Malte ZanderContents
After a takedown, a law firm needs five things: a one-page case summary, the unaltered raw data of the fake, a log with checksums, the correspondence with hosts and registrars, and proof of your rights and the damage. Hand everything over in an ordered structure with a table of contents, so the firm can assess which route is worthwhile without asking questions.
- ISO/IEC 27037 describes how digital evidence is identified, collected, acquired and preserved (ISO).
- The Berkeley Protocol sets minimum standards for collecting, preserving and verifying online information (UC Berkeley).
- Under the GDPR, processing personal data strictly necessary for the purpose of preventing fraud constitutes a legitimate interest (GDPR, Recital 47).
- Hosts in the EU must tell you their decision on a notice and the available redress options (DSA, Article 16).
What does a law firm ask after a takedown?
Always the same questions. What happened, where and when? Who is behind it, as far as can be seen? Which rights are affected? What damage has occurred? What have you already done, and with what result? A good evidence package answers these questions before they're asked. It saves you rounds of back and forth and saves the firm hours. This overview is not legal advice; it only describes what law firms typically need.
The checklist
| Component | Content | Format |
|---|---|---|
| Case summary | One page: what, where, when, who, damage, status | |
| Screenshots | Desktop and mobile, full URL, timestamp | Original files, PNG |
| Page source and archived copy | HTML, embedded files, a timestamped archive | HTML, WARC or PDF |
| Registration data | The domain's RDAP output | Raw data as text or JSON |
| DNS and hosting | Records, IP addresses, network records, CDN | Raw data with timestamps |
| Certificate | Issuer, validity, names, log entry | Certificate file and link |
| Log | Who captured what, when and with what | Table or PDF |
| Checksums | SHA-256 of every file | Text file |
| Correspondence | Reports, confirmations, decisions, ticket numbers | Emails as files, not forwarded |
| Rights | Trademark certificates, register extracts, authorizations | |
| Damage | Customer reports, affected transactions, internal effort | Anonymised where possible |
The one-page case summary
It's the most important document, because it lets the firm understand the case in five minutes. This structure works well:
Case: [short name, such as "Fake login your-brand-login.com"]
What: [phishing page, fake shop, fake verification page] imitates [brand, affected page]. It [asks for login credentials, sells goods, confirms forged certificates].
Where: [full URL], domain registered on [date] with [registrar], hosted by [host], behind [CDN, if any].
When: first tip on [date, time, time zone] from [source], online until [date or "still online"].
Who: [known details about the operator or "unknown"], linked to [earlier cases].
Damage: [number of customer reports, known losses, support effort].
Status: reported to [channels] on [date]. Result: [removed on, suspended on, open].
Question for the firm: [for example, assess a cease-and-desist letter, a domain dispute or a criminal complaint].
What belongs in the raw data?
Everything you collected during preservation, in its original state. Summaries help, but they don't replace the raw data. A law firm or an expert wants to see the RDAP response, not your transcript of it. How to make screenshots that hold up is in Screenshots as evidence, how to archive a page in Archiving fake sites before they vanish.
Why a log and checksums?
Because they carry the credibility of the evidence. The log records who created which file, when and with what. The checksum proves the file hasn't changed since. Together they form the chain of custody that the other side and a court can follow. How to do this simply is explained in Chain of custody for digital evidence.
Which correspondence belongs in it?
Every report to hosts, registrars, CDNs, platforms and browsers, each with date, recipient and ticket number, plus confirmations of receipt and decisions. Hosts in the EU must tell you their decision and the available redress options (DSA, Article 16). These messages show what you did and can matter for further steps. Save emails as files with all headers, not as forwarded messages.
And the personal data?
With judgment. Evidence often contains data about people, such as names in registration data, victims' email addresses or customer numbers. The GDPR recognises fraud prevention as a legitimate interest where the processing is strictly necessary for it (GDPR, Recital 47). So hand over only what the case needs, redact or anonymise customer data in copies and document who has access.
How do you hand over the package?
In a fixed folder structure with a table of contents:
00_case_summary.pdf with the page above.
01_evidence with screenshots, page source, archived copies and RDAP, DNS, hosting and certificate data.
02_log_and_checksums with the capture log and the checksum list.
03_correspondence with every report and answer.
04_rights with trademark certificates and authorizations.
05_damage with anonymised customer reports and effort.
Transfer the package through a protected channel, not as an open email attachment, and record the handover in the log.
How does AI Fraud Protect help?
AI Fraud Protect builds an evidence package for every case automatically, with screenshots and registration, DNS, hosting and certificate data, and keeps every report and answer with the case. When your legal team or law firm takes over, the case is fully documented. A person reviews and sends every report.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
When should I bring in a law firm?
When the same actor keeps coming back, an operator is known, customers have lost money or you want to recover a domain for good. For single phishing pages, a takedown is usually enough.
Does the fake site still need to be online to hand over evidence?
No, if you secured it before the takedown. That's exactly why evidence always comes before the report.
Are screenshots enough for a cease-and-desist letter?
The firm decides. The more complete the raw data, log and checksums, the stronger your position.
How long do we keep the package?
As long as legal steps are possible or under way. Set the period with your legal team and delete afterwards, with documentation.
Sources
UC Berkeley Human Rights Center: Berkeley Protocol on Digital Open Source Investigations
Digital Services Act, Article 16, with the official text on EUR-Lex