Scam Detective
Real report · 10 domains · free to read

This is the $249 report, in full.

One complete Portfolio Impersonation Audit across 10domains, published with nothing removed: one exposure score over the whole portfolio, each domain's own score and verdict at the head of its section, every documented hostname with its dated evidence and a risk rating derived in code, all 176 exhibits, and 10 takedown requests — one per domain, drafted to be sent separately.

97/100
portfolio exposure — high exposure
10
domains, each audited on its own
12
documented hostnames, each named in full
130
dated observations behind them
Read the whole reportAudit my own domains — $249

Where every line of this came from

It was assembled from our own published research, not written for this page and not produced by a sweep run today. Every hostname, every observed state, every date and every artefact below is already published free, hostname by hostname, in the corpus of 61 documented hostnames across 57 brands — 653 dated observations in total, the most recent round on 27 October 2026. Every row links back to the page carrying its own full record.

These 10 domains are not one company's portfolio. A real order covers the domains that one buyer owns and enters at checkout. To show a ten-domain document at full size without inventing a single observation, it is built from 10brands we already document — which is exactly what makes every row in it checkable against something we published independently. The SHAPE of the document is the product's: your own order would carry your own domains in the order you entered them, with the same sections in the same order.

It is the single-domain audit, once per domain. There is no deeper method and no extra research tier at the higher price — the first section here is the same report published on its own at the $29 Brand Impersonation Audit sample, unchanged. What $249 buys is the whole portfolio in one checkout and one dated file, instead of buying, running and collating 10 reports by hand.

What a paid run adds, stated plainly. When you buy, each of your domains gets a live sweep: a deterministic generator produces the lookalike and typosquat candidates for that name, every one is resolved, everything that answers is fetched with caches bypassed and graded against your own page, and each section opens with those counts. This document carries no such counts, because no such run produced it. The artefact produced end to end by the paid pipeline, with its own candidate counts, is published too: read that one here.

A rating is a function of the reading, not of the story. Two sections below rate low on a hostname that carries pages of published evidence, because the address was answering without serving a page on the date we last read it. We do not raise a rating to match a history, and we would not suggest sending a request for an address that is not serving — the request is printed for every domain because the document contains one per domain.

None of these brands commissioned this and none has paid us. The research is our own, published on the same terms as the rest of the corpus. If you are one of the brands named here and want this taken down or corrected, write to scam-detective8@mail.acoco.ai and we will act on it.

We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice.

The delivered report starts here

It is written to the buyer and we have not re-pointed a sentence of it for this page — so where a section says your own domain, it means the domain named at the head of that section.

97
exposure score / 100
Portfolio Impersonation Audit
10 domains
high exposure
most recent reading 27 October 2026 · score derived in code from what was observed

Summary

This is one Portfolio Impersonation Audit covering 10 domains: nomatic.com, kytebaby.com, glowrecipe.com, aersf.com, naturium.com, coyuchi.com, chamberlaincoffee.com, ekster.com, foursigmatic.com, diggs.pet. Each was audited on its own and the sections below are those 10 reports, in the order they were entered. Across the whole portfolio they list 12 hostnames carrying 130 dated observations between them, the most recent on 27 October 2026. A candidate name nobody has registered is counted and never listed, here exactly as in a single-domain audit.

The score above is derived in code from every listed row across all 10 domains, by the same weighting a single audit uses. Each domain's own score and verdict are stated at the head of its section, so a portfolio figure never hides which address carries the exposure.

The 10 domains in this report

Each section is a single-domain audit, unchanged. The score above is derived from every listed row across all of them; each domain's own score sits at the head of its section, so a portfolio figure never hides which address carries the exposure.

  1. nomatic.com — exposure 48/100, moderate exposure, 2 hostnames listed, most recent reading 27 October 2026
  2. kytebaby.com — exposure 26/100, moderate exposure, 2 hostnames listed, most recent reading 27 October 2026
  3. glowrecipe.com — exposure 24/100, moderate exposure, 1 hostname listed, most recent reading 27 October 2026
  4. aersf.com — exposure 24/100, moderate exposure, 1 hostname listed, most recent reading 27 October 2026
  5. naturium.com — exposure 24/100, moderate exposure, 1 hostname listed, most recent reading 27 October 2026
  6. coyuchi.com — exposure 24/100, moderate exposure, 1 hostname listed, most recent reading 20 October 2026
  7. chamberlaincoffee.com — exposure 24/100, moderate exposure, 1 hostname listed, most recent reading 27 October 2026
  8. ekster.com — exposure 24/100, moderate exposure, 1 hostname listed, most recent reading 13 August 2026
  9. foursigmatic.com — exposure 2/100, low exposure, 1 hostname listed, most recent reading 27 October 2026
  10. diggs.pet — exposure 2/100, low exposure, 1 hostname listed, most recent reading 27 October 2026

1. nomatic.com

exposure 48/100moderate exposure2 hostnames listedread 27 October 2026

This section covers nomatic.com, the domain Nomatic owns. We hold 2 hostnames documented against it in our own published corpus, carrying 24 dated observations between them, the most recent on 27 October 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

2 were “live, HTTP 200” at their most recent completed check. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

2 of them reproduce material we matched to Nomatic's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and those are the rows to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

nomaticstore.comhigh riskretail suffix

Name shape: your name with a retail word after it (nomatic.com → nomaticstore.com) — one of the patterns a sweep of your own domain generates. On 27 October 2026 we fetched nomaticstore.com with cache bypassed and the observed state was “live, HTTP 200” — it was serving when we looked. Evidence class on our own published record: Lookalike storefront — asset-level evidence. What we published for it, word for word, from the last check on which it was serving (27 October 2026): Loads 40 images directly from nomatic.com — the genuine Nomatic’s own domain — including its homepage banner, e.g. nomatic.com/cdn/shop/files/WFA_Homepage_M-1070x900_1.png. Reproduces 3 of Nomatic’s own image filenames, e.g. an-sj1-blk_outsetsoftshelljacket-hoodie_black_nomatic_11, an-rp1-olv_outsetpant_classic_olive_nomatic_04, an-jp1-ccl_outsetjogger_charcoal_nomatic_04. Reproduces 3 of Nomatic’s own product codes: AN-SJ1, AN-RP1, AN-JP1. 11 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-nomaticstore-com-legit.

Asset-level proof: Loads 40 images directly from nomatic.com — the genuine Nomatic’s own domain — including its homepage banner, e.g. nomatic.com/cdn/shop/files/WFA_Homepage_M-1070x900_1.png.

The decay history — 11 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — live, HTTP 200
  • 8 September 2026 — live, HTTP 200
  • 15 September 2026 — live, HTTP 200
  • 22 September 2026 — live, HTTP 200
  • 29 September 2026 — live, HTTP 200
  • 6 October 2026 — live, HTTP 200
  • 13 October 2026 — live, HTTP 200
  • 18 October 2026 — live, HTTP 200
  • 19 October 2026 — live, HTTP 200
  • 20 October 2026 — live, HTTP 200
observed: live, HTTP 200 when checked on 27 October 2026dated observations behind this row: 12evidence class: Lookalike storefront — asset-level evidence

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

nomatic.shophigh riskother ending

Name shape: the same name on a different ending (nomatic.com → nomatic.shop) — one of the patterns a sweep of your own domain generates. On 27 October 2026 we fetched nomatic.shop with cache bypassed and the observed state was “live, HTTP 200” — it was serving when we looked. Evidence class on our own published record: Lookalike storefront — title & copy match. What we published for it, word for word, from the last check on which it was serving (27 October 2026): Its page title reproduces Nomatic’s own wording: “Shop Travel Luggage, Backpacks and More.” 11 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-nomatic-shop-legit.

