Strange domain problem – need advice
Yesterday, out of the blue, I started receiving some 'interesting' emails to an unknown user/address at that side-project's domain.
First were a couple of website signups that needed an email verification click. I didn't think too much about it, guessing that maybe someone had mistyped their email address from a similarly spelled domain. It happens. But then came a Google workspace setup verification email (legit, from Google). I called Google workspace support and they understood that I owned the domain and also that I had not initiated setting up Google Workspace. They informed me that whoever was doing that would not be successful because they would have to prove ownership of the domain. In my experience this is usually done by adding record to DNS, or by placing a file with a long random key on the server that hosts the website, so maybe I shouldn't be too worried about that?
But then today, I am starting to get more email to that domain/address containing canned responses from websites that loan money, credit card companies, etc.
So is this some amateurish attempt at identity theft? What is the endgame here? Anybody have any experience with something like this?
What should I be doing? I changed several passwords since yesterday, added extra protection to the domain name at the registrar to prevent hijacking, but what else should I be doing?
Advice welcomed.