Recover a .net domain used for phishing: what panels actually decide

Recover a .net domain used for phishing: what panels actually decide. UDRP and ccTLD domain recovery and defense across .net. Email the firm to assess your cas…

A brand owner finds a .net domain that mirrors its mark precisely – same letters, same visual weight – and the domain is routing visitors to a fake login page harvesting credentials. The harm is immediate. The legal question is whether a UDRP complaint can stop it, and what the evidence needs to look like for a panel to order transfer.

Recovering a .net domain used for phishing turns on all three elements of Paragraph 4(a) of the UDRP: confusing similarity to a mark you hold, no legitimate interest on the registrant's side, and registration and use in bad faith. Phishing conduct is among the clearest demonstrations of bad faith a panel can see. A standard WIPO case resolves in about two months, with a filing fee starting at USD 1,500 for a single-member panel. The only remedies are transfer or cancellation – there are no damages.

This analysis covers the governing doctrine, the evidence patterns that consistently decide these cases, the minority positions worth knowing, and the practical steps from complaint to transfer.

Why .net and why phishing changes the analytical starting point

The .net zone is a generic top-level domain administered under ICANN's standard accredited-registrar scheme, and every accredited registrar's registration agreement incorporates the UDRP. That means the same Policy that governs .com applies in full to .net – the complainant files at WIPO, the Forum, the Czech Arbitration Court (CAC), or the ADNDRC, and the panel applies Paragraph 4(a)'s three-element test identically. There is no .net-specific carve-out, no lighter evidential burden, and no stricter one. The zone distinction matters almost entirely for forum selection and for showing that the registrant chose .net to trade on a mark associated with a domain already registered in another extension.

What does change the starting point is the nature of the conduct. Most UDRP complaints face a genuine contest over bad faith: the registrant holds a plausible generic term, argues prior use, or claims fair comment. Phishing cases rarely present those defenses credibly. A domain that replicates a bank's or software company's name and routes to a credential-harvesting page is not operating a bona fide business. Panels have consistently treated active phishing as one of the paradigm examples of registration and use in bad faith, and the absence of any coherent legitimate-use explanation tends to collapse all three elements together.

That said, the analysis still runs element by element. Collapsing them in a complaint is a tactical error that can cost clarity and – in a close case – the outcome.

How does the confusing-similarity element work for phishing domains?

Under Paragraph 4(a)(i), the domain must be identical or confusingly similar to a trademark or service mark in which the complainant has rights. For phishing domains, this element is almost always the easiest to satisfy – and that relative ease explains something important about how the bad-faith analysis compensates for any formal deficiency in the other two elements.

Panels assess confusing similarity by comparing the domain's second-level label (the part before the dot) with the complainant's mark, generally ignoring the TLD itself. Common phishing patterns are: the exact mark as the second-level label (brandname.net); the mark plus a service descriptor (brandname-secure.net, brandname-login.net); the mark with a transposed letter or a doubled consonant (classic typosquatting); and the mark with a geographic or service suffix. All of these are routinely found confusingly similar. The addition of words like "secure," "verify," or "support" does not reduce confusing similarity – panels have repeatedly held that such additions can increase confusion by reinforcing the deceptive appearance of legitimacy that phishing depends on.

The complainant needs to demonstrate rights in a mark. A registered trademark is the cleanest basis, but panels have accepted unregistered (common law) marks where the complainant establishes sufficient reputation through use. In phishing matters, the registrant's evident intent to impersonate a known brand is itself circumstantial evidence that such a reputation exists – which occasionally helps complainants whose formal registration is pending or covers only certain classes.

For a read on whether the three UDRP elements are met in your specific situation, reach us at info@cognomenlaw.com.

What decides the legitimate-interest element when the domain is used for phishing?

Paragraph 4(a)(ii) requires the complainant to establish a prima facie case that the registrant has no rights or legitimate interests in the domain. That shifts a limited burden to the registrant to come forward with a response demonstrating one of the Paragraph 4(c) safe harbors: a bona fide offering of goods or services before notice of the dispute, being commonly known by the name, or legitimate noncommercial or fair use.