The decay history — 11 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — live, HTTP 200
  • 8 September 2026 — live, HTTP 200
  • 15 September 2026 — live, HTTP 200
  • 22 September 2026 — live, HTTP 200
  • 29 September 2026 — live, HTTP 200
  • 6 October 2026 — live, HTTP 200
  • 13 October 2026 — live, HTTP 200
  • 18 October 2026 — live, HTTP 200
  • 19 October 2026 — live, HTTP 200
  • 20 October 2026 — live, HTTP 200
observed: live, HTTP 200 when checked on 27 October 2026dated observations behind this row: 12evidence class: Lookalike storefront — title & copy match

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

The takedown request for nomatic.com, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 1 OF 10 — for nomatic.com
Send this one on its own. Each request names only the hostnames found
against nomatic.com, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — nomaticstore.com

To whom it may concern,

I am [your full name], [your role] at Nomatic, the owner of the brand
"Nomatic" and of the domain nomatic.com. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  nomaticstore.com
    Observed 27 October 2026 (cache bypassed): live, HTTP 200.
    Evidence: Loads 40 images directly from nomatic.com — the genuine Nomatic’s own domain — including its homepage banner, e.g. nomatic.com/cdn/shop/files/WFA_Homepage_M-1070x900_1.png.
    Evidence: Reproduces 3 of Nomatic’s own image filenames, e.g. an-sj1-blk_outsetsoftshelljacket-hoodie_black_nomatic_11, an-rp1-olv_outsetpant_classic_olive_nomatic_04, an-jp1-ccl_outsetjogger_charcoal_nomatic_04.
    Evidence: Reproduces 3 of Nomatic’s own product codes: AN-SJ1, AN-RP1, AN-JP1.
    Independently documented: https://scam-detective8.acoco.ai/is-nomaticstore-com-legit (checked 27 October 2026).

  nomatic.shop
    Observed 27 October 2026 (cache bypassed): live, HTTP 200.
    Evidence: Its page title reproduces Nomatic’s own wording: “Shop Travel Luggage, Backpacks and More.”
    Independently documented: https://scam-detective8.acoco.ai/is-nomatic-shop-legit (checked 27 October 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Nomatic
[Your email] · [Your telephone]
[nomatic.com]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (30)
RefHostnameWhat we readRead on
D1.A1nomaticstore.comour own cache-bypassed check of this hostname — live, HTTP 200Supports: That we observed this hostname in that state on the date stated.2026-10-27
D1.A1.1nomaticstore.comLoads 40 images directly from nomatic.com — the genuine Nomatic’s own domain — including its homepage banner, e.g. nomatic.com/cdn/shop/files/WFA_Homepage_M-1070x900_1.png.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D1.A1.2nomaticstore.comReproduces 3 of Nomatic’s own image filenames, e.g. an-sj1-blk_outsetsoftshelljacket-hoodie_black_nomatic_11, an-rp1-olv_outsetpant_classic_olive_nomatic_04, an-jp1-ccl_outsetjogger_charcoal_nomatic_04.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D1.A1.3nomaticstore.comReproduces 3 of Nomatic’s own product codes: AN-SJ1, AN-RP1, AN-JP1.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D1.A1.h1nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D1.A1.h2nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D1.A1.h3nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D1.A1.h4nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D1.A1.h5nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D1.A1.h6nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D1.A1.h7nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D1.A1.h8nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D1.A1.h9nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D1.A1.h10nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D1.A1.h11nomaticstore.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-20
D1.A1.rnomaticstore.comour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-nomaticstore-com-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—
D1.A2nomatic.shopour own cache-bypassed check of this hostname — live, HTTP 200Supports: That we observed this hostname in that state on the date stated.2026-10-27
D1.A2.1nomatic.shopIts page title reproduces Nomatic’s own wording: “Shop Travel Luggage, Backpacks and More.”Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D1.A2.h1nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D1.A2.h2nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D1.A2.h3nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D1.A2.h4nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D1.A2.h5nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D1.A2.h6nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D1.A2.h7nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D1.A2.h8nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D1.A2.h9nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D1.A2.h10nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D1.A2.h11nomatic.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-20
D1.A2.rnomatic.shopour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-nomatic-shop-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

2. kytebaby.com

exposure 26/100moderate exposure2 hostnames listedread 27 October 2026

This section covers kytebaby.com, the domain Kyte Baby owns. We hold 2 hostnames documented against it in our own published corpus, carrying 24 dated observations between them, the most recent on 27 October 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

1 was “live, HTTP 200” at its most recent completed check; 1 does not resolve. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

2 of them reproduce material we matched to Kyte Baby's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and those are the rows to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

kytebabyshop.comhigh riskretail suffix

Name shape: your name with a retail word after it (kytebaby.com → kytebabyshop.com) — one of the patterns a sweep of your own domain generates. On 27 October 2026 we fetched kytebabyshop.com with cache bypassed and the observed state was “live, HTTP 200” — it was serving when we looked. Evidence class on our own published record: Lookalike storefront — title & copy match. What we published for it, word for word, from the last check on which it was serving (27 October 2026): Its page title reproduces Kyte Baby’s own wording: “Bamboo Baby Clothes, Sleep Bags & Essentials.” 11 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-kytebabyshop-com-legit.

The decay history — 11 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — live, HTTP 200
  • 8 September 2026 — live, HTTP 200
  • 15 September 2026 — live, HTTP 200
  • 22 September 2026 — live, HTTP 200
  • 29 September 2026 — live, HTTP 200
  • 6 October 2026 — live, HTTP 200
  • 13 October 2026 — live, HTTP 200
  • 18 October 2026 — live, HTTP 200
  • 19 October 2026 — live, HTTP 200
  • 20 October 2026 — live, HTTP 200
observed: live, HTTP 200 when checked on 27 October 2026dated observations behind this row: 12evidence class: Lookalike storefront — title & copy match

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

kytebaby.shoplow riskother endingRegistry record read back — 19 October 2026

Name shape: the same name on a different ending (kytebaby.com → kytebaby.shop) — one of the patterns a sweep of your own domain generates. On 27 October 2026 the observed state of kytebaby.shop was “does not resolve” — confirmed on 2 independent DNS checks. Its observed state is unchanged from our 20 October 2026 check. It was last observed “live, HTTP 200” on 2 September 2026. Evidence class on our own published record: Lookalike storefront — title & copy match. What we published for it, word for word, from the last check on which it was serving (2 September 2026): Its page title reproduces Kyte Baby’s own trademark tagline: “The Original Bamboo Sleep Bag™.” 11 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. Reading GMO Registry, the .shop registry’s own RDAP record for kytebaby.shop on 19 October 2026, the record carried the status codes “client hold”, “client transfer prohibited” and “inactive”, last changed 2 September 2026 (2026-09-02T23:19:24Z). The registration itself is intact: created 21 June 2026, running to 21 June 2027, and not deleted. That is consistent with the “does not resolve” state we observed ourselves on 27 October 2026. clientTransferProhibited on its own is the routine lock carried by nearly every registered domain and shows nothing by itself. What we record here is the combination, read together: a hold on the registry record, no answer in the DNS on our own checks, and a registration that has neither expired nor been deleted — the name is still registered, it is simply not in the zone. We hold no filing, no correspondence and no reference number for this domain. We do not know who asked for this, or why. A registrar or registry acting after we published is not a registrar or registry acting because we published, and we claim no part in it. We did not observe why it stopped resolving, we make no claim that it was removed, suspended or taken down, and a hostname that stops resolving can be re-pointed at any time — one in this corpus already has. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-kytebaby-shop-legit.

