Recover a .me domain used for phishing: what panels actually decide

Recover a .me domain used for phishing: what panels actually decide. UDRP and ccTLD domain recovery and defense across .me. Email the firm to assess your case.

A stranger registers a domain that pairs your brand with the word "secure," "login," or "account" under the .me ccTLD. Within weeks, phishing emails are landing in your customers' inboxes, each bearing a convincing URL. You want the domain transferred to you – and you want it soon. The question is whether the UDRP applies to .me, how a panel reads a phishing pattern, and what evidence actually decides the case.

The .me ccTLD (Montenegro's national domain) has appointed WIPO as its dispute-resolution provider, meaning the UDRP applies in full to .me registrations. To recover a .me domain used for phishing you must satisfy all three elements of Paragraph 4(a) of the Policy: confusing similarity to a mark you hold, no legitimate interest on the registrant's part, and registration and use in bad faith. Phishing is one of the most unambiguous bad-faith patterns panels encounter – but it still requires a complete evidentiary record. The WIPO filing fee starts at USD 1,500 for a single-member panel and a decision normally issues within about two months.

This analysis covers the governing rules, the three elements as panels apply them in phishing cases, the evidence that decides the outcome, the minority positions you should anticipate, and the realistic path from discovery to transfer.

Why the UDRP governs .me disputes and what that means in practice

Montenegro's registry, dot.ME LLC, operates under a contractual arrangement that puts WIPO and several co-providers in charge of .me dispute resolution using the full UDRP ruleset. That is significant. It means every procedural rule that governs a .com dispute – the 20-day response window, the transfer-or-cancellation remedy, the Paragraph 4(b) bad-faith factors, the Paragraph 4(c) safe-harbor defenses – applies verbatim to .me. There is no separate ccTLD procedure with a lower evidentiary bar, no mediation prerequisite, and no eligibility requirement tied to Montenegrin residency or EU nexus.

In practical terms, a brand owner who discovers a .me phishing domain already knows the rulebook. The same three elements that must be proved in a .com case must be proved here. The difference is in the factual context that phishing creates. Phishing is not passive parking and not a legitimate resale market. It is active deception directed at real people. Panels read that operational context when they score bad faith, and it matters substantially at the third element.

One further point: because .me attracts personal and professional branding – the TLD is marketed as a first-person identifier – impersonation through a .me domain carries a particular persuasive force. A registrant who creates "security-[YourBrand].me" or "[YourBrand]-login.me" is exploiting the personal-branding association of the TLD to make the phishing address look credible. Panels have recognized this framing. It reinforces the bad-faith inference without requiring the complainant to prove it separately.

If you have identified a .me domain directing your customers to a fraudulent login or payment page, the window to act is now – not after the next wave of phishing emails. For an assessment of whether the three UDRP elements are met in your situation, contact info@cognomenlaw.com.

Element one: Is your .me domain confusingly similar to a mark you hold?

The first element is the most straightforward – and phishing operators tend to satisfy it for the complainant. A phishing domain that does not look like the target brand fails as a phishing tool, so the registrant has a structural incentive to create confusing similarity. Panels assess this element on a side-by-side comparison of the domain's second-level label and the complainant's mark, ignoring the TLD itself.

Three patterns recur. In the first, the domain reproduces the mark exactly under .me: "[YourBrand].me". The similarity finding is straightforward. In the second, the domain adds a generic or descriptive term alongside the mark: "[YourBrand]secure.me", "[YourBrand]-login.me", "[YourBrand]account.me". Panels consistently hold that adding words with a security or account-management connotation heightens rather than resolves the confusion, because those additions reinforce the impression that the site is an authorized access point. In the third pattern, the domain incorporates a typo or character substitution – a classic typosquat. Here the similarity analysis requires showing that ordinary users would mistake the misspelled version for the real brand. Panels have consistently found typosquats confusingly similar where the visual difference is a single letter or transposition.

