Separate the claim from the infrastructure
A fraudulent website often makes claims, such as a company registration number, a physical address or years of trading, that can be checked independently of the site itself. Before taking any claim at face value, collect the underlying infrastructure evidence: the registrable domain, its RDAP record, DNS configuration and certificates. Infrastructure evidence does not depend on the operator's honesty, whereas page content does.
Registration and timeline
Check the domain's creation date in RDAP and compare it against the claims on the site. A retailer claiming to have operated for a decade on a domain registered a few weeks ago is a meaningful inconsistency, though not proof by itself: businesses do change domains, and some legitimate sites migrate registrars. Record the registrar, nameservers and any status codes such as clientHold or pendingDelete, which can indicate recent registrar action.
Hosting, certificates and payment flow
Identify the IP address and its network holder, and check whether the site sits behind a CDN. Search certificate transparency logs for the domain to see when HTTPS was first configured and whether other related hostnames exist, for example a separate checkout or payment subdomain that was issued its own certificate. A payment page hosted on infrastructure entirely unrelated to the rest of the claimed business is worth noting.
Document the checkout flow, payment methods offered and any redirect to a third-party processor, since these details matter for financial institutions and payment networks handling a dispute, but collect them from an isolated browsing environment.
Corroboration and preservation
Cross-check any company number, address or contact details against independent public registers rather than the site's own about page. Preserve screenshots, the original URLs, response headers and DNS/RDAP evidence with timestamps, and compute a hash of the compiled evidence so it can be produced later without dispute over whether it was altered.
- Registrable domain, creation date, registrar, status codes.
- DNS and certificate transparency evidence with timestamps.
- IP network holder and CDN/proxy identification.
- Independent verification of company numbers or addresses.
- Preserved screenshots and sealed evidence hash.