The decay history — 11 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — live, HTTP 200
  • 8 September 2026 — does not resolve
  • 15 September 2026 — does not resolve
  • 22 September 2026 — does not resolve
  • 29 September 2026 — does not resolve
  • 6 October 2026 — does not resolve
  • 13 October 2026 — does not resolve
  • 18 October 2026 — does not resolve
  • 19 October 2026 — does not resolve
  • 20 October 2026 — does not resolve
observed: does not resolve when checked on 27 October 2026dated observations behind this row: 12evidence class: Lookalike storefront — title & copy match

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

The takedown request for kytebaby.com, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 2 OF 10 — for kytebaby.com
Send this one on its own. Each request names only the hostnames found
against kytebaby.com, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — kytebabyshop.com

To whom it may concern,

I am [your full name], [your role] at Kyte Baby, the owner of the brand
"Kyte Baby" and of the domain kytebaby.com. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  kytebabyshop.com
    Observed 27 October 2026 (cache bypassed): live, HTTP 200.
    Evidence: Its page title reproduces Kyte Baby’s own wording: “Bamboo Baby Clothes, Sleep Bags & Essentials.”
    Independently documented: https://scam-detective8.acoco.ai/is-kytebabyshop-com-legit (checked 27 October 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Kyte Baby
[Your email] · [Your telephone]
[kytebaby.com]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (29)
RefHostnameWhat we readRead on
D2.A1kytebabyshop.comour own cache-bypassed check of this hostname — live, HTTP 200Supports: That we observed this hostname in that state on the date stated.2026-10-27
D2.A1.1kytebabyshop.comIts page title reproduces Kyte Baby’s own wording: “Bamboo Baby Clothes, Sleep Bags & Essentials.”Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D2.A1.h1kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D2.A1.h2kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D2.A1.h3kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D2.A1.h4kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D2.A1.h5kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D2.A1.h6kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D2.A1.h7kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D2.A1.h8kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D2.A1.h9kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D2.A1.h10kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D2.A1.h11kytebabyshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-20
D2.A1.rkytebabyshop.comour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-kytebabyshop-com-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—
D2.A2kytebaby.shopour own cache-bypassed check of this hostname — does not resolveSupports: That we observed this hostname in that state on the date stated.2026-10-27
D2.A2.1kytebaby.shopIts page title reproduces Kyte Baby’s own trademark tagline: “The Original Bamboo Sleep Bag™.”Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-09-02
D2.A2.h1kytebaby.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D2.A2.h2kytebaby.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D2.A2.h3kytebaby.shopan earlier check of the same hostname — does not resolveSupports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D2.A2.h4kytebaby.shopan earlier check of the same hostname — does not resolveSupports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D2.A2.h5kytebaby.shopan earlier check of the same hostname — does not resolveSupports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D2.A2.h6kytebaby.shopan earlier check of the same hostname — does not resolveSupports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D2.A2.h7kytebaby.shopan earlier check of the same hostname — does not resolveSupports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D2.A2.h8kytebaby.shopan earlier check of the same hostname — does not resolveSupports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D2.A2.h9kytebaby.shopan earlier check of the same hostname — does not resolveSupports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D2.A2.h10kytebaby.shopan earlier check of the same hostname — does not resolveSupports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D2.A2.h11kytebaby.shopan earlier check of the same hostname — does not resolveSupports: A superseded observation, kept with its own date rather than deleted.2026-10-20
D2.A2.regkytebaby.shopRegistry record read back — 19 October 2026 — Reading GMO Registry, the .shop registry’s own RDAP record for kytebaby.shop on 19 October 2026, the record carried the status codes “client hold”, “client transfer prohibited” and “inactive”, last changed 2 September 2026 (2026-09-02T23:19:24Z). The registration itself is intact: created 21 June 2026, running to 21 June 2027, and not deleted. That is consistent with the “does not resolve” state we observed ourselves on 27 October 2026. clientTransferProhibited on its own is the routine lock carried by nearly every registered domain and shows nothing by itself. What we record here is the combination, read together: a hold on the registry record, no answer in the DNS on our own checks, and a registration that has neither expired nor been deleted — the name is still registered, it is simply not in the zone. We hold no filing, no correspondence and no reference number for this domain. We do not know who asked for this, or why. A registrar or registry acting after we published is not a registrar or registry acting because we published, and we claim no part in it.Supports: A dated reading of the TLD registry's own record. It is never a state, and it shows nothing about who asked for it or why.—
D2.A2.rkytebaby.shopour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-kytebaby-shop-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

3. glowrecipe.com

exposure 24/100moderate exposure1 hostname listedread 27 October 2026

This section covers glowrecipe.com, the domain Glow Recipe owns. We hold 1 hostname documented against it in our own published corpus, carrying 12 dated observations between them, the most recent on 27 October 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

1 was “live, HTTP 200” at its most recent completed check. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

1 of them reproduces material we matched to Glow Recipe's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and that is the row to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

glowrecipeshop.comhigh riskretail suffix

Name shape: your name with a retail word after it (glowrecipe.com → glowrecipeshop.com) — one of the patterns a sweep of your own domain generates. On 27 October 2026 we fetched glowrecipeshop.com with cache bypassed and the observed state was “live, HTTP 200” — it was serving when we looked. Evidence class on our own published record: Lookalike storefront — asset-level evidence. What we published for it, word for word, from the last check on which it was serving (27 October 2026): Loads 35 images directly from glowrecipe.com — the genuine Glow Recipe’s own domain — including its homepage banner, e.g. glowrecipe.com/cdn/shop/files/6_25_SUMMER_ROUTINE_REFRESH_GWP_HP_DESKTOP_1_1950x.jpg. Its page title reproduces Glow Recipe’s own tagline wording: “Clinically Effective. Fruit-Powered. Glowing Skin.” 11 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-glowrecipeshop-com-legit.

Asset-level proof: Loads 35 images directly from glowrecipe.com — the genuine Glow Recipe’s own domain — including its homepage banner, e.g. glowrecipe.com/cdn/shop/files/6_25_SUMMER_ROUTINE_REFRESH_GWP_HP_DESKTOP_1_1950x.jpg.

The decay history — 11 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — live, HTTP 200
  • 8 September 2026 — live, HTTP 200
  • 15 September 2026 — live, HTTP 200
  • 22 September 2026 — live, HTTP 200
  • 29 September 2026 — live, HTTP 200
  • 6 October 2026 — live, HTTP 200
  • 13 October 2026 — live, HTTP 200
  • 18 October 2026 — live, HTTP 200
  • 19 October 2026 — live, HTTP 200
  • 20 October 2026 — live, HTTP 200
observed: live, HTTP 200 when checked on 27 October 2026dated observations behind this row: 12evidence class: Lookalike storefront — asset-level evidence

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

The takedown request for glowrecipe.com, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 3 OF 10 — for glowrecipe.com
Send this one on its own. Each request names only the hostnames found
against glowrecipe.com, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — glowrecipeshop.com

To whom it may concern,

I am [your full name], [your role] at Glow Recipe, the owner of the brand
"Glow Recipe" and of the domain glowrecipe.com. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  glowrecipeshop.com
    Observed 27 October 2026 (cache bypassed): live, HTTP 200.
    Evidence: Loads 35 images directly from glowrecipe.com — the genuine Glow Recipe’s own domain — including its homepage banner, e.g. glowrecipe.com/cdn/shop/files/6_25_SUMMER_ROUTINE_REFRESH_GWP_HP_DESKTOP_1_1950x.jpg.
    Evidence: Its page title reproduces Glow Recipe’s own tagline wording: “Clinically Effective. Fruit-Powered. Glowing Skin.”
    Independently documented: https://scam-detective8.acoco.ai/is-glowrecipeshop-com-legit (checked 27 October 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Glow Recipe
[Your email] · [Your telephone]
[glowrecipe.com]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (15)
RefHostnameWhat we readRead on
D3.A1glowrecipeshop.comour own cache-bypassed check of this hostname — live, HTTP 200Supports: That we observed this hostname in that state on the date stated.2026-10-27
D3.A1.1glowrecipeshop.comLoads 35 images directly from glowrecipe.com — the genuine Glow Recipe’s own domain — including its homepage banner, e.g. glowrecipe.com/cdn/shop/files/6_25_SUMMER_ROUTINE_REFRESH_GWP_HP_DESKTOP_1_1950x.jpg.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D3.A1.2glowrecipeshop.comIts page title reproduces Glow Recipe’s own tagline wording: “Clinically Effective. Fruit-Powered. Glowing Skin.”Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D3.A1.h1glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D3.A1.h2glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D3.A1.h3glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D3.A1.h4glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D3.A1.h5glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D3.A1.h6glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D3.A1.h7glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D3.A1.h8glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D3.A1.h9glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D3.A1.h10glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D3.A1.h11glowrecipeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-20
D3.A1.rglowrecipeshop.comour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-glowrecipeshop-com-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

4. aersf.com

exposure 24/100moderate exposure1 hostname listedread 27 October 2026

This section covers aersf.com, the domain Aer owns. We hold 1 hostname documented against it in our own published corpus, carrying 12 dated observations between them, the most recent on 27 October 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

1 was “live, HTTP 200” at its most recent completed check. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

1 of them reproduces material we matched to Aer's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and that is the row to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

aersfshop.comhigh riskretail suffix

Name shape: your name with a retail word after it (aersf.com → aersfshop.com) — one of the patterns a sweep of your own domain generates. On 27 October 2026 we fetched aersfshop.com with cache bypassed and the observed state was “live, HTTP 200” — it was serving when we looked. Evidence class on our own published record: Lookalike storefront — asset-level evidence. What we published for it, word for word, from the last check on which it was serving (27 October 2026): Loads 80 images directly from aersf.com — the genuine Aer’s own domain — rather than hosting its own copies, e.g. aersf.com/cdn/shop/files/AER21064_1_citypackpro224l_black_34hero_760x760@2x.jpg. Reproduces 30 of Aer’s own image filenames verbatim, e.g. aer21064_1_citypackpro224l_black_34hero_760x760@2x, aer21071_1_travelpack435l_black_34hero_760x760@2x, aerl1102_carryon_black_34hero_760x760@2x. Its page title is simply “Aer” — the real brand’s name, with nothing else in it. 11 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-aersfshop-com-legit.