What if you hold only a common-law mark, not a registered trademark? Panels accept unregistered marks where the complainant demonstrates sufficient secondary meaning – consistent commercial use, third-party recognition, and evidence that customers associate the name with your goods or services. For a phishing complaint, that showing matters more than in a passive-holding case, because the registrant may attempt to argue the mark is weak or unrecognized. Building the trademark record before filing is not optional; it is the foundation of the complaint.

Element two: Can a phishing operator claim any legitimate interest in your .me domain?

The second element requires the complainant to make a prima facie showing that the registrant lacks rights or legitimate interests, at which point the burden shifts to the respondent to produce evidence of one of the Paragraph 4(c) safe harbors. Phishing operators rarely respond – and they essentially never produce a credible safe-harbor defense.

Why? Because the three safe harbors in Paragraph 4(c) are structurally incompatible with phishing. A bona fide offering of goods or services before notice of the dispute requires commercial legitimacy that a phishing site cannot demonstrate. Being commonly known by the domain name requires actual usage as an identifier, not stolen brand use. Legitimate noncommercial or fair-use purposes are facially impossible when the site harvests credentials or financial data.

Panels typically dispose of the second element quickly in phishing cases. The complainant shows the domain mimics the mark, the registrant's WHOIS/RDDS data shows no connection to the brand, the site's purpose is deceptive impersonation, and the panel infers an absence of legitimate interest. Default cases – where the respondent never answers – are common in phishing disputes. Default does not automatically win the case, but it allows the panel to draw reasonable inferences from the complainant's unrebutted record.

A minority of panels in default cases have applied a stricter standard: they look for affirmative evidence of illegitimacy rather than relying solely on the complainant's inference. In our practice we address this by including forensic screenshots of the phishing page, cached versions, email headers where available, and any third-party abuse reports. That affirmative record satisfies even the more demanding approach.

Element three: How do panels read registration and use in bad faith in a phishing case?

The third element is where phishing cases diverge most sharply from routine cybersquatting. Bad faith under the UDRP must be established at both stages – registration and ongoing use – as a cumulative requirement. Phishing satisfies both limbs by design.

At registration, the question is whether the registrant chose the domain because of its resemblance to a known mark, intending to exploit that resemblance. Panels infer this from the combination of: the mark's prior distinctiveness or fame, the domain's deliberate mimicry (including the choice of the .me TLD for its personal-branding context), and the absence of any plausible good-faith explanation. A registrant who assembles "[YourBrand]secure.me" on the day your company publishes a new authentication product has essentially disclosed purpose through timing and construction.

At use, phishing is the clearest single fact pattern in the bad-faith catalogue. Paragraph 4(b) of the Policy lists as an illustrative bad-faith circumstance the use of a domain to attract internet users for commercial gain by creating a likelihood of confusion with the complainant's mark – and the Panel majority has consistently extended this to credential-harvesting pages on the ground that the gain need not be direct sales revenue. Phishing monetizes confusion through stolen data. The commercial-gain nexus is satisfied.

Panels have also applied a "passive holding plus phishing infrastructure" rationale: even where the phishing page is briefly taken down after the complaint is filed, a panel may still find bad faith in use if the registrant had activated phishing infrastructure before filing and shut it down strategically. The shutdown does not sanitize the registration. We have seen this pattern in several matters and the consistent outcome is that panels decline to reward pre-filing concealment.

What is the contrary view? A small number of panels have demanded harder evidence of commerciality – specifically, evidence that the phishing operation generated identifiable revenue or caused measurable customer harm, rather than merely deploying a deceptive page. This minority view is substantially weaker after years of phishing-specific decisions, but it remains a reason to include evidence of actual customer deception (phishing reports, support tickets, abuse-desk notifications) wherever those documents exist.

If a prior filing produced a denial on the third element – or if you received a complaint you believe is filed in bad faith against your legitimately registered .me – email info@cognomenlaw.com for a focused second read on the element that turned the result.

What evidence actually decides a .me phishing UDRP

Evidence drives the outcome in phishing cases more than in any other UDRP category, precisely because the third-element question is factual rather than doctrinal. Panels want a complete operational picture of the phishing campaign – not merely a trademark certificate and a screen grab of the domain's homepage.

