Question 1

WHOIS shows the registrant as "REDACTED FOR PRIVACY". Dead end?

Accepted Answer

Starting line: the residue (registrar, dates, nameservers) plus fingerprint cluster in g, archives and content identifiers usually narrows sharply, and the registrar holds the actual identity for disclosure by request or order:

Question 2

The fraudulent site has already been taken down. Have we lost the evidence?

Accepted Answer

Mostly no: registration and DNS history, certificate logs and content archives were recording all along, the registrar and host retain account records, and the payment layer retains the money's path: §8's map is the recovery plan. What take d own does cost is anything never archived: which is why on live matters capture always precedes the abuse report.

Question 3

Can we find every domain a wrongdoer operates?

Accepted Answer

Often most of them: certificate transparency, shared fingerprints, nameserver and registration patterns, and same-account disclosure from registrars map estates well: Example 1's o per at or ran to five cousins, Example 2's to two. "Every" is unprovable: findings say "the following linked domains", with the linking evidence per domain, and stay open to additions.

Question 4

An email claims to be from our client's domain. How do we prove it was not?

Accepted Answer

From the receipt evidence: the message's Authentication-Results and full headers show whether SPF/DKIM/ DMARC passed at delivery and which infrastructure actually sent it; the client's published records at the date (from DNS history) show what should have passed; and the sending domain's own §3 profile (cousin spelling, creation date, MX) usually completes the story. Where everything passed cleanly from the genuine domain, the inquiry pivots honestly to compromise or insider: guide 79 §6's fork.

Question 5

Is a Norwich Pharmacal order really available against a registrar or payment process or?

Accepted Answer

In principle yes, on the standard mixed-up-in-wrongdoing basis, and process or s are often the most productive target because payment instruments resist fabrication: the practical constraints are jurisdiction and drafting precision (exact domains, accounts, dates, in the respondent's own vocabulary). The §4 package is what persuades the court the order will actually identify someone.

Question 6

Should our client publish DMARC even if it is the victim here?

Accepted Answer

Immediately: a reject-policy DMARC record (rolled out carefully) makes the client's domain hard to spoof and generates reports of attempts: prospectively protective, and retrospectively relevant, since the absent policy at the material time is increasingly raised in loss-allocation arguments after payment frauds, as Example 1's bank correspondence shows. It is the rare remediation that is also good evidence hygiene. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Domain DNS And Hosting Records