Asset-level proof: Loads 80 images directly from aersf.com — the genuine Aer’s own domain — rather than hosting its own copies, e.g. aersf.com/cdn/shop/files/AER21064_1_citypackpro224l_black_34hero_760x760@2x.jpg.

The decay history — 11 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — live, HTTP 200
  • 8 September 2026 — live, HTTP 200
  • 15 September 2026 — live, HTTP 200
  • 22 September 2026 — live, HTTP 200
  • 29 September 2026 — live, HTTP 200
  • 6 October 2026 — live, HTTP 200
  • 13 October 2026 — live, HTTP 200
  • 18 October 2026 — live, HTTP 200
  • 19 October 2026 — live, HTTP 200
  • 20 October 2026 — live, HTTP 200
observed: live, HTTP 200 when checked on 27 October 2026dated observations behind this row: 12evidence class: Lookalike storefront — asset-level evidence

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

The takedown request for aersf.com, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 4 OF 10 — for aersf.com
Send this one on its own. Each request names only the hostnames found
against aersf.com, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — aersfshop.com

To whom it may concern,

I am [your full name], [your role] at Aer, the owner of the brand
"Aer" and of the domain aersf.com. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  aersfshop.com
    Observed 27 October 2026 (cache bypassed): live, HTTP 200.
    Evidence: Loads 80 images directly from aersf.com — the genuine Aer’s own domain — rather than hosting its own copies, e.g. aersf.com/cdn/shop/files/AER21064_1_citypackpro224l_black_34hero_760x760@2x.jpg.
    Evidence: Reproduces 30 of Aer’s own image filenames verbatim, e.g. aer21064_1_citypackpro224l_black_34hero_760x760@2x, aer21071_1_travelpack435l_black_34hero_760x760@2x, aerl1102_carryon_black_34hero_760x760@2x.
    Evidence: Its page title is simply “Aer” — the real brand’s name, with nothing else in it.
    Independently documented: https://scam-detective8.acoco.ai/is-aersfshop-com-legit (checked 27 October 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Aer
[Your email] · [Your telephone]
[aersf.com]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (16)
RefHostnameWhat we readRead on
D4.A1aersfshop.comour own cache-bypassed check of this hostname — live, HTTP 200Supports: That we observed this hostname in that state on the date stated.2026-10-27
D4.A1.1aersfshop.comLoads 80 images directly from aersf.com — the genuine Aer’s own domain — rather than hosting its own copies, e.g. aersf.com/cdn/shop/files/AER21064_1_citypackpro224l_black_34hero_760x760@2x.jpg.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D4.A1.2aersfshop.comReproduces 30 of Aer’s own image filenames verbatim, e.g. aer21064_1_citypackpro224l_black_34hero_760x760@2x, aer21071_1_travelpack435l_black_34hero_760x760@2x, aerl1102_carryon_black_34hero_760x760@2x.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D4.A1.3aersfshop.comIts page title is simply “Aer” — the real brand’s name, with nothing else in it.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D4.A1.h1aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D4.A1.h2aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D4.A1.h3aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D4.A1.h4aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D4.A1.h5aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D4.A1.h6aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D4.A1.h7aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D4.A1.h8aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D4.A1.h9aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D4.A1.h10aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D4.A1.h11aersfshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-20
D4.A1.raersfshop.comour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-aersfshop-com-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

5. naturium.com

exposure 24/100moderate exposure1 hostname listedread 27 October 2026

This section covers naturium.com, the domain Naturium owns. We hold 1 hostname documented against it in our own published corpus, carrying 12 dated observations between them, the most recent on 27 October 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

1 was “live, HTTP 200” at its most recent completed check. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

1 of them reproduces material we matched to Naturium's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and that is the row to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

naturium.ushigh riskother ending

Name shape: the same name on a different ending (naturium.com → naturium.us) — one of the patterns a sweep of your own domain generates. On 27 October 2026 we fetched naturium.us with cache bypassed and the observed state was “live, HTTP 200” — it was serving when we looked. Evidence class on our own published record: Lookalike storefront — catalogue evidence. What we published for it, word for word, from the last check on which it was serving (27 October 2026): Reproduces 2 of Naturium’s own image filenames, e.g. natr-60140-phyto-glow-shimmer-comet-primary-capon-front-bonebkgd, natr_theenergizer_bonebkgd_front. Reproduces 2 of Naturium’s own product codes: NATR-60140, NATR-40020. Its page title reproduces Naturium’s own tagline wording: “Clinically-Effective, Luxurious Skincare & Bodycare.” 11 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-naturium-us-legit.

The decay history — 11 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — live, HTTP 200
  • 8 September 2026 — live, HTTP 200
  • 15 September 2026 — live, HTTP 200
  • 22 September 2026 — live, HTTP 200
  • 29 September 2026 — live, HTTP 200
  • 6 October 2026 — live, HTTP 200
  • 13 October 2026 — live, HTTP 200
  • 18 October 2026 — live, HTTP 200
  • 19 October 2026 — live, HTTP 200
  • 20 October 2026 — live, HTTP 200
observed: live, HTTP 200 when checked on 27 October 2026dated observations behind this row: 12evidence class: Lookalike storefront — catalogue evidence

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

The takedown request for naturium.com, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 5 OF 10 — for naturium.com
Send this one on its own. Each request names only the hostnames found
against naturium.com, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — naturium.us

To whom it may concern,

I am [your full name], [your role] at Naturium, the owner of the brand
"Naturium" and of the domain naturium.com. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  naturium.us
    Observed 27 October 2026 (cache bypassed): live, HTTP 200.
    Evidence: Reproduces 2 of Naturium’s own image filenames, e.g. natr-60140-phyto-glow-shimmer-comet-primary-capon-front-bonebkgd, natr_theenergizer_bonebkgd_front.
    Evidence: Reproduces 2 of Naturium’s own product codes: NATR-60140, NATR-40020.
    Evidence: Its page title reproduces Naturium’s own tagline wording: “Clinically-Effective, Luxurious Skincare & Bodycare.”
    Independently documented: https://scam-detective8.acoco.ai/is-naturium-us-legit (checked 27 October 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Naturium
[Your email] · [Your telephone]
[naturium.com]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (16)
RefHostnameWhat we readRead on
D5.A1naturium.usour own cache-bypassed check of this hostname — live, HTTP 200Supports: That we observed this hostname in that state on the date stated.2026-10-27
D5.A1.1naturium.usReproduces 2 of Naturium’s own image filenames, e.g. natr-60140-phyto-glow-shimmer-comet-primary-capon-front-bonebkgd, natr_theenergizer_bonebkgd_front.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D5.A1.2naturium.usReproduces 2 of Naturium’s own product codes: NATR-60140, NATR-40020.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D5.A1.3naturium.usIts page title reproduces Naturium’s own tagline wording: “Clinically-Effective, Luxurious Skincare & Bodycare.”Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D5.A1.h1naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D5.A1.h2naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D5.A1.h3naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D5.A1.h4naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D5.A1.h5naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D5.A1.h6naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D5.A1.h7naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D5.A1.h8naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D5.A1.h9naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D5.A1.h10naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D5.A1.h11naturium.usan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-20
D5.A1.rnaturium.usour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-naturium-us-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

