EPP status codes
EPP status codes are the flags a registry or registrar sets on a domain (such as clientHold, serverHold or clientTransferProhibited) that show whether it can resolve, be transferred or be changed.
How it works
Codes starting with client are set by the registrar, those starting with server by the registry. clientHold and serverHold remove the domain from DNS, which is how most phishing takedowns are implemented.
Statuses appear in RDAP and WHOIS output and change when a registrar acts on an abuse report.
Example from the PhishDestroy database
- vaultofin.com: Domain with a recorded takedown, first detected 2026-06-15.
- postmarkapp.net: Domain with a recorded takedown, first detected 2026-06-15.
- phersonetwork.com: Domain with a recorded takedown, first detected 2026-06-15.
How to protect yourself
- After reporting, check for clientHold or serverHold to confirm the registrar acted.
- A redemptionPeriod or pendingDelete status means the domain is on its way to deletion.