expected available in`, then the wait in seconds |
| `429` | The per-second rate limit or the API Calls allowance | `{"message": "Rate limit exceeded", ...}`. See [Rate limits](https://wiki.darknetsearch.com/api/guides/rate-limits.md). |
| `502` | The domain monitoring service failed | `{"detail": "The requested service is temporarily unavailable."}` |
| `504` | The domain monitoring service timed out | `{"detail": "The requested service timed out."}` |

### Endpoints

| Action | Endpoint |
| - | - |
| Download the power of attorney template | [`GET /api/spoofguard/powers_of_attorney/template/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/spoofguard/powers_of_attorney/template/) |
| List powers of attorney | [`GET /api/spoofguard/powers_of_attorney/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/spoofguard/powers_of_attorney/) |
| Upload a signed power of attorney | [`POST /api/spoofguard/powers_of_attorney/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/powers_of_attorney/) |
| Get a power of attorney | [`GET /api/spoofguard/powers_of_attorney/{power_of_attorney_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/spoofguard/powers_of_attorney/\{power_of_attorney_id}/) |
| Rename or replace a power of attorney | [`PATCH /api/spoofguard/powers_of_attorney/{power_of_attorney_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/PATCH/api/spoofguard/powers_of_attorney/\{power_of_attorney_id}/) |
| Delete a power of attorney | [`DELETE /api/spoofguard/powers_of_attorney/{power_of_attorney_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/DELETE/api/spoofguard/powers_of_attorney/\{power_of_attorney_id}/) |
| List takedowns | [`GET /api/spoofguard/takedowns/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/spoofguard/takedowns/) |
| Create a draft | [`POST /api/spoofguard/takedowns/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/takedowns/) |
| Get a takedown | [`GET /api/spoofguard/takedowns/{takedown_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/GET/api/spoofguard/takedowns/\{takedown_id}/) |
| Edit a draft | [`PATCH /api/spoofguard/takedowns/{takedown_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/PATCH/api/spoofguard/takedowns/\{takedown_id}/) |
| Delete a takedown | [`DELETE /api/spoofguard/takedowns/{takedown_id}/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/DELETE/api/spoofguard/takedowns/\{takedown_id}/) |
| Send a takedown | [`POST /api/spoofguard/takedowns/{takedown_id}/send/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/takedowns/\{takedown_id}/send/) |
| Retry a failed preparation | [`POST /api/spoofguard/takedowns/{takedown_id}/retry_preparation/`](https://client-api.leak.center/scalar-docs/#tag/spoofguard/POST/api/spoofguard/takedowns/\{takedown_id}/retry_preparation/) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.