6. coyuchi.com

exposure 24/100moderate exposure1 hostname listedread 20 October 2026

This section covers coyuchi.com, the domain Coyuchi owns. We hold 1 hostname documented against it in our own published corpus, carrying 11 dated observations between them, the most recent on 20 October 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

1 was “live, HTTP 200” at its most recent completed check. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

1 of them reproduces material we matched to Coyuchi's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and that is the row to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

coyuchi.shophigh riskother ending

Name shape: the same name on a different ending (coyuchi.com → coyuchi.shop) — one of the patterns a sweep of your own domain generates. On 20 October 2026 we fetched coyuchi.shop with cache bypassed and the observed state was “live, HTTP 200” — it was serving when we looked. Evidence class on our own published record: Lookalike storefront — title & copy match. What we published for it, word for word, from the last check on which it was serving (20 October 2026): Its page title reproduces Coyuchi’s own wording: “Organic Bedding, Organic Cotton Sheets & Organic Towels.” 10 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. not re-checked — our own check failed on 27 October 2026: The hostname resolves — confirmed on this round on two independent resolvers, both answering cleanly — and our own fetch failed on every attempt: four attempts across two schemes and two separate egress paths all failed at our own egress, and we obtained no status code from any of them. A failed connection of ours is not a status code and not a reading, so this is recorded as our own failure and never as a state of the domain. Its 20 October 2026 finding of “live, HTTP 200” and its 20 October 2026 date both stand unchanged, and nothing here is a statement about what it is serving today. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-coyuchi-shop-legit.

The decay history — 10 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — live, HTTP 200
  • 8 September 2026 — live, HTTP 200
  • 15 September 2026 — live, HTTP 200
  • 22 September 2026 — live, HTTP 200
  • 29 September 2026 — live, HTTP 200
  • 6 October 2026 — live, HTTP 200
  • 13 October 2026 — live, HTTP 200
  • 18 October 2026 — live, HTTP 200
  • 19 October 2026 — live, HTTP 200
observed: not re-checked — our own check failed on 27 October 2026 — last observed live, HTTP 200 on 20 October 2026dated observations behind this row: 11evidence class: Lookalike storefront — title & copy match

Our published record for this hostname — checked 20 October 2026, and the source every line above is quoted from.

The takedown request for coyuchi.com, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 6 OF 10 — for coyuchi.com
Send this one on its own. Each request names only the hostnames found
against coyuchi.com, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — coyuchi.shop

To whom it may concern,

I am [your full name], [your role] at Coyuchi, the owner of the brand
"Coyuchi" and of the domain coyuchi.com. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  coyuchi.shop
    Observed 20 October 2026 (cache bypassed): live, HTTP 200.
    Evidence: Its page title reproduces Coyuchi’s own wording: “Organic Bedding, Organic Cotton Sheets & Organic Towels.”
    Independently documented: https://scam-detective8.acoco.ai/is-coyuchi-shop-legit (checked 20 October 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Coyuchi
[Your email] · [Your telephone]
[coyuchi.com]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (14)
RefHostnameWhat we readRead on
D6.A1coyuchi.shopour own cache-bypassed check of this hostname — live, HTTP 200Supports: That we observed this hostname in that state on the date stated.2026-10-20
D6.A1.1coyuchi.shopIts page title reproduces Coyuchi’s own wording: “Organic Bedding, Organic Cotton Sheets & Organic Towels.”Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-20
D6.A1.h1coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D6.A1.h2coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D6.A1.h3coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D6.A1.h4coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D6.A1.h5coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D6.A1.h6coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D6.A1.h7coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D6.A1.h8coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D6.A1.h9coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D6.A1.h10coyuchi.shopan earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D6.A1.xcoyuchi.shopnot re-checked — our own check failed on 27 October 2026 — The hostname resolves — confirmed on this round on two independent resolvers, both answering cleanly — and our own fetch failed on every attempt: four attempts across two schemes and two separate egress paths all failed at our own egress, and we obtained no status code from any of them. A failed connection of ours is not a status code and not a reading, so this is recorded as our own failure and never as a state of the domain. Its 20 October 2026 finding of “live, HTTP 200” and its 20 October 2026 date both stand unchanged, and nothing here is a statement about what it is serving today.Supports: A check we attempted and did not complete. It is recorded as our own failure, and the row keeps the date of the last check that finished.—
D6.A1.rcoyuchi.shopour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-coyuchi-shop-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

7. chamberlaincoffee.com

exposure 24/100moderate exposure1 hostname listedread 27 October 2026

This section covers chamberlaincoffee.com, the domain Chamberlain Coffee owns. We hold 1 hostname documented against it in our own published corpus, carrying 10 dated observations between them, the most recent on 27 October 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

1 was “live, HTTP 200” at its most recent completed check. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

1 of them reproduces material we matched to Chamberlain Coffee's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and that is the row to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

chamberlaincoffeeshop.comhigh riskretail suffix

Name shape: your name with a retail word after it (chamberlaincoffee.com → chamberlaincoffeeshop.com) — one of the patterns a sweep of your own domain generates. On 27 October 2026 we fetched chamberlaincoffeeshop.com with cache bypassed and the observed state was “live, HTTP 200” — it was serving when we looked. Evidence class on our own published record: Lookalike storefront — title & copy match. What we published for it, word for word, from the last check on which it was serving (27 October 2026): Its page title reproduces Chamberlain Coffee’s own wording: “Discount Chamberlain Coffee - Cold Brew, Matcha & More.” 9 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-chamberlaincoffeeshop-com-legit.

The decay history — 9 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — live, HTTP 200
  • 8 September 2026 — live, HTTP 200
  • 15 September 2026 — live, HTTP 200
  • 22 September 2026 — live, HTTP 200
  • 29 September 2026 — live, HTTP 200
  • 6 October 2026 — live, HTTP 200
  • 13 October 2026 — live, HTTP 200
  • 19 October 2026 — live, HTTP 200
observed: live, HTTP 200 when checked on 27 October 2026dated observations behind this row: 10evidence class: Lookalike storefront — title & copy match

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

The takedown request for chamberlaincoffee.com, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 7 OF 10 — for chamberlaincoffee.com
Send this one on its own. Each request names only the hostnames found
against chamberlaincoffee.com, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — chamberlaincoffeeshop.com

To whom it may concern,

I am [your full name], [your role] at Chamberlain Coffee, the owner of the brand
"Chamberlain Coffee" and of the domain chamberlaincoffee.com. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  chamberlaincoffeeshop.com
    Observed 27 October 2026 (cache bypassed): live, HTTP 200.
    Evidence: Its page title reproduces Chamberlain Coffee’s own wording: “Discount Chamberlain Coffee - Cold Brew, Matcha & More.”
    Independently documented: https://scam-detective8.acoco.ai/is-chamberlaincoffeeshop-com-legit (checked 27 October 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Chamberlain Coffee
[Your email] · [Your telephone]
[chamberlaincoffee.com]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (12)
RefHostnameWhat we readRead on
D7.A1chamberlaincoffeeshop.comour own cache-bypassed check of this hostname — live, HTTP 200Supports: That we observed this hostname in that state on the date stated.2026-10-27
D7.A1.1chamberlaincoffeeshop.comIts page title reproduces Chamberlain Coffee’s own wording: “Discount Chamberlain Coffee - Cold Brew, Matcha & More.”Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-10-27
D7.A1.h1chamberlaincoffeeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D7.A1.h2chamberlaincoffeeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D7.A1.h3chamberlaincoffeeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D7.A1.h4chamberlaincoffeeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D7.A1.h5chamberlaincoffeeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D7.A1.h6chamberlaincoffeeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D7.A1.h7chamberlaincoffeeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D7.A1.h8chamberlaincoffeeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D7.A1.h9chamberlaincoffeeshop.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D7.A1.rchamberlaincoffeeshop.comour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-chamberlaincoffeeshop-com-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

8. ekster.com

exposure 24/100moderate exposure1 hostname listedread 13 August 2026

This section covers ekster.com, the domain Ekster owns. We hold 1 hostname documented against it in our own published corpus, carrying 1 dated observation between them, the most recent on 13 August 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

1 was “live, HTTP 200” at its most recent completed check. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

