Panama takedown procedure, explained step by step

Who can file a complaint, and where?

Anyone can, by email to [email protected], without an account. Courts, prosecutors and lawyers use the same address with the subject line "Legal request"; urgent cases (a threat to life, child abuse material) use the subject "URGENT". Write in English or Spanish, name the domain exactly, and attach your evidence.

The procedure below applies to every domain registered through DomaineGoat LLC, a company incorporated in Panama. Domains are registered through our ICANN-accredited registrar partner. The procedure is the same with or without Domain protection, with one addition for protected domains: a person reads every complaint before any action on the domain. Its legal basis, text by text, is on the Panama domain law page.

What counts as a well-documented abuse report?

A well-documented report lets us confirm the abuse without guessing. For track A, that means:

• the exact URL or host, not just the domain;
• what it does: the bank imitated, the malware family, the payment demanded;
• when it was seen, in UTC;
• evidence we can check: a screenshot, a file hash, a sandbox report, message headers, a victim's order or transfer record.

For child sexual abuse material, send the URL only. Never attach or forward the material. Under Penal Code article 185, as amended by Law 478 of 2025, possession is itself a crime in Panama.

A report that lacks evidence is not refused outright. We ask for what is missing. The time limits apply to a well-documented report, so they run once the evidence is complete. ICANN's Registrar Accreditation Agreement (§3.18.1), which binds our registrar partner and, through it, our service, requires registrars to investigate abuse reports and respond appropriately. Since the 5 April 2024 amendments, §3.18.2 requires prompt mitigation once a registrar has actionable evidence of DNS abuse.

Why does a copyright or defamation complaint need a Panamanian court?

Because under Panamanian law an intermediary acquires actual knowledge only from a competent authority's decision. Law 51 of 2008 (arts. 87–91) exempts intermediaries that lack actual knowledge that content is unlawful. Knowledge exists once a competent authority has declared the content unlawful and ordered its removal.

Panama's copyright law, Law 64 of 2012, gives rightholders court remedies and precautionary measures (arts. 175–178). We found no private notice-and-takedown procedure in it. A rightholder in a hurry can ask a Panamanian judge for a precautionary measure; that measure reaches us as a court order.

In practice, a content complaint goes three ways: to the holder, forwarded by us; to the host, which stores the content; or to a Panamanian court. We tell the complainant all three. For copyright notices sent under United States law, see DMCA notices.

How are foreign court judgments handled?

A foreign judgment is refused until the Supreme Court of Panama recognises it, and the refusal is counted. Recognition, called exequatur, is filed with the Sala Cuarta de Negocios Generales under articles 155 to 157 of Law 61 of 2015. The Court gives five days to the party bound by the judgment and to the Procurador General de la Nación.

Article 156 sets four conditions, among them that the defendant was personally served and could defend. Once recognised, the judgment is handled like a Panamanian order: verified, applied as written, and notified. The conditions and the documents are on the court orders page.

What can the registry, or our registrar partner, do without us?

A great deal: the registry holds its own copy of the registration and answers to the law of its own country. Our procedure governs what we do. It cannot stop a registry from acting.

• Court orders where the registry sits. A court in the registry's country can order it to suspend, lock or transfer a domain directly. Verisign, which runs .com and .net, is in the United States.
• Registry statuses. A registry can set its own hold or lock on a domain (serverHold, serverTransferProhibited), which no registrar can lift.
• Registry policies. Each registry applies its own abuse and eligibility rules. Country-code registries apply their own dispute policies.
• URS locks. In a URS case, it is the registry that locks the domain, within 24 hours of the provider's notice.

• Our registrar partner. Shown in the RDAP record, it keeps its own legal duties and abuse contact. A court of its own country can order it directly.

The country of every registry we sell is in the registry jurisdiction index. When a registry acts, we tell you what we learn and count the case in the transparency report.

What happens during a UDRP or URS case?

The domain is locked, it keeps resolving, and a panel decides. Under paragraph 4 of the UDRP Rules (complaints filed from 31 July 2015), the provider's verification request includes a request to lock the domain. The registrar confirms the lock within 2 business days and must not notify the respondent before the lock is applied.

In a URS case, the registry locks the domain within 24 hours, the name keeps resolving, and the holder has 14 calendar days to respond. The complainant must prove its case by clear and convincing evidence. If it wins, the domain is suspended for the rest of its registration period.

With Domain protection, our company is the registrant of record, so the complaint names it. We tell you, and you can answer it. Full details: UDRP and URS.

Worked examples: five complaints, five outcomes

1. A fake bank login page. A security company reports secure-login.example showing a copy of a bank's sign-in page, with a screenshot and the URL. Track A: the domain is suspended within 24 hours of a well-documented report, and the holder is told. The holder answers that a plugin was hacked, cleans the site and sends proof. We read the answer and decide on reinstatement in writing.

2. A copyright notice for a streaming site. An agent for a film studio sends a DMCA-style notice about films-online.example. Track B: no action on the domain. We forward the notice to the holder and reply to the agent: the host, the holder, or a Panamanian court. The complaint is counted as received, not acted on.

3. A foreign judgment for a transfer. A company wins a default judgment abroad ordering brand-shop.example transferred to it. Track C: refused, because no exequatur has been granted. We explain the Sala Cuarta route and article 156. If the registry sits in the court's country, the company may also go to the registry directly.

4. A UDRP complaint. A trademark owner files a UDRP complaint against a domain with Domain protection. Track D: we lock the domain within 2 business days and confirm. The complaint names our company as registrant of record. Once the lock is applied, we tell the customer, who answers the provider. The panel decision is applied as written.

5. A production order in a fraud case. A Panamanian prosecutor investigating a fake investment site sends an order under CPP article 338-C. Track C: we verify it with the prosecutor's office, then release what we hold for that domain. We tell the customer unless the order forbids it, and count the order separately.

How much does a domain under this procedure cost?

The procedure is included with every domain at no extra cost. A .com costs $11.99/year, the same to renew and to transfer, paid in crypto. Domain protection adds +$29 per year and per domain: registration in our company's name and a transfer lock on by default. The full grid of 43 extensions is on the price list.