In phishing cases, the registrant virtually never comes forward with a credible safe-harbor argument. The most common outcome is a default – the 20-day response window closes with no filing. Even where a response appears, panels treat a credential-harvesting use as incompatible with bona fide activity by definition. Phishing is fraud; fraud is not a legitimate interest. The consensus view is that a complainant who shows that the domain resolves to a phishing page has discharged its prima facie burden, and the absence of any response or any coherent explanation renders the second element established.

The more interesting sub-question is what happens when the phishing site is taken down between the complaint filing and the panel decision. Registrants occasionally remove the content once a complaint is filed, perhaps hoping to argue the domain is now passive. Panels have generally rejected that stratagem. Evidence of the phishing use – screenshots, URL-scanning reports, archived captures – is evaluated as of the date it occurred. The domain's subsequent parking or dormancy does not retroactively create a legitimate interest.

How do panels analyze bad faith in phishing cases under Paragraph 4(b)?

Bad faith is the element where the phishing fact pattern is most instructive for practitioners, because it simultaneously illustrates the consensus rule, the gap-filling mechanism, and the narrow area of genuine analytical tension.

Paragraph 4(b) enumerates four non-exhaustive circumstances of bad faith. The one most directly applicable to phishing is sub-clause (iv): using the domain to attract, for commercial gain, internet users to the registrant's website by creating a likelihood of confusion with the complainant's mark as to source, sponsorship, affiliation, or endorsement. Credential harvesting is commercial in the relevant sense – the registrant obtains something of value (login credentials, payment details, or direct financial transfers) by exploiting the confusion. Panels have consistently applied this provision to phishing conduct without difficulty.

A second route is sub-clause (i): registration primarily to sell the domain to the mark owner for a sum exceeding out-of-pocket costs. In some hybrid cases, the registrant initially uses the domain for phishing and then pivots to a ransom demand. Both phases independently support bad faith, and panels have found them mutually reinforcing.

The consensus view also holds that active phishing forecloses any good-faith argument under the "legitimate noncommercial or fair use" safe harbor. There is no fair-use doctrine for credential harvesting.

Where does the minority or contrary view arise? It arises in two specific sub-scenarios. First, where the complainant cannot produce contemporaneous evidence of the phishing activity – only a screen-capture taken after the complaint was filed, or a third-party report that may post-date the registration by a significant period. Some panels have applied a stricter reading, requiring more than a claim about past phishing where the current state of the domain is neutral or parked. Second, where the mark itself is weak or descriptive and the domain could plausibly be interpreted as referring to a generic function (a "secure network" service, a generic IT descriptor). In such cases, a minority of panels has declined to find bad faith on the phishing allegation alone, requiring additional evidence of targeting. These are fact-specific outliers, but they explain why the complainant's evidence package matters enormously.

What evidence actually decides the outcome – and what is often missing?

Phishing cases can look straightforward in the abstract and fail in practice for one reason: the evidence of the phishing activity is often perishable. Phishing sites typically operate for days or weeks before the registrant takes them down, moves the content to a different domain, or the hosting provider suspends the account following an abuse report. By the time the trademark owner's team identifies the domain, prepares a complaint, and files it – a process that can itself take several weeks – the live evidence may be gone.

The evidence categories that panels find persuasive are the following. Contemporaneous screenshots of the live phishing page, with the full URL and a visible timestamp, are the single most important item. URL-reputation-scan reports from publicly accessible security tools, cached or archived versions of the page, and any communications from the registrant (ransom demands, correspondence threatening disclosure of harvested data) are all highly probative. Formal notifications to the registrant of the trademark rights – a cease-and-desist, an abuse report, a takedown request – establish the registrant's awareness of the mark, which reinforces the inference of targeting. Security-incident reports from the complainant's own IT or fraud-prevention team, particularly if they document user complaints or financial harm, are also regularly credited.

