Disclosed herein are systems and methods for automatic takedown of counterfeit websites using API-based and/or email-based takedown. In implementations the method includes checking the domain of a Uniform Resource Locator (URL) against a database to determine if an API-based takedown can be performed for the counterfeit website. If an API-based takedown cannot be performed the system determines the email of the hosting provider hosting the counterfeit website based on the resolve Internet Protocol (IP) address and sends a takedown notification via email with evidence such as screenshots, hosting infrastructure information, website lifecycle and scan timestamp. The system checks periodically whether the counterfeit website has been taken down by the network owner. If, after a check, the website is still live, the process of takedown is repeated until the website is taken down.