Takedowns

Takedowns automate the first step of the response workflow: drafting an abuse-report email for a confirmed impersonation, addressed to the right recipient.

The workflow

1. From the triage queue or finding detail, trigger Generate takedown.
2. Rails calls Python POST /v1/takedown/generate with {scan_id, finding_id, domain}.
3. Python returns {subject, body}:
   • A deterministic template is always produced (never blocked on the model).
   • When an AI provider is configured, the draft is polished by the LLM.
4. Rails records a takedown_generated audit event and shows the draft with copy buttons.

Recipient targeting

The draft is addressed based on the finding’s registration data:

• The registrar’s abuse contact when registration data is available.
• The hosting provider otherwise.

What the draft contains

The abuse email cites the platform’s evidence: the lookalike domain, brand overlap signals, registration/hosting details, severity, and the specific abuse reason. It’s designed to be sent as-is or edited.

Note

Takedowns produce drafts only. Nothing is sent automatically; the analyst copies the email and sends it from their own mailbox.

Next

• Triage
• Reporting