The core evidentiary bundle in a well-prepared phishing complaint includes the following. First, proof of trademark rights: registration certificates, renewal receipts, and in common-law cases the commercial-use record described above. Second, a contemporaneous capture of the phishing site itself – ideally with a full DOM capture or a professional screenshot service, not a phone photo of a monitor. Third, email evidence: phishing emails received by your customers, with headers intact, linking the campaign to the domain. Fourth, abuse-report documentation: reports filed with your registrar, with the registrant's registrar, with ICANN, with anti-phishing databases, or with national cybercrime authorities. Each report is a time-stamped record of active misuse. Fifth, WHOIS/RDDS data: current and historical records showing the registrant's identity information, registration date, and nameserver configuration. RDDS history often reveals that the phishing infrastructure – including mail exchange records pointing to bulk-email services – was set up within days of registration.

Two additional categories can strengthen an already strong record. Evidence of actual harm – customer support logs, fraud-alert notices, bank recall requests – addresses the minority-view concern about measurable impact. And evidence of the complainant's brand prominence at the time of registration – press coverage, website traffic, social-media following, advertising spend – supports the inference of bad-faith intent at registration.

In a recent matter (a .me domain incorporating a financial services brand with a security-themed modifier, winter 2025), we assembled a complaint that included email headers, RDDS history, and abuse-desk tickets documenting credential-harvesting activity directed at the brand's retail customers. The panel transferred the domain approximately seven weeks after filing. No extension was requested and the registrant did not respond.

The timeline and forum mechanics for a .me phishing complaint

The procedural path for a .me UDRP complaint at WIPO tracks the standard gTLD timeline closely. You file the complaint; WIPO reviews it for formal compliance and commences the case; the registrant has 20 days to file a response; a single-member panel is appointed and issues a decision; the registrar implements the transfer or cancellation. From filing to transfer, a standard case runs about two months, though complex matters or panel availability can extend this.

For phishing cases, speed matters more than in passive-holding disputes. The harm is active and ongoing – customers are being deceived in real time. Two practical steps can accelerate the resolution without bypassing the formal procedure. First, a registrar abuse-contact request can cause the registrar to take the phishing site offline pending the UDRP proceeding, even before a panel decision. This does not transfer the domain, but it disrupts the phishing campaign. Second, WIPO offers an expedited track delivering a decision within about one month for single-panel cases covering up to five domains. That option is available by agreement or by WIPO determination where urgency is shown – a live phishing campaign is a strong factual basis for the request.

Forum choice: .me disputes may also be filed at other UDRP providers, but in our practice WIPO is the standard choice for .me given its familiarity with the zone and the depth of its published decisions. The WIPO filing fee for a single-member panel covering one to five domains is USD 1,500; a three-member panel costs USD 4,000. In phishing cases with a clear record and a non-responding registrant, a single-member panel almost always suffices. A three-member panel becomes relevant when the registrant has filed a credible response or when the mark's validity is genuinely contested.

Reverse domain name hijacking: the registrant's perspective on a .me phishing complaint

Most registrants whose .me domain is used for phishing have no legitimate defense and no standing to invoke reverse domain name hijacking (RDNH). RDNH – a panel finding that the complainant brought the proceeding in bad faith to deprive a legitimate registrant – is structurally unavailable when the registrant is actually running a phishing operation. You cannot be a victim of an abusive complaint if you have no legitimate interest to protect.

But the picture is different in one subset of cases: the domain investor or legitimate business owner whose .me registration is targeted by an aggressive complainant who mistakes phishing conduct by a third party for the registrant's own conduct. Domain compromise – where an attacker hijacks a legitimate registrant's domain or its DNS to run phishing without the registrant's knowledge – does occur. If a complainant files against the nominal registrant without investigating whether that registrant was itself a victim of domain theft, a panel may well find RDNH or at least deny the complaint for failure to prove bad faith at registration.

