Takedown Automation
Automated Abuse Reporting & Status Tracking
Automated Abuse Reporting & Status Tracking
// Overview
A production module inside a Security Command Center (SCC) platform that automatically files takedown requests for malicious sites (phishing, brand-jacking gambling) to the national content regulator and other platforms, programmatically defeating bot protection, and tracks every request through its lifecycle on a single dashboard.
// Background
The challenge
Detection was working, but getting confirmed sites
removed was a separate, entirely manual battle.
Submission was bot-gated
The reporting portal sits behind Cloudflare and a
dynamic Livewire form; each report meant human clicks.
Bot protection made every submission a manual challenge
Duplicate effort
Without a dedup check, the same domain got reported
repeatedly, wasting time and muddying tracking.
Re-reporting known domains was routine
No lifecycle visibility
Once filed, a request disappeared into an inbox; no
single place to see submitted vs in-progress vs resolved.
Filed and forgotten, until someone chased it
Fragmented channels
Some takedowns go to the national portal, others to
registrar/hosting abuse desks, no record.
One funnel for all platforms didn't exist
Net effect
Detection was working; getting sites removed was
the bottleneck.
// Solution
Takedown automation, submit, track & follow up
Data sources
Confirmed malicious URL
from web / social monitoring
triggered automatically
Manual channels
registrar · hosting · email
analyst-driven entries
Pipeline
Auto submit
bot-protection bypass
form flow automation
Submit
Record
activity log
+ ticket ID
Record
Scheduler
re-check status
verify reachable
Poll
Dashboard
Vue 3 + FastAPI
status × plat
Dashboard
Bot-protection bypass · check-before-submit dedup · daily Airflow polling · unified auto + manual funnel
// Impact
Reporting: manual → automated
Before · by hand
manual anti-bot clicks · no scaleAfter · automated bypass
automated · bot-free · 0 manual clicks0
manual clicks per takedown report
Operational impact
Reporting at machine speed
bypass beats bot-gated forms, reported
No duplicate filings
dedup recovers existing ticket codes
End-to-end visibility
funnel: submitted → progress → resolved
Reliable follow-up
ticket IDs re-polled daily, no stalls
Unified audit trail
auto + manual in one activity log
Closes the loop
detection → takedown in one flow
Results
clicks / report
0
automated filing
24/7
ticket IDs kept
100%
status polling
daily
Covers auto portal + manual registrar
All activity logged with ticket IDs.
// Tech Stack
| Layer | Technologies |
|---|---|
| Orchestration | Apache Airflow (daily takedown DAG: status-check → browser-check → fact rebuild), Papermill |
| Automation | curl-cffi (Chrome TLS/HTTP-2 impersonation, Cloudflare bypass), reverse-engineered Livewire flow (CSRF + snapshot), retry/back-off on rate limits, screenshot capture |
| Backend API | FastAPI, async httpx, psycopg / SQLAlchemy |
| Data store | PostgreSQL (takedown records + activity log + rebuilt fact table) |
| Frontend | Vue 3, Quasar, Vite, TypeScript, Pinia, TanStack Vue Query, ECharts |
// Architecture & Diagrams
Requests from several sources converge on one record; an automation agent submits to the government abuse service and a daily loop collects evidence and status until the case closes.
Disclaimer: sample visuals may contain anonymized, simulated, or non-production values for presentation purposes.