Introducing Email Domain Takedown, free for schools this semester

Phishing doesn’t end when you quarantine the message. The domain that sent it is still registered, still sending, and still pointed at everyone who didn’t report it. Most teams know this. Very few do anything about it, because getting a domain taken down is a slow, fiddly job that competes with everything else on the queue and usually loses.

Today we’re launching Email Domain Takedown. You give it the phishing email. An AI agent investigates the sending domain, assembles the evidence, and drafts the abuse report to the registrar or host. You read it and decide whether it goes. And through this back-to-school season, it’s free for accredited educational institutions, because right now they’re the ones getting hit.

Why schools, why now

The first weeks of a semester are the best phishing window of the year, and attackers know it. UT San Antonio delayed the start of its fall term by three days last month after an intrusion attempt was caught the weekend before classes, leaving 42,000 students locked out of their accounts in registration week.

Thousands of new students arrive with credentials they’ve used exactly once. Password reset requests spike, so a fake one doesn’t stand out. UC Berkeley’s security office is fielding reports right now of an email posing as a campus department, asking students for their CalNet login to fix a problem with their ID. Financial aid, tuition deadlines, housing, course registration: all of it lands in the same few weeks, and every piece is a plausible pretext with real money behind it. RIT’s security chief put it plainly in July: once attackers have a student’s credentials, they set up a financial-aid refund routed to a bank account the student doesn’t control.

The people defending against this are often a small IT team, sometimes one person, covering tens of thousands of mailboxes across departments that each run a little differently. They can usually detect and quarantine a campaign. What they almost never have is the hour it takes to work out who registered the domain, find the right abuse contact, and write a report a registrar will act on. So the domain stays up, and the same campaign comes back next week against a different department.

What a takedown actually takes

If you’ve never filed one, here’s the job. You start with the headers, reading the authentication results to decide whether SPF, DKIM and DMARC actually vouch for the From domain or whether the message was relayed. You compare From against Reply-To and check where the Message-ID originated, because that’s where business email compromise tends to show. You follow the links, which means manually unwrapping click trackers and URL-defense redirects to find the real destination. You look hard at the domain name and hope you notice the Cyrillic character that renders identically to a Latin one. You run WHOIS for the registrar, the registration age, and whether the owner is shielded. You open the page somewhere safe to see what the victim saw. Then you dig an abuse contact out of a free-text WHOIS record and write something specific enough that a registrar acts rather than ignores it.

Thirty to sixty minutes if you know what you’re doing. The real failure mode isn’t filing badly. It’s never filing.

How the agent works

It isn’t a script running the same checks in the same order. The agent is given tools, including WHOIS lookup and live page fetch, and decides for itself when to use them, following where the evidence leads until it has enough. A domain that resolves to a parked page is a different investigation from one serving a credential form, and it treats them differently.

Some of that work is deliberately not left to the model. Lookalike detection runs as plain code: punycode decoding, confusable-character folding, edit-distance scoring. A Cyrillic “a” is pixel-identical to a Latin “a”, and an internationalized homograph reaches a language model as an opaque xn-- string that resembles nothing. Code decides that exactly. The model is used where judgment is genuinely required and told the answer where it isn’t.

Then it argues against itself. Once it reaches a conclusion, a second pass runs with no memory of the first one’s reasoning and its own tool access, and its only job is to refute the finding: look for shared-hosting explanations, coincidental naming, thin evidence. A reviewer that can see the original chain of reasoning isn’t independent; it’s primed to agree. Most manual processes never get a second analyst at all.

When the evidence doesn’t support a verdict, it says so and holds the case for a human, with the reason stated. It will ask you for the things that live only in your head, like whether you actually have a vendor relationship with the sender. It won’t ask you to re-describe an email it already has. And you can watch it work: every case keeps the full trace of what it looked up, what came back, and why it concluded what it did.

Nothing gets sent without you

The agent drafts. It never files. You approve each notice, and then our team reviews it before it goes out.

It also won’t file on a brand you don’t own. If a phishing email impersonates a bank and lands in your inbox, you’re the victim, but you have no standing to demand a takedown on the bank’s behalf, and filing one anyway abuses a process registrars depend on. Those cases are held, with a note on who to report to instead. It files when the abuse targets your identity: your domain, your brand, your people, or a lookalike of your name.

There’s no mailbox integration. No OAuth grant, no admin consent. You hand it one file. That’s the whole setup, which is why a stretched IT team can try it in an afternoon without a security review.

The free tier

Accredited educational institutions get five takedown cases per institution every thirty days, no card required. Eligibility is by email domain and covers educational suffixes worldwide, not just .edu: .ac.uk, .edu.au, .ac.jp, .edu.in and their equivalents. Verify your institutional address and file your first case.

For everyone else, cases are available individually or as credits. No subscription needed to file one.

Get started

Go to platform.mesasecurity.com/?module=takedown and sign in with Microsoft, Google, or an email address. Upload the phishing email you’re already sitting on.

If you run security for a school, you’ve almost certainly got one in your quarantine queue right now. That’s the one to start with.