Lookalike Domain Toolkit: Abuse Reports, Registrar Demands, and UDRP and URS Outlines

How to use this toolkit

Copy the paper you need, replace every [BRACKETED] item, and delete what doesn't fit. Don't send anything you haven't checked against your evidence: a false statement can create liability under 15 U.S.C. § 1114(2)(D)(iv), and overstatement costs credibility with the analyst you need. Send from a mailbox you know is clean. Keep a copy of each sent item, plus any response, in the evidence folder.

For the legal reasoning, read Lookalike Domains and Typosquatting: Phishing, Invoice Fraud, and the Legal Tools That Take Them Down. For the order of operations, use Taking Down a Lookalike Domain in Days: A Practical Guide and tick off tasks on the Lookalike Domain Response Checklist: A Practical Checklist.

Contents

1. Triage and incident sheet

Purpose: a one-page record that sets priorities. Owner: incident lead. Timing: minute zero; update throughout.

INCIDENT NO. ____   OPENED (date/time/zone): ________   LEAD: ________

A. MONEY     Payment pending? Y/N   Sent? Y/N   Amount: ____  Date/time: ____
             Originating bank/acct: ______  Beneficiary name: ______
             Beneficiary acct/bank: ______  Reference (IMAD/OMAD/UETR): ______
             Sent by: employee using own login / unknown (possible intruder)
B. PATTERN   Inbound (imitates vendor/colleague) / Outbound (imitates us) / Both
             Imitated party: ______   Mark owner: ______  Authorization on file? Y/N
C. DOMAIN    Fake name: ______   Registrable domain: ______  xn-- form: ______
             Real name: ______   Difference: ______
             Malicious / Compromised / Unknown (reason): ______
D. MAILBOX   Evidence of intrusion? Rules/forwarding/sign-ins: ______
E. OWNERS    Money: ____  Systems: ____  Domain: ____  Comms: ____  Legal: ____
F. CLOCKS    Bank called: ____  IC3 filed: ____  Hold issued: ____
             Registrar report: ____  Insurer notice: ____  Counterparty told: ____

Drafting notes. The "sent by" line matters because Article 4A treats an order your employee was tricked into sending differently from one an intruder sent. See UCC §§ 4A-202 to 4A-204, and compare Patco Construction Co. v. People's United Bank, 684 F.3d 197 (1st Cir. 2012), with Studco Building Systems US, LLC v. 1st Advantage Federal Credit Union, 133 F.4th 264 (4th Cir. 2025). Mark the sheet "prepared at direction of counsel" only if that's true.

2. Bank call script

Purpose: get a recall moving and a record made. Owner: controller or CFO. Timing: first call after discovery.

"This is [NAME], [TITLE] at [COMPANY], account ending [XXXX]. I'm reporting a fraudulent wire and asking for an immediate recall. On [DATE] at [TIME] we sent $[AMOUNT] to [BENEFICIARY NAME], account [NUMBER], at [BANK], reference [REF]. We were deceived by an impostor using a false domain. Please:

1. Open a fraud case and give me the number and your direct line.
2. Send the recall now, and call the beneficiary bank's fraud team directly.
3. Tell me what you need from me today to do that, including any hold harmless or indemnity letter.
4. Tell me whether any other payment from this account has gone to that beneficiary or bank.
5. Tell me what you heard back, and when I should call again."

Drafting notes. The FBI's domestic Kill Chain summary tells victims to ask for a recall or reversal and a hold harmless letter or letter of indemnity. Do not describe the wire as unauthorized unless you've confirmed that it was, because that word has a defined role in Article 4A.

3. Wire recall letter

Purpose: written confirmation of the request and authority for the bank to act. Owner: CFO signs; counsel reviews if available without delay. Timing: within the first hour; don't wait for a perfect draft.

[COMPANY LETTERHEAD]                                     [DATE, TIME, ZONE]
BY EMAIL AND HAND: [BANK NAME], Attn: [WIRE ROOM/FRAUD DEPT., CONTACT]
Re: URGENT recall of funds transfer. Case no. [___]

We confirm our call at [TIME] with [NAME]. We request that you immediately
recall, cancel, or reverse this funds transfer, and that you ask the
beneficiary's bank to hold and return the funds:

  Originator / account:       [___]
  Date and time:              [___]
  Amount and currency:        [___]
  Beneficiary as named:       [___]
  Beneficiary account:        [___]
  Beneficiary bank/routing:   [___]
  Intermediary bank, if any:  [___]
  IMAD/OMAD or UETR:          [___]

Basis. The payment order was issued by mistake after [COMPANY] received
fraudulent instructions from a person impersonating [IMITATED PARTY] using
the domain [FAKE DOMAIN]. The named beneficiary is not entitled to the funds.

The matter has been reported to the FBI's Internet Crime Complaint Center,
complaint ID [___]. Please give us the reply of each bank in the chain and
any information on onward transfers that you can lawfully share.

[COMPANY] will provide a reasonable indemnity on request. Send your form to
[NAME, PHONE]. Please preserve all records relating to this transfer.
Nothing in this letter waives any right or claim.

[SIGNATURE, TITLE, DIRECT PHONE]

Drafting notes. Under UCC § 4A-211(c)(2), after the beneficiary's bank accepts, cancellation requires that bank's agreement or a funds-transfer system rule and is available only in limited cases, including a sender's mistake that resulted in an order to a beneficiary not entitled to receive payment. That's why the letter uses those words. Section 4A-211(f) allows a receiving bank to recover its losses and expenses from the sender, which explains the indemnity. Read any indemnity before signing, and look for language that releases the bank.

