Protect people first
If a domain is being used for payment diversion, credential theft or harmful impersonation, warn likely targets through trusted channels and secure genuine accounts. Reset exposed credentials and preserve messages before deletion.
Record the technical picture
Capture the domain, URLs, DNS records, certificate information, email headers, registrar and hosting indicators. Infrastructure can change rapidly, so record dates and the tools or sources used.
Separate the legal and abuse grounds
Trademark or passing-off concerns, copyright, fraud, privacy, security abuse and contractual platform violations may support different channels. Use the strongest accurate ground for each recipient.
Coordinate reports
Registrar, registry, host, email provider, payment provider, browser-security service, search engine and social platform may each control a different layer. Avoid inconsistent statements and keep submission records.
Plan for recurrence
Monitor variant domains, strengthen authentication, document official channels and review brand registrations. A one-time suspension does not prevent a new domain from appearing.
Working checklist
- Full website and message captures
- Domain and DNS records
- Email headers and payment details
- Genuine brand and rights evidence
- List of affected users
- Channel-by-channel report log
- Law-enforcement assessment
- Variant-domain monitoring plan