1 of them reproduces material we matched to Ekster's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and that is the row to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

ekstershop.comhigh riskretail suffix

Name shape: your name with a retail word after it (ekster.com → ekstershop.com) — one of the patterns a sweep of your own domain generates. On 13 August 2026 it resolved and returned HTTP 200 with cache bypassed — it was serving a live storefront when we looked. Evidence class on our own published record: Lookalike storefront — asset-level evidence. What we published for it, word for word, from the last check on which it was serving (13 August 2026): Loads at least one asset — a B-Corp badge — directly from ekster.com’s own file server: //www.ekster.com/cdn/shop/files/B-Corp-Logo-White-RGB.png. Reproduces 6 of Ekster’s own image filenames, e.g. father_sdayprobundleapple-blackinfograph01, cardholder_pro_-_midnight_blue_infograph_01_9b48e5da-8a11-428f-bb40-4f4c73a843fb, d_r_passport_holder_-_onyx_infograph_01_no_logo. not re-checked — our own check failed on 27 October 2026: Our own fetch failed again — the TENTH consecutive sweep on which we have obtained no HTTP status for this hostname. It resolves in DNS, confirmed again on this round on both independent resolvers, and the failure is on the HTTP leg at our own egress: every https attempt ended in the same transport failure during the handshake and every http attempt timed out with nothing received. A closed connection is not a status code. We have learned nothing about this hostname since 13 August 2026 and its 13 August 2026 finding and date stand unchanged. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-ekstershop-com-legit.

Asset-level proof: Loads at least one asset — a B-Corp badge — directly from ekster.com’s own file server: //www.ekster.com/cdn/shop/files/B-Corp-Logo-White-RGB.png.

observed: not re-checked — our own check failed on 27 October 2026 — last observed live, HTTP 200 on 13 August 2026dated observations behind this row: 1evidence class: Lookalike storefront — asset-level evidence

Our published record for this hostname — checked 13 August 2026, and the source every line above is quoted from.

The takedown request for ekster.com, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 8 OF 10 — for ekster.com
Send this one on its own. Each request names only the hostnames found
against ekster.com, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — ekstershop.com

To whom it may concern,

I am [your full name], [your role] at Ekster, the owner of the brand
"Ekster" and of the domain ekster.com. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  ekstershop.com
    Observed 13 August 2026 (cache bypassed): live, HTTP 200.
    Evidence: Loads at least one asset — a B-Corp badge — directly from ekster.com’s own file server: //www.ekster.com/cdn/shop/files/B-Corp-Logo-White-RGB.png.
    Evidence: Reproduces 6 of Ekster’s own image filenames, e.g. father_sdayprobundleapple-blackinfograph01, cardholder_pro_-_midnight_blue_infograph_01_9b48e5da-8a11-428f-bb40-4f4c73a843fb, d_r_passport_holder_-_onyx_infograph_01_no_logo.
    Independently documented: https://scam-detective8.acoco.ai/is-ekstershop-com-legit (checked 13 August 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Ekster
[Your email] · [Your telephone]
[ekster.com]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (5)
RefHostnameWhat we readRead on
D8.A1ekstershop.comour own cache-bypassed check of this hostname — live, HTTP 200Supports: That we observed this hostname in that state on the date stated.2026-08-13
D8.A1.1ekstershop.comLoads at least one asset — a B-Corp badge — directly from ekster.com’s own file server: //www.ekster.com/cdn/shop/files/B-Corp-Logo-White-RGB.png.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-13
D8.A1.2ekstershop.comReproduces 6 of Ekster’s own image filenames, e.g. father_sdayprobundleapple-blackinfograph01, cardholder_pro_-_midnight_blue_infograph_01_9b48e5da-8a11-428f-bb40-4f4c73a843fb, d_r_passport_holder_-_onyx_infograph_01_no_logo.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-13
D8.A1.xekstershop.comnot re-checked — our own check failed on 27 October 2026 — Our own fetch failed again — the TENTH consecutive sweep on which we have obtained no HTTP status for this hostname. It resolves in DNS, confirmed again on this round on both independent resolvers, and the failure is on the HTTP leg at our own egress: every https attempt ended in the same transport failure during the handshake and every http attempt timed out with nothing received. A closed connection is not a status code. We have learned nothing about this hostname since 13 August 2026 and its 13 August 2026 finding and date stand unchanged.Supports: A check we attempted and did not complete. It is recorded as our own failure, and the row keeps the date of the last check that finished.—
D8.A1.rekstershop.comour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-ekstershop-com-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

9. foursigmatic.com

exposure 2/100low exposure1 hostname listedread 27 October 2026

This section covers foursigmatic.com, the domain Four Sigmatic owns. We hold 1 hostname documented against it in our own published corpus, carrying 12 dated observations between them, the most recent on 27 October 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

1 resolves and answers without serving the page. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

1 of them reproduces material we matched to Four Sigmatic's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and that is the row to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

foursigtics.comlow riskname variant

Name shape: a close variant of your name — a plural, or the dot dropped after www (foursigmatic.com → foursigtics.com) — one of the patterns a sweep of your own domain generates. On 27 October 2026 the observed state of foursigtics.com was “resolves but not serving — HTTP 522” — it still resolves, and it did not serve the storefront. Its observed state is unchanged from our 20 October 2026 check. It was last observed live, HTTP 200 on 17 August 2026. Evidence class on our own published record: Lookalike storefront — asset-level evidence. What we published for it, word for word, from the last check on which it was serving (17 August 2026): Four images on its homepage load from us.foursigmatic.com — the genuine Four Sigmatic store’s own domain. The page serves the genuine brand’s own hosted files, which is asset-level evidence. us.foursigmatic.com/cdn/shop/files/Group_46562_1.png?v=1757339492 us.foursigmatic.com/cdn/shop/files/coffee-beans-background-free-png_c7f5d7fb-f33a-407e-ad68-1ba42cdb33ab.png?v=1743097849 — used twice on the page. us.foursigmatic.com/cdn/shop/files/816897020195_Think_Organic_Coffee_with_Lions_Mane_Chaga_Mushrooms_Ground_Render_Front_19a5977f-9ebc-464e-9631-1cb358aecb0f.png?v=1743097854 The /cdn/shop/files/ path and the ?v= cache-busting stamps are a Shopify asset path, and the version stamps are the ones the genuine store generated. On the same page the product photographs load from foursigtics.com/wp-content/uploads/2026/02/… — the suspect’s own server. The four images pointing back at the real brand were decorative: background artwork in one marketing section. Its footer reads “Copyright © 2026 Four Sigmatic”. Discounts in the 65–70% band: ground coffee marked $20 down to $6, and protein marked $50 down to $15 — both exactly 70% off. A mushroom-coffee storefront carrying a slide for “JBuds Open Wireless Open-Ear Headphones” — a product the brand does not sell. The support address published on the page is support@ its own domain — writing to it reaches whoever runs the page, not the brand being copied. 11 earlier dated observations are on this record, the oldest “live, HTTP 200” on 17 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. A server answering 403 or 404 is not a takedown: enforcement means a registry status code (clientHold or serverHold) read back off the domain’s record, and we have read none for this hostname. We record only the state we observed, on the day we observed it. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-foursigtics-com-legit.

Asset-level proof: Four images on its homepage load from us.foursigmatic.com — the genuine Four Sigmatic store’s own domain. The page serves the genuine brand’s own hosted files, which is asset-level evidence.