4. Fraud notice to the beneficiary bank

Purpose: put a person at the receiving bank on specific notice. Owner: counsel, or CFO if no counsel yet. Timing: as soon as you have the bank's name; repeat to its legal department.

[DATE, TIME]   VIA [FRAUD DESK EMAIL / FAX / COURIER]
[BENEFICIARY BANK], Attn: Fraud Department / BSA Officer / Legal

Re: Proceeds of fraud in account [NUMBER], titled or described as [NAME]

On [DATE] a wire or ACH credit of $[AMOUNT], reference [REF], from [ORIGINATOR]
at [ORIGINATING BANK], was directed to the account above. That payment was
induced by fraud. The originator intended to pay [TRUE PAYEE], which has told
us it does not own or control this account. [Add if true: The name in the
payment order does not match the account holder.]

We ask that you (1) place an immediate hold on remaining funds, (2) review
further activity, (3) contact [ORIGINATING BANK FRAUD CONTACT] about return of
funds, and (4) preserve account-opening, signature, device, and transaction
records. A complaint was filed with the FBI's IC3, ID [___]. Please contact
[NAME, PHONE] today.

Drafting notes. Under Studco, a beneficiary's bank without actual knowledge at the time of deposit may rely on the number under UCC § 4A-207(b), and it has no duty to adopt routines to catch mismatches. This letter doesn't change that for a deposit already made. It does create specific knowledge going forward. Approved Mortgage Corp. v. Truist Bank, 106 F.4th 582 (7th Cir. 2024), held that a negligence claim about post-credit conduct was not preempted, while leaving the duty question open, and that Section 207 claims needed privity. Avoid accusing the account holder of knowing participation. In Studco, she was herself duped.

5. Law enforcement referral outline and IC3 data sheet

Purpose: give agents what they need in one reading. Owner: CFO or counsel. Timing: IC3 within the first hour; field office the same day for significant losses.

IC3 data sheet. Gather before you open the form:

• Your business, contact, and bank details.
• Each transaction: date, amount, sending and receiving bank, routing or SWIFT code, account numbers, beneficiary name, reference.
• Any second-hop information.
• Fraudster's emails, domains, IP addresses from headers, phone numbers, websites.
• Narrative: 10 lines at most.

Referral outline for FBI or Secret Service field office.

1. Headline. "$[AMOUNT] business email compromise; funds sent [DATE]; recall pending; IC3 ID [___]."
2. Status of funds. Banks in the chain, recall status, frozen amounts.
3. Timeline. First fraudulent contact, each payment, discovery.
4. Infrastructure. Domains with registrars, creation dates, MX and host, certificates, mailbox-rule findings.
5. Offense map. 18 U.S.C. § 1343 (wire fraud), § 1028A, § 1030 if there was intrusion, § 1956.
6. Requests. Help with the freeze; use of the Registrar Accreditation Agreement's law enforcement channel; preservation requests to providers; contact person for victim notifications.
7. What we will provide. Evidence set with hash values; a witness; loss documentation.

Drafting notes. The 2025 IC3 report describes international requests running through FinCEN's Rapid Response Team and legal attachés, so flag foreign banks prominently. Section 3.18.3 of the RAA requires a 24/7 contact for law enforcement and similar authorities, with well-founded reports reviewed within 24 hours. Victims have rights to notice and to be heard under 18 U.S.C. § 3771 once a case is charged, and mandatory restitution under § 3663A may follow conviction. Keep a loss ledger from day one. Have counsel consider privilege before handing over a forensic report.

6. Evidence capture log

Purpose: let someone later swear to what each item is. Owner: IT or forensic vendor. Timing: before any takedown report.

Header worksheet. For each message, note: From; Reply-To; Return-Path; each Received host and IP; Authentication-Results (SPF, DKIM, DMARC); DKIM d= value; Message-ID; date. Write one sentence on how it differs from an authentic message.

Drafting notes. Fed. R. Evid. 901 requires evidence sufficient to support a finding that an item is what you claim. The hash column supports a certification under Rule 902(14). A passing SPF or DKIM result on the fake domain doesn't help the sender; it only proves the mail came from that domain, which you can use to show that the same actor controlled the mail and the name. For forms of the certification, see Business Records Toolkit: Rule 902 Certifications, Foundation Scripts, and Hearsay Response Charts.

7. Registrar abuse report

Purpose: give the registrar actionable evidence of DNS Abuse. Owner: security lead or counsel. Timing: after evidence capture, within the first day. Send to: the abuse address in the RDAP record or on the registrar's home page.

Subject: PHISHING/IMPERSONATION: [FAKE DOMAIN]: active fraud, action requested

To the [REGISTRAR] abuse team (IANA ID [___]):

I report [FAKE DOMAIN], sponsored by [REGISTRAR], as maliciously registered and
in active use for phishing and impersonation of [IMITATED COMPANY].

WHO I AM: [NAME, TITLE, COMPANY]. [We own the mark and domain [REAL DOMAIN]. /
We are authorized by [OWNER], see Att. 1. / We received the fraudulent mail.]

WHY THE NAME IS MALICIOUS:
- Created [DATE], [N] days before the first fraudulent message.
- Differs from [REAL DOMAIN], in use since [YEAR], by [DIFFERENCE].
- No legitimate use that we could find. [State what you checked.]

WHAT IT IS DOING:
- [Mailbox] [ADDRESS] sent the attached message(s) on [DATES], posing as [PERSON]
  of [IMITATED COMPANY] and asking for [bank details/payment/credentials].
- MX record: [VALUE]. Web host: [VALUE]. Fake login at [FULL URL, DEFANGED].

