Match the correct sequence of steps typically taken by a threat actor carrying out a domain shadowing attack.