What is often missing? Two things in particular. First, complainants frequently omit evidence showing the registrant had actual or constructive knowledge of the mark at the time of registration. Where the mark is internationally well-known, panels infer that knowledge. Where it is a regional brand or a newer mark, that inference is not automatic, and the complainant needs to build the case expressly. Second, evidence of the bad-faith registration – as distinct from the bad-faith use – is sometimes thin. The UDRP requires both. A panel applying the strict conjunctive reading of "registered and used in bad faith" will ask: what shows the registrant registered this domain in bad faith, not merely that it was later put to a bad-faith use? Phishing launched at or near the registration date resolves this. A significant time gap between registration and the appearance of phishing content does not resolve it automatically, and a well-advised respondent would exploit that gap.

In a recent matter (a .net impersonation complaint, summer 2025), we assembled archived page captures obtained through a third-party URL-archiving service alongside the registrant's outbound email to the complainant's customers – harvested contact data used in a follow-on fraud campaign. The panel found all three elements established and ordered transfer. The archived captures had been obtained within 48 hours of the phishing site going live; without them, the evidentiary record would have been significantly weaker.

Consensus and minority positions compared – a decision map for practitioners

Understanding where panels agree and where they diverge allows a complainant to build toward the consensus position and guard against the minority challenge. The table below presents the key fault lines in prose form, because the nuances do not reduce cleanly to binary columns.

On confusing similarity: the consensus is strongly complainant-favorable. Virtually all panels treat phishing-pattern domains (mark + login/verify/secure) as confusingly similar, often emphasizing that the added word reinforces the deceptive effect. The minority position – that a long or complex added word could distinguish the domain – appears only in highly atypical fact patterns and is not a live risk in most cases.

On legitimate interest: the consensus is nearly unanimous. No panel has accepted that credential harvesting constitutes a bona fide offering of services. The minority view concerns the edge case where the respondent argues the domain was not used for phishing at all – i.e., that the complainant's evidence of the phishing activity is wrong – and the panel finds that question genuinely contested on the record. That is not a doctrinal minority position; it is a factual dispute, and it underscores why evidence quality is dispositive.

On bad faith: the consensus applies sub-clause (iv) directly and without difficulty to phishing use. The minority position is the one described above: where evidence of the phishing activity is thin, post-dates registration by a significant period, or where the mark is descriptive, some panels require the complainant to do more than allege phishing – they require proof that the domain was registered because of the mark. Complainants who treat phishing as a self-proving bad-faith allegation, without anchoring it to the mark's fame and the registration date, occasionally lose cases they should have won.

On passive holding after phishing stops: the consensus is that documented prior phishing use survives the domain going dark. The minority does not squarely reject this, but a handful of panels have applied heightened scrutiny to complaints where the phishing evidence is remote in time and the domain has been dormant for a substantial period. For active or recent phishing, this is not a practical obstacle.

If a prior UDRP filing on a phishing domain produced an unexpected result, a second read of the evidence record often identifies the element that was under-supported. Email info@cognomenlaw.com to discuss a reassessment.

Choosing the forum: WIPO, the Forum, or CAC for a .net phishing complaint

All three UDRP-accredited forums accept .net complaints. The choice is consequential in cost, speed, and – to a limited extent – panel pool.

WIPO handles the majority of UDRP proceedings. Its filing fee for a single-member panel covering one to five domains is USD 1,500. Where speed is critical – and in phishing matters it often is, because each additional day the domain operates causes incremental harm – WIPO offers an expedited option that targets a decision within approximately one month for single-panel cases covering up to five domains. That expedited track is worth considering when the phishing campaign is active and the harm is direct and ongoing. If either party requests a three-member panel, the fee rises to USD 4,000, and the timeline extends modestly.

The Forum's filing fees begin at approximately USD 1,300 for one to two domains on a single-member panel. It is a credible alternative, particularly for US-based complainants with multiple domains or where a complainant has an established filing history with the Forum's platform. WIPO and the Forum together account for roughly 97% of all UDRP proceedings – both are well-resourced and produce a large, citable body of decisions.