HARM: [$AMOUNT lost/at risk.] [FBI IC3 ID ___.] The activity is continuing.

REQUESTED ACTION: Under your obligations in RAA section 3.18 and your terms of
service, please (1) suspend the name (for example, clientHold) with a transfer
lock, (2) review other names in the same account or registered in the same
pattern, (3) preserve account, payment, and access records for law enforcement,
and (4) confirm receipt and your decision to [EMAIL/PHONE].

ATTACHED: Original email(s) with full headers; screenshot with URL; RDAP output;
DNS output; [authorization]; [registration certificate].

The statements above are accurate to the best of my knowledge.
[NAME, TITLE, PHONE]

Variant A: payment fraud with no web page

Replace the "what it is doing" section:

WHAT IT IS DOING: The name has no website but has live mail records [VALUE].
Its mailbox(es) impersonate a named employee of [IMITATED COMPANY] to solicit
bank account details and redirect payments under a false identity. The domain
exists to deceive recipients into revealing and acting on sensitive financial
information. Attached is a message showing this.

Variant B: compromised site

We believe [DOMAIN] is a legitimate site that has been compromised: it has been
registered since [YEAR] and has real content at [URL]. The phishing page is at
[FULL URL]. We ask that you notify the registrant and web host and set a short
deadline for removal, and suspend only if that fails. We are also reporting
this to the host.

Drafting notes. Section 3.18.2 of the RAA requires a registrar with actionable evidence to "promptly take the appropriate mitigation action(s)." The February 2024 advisory identifies clientHold and a transfer lock as options for clear phishing, and notification as the likelier course for a compromised domain. "DNS Abuse" covers phishing, not fraud generally, so Variant A tracks the words of the phishing description in SAC115. Don't assert phishing if the facts don't fit. Registrars are protected for disabling a name under a reasonable policy by § 1114(2)(D)(i) and (ii). A court order isn't required. The "same pattern" request anticipates the associated-domain work in ICANN's DNS Abuse Mitigation policy process, which isn't yet a contract duty. If the registrar asks for a trademark registration, attach it, but make clear this is a phishing report and not a trademark claim.

8. Hosting notice, with DMCA rider

Purpose: remove content, or get the host to end service, independent of the domain. Owner: security lead or counsel. Timing: same day as Paper 7.

Subject: Abuse report: phishing site on your network at [IP]: [FULL URL, DEFANGED]

The URL above, on [IP] in your network [ASN], impersonates [COMPANY] to collect
[credentials/payment information] from [targets]. It violates your acceptable
use policy. It is not authorized by [COMPANY]. Screenshot and page source are
attached. Please remove the content, suspend the account, preserve account and
access logs, and confirm by reply. Contact: [NAME, PHONE].

DMCA rider, for copied pages or logos:

Copyright notice under 17 U.S.C. 512(c)(3):
(i) Signature: [/NAME/], authorized to act for the copyright owner.
(ii) Work: [DESCRIPTION; URL OF ORIGINAL; REGISTRATION NO., IF ANY].
(iii) Infringing material: [FULL URL(S)].
(iv) Contact: [ADDRESS, PHONE, EMAIL].
(v) I have a good faith belief that the use is not authorized by the copyright
owner, its agent, or the law.
(vi) The information in this notice is accurate, and under penalty of perjury,
I am authorized to act on behalf of the owner of the exclusive right allegedly
infringed.

Drafting notes. The elements come from 17 U.S.C. § 512(c)(3). Section 512(f) penalizes knowing material misrepresentation, and Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016), requires considering fair use. A pixel-perfect phishing clone raises no serious fair-use issue, but a parody or commentary might. Logos may be trademark rather than copyright matters. A host that ignores specific notices has exposure risks under Louis Vuitton Malletier, S.A. v. Akanoc Solutions, Inc., 658 F.3d 936 (9th Cir. 2011), a point to hold for a second letter. More in Copyright Enforcement and DMCA Toolkit: A Roadmap and Research Guide.

9. Mail provider report

Purpose: close the fraudster's mailbox. Owner: security lead. Timing: same day; often the fastest win.

Subject: BEC/impersonation from your service: [ADDRESS] at [FAKE DOMAIN]

[FAKE DOMAIN] uses your mail service (MX: [VALUE]). The account [ADDRESS] is
sending email impersonating [PERSON] of [COMPANY] to redirect payments. Original
message with full headers attached, showing your service in the Received path.
Please disable the account and tenant, and preserve sign-in and account records
pending legal process.

Drafting notes. Attach the raw message. Providers will generally not give you the content of the account in response to this report or a civil subpoena, because 18 U.S.C. § 2702 restricts content disclosure. Ask only to preserve. See Paper 22 for records you can seek.

10. CDN report

Purpose: remove the proxy, or learn the origin host. Owner: security lead. Timing: same day, if DNS shows a CDN.

Subject: Phishing via your network: [FAKE DOMAIN]

[FAKE DOMAIN] resolves to your network and serves a page impersonating [COMPANY]
at [FULL URL]. Evidence attached. Please (1) identify the origin host to us, or
forward this report to it and to your customer, (2) stop proxying or display a
phishing warning under your terms, and (3) preserve account records. We are
reporting to the registrar [NAME] today.

Drafting notes. Expect a reply saying the CDN isn't the host, and use whatever origin information it gives. Should you obtain an order later, Arista Records, LLC v. Tkach, 122 F. Supp. 3d 32 (S.D.N.Y. 2015), held that a CDN with knowledge of a TRO was in active concert when its name servers and optimization connected users to an evasive site. An abuse report isn't an order, so leave that case for later correspondence.

