fraudulent Google Workspace sign-ups / Domain name impersonation

[Squip]

2 out of many primaries that we provide support to have their domain names as schoolname.co.uk

 

Both have recently been cc'd on emails from Google showing that somebody is trying to set up and verify Google Workspace for Education but using schoolname.org.uk instead - even using a genuine member of staff's name picked from the school website. The domain names have only been registered days before with 123-reg. Google were smart enough to find the correct domain name through DfE website and cc. them in, otherwise they would've had no idea!

 

The school and website providers have confirmed that they have not registered this new domain name.

 

We have responded to Google who have shut down the fraudulent tenant. (The owners of the malicious tenant have since changed MX records to Office 365)

We have emailed abuse@123-reg multiple times who never respond or take action. We have called them and been told to await a response - which never arrives.

We have also emailed Nominet who say nothing can be done unless authorised by law enforcement.

 

Has anyone ever experienced this? I can't work out what the 'end goal' is for these malicious sign-ups.

 

Any suggestions to get this issue resolved?

[paulkerton]

The end goal is to phish and ransomware the school, eventually.