How to prove how long a scam or clone website stayed online

Why the duration matters, not just the existence

In most scam and clone-site matters, nobody disputes that the site existed. The fight is about how long it ran and what happened while it ran. The period is often the fact that moves money or liability.

• Fraud recovery: a longer live period widens the window in which other victims paid, and helps tie payments and ads to the same operation.
• Trademark and passing-off claims: how long the infringing use ran is part of how the prejudice and the infringer's profits are argued.
• Domain disputes: a dated record of the content shows what the domain was used for, which is central to bad faith under the UDRP.
• Hosting and platform liability: under the Digital Services Act, what matters is whether the content stayed up after the provider was notified.

Each of these needs more than one picture. It needs a start, a series of points in between and, ideally, an end.

What one capture proves, and what it cannot

A capture sealed with a qualified eIDAS timestamp proves that the captured data existed at the time in the timestamp and has not changed since. Under Article 41(2) eIDAS that date and that integrity are presumed, and Article 41(3) makes the qualified timestamp recognised in every member state.

It does not prove when the site went online, how long it stayed, or that the content is true. One sealed capture is one point on a timeline. The rest of the timeline has to be built from other evidence and from more captures.

Pinning down the start: four traces worth collecting

You will rarely have a capture from day one. The start is usually reconstructed from traces that third parties recorded, and each should be captured itself, because these records can also change.

• Domain registration data (RDAP or WHOIS): the creation date of the domain. It shows when the name was registered, not when the shop went live.
• Certificate Transparency logs: public logs of TLS certificates. The first certificate issued for the domain often marks when the site was being prepared.
• Web archive snapshots: the earliest archived copy, if any. Useful as an indication, but made by a third party under its own method.
• Ads, posts and victim reports: the start date shown in an ad library, the first social media post linking to the site, the earliest complaint or payment.

Our server captures record RDAP/WHOIS data, DNS answers from three public resolvers and the TLS certificate chain with every proof, so the network side of the start is sealed together with the page.

Proving it stayed online: a sealed series

The middle of the timeline is where most cases are weak. Someone captured the site once, then again three weeks later, and the other side argues it was offline in between. A scheduled series closes that gap.

• Daily checks for active scams and clones that drive traffic or take payments.
• Weekly checks for slower matters, such as a copycat shop you are building a trademark case against.
• A manual capture on top of the schedule whenever something happens: a new payment page, a new ad, a price change.

Each check is its own sealed proof, so the record becomes a list of dated points rather than a story. A schedule is not continuous monitoring: changes that appear and disappear between two checks are not recorded, so pick the interval to fit the risk.

After notice: proving the site was still live

Under Article 6(1) of the Digital Services Act, a hosting provider keeps its liability exemption only if it acts expeditiously once it has actual knowledge of illegal content. Article 16(3) says a sufficiently precise notice gives rise to that knowledge.

So capture the notice itself (the form confirmation or e-mail), then keep the series running. A sealed check showing the page still live days after a precise notice is a far stronger fact than a statement that it was.

Mirrors, clones and domain hopping

Scam operators rarely run one domain. When one is blocked, the same shop appears under a new name, often with the same template, payment page or contact details.

• Put each known domain under its own monitor, including the payment or checkout page, not just the homepage.
• Capture what links the clones: identical page text, the same bank details or wallet, the same tracking ID or the same hosting IP.
• When a new mirror appears, capture it at once and add it to the series, so the case file shows one operation, not a list of unrelated sites.

Proving the end

The end of the period matters as much as the start: it shows when the harm stopped and whether a takedown worked. Capture the error page, the registrar's suspension page or the empty response when it happens.

A server capture of the error or suspension page also records the DNS answers and domain data, so you can show at a sealed point in time where the name pointed once the shop was gone.

Building the timeline exhibit

Judges, banks and panels do not want forty evidence packages. They want one table they can follow and the packages behind it.

• One row per event: date and time, what it shows, the source and the proof identifier.
• Start traces first (registration, first certificate, first archive copy, first ad), then the sealed series, then notices, then the end.
• The SHA-256 of each evidence package next to its row, so anyone can match the file to the table.
• One short methodology note: tools used, schedule, who captured what.
• The verification route: how the other side can check every package offline with open-source tooling.

In our dashboard you can group all proofs of one matter in a case folder and export the whole case as one ZIP with an index CSV, which is a ready start for that table.

Which tool for which step

Three products cover the workflow, and most teams combine them.

• Website Monitoring for the series: scheduled daily or weekly checks, each a proof with a qualified eIDAS timestamp, and an e-mail when the page changes. Business 99 EUR per month with 10 monitors, Monitoring 50 at 399 EUR and Monitoring 100 at 599 EUR, all excl. VAT.
• Forensic Browser for the journey: a test purchase from product page to checkout, logged-in seller pages or a video ad, captured as one sealed session. Annual licences from 290 EUR excl. VAT.
• Assisted Capture when the first capture cannot wait: our operator captures the URLs for you, Rush within 60 minutes guaranteed for 249 EUR excl. VAT, Single from 49 EUR within 90 minutes.

Server captures are public by default. For a sensitive investigation, unpublish the proofs in the dashboard so the operator cannot find them.

FAQ

Sources

• Regulation (EU) No 910/2014 (eIDAS), Article 41
• Regulation (EU) 2022/2065 (Digital Services Act), Articles 6 and 16
• Directive 2004/48/EC on the enforcement of intellectual property rights, Article 13 (damages)
• WIPO Jurisprudential Overview 3.0 (UDRP, bad faith)
• RFC 6962: Certificate Transparency
• RFC 9083: JSON Responses for the Registration Data Access Protocol (RDAP)
• Council of Europe: Guidelines on electronic evidence in civil and administrative proceedings