11. Registry escalation and registrar demand letter

Purpose: move a stalled report by showing a record and a next step. Owner: counsel. Timing: 24 to 72 hours after the first report, as the facts warrant.

Registry escalation

Subject: Referral: DNS Abuse in .[TLD]: [FAKE DOMAIN], registrar [NAME] not yet responsive

[REGISTRY OPERATOR] abuse team: We reported [FAKE DOMAIN] to [REGISTRAR] on [DATE,
TIME] (copy attached). The name remains active and [is sending fraudulent mail].
Under Specification 6, Section 4 of your Registry Agreement, please review the
attached evidence and refer the name to the registrar with this evidence, or take
direct action as you consider appropriate. Please confirm.

Registrar demand letter

[LAW FIRM LETTERHEAD]                                                [DATE]
VIA EMAIL: [ABUSE AND LEGAL CONTACTS]

Re: [FAKE DOMAIN]: request for immediate mitigation; prior report of [DATE]

We represent [CLIENT], owner of [MARK] (U.S. Reg. No. [___]) and [REAL DOMAIN].
On [DATE] [CLIENT] reported the name above with [describe evidence]. You
acknowledged on [DATE] / have not acknowledged that report. The name remains in
use: [describe, with date of latest activity].

Section 3.18 of your Accreditation Agreement requires reasonable and prompt
steps to investigate, and prompt mitigation on actionable evidence. We ask that
by [TIME, DATE] you suspend the name, place a transfer lock, and preserve
records. A registrar that disables a name under a reasonable policy has the
protection of 15 U.S.C. 1114(2)(D).

If you require anything further, tell us specifically what it is. Absent
action, [CLIENT] will file with ICANN Contractual Compliance and consider other
remedies, including seeking an order that would be served on you.

[SIGNATURE]

Drafting notes. Keep the tone cooperative. A registrar's promises run to ICANN, and Register.com, Inc. v. Verio, Inc., 356 F.3d 393 (2d Cir. 2004), steers third parties to ICANN's process, so don't threaten to sue on the RAA. Damages against a registrar for registering or maintaining a name require bad faith intent to profit under § 1114(2)(D)(iii), and contributory cybersquatting isn't available under Petroliam Nasional Berhad v. GoDaddy.com, Inc., 737 F.3d 546 (9th Cir. 2013). Asking for a transfer to your client here is usually pointless because registrars won't do it without a UDRP result or order. The registry language tracks the base Registry Agreement amendment.

12. ICANN compliance complaint outline

Purpose: invoke ICANN's enforcement. Owner: counsel. Timing: after a reasonable time for the registrar or registry to respond. Where: ICANN Contractual Compliance, form "Abuse/DNS Abuse (Registrar)" or "DNS Abuse (Registry That Operates the TLD)."

1. Domains. List gTLD names only. Don't include ccTLDs.
2. How the name is used for abuse. Two or three sentences with the type of DNS Abuse named.
3. Evidence of abuse. Phishing email or screenshot with full URL.
4. Your prior report. Copy, date, and all later communications. Any evidence the registrar requested, and that you supplied it or why not.
5. Authority. If you're acting for the impersonated company, attach authorization.
6. Why the response fell short. Be specific. For instance: "Acknowledged on [DATE]; no investigation reported in [N] days while mail continued on [DATES]."
7. Relief. Confirmation of investigation and mitigation.

Drafting notes. These items come from ICANN's complaint guide. ICANN reports a high volume of invalid complaints, so keep to scope. ICANN's report through 5 August 2026 notes that in about 21 percent of resolved cases the contracted party found no actionable evidence and explained why, so show your evidence was adequate. Expect weeks, not hours, and use it as a record and a pressure point.

13. Staff notice

Purpose: stop further loss. Owner: executive sponsor. Timing: hours one to eight, via a trusted channel.

Subject: Fraud alert: do not act on payment changes from [FAKE DOMAIN]

We have seen fraudulent emails from addresses resembling [IMITATED COMPANY],
including [DEFANGED DOMAIN]. Until further notice:
- Do not change any payee's bank details without calling the number in our
  master file. Do not use a number from an email or invoice.
- If you've received anything from this address, do not reply or click. Forward
  it as an attachment to [PERSON/ADDRESS].
- If you have paid or changed anything recently and aren't sure, tell [PERSON] now.
  No one is in trouble for raising a concern.
- Please don't discuss this outside this group. Refer outside questions to [PERSON].

Drafting notes. The last bullet keeps your factual record clean. The "no one is in trouble" line encourages early reports, which is the point. Discussions of fault should go through counsel, since they'll be sought in discovery in any best-position fight.

14. Counterparty call script and preservation letter

Purpose: warn the other side, gather facts, and avoid admissions. Owner: CFO calls; counsel sends the letter. Timing: same day.

Call script. "We've received fraudulent payment instructions from an address imitating your company: [ADDRESS]. We've reported it to our bank and the FBI. Your mail system may be affected, so please have IT check for unusual rules and sign-ins. Could you send written authorization for us to report the domain, or tell us you'll do it? Who should we talk to? We'll have our lawyers talk about the rest."

Re: Fraudulent instructions: request to preserve

On [DATE] we received email from [ADDRESS], not an address we believe you control,
containing altered payment details. [Facts, without characterization.] We have
reported this to law enforcement. Please preserve mailbox contents, sign-in and
audit logs, mailbox rules, security alerts, and communications about this matter
for [NAMED USERS], and suspend routine deletion. We will do the same. We suggest
counsel speak this week about exchanging technical findings and a standstill.
This letter is not a statement of position on any party's rights or obligations.

