Recover a .au domain used for phishing: what panels actually decide

A phishing site dressed in your brand's colors goes live on a .au domain you never registered. Customers receive convincing emails directing them there. Every hour it stays up erodes the trust your organization has built. The question is not whether you have a claim — phishing is the clearest species of bad faith in domain disputes. The question is what standard actually governs a .au domain, how the procedure works in practice, and what evidence panels expect to see before they order a transfer.

To recover a .au domain used for phishing, a complainant must satisfy the auDRP — Australia's adaptation of the UDRP, administered by auDA-approved providers — by establishing all three elements of the test: confusing similarity to a name or mark in which the complainant has rights; no rights or legitimate interests on the respondent's side; and registration or use in bad faith. Phishing conduct overwhelmingly satisfies the bad-faith limb, but the confusing-similarity and rights elements still require careful evidence. A completed case typically resolves within roughly two months, with transfer or cancellation as the only available remedies.

This analysis covers the governing rules, the element-by-element decision pattern, what evidence wins and what loses, where panels divide, and how the auDRP interacts with the UDRP if the same actor registered the matching .com.

What is the auDRP and how does it differ from the UDRP for .au phishing disputes?

The auDRP is Australia's adaptation of the UDRP, adopted by the .au Domain Administration (auDA) and administered by approved dispute-resolution providers. Its three-element test closely tracks Paragraph 4(a) of the UDRP: confusing similarity to a name or mark in which the complainant has rights; no rights or legitimate interests on the respondent's part; and registration or use in bad faith. That last phrase — registration or use — reflects a meaningful drafting difference from the original UDRP, which requires the complainant to prove registration and use in bad faith as a cumulative test.

Why does the distinction matter in a phishing case? Because a phishing operator may register the domain in apparent good faith — using generic registrant data — and only begin the abusive use later. Under the standard UDRP, a complainant who cannot show that the registrant had the complainant's mark in mind at the moment of registration faces a harder path. Under the auDRP's "or" formulation, panels can focus on demonstrable bad use even where the registration history is ambiguous. That structural feature makes the auDRP, in our practice, somewhat more hospitable to complainants whose brand was not yet widely known at the time of the disputed registration but whose mark is clearly targeted now.

The auDRP also imposes a residency condition on holding .au domains: registrants must have an Australian nexus (an ACN, ABN, trademark registration, or incorporated association, among other qualifying connections). Panels have noted that a registrant who cannot demonstrate any qualifying nexus — and whose registration appears to have been obtained using false or fabricated registrant details — has no legitimate interest by definition. In phishing cases, false registrant details are the rule, not the exception. That fact quietly strengthens the complainant's position on Element Two.

How do panels assess confusing similarity when a .au domain is used for phishing?

The first element of the auDRP test — confusing similarity to a mark or name in which the complainant has rights — is the threshold the panel applies before examining anything else. On a phishing domain, panels have consistently held that the similarity analysis under auDRP Element One is almost identical to the approach under UDRP Paragraph 4(a)(i): the panel strips the country-code extension (.au) and any second-level label (.com), then compares what remains with the complainant's mark.

Phishing domains take predictable forms. The most common patterns panels see are: the brand name reproduced exactly (brand.com.au); the brand name combined with a generic term that signals legitimacy ("secure-brand.com.au", "brand-verification.com.au", "brand-login.com.au"); and character-substitution variants that survive a casual reading. Each of these is treated by panels as confusingly similar to the underlying mark, because the purpose of that similarity is itself the evidence of intent. The panel does not need to be deceived; it needs to find that an ordinary internet user navigating to the domain could be deceived. Panels have consistently held that a domain which incorporates a distinctive trademark in full, combined only with a generic or descriptive word, is confusingly similar regardless of the added term.

Does the complainant need a registered trademark? Not necessarily. The auDRP, like the UDRP, recognizes unregistered or common-law trademark rights, provided the complainant demonstrates that the name has acquired distinctiveness through use. In our experience advising brand owners, a complainant with an Australian Trade Mark Register entry has the strongest starting position — the registration is proof of rights that panels accept without further analysis. A complainant relying on common-law reputation must produce evidence of market presence: sales figures, advertising expenditure, media coverage, or customer volume in Australia.

For a read on whether all three elements are met in your .au situation, reach us at info@cognomenlaw.com.

What evidence of "no legitimate interest" actually persuades a panel in a .au phishing case?

The second element — that the respondent has no rights or legitimate interests in the domain — is the most mechanically straightforward in a phishing matter, yet it is the element complainants most often under-document. Panels require the complainant to make a prima facie showing; the burden then shifts to the respondent to articulate a legitimate interest. A phishing operator almost never files a response. When the respondent defaults, panels draw negative inferences, but they do not simply assume Element Two is satisfied — they expect the complainant's own record to demonstrate the absence of any colorable claim.