The decay history — 11 earlier dated observations
  • 17 August 2026 — live, HTTP 200
  • 2 September 2026 — resolves but not serving — HTTP 403
  • 8 September 2026 — resolves but not serving — HTTP 403
  • 15 September 2026 — resolves but not serving — HTTP 403
  • 22 September 2026 — resolves but not serving — HTTP 403
  • 29 September 2026 — resolves but not serving — HTTP 403
  • 6 October 2026 — resolves but not serving — HTTP 522
  • 13 October 2026 — resolves but not serving — HTTP 522
  • 18 October 2026 — resolves but not serving — HTTP 522
  • 19 October 2026 — resolves but not serving — HTTP 522
  • 20 October 2026 — resolves but not serving — HTTP 522
observed: resolves but not serving — HTTP 522, when checked on 27 October 2026dated observations behind this row: 12evidence class: Lookalike storefront — asset-level evidence

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

The takedown request for foursigmatic.com, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 9 OF 10 — for foursigmatic.com
Send this one on its own. Each request names only the hostnames found
against foursigmatic.com, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — foursigtics.com

To whom it may concern,

I am [your full name], [your role] at Four Sigmatic, the owner of the brand
"Four Sigmatic" and of the domain foursigmatic.com. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  foursigtics.com
    Observed 27 October 2026 (cache bypassed): resolves but not serving — HTTP 522.
    Evidence: Four images on its homepage load from us.foursigmatic.com — the genuine Four Sigmatic store’s own domain. The page serves the genuine brand’s own hosted files, which is asset-level evidence.
    Evidence: us.foursigmatic.com/cdn/shop/files/Group_46562_1.png?v=1757339492
    Evidence: us.foursigmatic.com/cdn/shop/files/coffee-beans-background-free-png_c7f5d7fb-f33a-407e-ad68-1ba42cdb33ab.png?v=1743097849 — used twice on the page.
    Evidence: us.foursigmatic.com/cdn/shop/files/816897020195_Think_Organic_Coffee_with_Lions_Mane_Chaga_Mushrooms_Ground_Render_Front_19a5977f-9ebc-464e-9631-1cb358aecb0f.png?v=1743097854
    Evidence: The /cdn/shop/files/ path and the ?v= cache-busting stamps are a Shopify asset path, and the version stamps are the ones the genuine store generated.
    Evidence: On the same page the product photographs load from foursigtics.com/wp-content/uploads/2026/02/… — the suspect’s own server. The four images pointing back at the real brand were decorative: background artwork in one marketing section.
    Evidence: Its footer reads “Copyright © 2026 Four Sigmatic”.
    Evidence: Discounts in the 65–70% band: ground coffee marked $20 down to $6, and protein marked $50 down to $15 — both exactly 70% off.
    Evidence: A mushroom-coffee storefront carrying a slide for “JBuds Open Wireless Open-Ear Headphones” — a product the brand does not sell.
    Evidence: The support address published on the page is support@ its own domain — writing to it reaches whoever runs the page, not the brand being copied.
    Independently documented: https://scam-detective8.acoco.ai/is-foursigtics-com-legit (checked 27 October 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Four Sigmatic
[Your email] · [Your telephone]
[foursigmatic.com]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (23)
RefHostnameWhat we readRead on
D9.A1foursigtics.comour own cache-bypassed check of this hostname — resolves but not serving — HTTP 522Supports: That we observed this hostname in that state on the date stated.2026-10-27
D9.A1.1foursigtics.comFour images on its homepage load from us.foursigmatic.com — the genuine Four Sigmatic store’s own domain. The page serves the genuine brand’s own hosted files, which is asset-level evidence.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.2foursigtics.comus.foursigmatic.com/cdn/shop/files/Group_46562_1.png?v=1757339492Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.3foursigtics.comus.foursigmatic.com/cdn/shop/files/coffee-beans-background-free-png_c7f5d7fb-f33a-407e-ad68-1ba42cdb33ab.png?v=1743097849 — used twice on the page.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.4foursigtics.comus.foursigmatic.com/cdn/shop/files/816897020195_Think_Organic_Coffee_with_Lions_Mane_Chaga_Mushrooms_Ground_Render_Front_19a5977f-9ebc-464e-9631-1cb358aecb0f.png?v=1743097854Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.5foursigtics.comThe /cdn/shop/files/ path and the ?v= cache-busting stamps are a Shopify asset path, and the version stamps are the ones the genuine store generated.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.6foursigtics.comOn the same page the product photographs load from foursigtics.com/wp-content/uploads/2026/02/… — the suspect’s own server. The four images pointing back at the real brand were decorative: background artwork in one marketing section.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.7foursigtics.comIts footer reads “Copyright © 2026 Four Sigmatic”.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.8foursigtics.comDiscounts in the 65–70% band: ground coffee marked $20 down to $6, and protein marked $50 down to $15 — both exactly 70% off.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.9foursigtics.comA mushroom-coffee storefront carrying a slide for “JBuds Open Wireless Open-Ear Headphones” — a product the brand does not sell.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.10foursigtics.comThe support address published on the page is support@ its own domain — writing to it reaches whoever runs the page, not the brand being copied.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-17
D9.A1.h1foursigtics.coman earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-17
D9.A1.h2foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 403Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D9.A1.h3foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 403Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D9.A1.h4foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 403Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D9.A1.h5foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 403Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D9.A1.h6foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 403Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D9.A1.h7foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 522Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D9.A1.h8foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 522Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D9.A1.h9foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 522Supports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D9.A1.h10foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 522Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D9.A1.h11foursigtics.coman earlier check of the same hostname — resolves but not serving — HTTP 522Supports: A superseded observation, kept with its own date rather than deleted.2026-10-20
D9.A1.rfoursigtics.comour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-foursigtics-com-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

10. diggs.pet

exposure 2/100low exposure1 hostname listedread 27 October 2026

This section covers diggs.pet, the domain Diggs owns. We hold 1 hostname documented against it in our own published corpus, carrying 12 dated observations between them, the most recent on 27 October 2026. Every one of them is listed below with the state we observed, the date we observed it, the artefacts we published for it and a risk rating derived in code from the reading alone.

1 resolves and answers without serving the page. A hostname's state can change on any day, in either direction — a row in this corpus has already gone dark and come back — so each line below is a record of what was observed on its own date and is not a statement about what that address is serving today.

1 of them reproduces material we matched to Diggs's own site — its hosted files, its image filenames, its catalogue handles or product codes, or its title wording — and that is the row to chase first. The artefact sentences are quoted exactly as we published them, and each belongs to the date it was observed.

What happens next is yours to do. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice. Questions about anything in this report: scam-detective8@mail.acoco.ai.

diggs.livelow riskother ending

Name shape: the same name on a different ending (diggs.pet → diggs.live) — one of the patterns a sweep of your own domain generates. On 27 October 2026 the observed state of diggs.live was “resolves but not serving — HTTP 404” — it still resolves, and it did not serve the storefront. Its observed state is unchanged from our 20 October 2026 check. It was last observed live, HTTP 200 on 13 August 2026. Evidence class on our own published record: Lookalike storefront — catalogue evidence. What we published for it, word for word, from the last check on which it was serving (13 August 2026): Reproduces 32 of Diggs’s own image filenames verbatim, e.g. screenshot_2026-07-09_at_8.37.05_pm, full-width_image, people-magazine. Reproduces 6 of Diggs’s catalogue product handles, e.g. /products/evolv, /products/revol-collapsible-dog-crate, /products/evolv-accessories-bundle. Its page title reproduces Diggs’s own wording almost exactly: “Diggs® | Designed for dogs, made for homes like yours.” 11 earlier dated observations are on this record, the oldest “live, HTTP 200” on 13 August 2026. Each is kept with its own date; none is deleted when a later check disagrees with it. A server answering 403 or 404 is not a takedown: enforcement means a registry status code (clientHold or serverHold) read back off the domain’s record, and we have read none for this hostname. We record only the state we observed, on the day we observed it. Published in full, with its whole history, at https://scam-detective8.acoco.ai/is-diggs-live-legit.

The decay history — 11 earlier dated observations
  • 13 August 2026 — live, HTTP 200
  • 2 September 2026 — resolves but not serving — HTTP 404
  • 8 September 2026 — resolves but not serving — HTTP 404
  • 15 September 2026 — resolves but not serving — HTTP 404
  • 22 September 2026 — resolves but not serving — HTTP 404
  • 29 September 2026 — resolves but not serving — HTTP 404
  • 6 October 2026 — resolves but not serving — HTTP 404
  • 13 October 2026 — resolves but not serving — HTTP 404
  • 18 October 2026 — resolves but not serving — HTTP 404
  • 19 October 2026 — resolves but not serving — HTTP 404
  • 20 October 2026 — resolves but not serving — HTTP 404
observed: resolves but not serving — HTTP 404, when checked on 27 October 2026dated observations behind this row: 12evidence class: Lookalike storefront — catalogue evidence

Our published record for this hostname — checked 27 October 2026, and the source every line above is quoted from.