Drafting notes. The call is itself protective. Bile v. RREMC, LLC, 2016 WL 4487864 (E.D. Va. Aug. 24, 2016), discussed in Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., 759 F. App'x 348 (6th Cir. 2018), put the loss on the party that knew of a diversion attempt and said nothing. Preservation duties attach when litigation is reasonably foreseeable; see Fed. R. Civ. P. 37(e).

15. Customer warning

Purpose: protect customers and limit reputational harm. Owner: communications with counsel. Timing: same day in an outbound attack; also post on your website.

Subject: Security notice: fake [COMPANY] invoices and websites

Criminals are sending messages that imitate [COMPANY]. They use addresses and
websites that look like ours, such as [DEFANGED FAKE DOMAIN]. Our only domain for
email and billing is [REAL DOMAIN].

What to do:
- Do not pay or change bank details based on these messages.
- [COMPANY] will not change our bank details by email. To check any request, call
  us at [NUMBER FROM YOUR CONTRACT/WEBSITE].
- If you've already responded or paid, call your bank immediately and ask it to
  recall the payment, then file a report at ic3.gov. Then call us.
- Forward suspicious messages as attachments to [REPORTING ADDRESS].

We've reported the fake sites and are working with providers to remove them.

Drafting notes. Don't say "our systems were not affected" until you know. Don't name a suspect. If forensic work shows customer data was exposed, a separate notice may be required under state law; see Data Breach and Incident Response Toolkit: From Detection to Notification. A clear, early warning may also help in any later comparison of who was best placed to prevent a customer's loss.

16. Insurer notice

Purpose: satisfy notice conditions and preserve all coverage arguments. Owner: counsel or broker. Timing: within 72 hours; check policy terms.

Re: Notice of loss and circumstances. Policy nos. [CRIME], [CYBER], [E&O/OTHER]
Insured: [___]. Discovered: [DATE, TIME].

The Insured gives notice of a loss of approximately $[___] from a funds transfer
on [DATE], induced by fraudulent electronic communications from a person
impersonating [___] using the domain [___]. Recovery efforts are underway (bank
case [___]; IC3 ID [___]). The Insured tenders under all potentially applicable
coverage, including Computer Fraud, Funds Transfer Fraud, Fraudulent Instruction
or Social Engineering, and breach response. Please identify all forms, deadlines,
and any required consents and panel vendors. The Insured reserves all rights.
This description is preliminary and may be supplemented.

Drafting notes. Don't narrow the description. Coverage may turn on whether the email was a "direct" cause and whether a fact was "spoofing" of your system or a message from an outside domain. Compare American Tooling Center, Inc. v. Travelers Casualty & Surety Co., 895 F.3d 455 (6th Cir. 2018), Medidata Solutions Inc. v. Federal Insurance Co., 729 F. App'x 117 (2d Cir. 2018), and Ernst & Haas Management Co. v. Hiscox, Inc., 23 F.4th 1195 (9th Cir. 2022), with Apache Corp. v. Great American Insurance Co., 662 F. App'x 252 (5th Cir. 2016). Get consent before settling with a counterparty.

17. Forum decision matrix

Purpose: record why you chose a forum. Owner: counsel. Timing: day three onward.

Score each row for your matter.

For the wider comparison, see Domain Name Dispute Forum Selection Checklist: A Practical Checklist.

Drafting notes. Lamparello v. Falwell, 420 F.3d 309 (4th Cir. 2005), is the caution on critics.

18. URS complaint outline

Purpose: suspend a name quickly in a covered TLD. Owner: counsel. Timing: day three onward; file through an ICANN-approved provider listed at icann.org/urs.

1. Parties and contact details. Complainant and representative; registrant as shown; registrar.
2. Domain name(s). Fifteen or more names by the same registrant triggers a refundable response fee.
3. Mark. Word mark, registration number, jurisdiction, goods or services; proof of current use, by a Trademark Clearinghouse-validated declaration and specimen, or submitted directly.
4. Ground one. Identical or confusingly similar: "[FAKE DOMAIN] differs from [MARK] only by [DIFFERENCE]."
5. Ground two. No legitimate right or interest: no authorization, not known by the name, no bona fide use; used to impersonate.
6. Ground three. Registered and used in bad faith: intentionally attracting users for commercial gain by confusion about source, sponsorship, or affiliation.
7. Free-text box, up to 500 words. Use it for the fraud story:

Respondent registered [FAKE DOMAIN] on [DATE], [N] days before using it to send
email impersonating Complainant's [TITLE] to Complainant's customers and to
request payment to an account unconnected with Complainant (Annex [_]). The name
has no other use. No conceivable good-faith use would explain a name differing
from Complainant's mark by [DIFFERENCE], paired with messages copying
Complainant's signature block. There is no genuine issue of material fact.

8. Attestation. Good-faith basis and no improper purpose.

Drafting notes. All of this is in the URS Procedure: §§ 1.2.6 and 1.2.7 (content), 4.1 (registry lock within 24 hours; the name keeps resolving), 5.1 (14 calendar days to respond), 8.2 and 8.3 (clear and convincing evidence; no genuine issue of material fact), 10 (suspension for the rest of the term and optional one-year extension; no other remedy), and 11 (abusive complaints can result in a bar). ICANN's FAQ puts the cost at $300 to $500, but confirm with the provider. The URS's bad-faith factor is about attracting users to a "web site or other on-line location," so for an email-only fraud explain why the mailbox is an online location or why the factor list is non-exclusive. If the facts have any complication, use the UDRP. For deeper forms, see the Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses.

