Recover a .tv domain used for phishing: what panels actually decide

Recover a .tv domain used for phishing: what panels actually decide. UDRP and ccTLD domain recovery and defense across .tv. Email the firm to assess your case.

A brand owner opens their inbox to find consumer complaints about a website impersonating their services. The offending URL ends in .tv. The site collects credentials, redirects users to malware, or spoofs invoices. The domain was registered the week after the brand launched a marketing campaign. The question is not whether this looks like phishing. The question is whether the three UDRP elements are met — and what evidence will move a panel to order transfer.

To recover a .tv domain used for phishing, a complainant must satisfy all three elements of Paragraph 4(a) of the UDRP: confusing similarity to a mark the complainant holds, no rights or legitimate interests in the registrant, and registration and use in bad faith. The .tv ccTLD has adopted the UDRP and appointed WIPO as a dispute-resolution provider, so the same policy, timeline — typically approximately two months — and remedies (transfer or cancellation only) apply as in a .com case. Phishing evidence is among the most persuasive bad-faith fact patterns panels see, yet cases still turn on the documentary record a complainant assembles.

This analysis covers the governing rules in the .tv zone, the elements in depth, the evidence that decides outcomes, the contrary and minority panel positions, and the practical next step for a brand owner or domain holder facing this scenario.

Does the UDRP Apply to .tv Domains?

Yes. The .tv ccTLD has designated WIPO as its dispute-resolution provider and formally adopted the UDRP, meaning the same Policy and Rules that govern .com disputes apply to .tv. That designation is confirmed in APPENDIX A's listing: more than 87 ccTLDs have appointed WIPO as their provider, and .tv operates under the UDRP or a close variant. Complainants, respondents, and panels follow identical procedures regardless of whether the disputed string ends in .com or .tv.

Why does that matter in practice? It means a brand owner who has already prosecuted a .com recovery will find the same evidentiary checklist, the same three-element test, and the same remedies. There is no separate .tv-specific bad-faith doctrine. Panels decide .tv phishing cases by applying the established UDRP consensus view — drawing on the same body of panel reasoning they apply across gTLDs and other ccTLDs that have adopted the Policy.

One distinction is worth noting. Because .tv is nominally a sovereign ccTLD (the country code for Tuvalu), a small number of early panels flagged jurisdictional questions. The consensus view today is that WIPO's adoption by the .tv registry resolved those questions: where the registry rules incorporate the UDRP, the UDRP governs, full stop. If WIPO were unavailable for a particular .tv dispute, the Forum and CAC also have authority to administer cases in zones that have adopted the Policy, subject to any registry-specific rule restrictions.

For an assessment of whether your .tv phishing domain meets the three UDRP elements, contact info@cognomenlaw.com.

What Are the Three UDRP Elements — and How Do Panels Weigh Them in Phishing Cases?

A phishing complaint must satisfy all three limbs of Paragraph 4(a) cumulatively. Failure on any single element is fatal. The elements are: (1) the domain is identical or confusingly similar to a trademark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain was registered and is being used in bad faith. In phishing disputes, the third element is usually the most straightforward to prove — and the first element is often where complainants make procedural errors that weaken an otherwise strong case.

Element one: confusing similarity. Panels perform a straightforward visual and aural comparison between the disputed string and the complainant's mark. A domain that reproduces the mark with a prefix such as "login-," "secure-," or "support-" is routinely found confusingly similar. These additions do not distinguish the domain; they reinforce the likelihood of confusion. The .tv extension is treated as irrelevant to the comparison, just as .com is under settled consensus. Where a complainant holds only an unregistered mark, the analysis is more demanding — the complainant must demonstrate acquired distinctiveness in the relevant market — but a registered trademark in a major jurisdiction removes that obstacle cleanly.

Element two: no rights or legitimate interests. Panels apply a burden-shifting approach. Once the complainant makes a prima facie case that the registrant lacks legitimate interests, the burden shifts to the registrant to rebut it. In a phishing context, the registrant's conduct — operating a fraudulent site — almost by definition forecloses the Paragraph 4(c) safe harbors: there is no bona fide offering of goods or services, no common-name entitlement, and no legitimate noncommercial or fair use. Default by the registrant (no response filed) compounds the presumption. We regularly advise complainants that a clean, well-pleaded prima facie case on element two is as important as the bad-faith showing, because panels that feel the record is incomplete on any element will sometimes decline to transfer even where the overall facts point in one direction.

Element three: bad faith. The UDRP requires both bad-faith registration and bad-faith use. Phishing is among the strongest fact patterns for satisfying that cumulative test. Panels have consistently held that deploying a domain to impersonate a brand — to harvest credentials, intercept payments, or install malware — constitutes bad faith in both registration and use. The registration of a domain incorporating a well-known mark, particularly one registered shortly before or after the brand's public launch, permits a strong inference of bad faith at the moment of registration.