CAC's entry fee is lower – approximately USD 500–800 – making it the least expensive option for cost-sensitive complainants with a clear-cut case. It is the least used of the four providers and its panel pool is smaller, but its decisions are recognized under the Policy and carry the same legal effect as WIPO or Forum orders.

What does a complainant filing across multiple .net phishing domains do? The UDRP permits a single complaint to cover multiple domains only when the registrant is the same holder. A phishing campaign launched across a cluster of variations (brandname-login.net, brandname-secure.net, brandname-verify.net) registered to the same entity can be consolidated into one complaint, which reduces per-domain cost and presents a compelling pattern-of-conduct argument for the panel.

Court action is also theoretically available. US anticybersquatting litigation allows damages and transfer through a federal court action, and in cases where the financial harm from a phishing campaign is quantifiable and substantial, the damages route may justify the higher cost. For .net domains registered outside the US, cross-border enforcement adds complexity; in practice, the UDRP is faster and sufficient for the transfer remedy in the great majority of .net phishing cases. COGNOMEN coordinates with local litigation counsel in the relevant jurisdiction where court action abroad is required.

What about respondent-side defense in a phishing complaint – and when does RDNH arise?

Respondent-side representation in a genuine phishing case is uncommon for obvious reasons. A registrant who is actually operating a phishing site has no credible defense. That said, we regularly encounter situations where the complainant's characterization of the use as "phishing" is disputed, overstated, or simply wrong – and where the underlying domain has a legitimate registration history that predates any alleged misuse.

The scenario that generates viable defense work is this: a registrant holds a descriptive or generic .net domain for a lawful purpose, a third party or a fraudster uses that domain in a phishing campaign without the registrant's knowledge (through DNS hijacking, a compromised hosting account, or a fraudulent use of the registrant's domain in email headers without touching the domain's DNS), and the brand owner files a UDRP complaint against the registrant as if the registrant were responsible for the phishing. The registrant may have no idea the complaint is coming.

In those cases, the defense record turns on documenting the legitimate registration history, demonstrating the absence of control over the phishing use, and showing that the domain itself predated any association with the complainant's mark. Where the complaint is nonetheless filed aggressively and the complainant knew or should have known the registrant was not responsible for the phishing, a panel may make a finding of Reverse Domain Name Hijacking (RDNH). An RDNH finding carries no financial penalty under the UDRP, but it is a formal reputational mark against the complainant and, in the right case, a basis for subsequent court action in some jurisdictions.

The realistic process from discovery to transfer

The UDRP process runs five stages: complaint preparation and filing, formal compliance review by the forum, commencement and service on the registrant, the response period, panel appointment and decision, and registrar implementation of any transfer order.

From the moment a brand owner identifies a .net phishing domain to the moment a transfer order is implemented, the realistic range is approximately two to three months for a standard single-member case at WIPO or the Forum. The 20-day response window begins on the date the forum formally commences the case, which typically follows filing by a few business days. If the registrant defaults – as is common in phishing cases – the panel moves to decision without waiting for a response. If the registrant responds, the timeline extends modestly.

What does a complainant need to have ready before filing? A clear chain of trademark rights (registration certificates, evidence of use if claiming common law rights), a complete evidence package of the phishing activity (screenshots, archives, third-party security reports, any communications with or from the registrant), a whois/RDDS search confirming the registrant's identity (or as much as is available given privacy service use), and a reasoned written complaint that walks the panel through each element. The complaint is not a place for advocacy rhetoric; panels are experienced practitioners, and a measured, element-by-element analysis reads more credibly than a heated recitation of the harm.

In a further recent matter (a cluster of .net phishing domains, early 2026), the complainant had identified approximately a dozen variations of its banking brand registered to a single entity within a 48-hour window. Filing a consolidated complaint covering all twelve reduced the per-domain forum fee materially and placed before the panel a pattern-of-conduct argument that reinforced bad faith across every domain. The transfer order covered all twelve.

Related at COGNOMEN

• UDRP domain recovery services – WIPO, the Forum, CAC, and ADNDRC
• How to prove bad faith in IT-sector domain disputes: a practitioner's guide
• Domain escrow for .net transactions: structure, risk, and process