19. UDRP complaint outline

Purpose: transfer the name. Owner: counsel. Timing: day three onward; a lock arrives in days, and decision in about two months.

1. Rule 3(b) formalities. Parties, panel election, respondent (or "unidentified" if redacted, as the Rules allow), registrar, marks, remedy, mutual jurisdiction, certification.
2. Element one: identical or confusingly similar. Show the mark (registration or common-law evidence). Then show the comparison, ignoring the TLD.
3. Element two: no rights or legitimate interests. Make a prima facie case: no authorization; not commonly known by the name; fraud confers no rights.
4. Element three: registered and used in bad faith.
   • Registration. Timing relative to the mark's fame and the fraud; targeting shown by the signature block and contents.
   • Use. The fraudulent messages, any fake site.
   • Concealment. False data or proxy.
5. Remedy. Transfer to Complainant.
6. Annexes. Registration certificates; declaration from a person with knowledge; emails with full headers, with unnecessary bank data redacted; DNS and RDAP output; victim statement, if available; prior abuse reports.

Model bad-faith paragraph:

The disputed domain name has been used to send email in which Respondent posed
as [NAMED EMPLOYEE] of Complainant, reproduced Complainant's signature block, and
directed [RECIPIENT] to send payment to a bank account unconnected with
Complainant (Annex [_]). Panels treat use of a domain name for phishing and
similar fraud as manifest evidence of bad faith, and recognize that a domain name
may be used in bad faith even when no website resolves. See WIPO Overview 3.1,
sections 3.1.4 and 3.4. Registration [N] days before these messages, in a form
differing from Complainant's domain by a single [character/word], supports the
inference that the name was registered for this purpose.

Drafting notes. Elements: UDRP Policy ¶ 4(a). Process: UDRP Rules ¶¶ 3(b)(v) (unidentified respondent), 4(b) (lock and data within two business days), 5(a) (20 days to respond), 15(b) (14 days to decide), and 15(e) (bad faith complaints). Typo and combination law: WIPO Overview 3.1 §§ 1.7 to 1.9, 1.11. Cost: WIPO's schedule lists $1,500 for one to five names with one panelist. For inbound victims, the mark owner must be the complainant. Word limits come from each provider's supplemental rules. For the full checklist, see Filing a UDRP Domain Name Complaint: A Practical Checklist, and for longer forms the Domain Name Toolkit: UDRP Complaints, ACPA Pleadings, and Portfolio Management.

20. TRO package outline and proposed order language

Purpose: court-ordered disruption when other tools fail or scale demands it. Owner: litigation counsel. Timing: before delay undermines urgency.

Complaint counts.

1. Cybersquatting, 15 U.S.C. § 1125(d): mark, distinctiveness at registration, similarity (Shields v. Zuccarini, 254 F.3d 476 (3d Cir. 2001)), each relevant factor in § 1125(d)(1)(B)(i), and profit (Coca-Cola Co. v. Purdy, 382 F.3d 774 (8th Cir. 2004)).
2. Infringement and false designation, §§ 1114 and 1125(a).
3. If facts support, and even without a mark where there was an intrusion (Microsoft's complaint in No. 1:21-cv-822 (E.D. Va.) pleaded no trademark count): § 1030, § 2701, RICO under § 1964(c), state claims, and Cal. Bus. & Prof. Code § 22948.3.
4. Prayer: injunction, transfer under § 1125(d)(1)(C), statutory damages up to $100,000 per name under § 1117(d), fees under § 1117(a).

Motion papers.

• Brief addressing the elements in Winter v. NRDC, 555 U.S. 7 (2008), and the presumption in 15 U.S.C. § 1116(a).
• Business declaration: mark, use, how fraud works, victims.
• Technical declaration: domains, DNS, headers, why notice permits flight.
• Counsel's certification.
• Proposed order and alternative service request.

Counsel's certification, Rule 65(b)(1)(B).

I certify that [Plaintiff] has [describe notice efforts, or: has not given notice]
because the registrant concealed its identity behind [PROXY] and gave [false]
contact information, and because, as [TECHNICAL DECLARANT] explains, the operator
of these domains can within minutes change registrars, name servers, and mail
providers on learning of this action. Notice would likely cause the injury the
order is meant to prevent. Plaintiff will serve this motion and any order
immediately on execution of the order.

Proposed order, operative paragraphs.

1. Defendants, their officers, agents, servants, employees, attorneys, and all
persons in active concert or participation with them who receive actual notice of
this Order are restrained from using the domain names in Appendix A, or any name
confusingly similar to [MARK], and from impersonating Plaintiff or its personnel.

2. Within [24 hours] of service of this Order, the registrars and registries
identified in Appendix A shall (a) disable the listed domain names by placing them
on [serverHold or clientHold] so that they do not resolve, (b) lock them against
transfer or modification except on further order, and (c) preserve records of the
registration, account, access, and payment information relating to them.

3. On notice of this Order, any provider of name server, content delivery, hosting,
or email services shall not provide or continue such services to Defendants for
the domain names in Appendix A or any domain to which they move the activity.

4. Plaintiff may serve Rule 45 subpoenas for non-content records identifying
Defendants on the providers in Appendix B, returnable in [__] days.

5. Pursuant to Fed. R. Civ. P. 4(f)(3), [where applicable,] Plaintiff may serve
process by [email to addresses used by Defendants, and via the contacts in
registration records and on a website notice].

