Takedowns

Takedowns is deliberately a two-step, human-reviewed flow — not an automatic action that fires the moment something's flagged.

Step 1 — create a request

A takedown can be created from a Domains Incident, an Ads finding, or ad-hoc for any domain or URL you want to report. Creating one only:

  • Queues it with status pending
  • Sends a best-effort admin-notify email summarising what's being requested and why

Nothing is sent to any third party at this point.

Step 2 — review, then submit

Submitting is a separate, explicit action, gated to owner/admin/agency_manager roles. Only then does Kansyn actually send:

  • A WHOIS-registrar abuse email (skipped automatically for domains on known free-hosting platforms — WHOIS for sites.google.com resolves to Google's own registrar record, not the attacker's, so that channel is never useful there)
  • A Google Safe Browsing phishing report, against the exact URL including path
  • A Cloudflare abuse report, if the domain sits behind Cloudflare
  • An ICANN compliance report
  • A hosting-provider abuse email, if one's on file for the domain

Why the split

Filing a real abuse report about a domain is not something to trigger automatically off an unverified detection — false positives here have a real cost to whoever's on the receiving end. The pending → review → submit gate exists specifically to put a human in that loop.

Retries

If a submission channel fails outright (SMTP down, an API error), it's marked failed and retried automatically up to 3 total attempts. Channels that were correctly skipped — like WHOIS on a free-hosting platform — are recorded separately and never retried, since retrying wouldn't change the outcome.