What does that record need to show? At minimum: that the complainant has not licensed the respondent to use the mark; that the respondent is not and has never been known by the domain name; that the domain resolves to a fraudulent site (login harvesting, fake invoice pages, brand-impersonation content); and that the registrant details are false or borrowed from a third party. Screenshots of the phishing site — with full metadata, capture date, and URL confirmed — are indispensable. WHOIS or RDDS records showing a registrant name that does not correspond to any real Australian entity, combined with an address that is fictional or belongs to someone else, are equally important. Panels have noted that a domain configured to send emails impersonating the complainant's customer communications is, on its face, inconsistent with any bona fide use.

The auDRP's safe harbors under Paragraph 4(c) — a bona fide offering before notice of the dispute; being commonly known by the name; legitimate noncommercial or fair use — are practically unavailable to a phishing operator. Panels treat the act of operating a phishing site as conclusive proof that none of the safe harbors applies, because phishing is, by definition, deceptive commercial activity.

How do panels evaluate bad faith in a .au phishing dispute — and where do decisions divide?

Bad faith is the element where the auDRP's doctrinal content is richest, and where panel decisions occasionally diverge. The consensus view is that operating a phishing site constitutes bad faith as a matter of near-certainty: the domain was registered and is being used to attract internet users, for commercial gain, by creating confusion as to the source, sponsorship, or endorsement of the site. That maps directly to the fourth bad-faith factor recognized in UDRP Paragraph 4(b) and adopted by auDRP panels. Panels have also consistently held that where a domain is configured to impersonate a complainant's email domain — sending fraudulent payment instructions or credential-harvesting messages — the registrant's intent to disrupt the complainant's business is self-evident.

Where do panels divide? The clearest area of disagreement concerns passive holding — the scenario where the domain was registered but has not yet been actively used for phishing at the time the complaint is filed. Under the UDRP, the leading doctrine on passive holding holds that a respondent's inaction is not itself dispositive; panels look at the totality of circumstances (the distinctiveness of the mark, the implausibility of good-faith use, the concealment of registrant identity). The auDRP's "registration or use" formulation theoretically reduces the need for this analysis — a complainant can rely on bad use alone if evidence of active phishing exists. But panels have encountered cases where the phishing campaign ceased abruptly after the complaint was filed or threatened. Some panels have found that demonstrated past use is sufficient even where the site is parked or blank at the time of decision; others have required the complainant to show some continuing or residual abusive conduct. In our practice, we document the phishing campaign as thoroughly as possible before filing, precisely to insulate the case from this factual gap.

A minority of panels have scrutinized timing: where a complainant's mark is relatively young or where the brand name has a strong descriptive or geographic dimension, some panels have examined whether the registrant could plausibly have had a legitimate purpose. These cases are genuinely harder, and a complainant should not assume that the word "phishing" in a complaint automatically ends the analysis. Evidence that the registrant sent phishing emails — or that the site logged credentials — is far more persuasive than inferential argument about registration intent.

What does the auDRP process look like from filing to transfer, and how long does it take?

An auDRP complaint is filed with an auDA-approved dispute-resolution provider. The respondent then has 20 days to file a response once the case formally commences — the same window as under the standard UDRP. If no response is filed, the matter proceeds on the complainant's record alone. Panel appointment follows, and the panelist (or panel, if three members are requested) issues a decision. Implementation — the actual transfer of the registrar lock and domain control — follows the provider's standard implementation period.

End-to-end, a straightforward auDRP case on a single domain typically resolves within approximately two months. Phishing cases rarely generate procedural complications on the respondent's side, because the registrant's interest is in concealment, not litigation. The default rate in phishing complaints is correspondingly high, and panels move quickly when no response is filed. That said, a three-member panel request by either party extends the timeline modestly, and a settlement during the proceeding suspends it.

The only remedies the auDRP offers are transfer of the domain to the complainant or cancellation. There is no monetary award, no costs order, and no injunction from the panel itself. If the complainant needs to recover damages — for example, because customers suffered financial loss from the phishing campaign — that claim requires separate civil litigation in Australian courts, which COGNOMEN handles with local litigation counsel in the relevant jurisdiction. The domain dispute proceeding and the civil action can proceed in parallel; they do not require sequencing.

How does the auDRP interact with the UDRP if the same phishing actor registered the .com?

Phishing operations rarely target a single zone. In our experience, the same actor frequently registers the matching .com alongside the .au, or registers a family of typosquatted variants across multiple extensions. This raises a practical coordination question: should the complainant file the auDRP and the UDRP simultaneously, or sequence them?

The right route depends on the zone and the goal. If the domain is a .com and the complainant wants transfer, a UDRP complaint at WIPO or the Forum is the primary path — the WIPO filing fee starts at USD 1,500 for a single-member panel covering up to five domains, and a standard case resolves in about two months. If the domain is .au, the auDRP governs; the UDRP does not apply to ccTLDs that have not adopted it, and .au has its own procedure. If both .com and .au registrations are held by the same actor — something WHOIS data or technical indicators may confirm — the most efficient approach is to file both proceedings concurrently, so neither domain remains live as a fallback phishing platform while the other is suspended pending decision.