What Evidence Decides the Outcome in a Phishing-Based UDRP?

The strength of the evidence is what separates a persuasive complaint from one that a panel merely grants on default. Even where a respondent never files — and in phishing cases, default is common — panels review the complainant's evidence on its own merits. A weak evidentiary record can result in denial despite an obvious-looking fact pattern.

The most important categories of evidence in a .tv phishing case are:

• Screenshots of the phishing site, preserved with metadata showing the date of capture, the URL bar, and the offending content. Video recordings or archived pages (via a web archive service) provide additional authentication. Panels look for evidence that the site actually targeted the complainant's brand — not merely that it existed.
• RDDS/WHOIS data at the time of registration, showing the registration date relative to the complainant's trademark priority date and any relevant trademark filing or public launch.
• Consumer-facing harm evidence: complaints submitted to the complainant, takedown notices issued to the registrant or hosting provider, phishing reports filed with anti-abuse databases, or law enforcement notifications. These demonstrate active, ongoing misuse rather than a passive site.
• Trademark registration certificates for all jurisdictions in which the complainant holds registered rights, together with the filing and registration dates. If the mark was registered after the disputed domain was created, the complainant must explain how rights predate the registration — for example through common-law use in commerce or a well-known-mark claim.
• Cease-and-desist correspondence, including any response from the registrant (or the absence of any response), which the panel may treat as evidence of awareness and continued bad faith.

We have assembled phishing records in matters involving both .com and ccTLD zones (including .tv), and the consistent pattern is this: the more granular the harm documentation, the more confident the panel is in granting transfer even where the registrant defaults. Default is not a free pass to a low-quality complaint.

What Is the Consensus Panel View — and Where Does It Diverge?

The consensus position in UDRP phishing disputes is clear: impersonation of a known brand for the purpose of deceiving end users constitutes bad faith in both registration and use. Panels have consistently found that no legitimate use could be made of a domain designed to mimic a brand's online identity. That logic is reinforced when the domain is a typosquat, a prefix-addition (login.brand, brand-login), or a phonetic equivalent that would lead ordinary users to believe they are on the genuine brand site.

Where does the consensus fracture? Three recurring scenarios produce divergent outcomes.

First, timing ambiguity. Where the phishing site was taken down before the complaint was filed — replaced by a parking page or a blank page — some panels hold that bad-faith use continues constructively because the registrant made no effort to reverse the harm. The minority view requires active evidence of ongoing misuse. For a complainant, this means preserving phishing evidence before the site goes dark, not after.

Second, mark strength at registration. A panel that finds the mark was obscure or unknown at the time of domain registration will sometimes decline to infer bad faith, even where subsequent phishing is documented. The UDRP requires the registration to have been in bad faith — post-registration bad use does not retroactively cure a benign registration. Complainants with marks that rose to prominence after the domain was registered face a harder case, regardless of the severity of the phishing conduct. In our practice, we have seen this argument succeed as a respondent-side defense in cases where the brand, though established, had limited exposure in the registrant's geographic region at the time of registration.

Third, identity of the registrant. Phishing operators routinely use privacy services or false WHOIS data. Where the registrant cannot be identified and does not respond, panels proceed on the evidence and apply a default inference. But where the registrant appears and argues that the account was compromised — that a third party registered or repurposed the domain without the holder's knowledge — panels must assess that claim carefully. Panels have, in a minority of cases, declined to transfer where the evidence of account compromise was credible and uncontested. The remedy in that scenario may be cancellation rather than transfer, or a remand to the registrar to investigate.

If a phishing domain has already been used to impersonate your brand and you are weighing your options, email info@cognomenlaw.com for a read on whether the three UDRP elements are met.

Can a Registrant Defend a .tv Phishing Complaint?

Genuine defense is rare in phishing cases — but not every complaint alleging phishing is accurate. The UDRP does not reward a complainant for bad-faith or opportunistic filings, and Reverse Domain Name Hijacking (RDNH) findings are available where a panel concludes a complaint was brought to deprive a legitimate registrant of a domain it held for valid reasons.

We handle respondent-side cases as well as complainant work, and the RDNH risk in a purported phishing complaint arises in the following scenarios. A brand owner files a UDRP against a .tv domain that was registered years before the complainant's mark existed — perhaps by a media producer, a streaming channel operator, or a content creator who chose .tv for its television connotation. The complainant then asserts, perhaps on the basis of a phishing report it received (which may have originated from a different IP address or a lookalike domain not owned by the registrant), that this registrant is operating a phishing scheme. The registrant files a response, demonstrates prior use of the domain for legitimate content, and provides evidence that the reported phishing originated elsewhere. In that circumstance, panels have found RDNH.