The takedown request for diggs.pet, as delivered

Drafted for the brand owner to send. We do not file it, and we name no registrar or host in it — we did not look either up on this tier, and we do not guess.

=================================================================
REQUEST 10 OF 10 — for diggs.pet
Send this one on its own. Each request names only the hostnames found
against diggs.pet, so the desk you send it to sees only what it can act on.
=================================================================
HOW TO USE THIS: send one copy per desk. The domain's registrar and the hosting provider are two different
recipients and each wants its own request. We do not name either here — we did not look them up, and we do not
guess. The three lookups that find them are published, free, at https://scam-detective8.acoco.ai/someone-cloned-my-store.
Confirm your own trademark position before you send this; we do not advise on it.

---

To: [Abuse desk — registrar, or hosting provider, for the domain named below]
Subject: Trademark impersonation / abuse report — diggs.live

To whom it may concern,

I am [your full name], [your role] at Diggs, the owner of the brand
"Diggs" and of the domain diggs.pet. [State your trademark registration
number and jurisdiction here, or the basis of your unregistered rights.]

I am reporting the following domain(s), which impersonate that brand:

  diggs.live
    Observed 27 October 2026 (cache bypassed): resolves but not serving — HTTP 404.
    Evidence: Reproduces 32 of Diggs’s own image filenames verbatim, e.g. screenshot_2026-07-09_at_8.37.05_pm, full-width_image, people-magazine.
    Evidence: Reproduces 6 of Diggs’s catalogue product handles, e.g. /products/evolv, /products/revol-collapsible-dog-crate, /products/evolv-accessories-bundle.
    Evidence: Its page title reproduces Diggs’s own wording almost exactly: “Diggs® | Designed for dogs, made for homes like yours.”
    Independently documented: https://scam-detective8.acoco.ai/is-diggs-live-legit (checked 27 October 2026).

The use of our brand at these addresses is not authorised by us and is likely to mislead our customers into
believing they are dealing with us.

I request that you take the action available to you under your own abuse policy — suspension of the domain, or
removal of the infringing content — and confirm in writing what action you have taken and when.

I have a good-faith belief that the use described above is not authorised by the trademark owner, its agent or
the law, and the information in this notice is accurate to the best of my knowledge.

[Your name]
[Your role], Diggs
[Your email] · [Your telephone]
[diggs.pet]

---

Attachments to include: the exhibit list from your audit (each row carries the date it was observed), and a
screenshot or saved copy of each page you are reporting, taken by you at the time of sending.
The dated exhibits for this domain (16)
RefHostnameWhat we readRead on
D10.A1diggs.liveour own cache-bypassed check of this hostname — resolves but not serving — HTTP 404Supports: That we observed this hostname in that state on the date stated.2026-10-27
D10.A1.1diggs.liveReproduces 32 of Diggs’s own image filenames verbatim, e.g. screenshot_2026-07-09_at_8.37.05_pm, full-width_image, people-magazine.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-13
D10.A1.2diggs.liveReproduces 6 of Diggs’s catalogue product handles, e.g. /products/evolv, /products/revol-collapsible-dog-crate, /products/evolv-accessories-bundle.Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-13
D10.A1.3diggs.liveIts page title reproduces Diggs’s own wording almost exactly: “Diggs® | Designed for dogs, made for homes like yours.”Supports: That this page reproduced the brand's own material, read off its own markup on the last date we observed it serving.2026-08-13
D10.A1.h1diggs.livean earlier check of the same hostname — live, HTTP 200Supports: A superseded observation, kept with its own date rather than deleted.2026-08-13
D10.A1.h2diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-09-02
D10.A1.h3diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-09-08
D10.A1.h4diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-09-15
D10.A1.h5diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-09-22
D10.A1.h6diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-09-29
D10.A1.h7diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-10-06
D10.A1.h8diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-10-13
D10.A1.h9diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-10-18
D10.A1.h10diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-10-19
D10.A1.h11diggs.livean earlier check of the same hostname — resolves but not serving — HTTP 404Supports: A superseded observation, kept with its own date rather than deleted.2026-10-20
D10.A1.rdiggs.liveour own published record for this hostname, with its full dated history: https://scam-detective8.acoco.ai/is-diggs-live-legitSupports: That every line of this row is published independently of this document, and can be checked against it.—

Scope, stated on the document itself

Every reading in this document was taken on the date printed beside it, the most recent of them on 27 October 2026, and each is published independently on its own page. It is a point-in-time record, not monitoring, and not legal advice. This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform. We name no registrar, hosting provider, network or certificate authority, and we make no assertion about anyone's identity or intent. A hostname's state can change at any time after the date beside it. Every domain in this portfolio was audited separately and each section states the dates its own readings were taken; a date on one section says nothing about another.

These are not sentences written for this page. They are the scope limits from our own claims register, reproduced word for word, and they bind every surface of this site — including the one you are reading.

  • Every report is a point-in-time audit of publicly observable information, dated to the day the reads were taken. A hostname's state can change at any time after that date.
  • No continuous monitoring, on any tier. There is no real-time feed, no API and no alerting, and nothing is re-checked after the report is delivered.
  • No takedown execution, on any tier: we never file. We assemble the evidence and draft the request; the buyer sends it.
  • We never contact the registrant, and we do not contact a registrar, host or platform on a customer's behalf.
  • No outcome and no timeline is promised. Whether anything is suspended is the registrar's, host's or platform's decision alone.
  • No legal representation, ever. This is the boundary that did NOT move and must never be softened. We are not a law firm.
  • No fund recovery.
  • No legal proceedings, and no advice on the merits of a trademark position.
  • We make no assertion about any registrant's intent or criminality

Quoted from growth/approved-claims.md §13b, with no word added, removed or softened. The line that travels with this product on every surface that sells it: This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform.

Run this on the domains you own

Enter up to 10 domains you own and pay once. Each one is swept, read and graded on its own, and the sections are assembled into one dated document in the order you entered them — the document you have just read in full.

We will run the audit on each of these

One domain per line, up to 10. Enter the domains you OWN — never a lookalike you are worried about. Each one is swept for names resembling it, so an address you do not own would produce a report about somebody else's name.

No domain read yet.

Secure payment by Stripe. One payment, no subscription, no account to create. Questions before you pay: scam-detective8@mail.acoco.ai.

No card? Buy it on an invoice instead

Request an invoice for the Portfolio Impersonation Audit — $249

Most brand-protection, trademark and legal teams cannot put a company card through a supplier's web form — spend leaves as an invoice, often against a purchase order. If that is you, ask for one here instead.

Tell us who to invoice and which domains the audit covers. We email you a confirmation immediately and send the invoice to the same address. The report is produced once the invoice is paid.

These are not sentences written for this page. They are the scope limits from our own claims register, reproduced word for word, and they bind every surface of this site — including the one you are reading.

  • Every report is a point-in-time audit of publicly observable information, dated to the day the reads were taken. A hostname's state can change at any time after that date.
  • No continuous monitoring, on any tier. There is no real-time feed, no API and no alerting, and nothing is re-checked after the report is delivered.
  • No takedown execution, on any tier: we never file. We assemble the evidence and draft the request; the buyer sends it.
  • We never contact the registrant, and we do not contact a registrar, host or platform on a customer's behalf.
  • No outcome and no timeline is promised. Whether anything is suspended is the registrar's, host's or platform's decision alone.
  • No legal representation, ever. This is the boundary that did NOT move and must never be softened. We are not a law firm.
  • No fund recovery.
  • No legal proceedings, and no advice on the merits of a trademark position.
  • We make no assertion about any registrant's intent or criminality

Quoted from growth/approved-claims.md §13b, with no word added, removed or softened.

This is not a different or deeper method. One domain is the $29 Brand Impersonation Audit and you should buy that instead; the $249 buys the same audit across a portfolio in one checkout and one combined dated report. The $29 report is published in full too.

This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform.

Every finding here is an assessment of publicly available information at the time of the check, and is not legal advice. We produce the evidence and the correctly addressed request, and we never file: on every tier the buyer sends it. We do not monitor continuously and never contact the registrant on a customer’s behalf, and no outcome or timeline is guaranteed. Confirm your own trademark position before sending anything adversarial.

Who we are, and exactly how we verify a copy: about Scam Detective.