1. The first search
Record the date, approximate time, service used, exact spelling, extension, and what the service showed. A screenshot is much stronger than memory alone.
That sequence is worth documenting. It is not, by itself, proof that the company you searched with used your query to take the domain.
ICANN's Security and Stability Advisory Committee historically used the term for a situation in which a party with access to an Internet user's domain-availability interest uses that information to preemptively register the name. ICANN later described the concern as a registrar using insider information to register names for resale or advertising revenue.
Record the date, approximate time, service used, exact spelling, extension, and what the service showed. A screenshot is much stronger than memory alone.
Record when you next checked, what changed, and whether the name became registered, reserved, premium-priced, parked, or listed for sale.
Preserve RDAP/registry facts, nameservers, seller pages, broker correspondence, and archived pages. These can establish later facts even when they cannot reconstruct the earlier availability screen.
Do not assume timing establishes who caused the registration, what data they saw, or why the domain changed status. Those are separate factual questions.
Our public research form can record that you say a domain appeared available before later becoming unavailable, where you searched, and the approximate elapsed time. That information remains explicitly user-reported unless independent evidence corroborates it.
Separate the current page state from assumptions about motive or history.
Build an evidence file before an aftermarket price becomes your anchor.
Understand the difference between resale activity and trademark-based cybersquatting.