There is variation in response.
The report was placed on "client hold" and the domain displaying the fake site screen was shut down thanks to a prompt response, but there are cases where a prompt response is not given and the request is made to "submit the image again." In such cases, there have been several cases where the domain owner noticed the report during the exchange and changed the page content so that it would not be displayed, thereby avoiding the domain being suspended. As a result, we believe that the domain holders in question may use the domain again for fraud without facing any punishment, or may create a new domain and spoof it as the login page of another company, thereby committing new fraudulent acts. These include screenshots that identify the target domain, the full URL of the legitimate site where the same page as the page the target domain is spoofing is displayed, how the fake site was identified, which pages are being duplicated within the target domain's pages (mainly the complete duplication of login pages from legitimate sites, or pages that do not exist on the legitimate site and which misuse corporate logos to disguise themselves as login pages), and an explanation of the type of criminal activity being committed and what will happen (all of the cases involve requests for personal information or credit card information, and there is a possibility of financial loss, and infringement of the logo's trademark/design and site page has been confirmed).We report these based on facts and have no intention of providing false information, so it can sometimes be unpleasant. I understand that it is important to check whether or not the fake page is displayed, but even if it is not displayed, if you compare the attached image with the same page on the legitimate site, it should be clear that it is a scam, even if the content is written in a different country's language (the page format and position of the input fields are the same, and only the logo is being misused, for example). Therefore, I think it is necessary to suspend the domain even if it does not display based on the attached image. I also think that all service contracts should be terminated for users who have engaged in fraudulent activity even once. We believe that it is almost 100% likely that users who commit/have committed fraud will repeat the same criminal acts while changing domain names and target companies (mainly credit card companies), and it is extremely unlikely that they will suddenly resume operating a normal website. Therefore, we would like to request that the response be restructured to prevent new fraudulent acts from occurring, such as by creating something like a blacklist based on data on IP addresses and device information used to access the site, making it impossible to access the site from a device used to commit fraud and to apply for service again, or by imposing stricter terms of use, such as disqualifying users for a certain period of time.