Phishing Domains: Separating Registrar, Hosting and CDN Reports
Separate registrar, hosting and CDN roles in phishing incidents; plan safe evidence collection, reports and outcome checks.
What’s in this article?
Direct answer
Registrars, hosting providers and CDNs perform different functions. Reports should address the verified technical role and the behaviour actually observed. Removing content, disrupting access and transferring a domain are different outcomes. Security response and a trademark complaint may be coordinated without treating one as a substitute for the other.
Preserve evidence and reduce harm
Where a page seeks credentials or payment, follow the security incident plan. Do not submit genuine customer information as a test. Preserve the URL, time, request and safely collected records. Separate established observations from suspicions in the report.
Plan customer communications through verified official channels. Avoid unnecessary disclosure of victim addresses, message headers or payment details in public notices. Restrict access to evidence copies containing personal data.
Map the services
A registrar manages the registration relationship; hosting concerns stored content; a CDN's role depends on the service provided. A visible intermediary IP does not conclusively identify the origin or operator. Unrelated customers sharing infrastructure should not be accused by association.
Tailor each report to the provider's current reporting channel and requirements. Preserve ticket identifiers, submission times, responses and actual actions separately. An acknowledgement is not evidence that the domain was suspended or transferred. If the site moves, add a linked observation rather than erasing the original incident.
Fictional operational scenario
An imitation support site disappears and returns on a different domain. Counting the first disappearance as complete resolution would hide recurrence. Templates and contact patterns may inform monitoring, but a shared design is not conclusive proof of a common individual. Assign separate owners for security reports, domain proceedings and customer notices.
Closure checklist
- Verify the relevant providers and roles.
- Attach specific URLs and necessary evidence.
- Distinguish acknowledgements from completed actions.
- Recheck accessibility with a dated observation.
- Open a separate transfer or legal file where required.
Classify provider responses accurately
Use different statuses for acknowledgement, requests for information, reported action and an outcome that could not be verified. A page failing to load in the investigator's environment does not establish provider removal. Record the recheck time and its limitations.
Keep factual statements consistent across reports about the same incident. If a domain, date or identity allegation is corrected, update the relevant records. Indiscriminate mass reporting can affect legitimate services and distract from actual harm. Measure the suitability of the recipient and evidence rather than submission volume alone.
Questions
Does hosting removal make the brand the domain owner? No. Content services and registration control differ.
Does a CDN logo establish participation in wrongdoing? Not by itself. Assess the actual service role and evidence.
Official sources
Related guides
- Resolving Domain Name Disputes: A Decision Guide for Brand Teams
- Digital Evidence and Timelines in Domain Name Disputes
- RDAP and Redacted Registrant Data: What Can an Investigation Establish?
- Typosquatting and IDNs: Prioritising Lookalike Domains
Brand protection and monitoring
General information only. Rights, authority and current procedure require case-specific assessment. Fictional examples are not B10 client cases or claimed successes.