What was found
Check source, date, relevance and supporting observations. Distinguish a suspicious match from validated abuse. An inconclusive finding can be the correct outcome.
From a lookalike domain to a response decision.
Step through a fictional example: spot a similar domain, review the evidence and decide whether to request a website takedown.
Synthetic workflow illustration
Meridian and all domains below are fictional. This is not a live alert, a customer result or a product screenshot. The example explains responsibilities and decisions; it makes no detection or removal-time claim.
Case illustrationObservation
IntelFinder monitoring
A similar domain is observed.
- Brand domain
- meridian.example
- Observed domain
- meridian-support.example
- Evidence state
- Name similarity only
The domain resembles the protected brand. That makes it worth reviewing, but it does not establish that the site is malicious or that anyone has been harmed.
The next question
What does the website show, and what evidence connects it to misuse of the brand?
What a useful case should make clear.
Understand the evidence
and who acts next.
In a case walkthrough, we explain what the finding shows, what your team needs to review and how the evidence can support your team’s response.
Who can request action
Confirm who can request action, who reviews the case and which manual steps or exceptions remain with the customer, partner or product workflow.
What happened next
A provider reply, an observed offline page and a successful removal attributable to a specific action are different facts. Keep them distinct.
What would a useful result look like for you?
Discuss the evidence you need and the response work your team currently performs.