Why a scam site stays online for weeks
The gap between “reported” and “gone”
A victim files an abuse report. A researcher tweets the URL. A bank’s fraud team flags it internally. And the scam site just keeps running, sometimes for weeks, sometimes for months. This isn’t incompetence on the part of whoever received the report. It’s a structural feature of how the internet is built: no single party has the authority to instantly delete a website, and the parties who do have some authority are each working from incomplete information, competing priorities, and a queue.
Understanding how website takedowns actually work explains why this gap exists, and why the sites that survive longest are the ones deliberately engineered around it.
Who actually has the power to pull a site down
A website isn’t one thing sitting in one place. It’s a stack of separate relationships, and each layer belongs to a different company that can, in theory, kill the site by withdrawing service.
The domain registrar controls the DNS records that point a name like totally-legit-bank.com at an IP address. Suspend the domain and browsers can no longer resolve it.
The hosting provider controls the server the content actually lives on. Pull the account and the files are gone, assuming there’s no backup mirror elsewhere.
The CDN or reverse proxy, most commonly Cloudflare, sits in front of both and terminates the connection on the visitor’s behalf. It can drop the site from its network, but it usually doesn’t host the content or know the origin’s real address.
The domain registry, the organization that runs a whole top-level domain like .com or .xyz, can suspend a domain at the registry level if the registrar won’t act, but registries are reluctant to do this and reserve it for extreme cases.
Each of these companies has an abuse desk, and each abuse desk only sees its own slice of the stack. The registrar doesn’t know what’s hosted on the site. The host often doesn’t know who registered the domain. Coordinating a takedown means getting several different companies, in several different countries, to agree the evidence justifies action, on their own timeline.
Why abuse reports sit in a queue
Abuse desks at large hosts and registrars process an enormous volume of reports, and a meaningful share of them are wrong, exaggerated, or filed by a competitor trying to knock a rival offline. That means every report has to be triaged before anyone acts on it. A generic “this site is a scam” email with no evidence gets deprioritized behind reports that include screenshots, transaction records, or a clear violation of the acceptable use policy.
Cross-border reporting adds another layer of friction. A registrar in one country receiving a report from a victim in another has no obligation to act quickly, and legal standards for what counts as sufficient evidence of fraud vary by jurisdiction. Law enforcement requests move even slower, often requiring formal legal process like a subpoena or mutual legal assistance treaty request before a company will hand over identifying information or take unilateral action based on a police request alone.
None of this is secret or unusual. It’s just slow by design, because acting on unverified accusations creates its own liability.
Bulletproof hosting and jurisdiction shopping
Some hosting providers built their business model around ignoring abuse reports, or at least responding to them as slowly as legally possible. These are commonly called bulletproof hosts. They aren’t hiding, they operate openly and charge a premium precisely because they tolerate content that mainstream hosts would suspend within hours.
Operators running scam infrastructure will deliberately register through resellers and shell companies incorporated in jurisdictions with weak enforcement cooperation, so that even when a takedown request is well documented, the entity receiving it has no local legal incentive to comply quickly. This is jurisdiction shopping: picking the registrar, host, and even the top-level domain based on which combination is slowest to respond to complaints, not on price or performance.
Hiding behind infrastructure nobody wants to block
The more sophisticated defense against takedowns isn’t finding a host that ignores complaints. It’s making the site hard to isolate from legitimate traffic in the first place.
Putting a CDN in front of the origin server means the abuse desk that receives a complaint sees only the CDN’s IP address, not the actual server. The CDN has to be convinced to unmask or drop the site before anyone can act on the hosting layer, and large CDNs are cautious about doing that on a single report, because false positives against a legitimate customer are expensive for their reputation.
Some operators go further and host the scam page as a subpage or redirect chain on a legitimate platform: a free site builder, a cloud storage bucket, a form service, a URL shortener. Platform abuse teams can pull an individual page, but the domain itself (say, a well known cloud provider’s storage domain) never goes on a blocklist, because doing so would break thousands of unrelated legitimate uses of that same domain. The scam borrows the platform’s trust and its resistance to being blocked wholesale.
Fast flux and disposable domains
Even without borrowed infrastructure, DNS itself can be used to outrun a takedown. A technique called fast flux involves setting extremely short time-to-live values on DNS records and rotating the IP addresses a domain resolves to every few minutes, across a pool of compromised or rented servers. By the time an abuse desk identifies and suspends one IP, the domain has already moved to another.
A related pattern is simply registering domains faster than they can be reported: dozens of near identical domains pointed at the same backend, so that suspending one barely dents traffic because the operator just promotes the next one in a phishing kit or spam campaign. This is why defenders increasingly look at domain registration patterns themselves, like a burst of newly created lookalike domains from the same registrant fingerprint, as an early signal rather than waiting for individual complaints.
Blocklists run on a separate, faster track
While the ownership chain of registrar, host, and registry moves slowly, there’s a parallel system that often acts faster: browser and email blocklists. Google Safe Browsing, Microsoft SmartScreen, and similar services crawl the web continuously, flag known scam and phishing patterns, and push warnings directly into Chrome, Edge, and mail clients within hours of detection, without needing to touch the site’s actual infrastructure at all.
This is why a scam site can technically stay “online” (still resolving, still serving pages) while its real-world traffic collapses because every mainstream browser is showing visitors a full page red warning before they can even load it. From a victim’s point of view the threat feels neutralized. From an abuse desk’s point of view, the domain is still an open ticket.
The other lever: payment rails
Content takedowns aren’t the only pressure point, and often not the most effective one. Card networks and payment processors run their own fraud monitoring and can freeze a merchant account based on chargeback rates or fraud pattern matching, cutting off the site’s ability to actually collect money even if the pages stay up. Crypto exchanges can flag and freeze wallets tied to reported scam addresses when funds move through a regulated on ramp or off ramp. For a scam that depends on collecting payment, losing the payment rail can matter more than losing the domain.
Why it usually takes several levers at once, not one
Scam sites that survive for weeks are almost never surviving because nobody reported them. They’re surviving because they were built to make each individual layer’s abuse process slow, ambiguous, or someone else’s problem: a bulletproof host that won’t act fast, a CDN that can’t distinguish them from legitimate traffic without more evidence, a domain registrar in a jurisdiction with no urgency, and a fresh backup domain ready the moment the first one gets suspended. Taking a site down for good typically means pressuring several of these layers simultaneously, which is exactly why it takes coordinated effort from researchers, platforms, and sometimes law enforcement, rather than a single well worded email.
If you want more of this kind of breakdown of the infrastructure behind the internet’s cat and mouse games, from bot detection to device fingerprinting to the proxy networks in between, come see what else we’ve covered on the Hidden Internet.
Get new guides and videos first — join the Telegram channel.