If you receive a UDRP complaint over a .me domain you registered legitimately, and the alleged phishing was conducted without your involvement – by a DNS hijacker or a hosting compromise – the defense requires prompt action: document the account compromise, produce server logs and access records, notify the registrar and WIPO, and build the legitimate-interest record before the response deadline. The 20-day response window does not pause for investigation. Early instruction of counsel is essential.

We regularly advise registrants who find themselves in exactly this position: legitimate name holders caught between an aggressive complainant and an attack on their own infrastructure. The defense is factually demanding but it is a complete one when the record is assembled correctly.

Cross-zone considerations: when a .me phishing campaign spans multiple domains

Phishing operations rarely confine themselves to a single domain. A sophisticated campaign may register the same impersonation variant under .com, .net, .me, and a handful of new gTLDs simultaneously, running phishing pages on all of them while any one domain is being taken down.

How should the complainant respond? The right route depends on the zone and the goal. A UDRP complaint at WIPO can cover multiple domains in a single proceeding only where the registrant is the same holder across all of them – a critical limitation when the phishing operator has used different registrars and registrant identities for each domain. Where that condition is met, a single complaint is more efficient and costs less per domain than separate filings.

Where the registrant identities differ, the options branch. For .com and other accredited gTLDs, separate UDRP complaints proceed in parallel. For new gTLDs, URS (Uniform Rapid Suspension) provides a faster, lower-cost suspension remedy – though it does not transfer ownership and the evidentiary standard is higher ("clear and convincing"). For a .eu companion domain, the ADR.eu procedure at the Czech Arbitration Court applies its own rules; for a .de companion, there is no UDRP at all and a DENIC DISPUTE entry combined with German court proceedings is the correct path. For any other ccTLD zone not covered above, the governing national procedure applies and current registry rules should be confirmed with counsel.

The strategic implication: a complainant responding to a multi-zone phishing campaign should map the registrant landscape – registrar records, registrant data, hosting infrastructure – before filing any single complaint, so that the filing sequence can be coordinated rather than reactive. Filing a .me UDRP first while ignoring a .com variant that mirrors it may transfer the .me domain only to find the phishing campaign has migrated entirely to .com.

In a recent matter (a multi-zone phishing campaign using variants under .me and two new-gTLD zones, spring 2025), we coordinated parallel UDRP complaints that named the same controlling registrant, secured transfer of all three domains within a ten-week window, and concurrently obtained registrar suspension of the phishing pages within the first two weeks of filing. Each forum's timeline ran independently, but the evidence assembled for the .me complaint served all three filings with minor adaptation.

What a complainant gets – and what the UDRP cannot deliver

The UDRP's remedies are strictly limited. A panel can order only transfer of the domain to the complainant or cancellation of the registration. There are no monetary damages, no cost awards, and no injunctions under the Policy. For a brand owner responding to phishing, that limitation is significant: the UDRP cannot compensate customers who were defrauded, cannot compel disclosure of the phishing operator's identity, and cannot address liability to third parties.

What about the phishing perpetrators themselves? Enforcement against them requires a different route: cybercrime reporting to national authorities, civil litigation in the relevant jurisdiction for identity theft, fraud, or passing off, or coordination with financial institutions to reverse fraudulent transactions. Those paths sit outside the UDRP entirely and involve local litigation counsel in the relevant jurisdiction and, typically, law enforcement cooperation. COGNOMEN handles the domain-recovery piece; the broader fraud response is coordinated with specialist investigators and litigators as the factual record warrants.

Is the UDRP enough? For most brand owners, yes – the domain transfer is the primary goal, and the UDRP delivers it efficiently. But where the phishing operation is large-scale, systematic, and causing ongoing financial harm to third parties, the domain proceeding is one component of a broader response plan, not the whole of it.

Related at COGNOMEN

• UDRP domain recovery services – how COGNOMEN files and manages UDRP complaints from filing to transfer
• Recovering a typosquat under .eu – how panels apply the ADR.eu procedure to confusingly similar registrations
• Responding within the UDRP deadline for a .biz domain – what the 20-day window demands of respondents