· Stewart Paxton

We registered loanee.co.uk, built a platform on it, tested it, deployed it and put it in front of a Scottish Premiership club. Three days later it was gone. No warning, no notice, no email until after the fact.

The reason: the domain has the word “loan” in it.

What actually happened

The registration went through normally. We paid, configured DNS, provisioned the server, set up SSH and certificates, deployed the application and tested it in production. A client started using it.

Three or four days later an email arrived from Nominet, the registry that runs .uk, saying the domain had been “temporarily deactivated” pending checks. By the time we read it, the site was already down. We only worked out why because we went looking.

The platform is a business-to-business tool for professional football clubs, used to manage players out on loan: contractual terms, appearances and minutes, training attendance, GPS and sports-science data, injuries and return-to-play, scouting reports. Access is invitation only, with accounts created for named staff at specific clubs. There is no public sign-up, no user-generated content, no crypto, no consumer lending. It is about as far from a phishing site as a football platform can get.

None of that mattered, because nothing had looked at what the domain did. Something had looked at what it was called.

The email was indistinguishable from phishing

This is the part worth dwelling on, because it is the part that can be fixed tomorrow.

The message asked us to click a link and hand over a live photograph of our face, a passport or driving licence, and proof of address. That is the highest-value payload a phishing campaign can ask for. It arrived unannounced, with the following characteristics:

  • Every link was a SendGrid click-tracking URL, several hundred characters of opaque redirect, rather than a nominet.uk address.
  • The domain was defanged, written as loanee[.]co[.]uk under a heading reading “OFFENDING DOMAINS”. That bracket notation is what security teams use to neutralise malicious links in incident reports. Seeing your own domain written that way, by the registry you bought it from, does not read as routine correspondence.
  • A hex reference number and a generic “Domain Abuse Analyst” signature, with no named contact and no phone number.
  • Urgency and consequence, the two levers every phishing email pulls.
  • A warning about clicking links, in the footer of an email whose entire purpose is to get you to click a link.

We replied asking for independent confirmation before uploading identity documents to a link in an unsolicited email. That is exactly the behaviour every security awareness course teaches. It cost another day.

The reply confirmed the email was genuine, and explained that the domain had been flagged by Domain Watch, Nominet’s screening service, most likely on the keywords “loan” and “ee”.

For the record, both replies addressed us as “Stuart”. Small thing. It did not help the impression that a real person had looked at any of this.

To be fair to Nominet

The goal is legitimate and worth defending. Nominet screens new .uk registrations because criminals register domains in bulk to run phishing and fraud, and the registry catching them early genuinely protects people. Some proportion of legitimate registrations will be caught alongside them. That is the nature of any screening system, and we would rather .uk was policed than not.

The verification itself is a reasonable ask. Mitek is a real identity provider used widely in finance. We completed it.

The problem is not that checks happen. It is the sequence, and the communication.

Three things that made this worse than it needed to be

We were sold a domain nobody had checked. IONOS took the payment and handed over a domain that was, at that moment, already on a path to being flagged. At no point during purchase was there any indication that a .uk registration is screened after the sale, or that certain words carry elevated risk. A single line at checkout would have changed every decision we made afterwards.

The suspension came before the conversation. The domain was deactivated first and explained afterwards. For a parked domain that is a minor inconvenience. For a domain with a production application behind it and a client logged in, it is an outage you cannot explain, because you do not yet know what has happened. We found out our own site was down by investigating, not by being told.

The verification is a black box. After submitting identity documents, there is no progress indicator. We assumed we were done. We were not: the application was silently sitting at “in progress”, needing more information, and we only discovered this by chasing. Days of downtime accumulated inside that gap.

The commercial impact lands entirely on the registrant. We had a live product in front of an elite sports client, days before a scheduled demonstration, and it disappeared without notice. Whatever the outcome, that is not a good look for a small studio, and no part of the process accounts for it.

What we would do differently, and what we would suggest

If you are registering a .uk domain, particularly a new one for something you intend to launch on:

  1. Assume the name will be screened. Words associated with fraud attract attention: loan, bank, pay, secure, verify, gift, refund, crypto, wallet, and brand names. Ours was flagged for a football loan platform. Context is not what gets assessed.
  2. Do not deploy production onto a brand-new .uk domain. Register it, point it at a holding page, and wait a week or two before anything depends on it. Had we done this, the suspension would have been an email rather than an incident.
  3. Have identity documents ready. If you are asked to verify, photo ID and proof of address in the same name and address as the registration will move faster than scrambling for them mid-outage.
  4. Verify the request independently, then act quickly. Do not click the link. Contact the registry through its published address, confirm the case, then complete the process without delay. Both halves matter: caution is right, but every day of hesitation is a day of downtime.
  5. Check the verification actually completed. Assume nothing. Log back in and confirm the status rather than waiting to hear.
  6. Keep a fallback domain, and do not hard-code the primary one. If your application, emails, callbacks and OAuth redirects all assume a single domain, losing it is total. A second domain configurable at the environment level turns a catastrophe into a redirect.
  7. Tell your client before they notice. We would rather explain an unexpected registry suspension than have a customer discover a dead login page.

And what would make this materially better, from where we stand:

  • Screen before the sale, or warn at the point of sale. Registrars know which domains will be reviewed. Telling the buyer costs nothing.
  • Contact the registrant before deactivating, at least where the domain is resolving and serving a real application. A short window to respond would prevent most of the harm.
  • Send abuse notices that do not look like abuse. Plain links to the registry’s own domain, a named contact, a reference the registrant can quote on the phone, and no security-report formatting applied to the recipient’s own property.

The domain is back online and the platform is running. It cost several days, a lot of chasing, and an awkward conversation with a client, all because a legitimate business registered a domain containing four letters that also appear in fraud.

If you are about to launch something on a fresh .uk domain, give it a fortnight before you depend on it. That single decision would have saved us the entire episode.

← Back to the blog