If the phishing operation extends into .uk, .eu, or other ccTLD zones, each carries its own distinct procedure. The Nominet DRS governs .uk; the ADR.eu platform governs .eu; and the DENIC dispute mechanism blocks transfer for .de while German court proceedings continue. None of these procedures can be filed as a single multi-zone complaint — each zone requires a separate filing under its own rules. A complainant dealing with a coordinated multi-zone phishing campaign should map the full registration picture before filing the first complaint, both to sequence proceedings efficiently and to preserve the option of presenting a pattern of abusive registrations as bad-faith evidence in each individual case.

To weigh auDRP against a parallel UDRP action for your case, email info@cognomenlaw.com.

What are the most common reasons an auDRP phishing complaint fails or is weakened?

The question brand owners rarely ask is: what causes a seemingly obvious phishing complaint to produce a denial or a narrowed outcome? Panels do deny phishing complaints — not often, but the pattern is instructive for anyone about to file.

The first and most frequent cause of failure is a thin rights showing. A complainant that relies on a common-law mark but submits only its own assertions, without third-party corroboration, sales data, or evidence of Australian market presence, gives the panel nothing concrete to assess. Panels are not permitted to take judicial notice of a brand's reputation; the complainant must build the factual record from the evidence submitted.

The second cause is documentary failure on the domain's conduct. Submitting a screenshot taken months after the phishing campaign ended — when the domain now resolves to a parked page or a blank server — puts the complainant in the position of arguing inference rather than fact. Panels have denied transfer where the only evidence of phishing is a complainant's own narrative, without contemporaneous site captures, email headers, or customer-reported incidents.

A third, less common cause is registrant confusion: some apparent phishing domains are, on investigation, held by a legitimate Australian entity that registered the domain for an unrelated business purpose and whose site was temporarily compromised by a third party. Panels have declined to transfer domains in those circumstances, finding that the registrant holds legitimate interests even if the domain was misused without the registrant's knowledge. That scenario is unusual, but it underscores why a pre-filing investigation into the registrant's identity and the registration history matters.

In autumn 2025, we prepared an auDRP complaint for a financial-services brand whose .com.au had been used in a credential-harvesting campaign targeting the brand's superannuation members. The registrant details were entirely fabricated — the listed address resolved to an empty lot. We compiled a packet of evidence including archived site captures, email header analysis from affected customers, and the brand's Australian trademark registration. The panel transferred the domain within approximately seven weeks of filing, with no response filed by the registrant. The same actor had registered the corresponding .com; a parallel UDRP proceeding at WIPO transferred that domain in a similar timeframe.

What is the realistic evidence toolkit for a complainant seeking to recover a .au phishing domain?

Building a complete evidence packet before filing is the most effective step a complainant can take to shorten the proceeding and reduce the risk of a denial. The packet should address all three elements in sequence.

For Element One — rights and confusing similarity — the complainant should produce: a copy of the Australian trademark registration or, for common-law marks, a dossier of use evidence (dated advertising, sales records, media coverage, customer volume, length of use in Australia). The domain comparison itself needs only brief explanation: if the mark is reproduced in full in the domain, a one-paragraph analysis suffices.

For Element Two — no legitimate interest — the record should include: a statement confirming no license has been granted; an RDDS/WHOIS capture showing the registrant identity; research showing the registrant is not a known entity in Australian commerce; and direct evidence of the phishing use (site screenshots with capture metadata, email specimens with full headers, customer complaints if available).

For Element Three — bad faith — the complainant should document the specific phishing mechanism (login harvesting, invoice fraud, payment diversion, credential capture), the technical configuration of the domain (MX records showing email use, SSL certificates imitating the complainant's own), and any evidence of prior similar conduct by the same actor across other domains or zones. A pattern of abusive registrations is a recognized bad-faith indicator under Paragraph 4(b) of the UDRP and its auDRP analogue, and panels have found it compelling.

One final point: panels cannot order an emergency suspension. If the phishing site is actively live and causing consumer harm, the appropriate parallel step is a registrar-level abuse complaint — most major registrars have an abuse contact that can trigger a hold pending investigation, independent of any formal dispute proceeding. That step does not substitute for the auDRP, but it can reduce harm while the formal complaint is prepared and filed.

In a separate matter handled in winter 2025, we advised a healthcare brand facing a .com.au phishing domain that had sent fraudulent appointment-confirmation emails to several thousand patients. Because the registrar responded to an abuse notice within 48 hours and placed the domain on hold, the phishing campaign was disrupted before the formal auDRP complaint was even filed. The complaint proceeded to a transfer decision approximately six weeks later. The parallel registrar abuse route and the formal auDRP proceeding worked in sequence, not in competition.

Related at COGNOMEN

• UDRP recovery services — recovering domains across gTLDs and ccTLDs
• Proving no legitimate interest in a domain dispute — the global standard
• Protecting your brand at a new gTLD launch — a practical guide

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.