How to shut down a phishing operation in 48 hours