Effectiveness of takedown actions against phishing campaigns: The role of OSINT in incident qualification, report routing and escalation

Research objective: The aim of this study is to examine the procedural determinants of phishing takedown effectiveness and to propose an OSINT-based model supporting incident qualification, report routing, and escalation processes.
Methodology: The study is based on a doctrinal analysis of EU notice-and-action requirements combined with an operational mapping of phishing infrastructure across DNS, hosting, and platform layers. It also incorporates the development of a minimal evidentiary standard for OSINT materials and a structured routing matrix linking phishing scenarios with relevant intermediaries.
Main conclusions: The findings indicate that the effectiveness of phishing disruption depends not only on detection but primarily on the quality of follow-on takedown actions. Establishing standardized OSINT evidence (including content capture, UTC time anchoring, integrity controls, and confidence grading) and implementing a structured routing matrix significantly improves takedown efficiency. The proposed measurement protocol enables reliable evaluation using key metrics such as time to takedown, persistence of removal, escalation yield, and erroneous takedown indicators.
Application of the study: The proposed model may support cybersecurity professionals, incident response teams, and regulatory bodies in improving the efficiency, accuracy, and reliability of phishing takedown processes, while reducing exposure time and ensuring procedural proportionality.
Originality/Novelty of the study: The study integrates legal and operational perspectives by combining EU regulatory frameworks with practical OSINT-based methodologies. It introduces a structured evidentiary standard and a routing matrix for phishing incidents, along with a comprehensive measurement framework, contributing to more effective and empirically grounded takedown strategies.

Metadane i eksport

Pobierz RISPobierz BibTeX

Powiązane publikacje i artykuły

• OSINT w cyberbezpieczeństwie. Od informacji do oceny zagrożenia (Artykuł)
• ARTIFICIAL INTELLIGENCE, IT INFRASTRUCTURE AND CYBERSECURITY IN LABOUR MARKET TRANSFORMATION: BRIDGING THE GAP IN UNDERSTANDING DIGITAL INEQUALITY IN THE EUROPEAN UNION (Publikacja)
• Ransomware Threats and Defensive Strategies: Insights from Literature and Practice (Publikacja)
• From Detection to Trust: Managing Cybersecurity Risks of Generative AI Systems in Organizations (Publikacja)

Mariusz Łazarski (2026). Effectiveness of takedown actions against phishing campaigns: The role of OSINT in incident qualification, report routing and escalation. Humanities & Social Sciences Reviews. https://doi.org/10.18510/hssr.2026.14111

Mariusz Łazarski. „Effectiveness of takedown actions against phishing campaigns: The role of OSINT in incident qualification, report routing and escalation”. Humanities & Social Sciences Reviews. 2026. https://doi.org/10.18510/hssr.2026.14111.

@article{NB202697,
  author = {Mariusz Łazarski},
  title = {Effectiveness of takedown actions against phishing campaigns: The role of OSINT in incident qualification, report routing and escalation},
  year = {2026},
  journal = {Humanities & Social Sciences Reviews},
  doi = {10.18510/hssr.2026.14111},
  url = {https://doi.org/10.18510/hssr.2026.14111}
}