6. Security is set at $[___]. This Order expires at [TIME] on [DATE, NOT MORE THAN
14 DAYS OUT]. A hearing on a preliminary injunction is set for [DATE].

Drafting notes. Courts are careful about ex parte relief (Granny Goose Foods, Inc. v. Brotherhood of Teamsters, 415 U.S. 423 (1974)), so show specific facts. Paragraph 3 draws on Tkach and is written to avoid the objection in Blockowicz v. Williams, 630 F.3d 563 (7th Cir. 2010), that mere inaction isn't active concert, though some judges may trim it, and foreign providers may not comply. Direct orders to named registries or registrars sometimes rest on Rule 65(d)(2) or the All Writs Act, 28 U.S.C. § 1651; check what your judge has signed. Alternative service: Rio Properties, Inc. v. Rio International Interlink, 284 F.3d 1007 (9th Cir. 2002), and watch for the Hague Service Convention under Water Splash, Inc. v. Menon, 581 U.S. 271 (2017). An asset freeze requires a traceable equitable claim given Grupo Mexicano de Desarrollo, S.A. v. Alliance Bond Fund, Inc., 527 U.S. 308 (1999). Further evidence forms are in the Trademark Injunction Toolkit: Evidence, Declarations, Proposed Orders, and Delay Chronologies. For keeping track of the 14-day clock, see the Federal Deadline Toolkit: Calendaring Protocols, Extension Motions, and Excusable Neglect Declarations.

21. In rem complaint outline

Purpose: reach the name when the registrant can't be reached. Owner: litigation counsel. Timing: after suspension is secured, or filed with an emergency motion.

1. Caption. [PLAINTIFF] v. [DOMAIN NAME], in the district of the registrar, registry, or other authority. Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002).
2. Jurisdiction. § 1125(d)(2); situs under (d)(2)(C); due process under Harrods Ltd. v. Sixty Internet Domain Names, 302 F.3d 214 (4th Cir. 2002).
3. Mark. Registered at the PTO or protected under § 1125(a) or (c).
4. Violation. Bad-faith facts or, per Harrods, infringement or dilution in appropriate circumstances.
5. Why in rem. Either no in personam jurisdiction, or due diligence failed after notice to the postal and email addresses given to the registrar, together with publication as directed.
6. Remedy. Forfeiture, cancellation, or transfer. No damages.
7. Motion for publication order. Propose email to the listed addresses plus a posting.

Pre-suit notice:

To the registrant of [DOMAIN], at the postal and email addresses provided to the
registrar: [PLAINTIFF] alleges that this domain name violates its rights in [MARK]
under 15 U.S.C. 1125(d). [PLAINTIFF] intends to proceed in rem under 15 U.S.C.
1125(d)(2) in the [COURT]. Contact [NAME, ADDRESS, EMAIL].

Drafting notes. Section 1125(d)(2)(D)(i) requires the registrar or registry to deposit documents establishing the court's control and to refrain from transferring, suspending, or otherwise modifying the name during the action, except on court order. A complaint sent to a registrar about to suspend can backfire, so time it. Prior authority includes Cable News Network L.P. v. CNNews.com, 162 F. Supp. 2d 484 (E.D. Va. 2001). Standard of proof: preponderance under Harrods.

22. Doe discovery motion points and subpoena rider

Purpose: identify the fraudster. Owner: litigation counsel. Timing: with or just after filing.

Motion points. Under Rule 26(d)(1) and Columbia Insurance Co. v. seescandy.com, 185 F.R.D. 573 (N.D. Cal. 1999): (1) Doe is a real person or entity who could be sued, as shown by registrations and mail traffic; (2) what you've done to find Doe; (3) the claim would survive a motion to dismiss; (4) the requested discovery can yield identifying information.

Rider for a Rule 45 subpoena.

For [DOMAIN(S)] and [ACCOUNT(S)] for the period [DATES], produce records sufficient
to show:
1. Subscriber or registrant name, addresses, phone numbers, and email addresses,
   including any underlying customer of a privacy or proxy service.
2. Account creation date and IP address.
3. Login dates, times, and IP addresses.
4. Payment method and transaction records (name, last four digits, billing address).
5. Other domains or accounts associated with the same customer, email, or payment
   instrument.
This subpoena does not seek the contents of any communication.

Drafting notes. The last line reflects 18 U.S.C. § 2702. Many providers will notify their customer before responding, and that notice can alert the target, so a preservation request comes first. Item 5 can reveal the wider campaign, and it can support joinder or a request for broader relief. Proxy services have a role that may fall outside the registrar safe harbors: Solid Host, NL v. Namecheap, Inc., 652 F. Supp. 2d 1092 (C.D. Cal. 2009).

23. Loss-allocation worksheet

Purpose: assess the fight with your trading partner. Owner: counsel, under privilege. Timing: week one; update as forensics come in.

Mark each fact and its source.

Authorities: Thomas v. Corbyn Restaurant Development Corp., No. D083655 (Cal. Ct. App. May 27, 2025); Erie Insurance Co. v. WAWGD, Inc. (D. Md. Apr. 29, 2024); Yangtze Railroad Fasteners International USA Inc. v. Ohio Valley Trackwork Inc., 2026-Ohio-1518; Arrow Truck Sales, Inc. v. Top Quality Truck & Equipment, Inc., 2015 WL 4936272 (M.D. Fla. Aug. 18, 2015); Jetcrete North America LP v. Austin Truck & Equipment, Ltd., 484 F. Supp. 3d 915 (D. Nev. 2020).

