Evidence & Forensic Documentation

The problem

Takedowns and legal action need solid evidence. Manual collection is slow and incomplete. Registrars and hosts expect structured, timestamped evidence before they act.

• Phishing domains that change hosting or go offline quickly
• Impersonation that needs content and DNS proof for takedown
• Portfolios where you need an audit trail for compliance
• Disputes (e.g. UDRP) that need documented history and intent

How it works

1. 1

   Capture on alert

   When a domain is flagged we capture WHOIS, DNS, IP, and content. You get a point-in-time record automatically.

2. 2

   Track over time

   We keep tracking changes so you have a timeline. That supports takedown and compliance narratives.

3. 3

   Build packages

   You request packages for registrars, registries, or legal use. We provide summaries and machine-readable data where relevant.

4. 4

   Export and retain

   Evidence can be exported and retained per your compliance and legal needs.

Frequently asked questions

• What evidence do you collect?

  We collect WHOIS, DNS records, IP and hosting info, SSL/TLS details, and archived content. The exact set depends on the domain and your plan.

• How long is evidence retained?

  Retention depends on your plan and settings. We can align with your compliance needs.

• Can evidence be used in legal proceedings?

  We design packages to be thorough and timestamped. Suitability for court depends on your jurisdiction and case; your counsel should review.

• Do you support UDRP?

  Our evidence is often used to support UDRP and similar proceedings. We do not provide legal advice; your counsel can use our documentation.

• How quickly can I get a package?

  For domains we already monitor, evidence is collected automatically. You can request a full package from the dashboard; delivery is typically within the same business day.