Drafting notes. This is not a math exercise. The test is usually applied by a factfinder, and Beau Townsend reversed a summary judgment for that reason. It suggested comparative apportionment if Article 3 principles are used. Compare recovery options against the bank: Studco and 218 Broadway, LLC v. J.P. Morgan Chase Bank, N.A. (S.D.N.Y. Aug. 14, 2026) show how narrow they are. Keep this worksheet out of business email.

24. Defensive registration matrix

Purpose: decide what to buy without buying the whole internet. Owner: brand owner and IT. Timing: annual review, and after any incident.

For each owned variant, publish records so it can't credibly send mail:

example-variant.com.        TXT  "v=spf1 -all"
_dmarc.example-variant.com. TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@[REALDOMAIN]"
example-variant.com.        MX   0 .     ; null MX (RFC 7505), if not receiving mail

Drafting notes. Consider whether defensive names should receive mail. Catching misdirected mail can be useful, but it brings in sensitive third-party messages. If you don't want that risk, a null MX declines mail. Check the Domain Name Toolkit for portfolio tracking, and put registry lock on the real domain. Registering a variant is not a substitute for a mark. A search through a tool such as marksy.us can show what's already registered as a trademark before you file.

25. Clause bank: payment instructions

Purpose: allocate the risk by contract so that no one has to litigate who was best placed. Owner: contracts counsel. Timing: at signing or on renewal.

A. Verification (balanced).

Changes to Payment Details. A notice changing a party's remittance details is
effective only when confirmed by a telephone call between the parties' Designated
Finance Contacts, using the numbers in Schedule [_]. Email alone is not sufficient.
Each party shall keep its Schedule [_] details current by signed notice.

B. Risk allocation (payee-friendly).

A payment sent to any account other than one identified in Schedule [_] or confirmed
under this Section does not satisfy Customer's payment obligation, regardless of the
source of the instruction.

C. Risk allocation (payor-friendly).

If a payment is misdirected because of unauthorized access to Supplier's systems or
mailboxes, and Customer followed this Section, the payment discharges Customer's
obligation to the extent of the amount paid.

D. Incident notice (mutual).

A party that learns of (i) unauthorized access to a mailbox used for this Agreement,
or (ii) an attempt to divert a payment under this Agreement, shall notify the other
party by telephone and in writing within one business day.

E. Invoice footer.

[COMPANY] will not change its bank details by email. Before paying to new details,
call your account manager at the number in your contract.

Drafting notes. Clauses A and D build in the facts that decide cases such as Thomas and Bile. Thomas treated departure from the settlement agreement's stated payee as a red flag, so a clear contract term helps whichever party relied on it. B and C are alternatives for a negotiated allocation. For vendor security terms more broadly, see Building a Vendor and Third-Party Risk Management Program. Check your bank agreement too: a wire form usually says that the bank may rely on the account number, which UCC § 4A-207(c) allows it to enforce against a customer given notice.

26. Response for a wrongly reported registrant

Purpose: restore a legitimate name fast. Owner: registrant's counsel. Timing: on notice, ideally within a day.

Re: [DOMAIN]: response to abuse report / suspension

[COMPANY] is the good-faith registrant of [DOMAIN], registered [DATE], and has used
it since [DATE] for [BUSINESS OR COMMENTARY]. We attach [formation documents,
invoices, screenshots of historical use]. The site does not imitate the complainant,
collects no credentials, and sends no solicitations in its name. We ask that you
restore service immediately and provide a copy of the report. If the report
contains knowing and material misrepresentations, 15 U.S.C. 1114(2)(D)(iv) makes
the reporter liable for resulting damages, costs, and fees, and we reserve all rights,
including an action under 15 U.S.C. 1114(2)(D)(v) to establish that our registration
and use are lawful.

Drafting notes. Section 1114(2)(D)(v) applies to names suspended, disabled, or transferred under a registrar policy. Criticism gets protection under Lamparello and Lucas Nursery & Landscaping, Inc. v. Grosse, 359 F.3d 806 (6th Cir. 2004). After a UDRP loss, paragraph 4(k) of the policy gives 10 business days to file in a court of mutual jurisdiction, and Barcelona.com, Inc. v. Excelentisimo Ayuntamiento de Barcelona, 330 F.3d 617 (4th Cir. 2003), and Sallen v. Corinthians Licenciamentos LTDA, 273 F.3d 14 (1st Cir. 2001), support that route. Separately, check that the site really is clean, because a hacked site can trigger a valid report against an innocent owner.

These forms are general starting points that need adapting to your facts, contracts, and jurisdiction before use, and they do not amount to legal advice on any particular matter.

Related Documents

Related Articles

• Lookalike Domains and Typosquatting: Phishing, Invoice Fraud, and the Legal Tools That Take Them Down: the law and technology behind these papers.
• Stolen Domain Names: How Domain Hijacking Happens and the Legal Paths to Getting One Back: when the real name is gone, and different papers apply.

Related Guides

• Taking Down a Lookalike Domain in Days: A Practical Guide: when to use each paper.

Related Checklists

• Lookalike Domain Response Checklist: A Practical Checklist: the task list that calls for these forms.
• Trademark Preliminary Injunction Checklist: A Practical Checklist: the motion requirements behind Paper 20.

Related Toolkits

• Domain Recovery Toolkit: Registrar Demands, Transfer Dispute Filings, and In Rem Complaints: the parallel set for stolen names.
• Fraud Response Toolkit: Freeze Requests, Dispute Letters, Reports, and Recovery Steps: forms for individual victims.
• Data Breach Litigation Toolkit: Privileged Investigation Protocols, Standing Motions, and Settlement Terms: where a mailbox compromise turns into a wider dispute.