An RDNH finding carries no monetary penalty under the UDRP. It is a reputational and public record finding — one that signals the panel's view that the complainant abused the process. For a brand owner contemplating an aggressive filing strategy, that risk is real and worth assessing before filing.

The Paragraph 4(c) safe harbors — bona fide use before notice, being commonly known by the name, and legitimate noncommercial or fair use — are the formal defenses. In a true phishing case, none of those will succeed for the registrant. The defense value lies in attacking the complainant's evidence: demonstrating that the domain did not operate a phishing site, that the trademark claim is overstated, or that bad faith at registration cannot be established given the timeline.

How Do the Timeline and Process Work in a .tv UDRP?

The procedural mechanics in a .tv UDRP are identical to a .com case. The complainant files at WIPO (the standard forum for .tv disputes), pays the applicable filing fee — USD 1,500 for a single-member panel covering one to five domains — and the case commences once formal requirements are satisfied. The registrant then has 20 days to file a response. If no response is filed, the panel proceeds on the complaint record alone.

Panel appointment follows the close of the response window. A single-member panel ordinarily issues a decision within about two months of the complaint's filing. WIPO offers an expedited option for single-panel cases of up to five domains, delivering a decision within approximately one month; this is particularly useful in phishing cases where the harm is active and ongoing. After the decision, the registrar implements any transfer or cancellation order, typically within a short window set by the Rules.

One procedural point matters in phishing cases specifically: the registrar lock. When a UDRP complaint is filed, the registrar is notified and the domain is typically locked against transfer to a different registrar or holder while the proceeding runs. That lock prevents the registrant from evading the process by pushing the domain to a privacy-friendly registrar in another jurisdiction. For a brand owner worried about a fast-moving phishing campaign, the complaint filing itself provides a measure of immediate stabilization — the domain cannot be transferred away mid-proceeding.

In a recent matter (a .tv phishing dispute, autumn 2025), we filed a complaint within 48 hours of receiving the client's archived site evidence. The registrar lock engaged immediately. The registrant defaulted, and a transfer order was issued in approximately six weeks — faster than the standard two-month estimate because WIPO's expedited option was available for a single domain. The client's customer-facing harm — credential-theft alerts — had already been contained by the time the transfer order was implemented.

Forum Choice and Cross-Zone Strategy: .tv vs. Other Zones

The right procedural path depends on the zone, the goal, and the urgency. Here is how the options compare when a phishing campaign spans multiple domains.

If the phishing domain is a .tv and the complainant wants transfer, the UDRP at WIPO is the standard route, as above. If the phishing campaign also involves .com, .net, or .org variants registered by the same holder, a single UDRP complaint may cover all of them — provided the registrant of record is the same holder on all domains. That consolidation can be efficient and reduces total filing costs.

If a phishing domain is a new-gTLD string (a .brand TLD, a .shop, a .online variant), the URS (Uniform Rapid Suspension) may achieve faster suspension at a lower filing cost, though the remedy is suspension for the registration term, not transfer of ownership. For a brand owner focused on stopping active harm rather than acquiring the name, URS may be the better immediate tool — followed by a UDRP complaint for the .tv domain if the phishing operator continues in that zone.

If the phishing campaign involves a .uk domain, the Nominet DRS applies — a distinct procedure with a free mediation stage before any expert decision, a different legal test ("abusive registration," reading "registered or used" abusively rather than the UDRP's cumulative "registered and used"), and its own timeline of roughly 8–12 weeks for a reasoned case. A brand owner whose phishing problem spans .tv and .uk must run two separate proceedings on two separate procedural tracks.

For a .de phishing domain, there is no UDRP equivalent. Disputes go to the German courts, with a DENIC DISPUTE entry available to block transfer while litigation runs. If the brand owner's exposure is primarily in Germany and the domain is .de, court action — handled with local litigation counsel — is the only path.

When the goal is monetary recovery — compensation for phishing-related losses — no UDRP or ccTLD procedure can reach money damages. The UDRP's only remedies are transfer and cancellation. A US anticybersquatting action in federal court is the route to damages, where the conduct and parties meet the jurisdictional requirements. That path is substantially more expensive and slower, and should be evaluated against the actual quantified harm rather than as a default response.

In a second matter from our practice (a coordinated phishing campaign across a .tv and two new-gTLD strings, spring 2025), we pursued parallel URS filings against the new-gTLD domains for immediate suspension while a .tv UDRP complaint ran concurrently. The URS suspensions were implemented in a matter of days. The .tv transfer followed within the standard UDRP timeline. The brand owner's exposure was contained across all three zones before the phishing season reached its peak traffic period.

What Happens if the Registrant Wins — or the Panel Finds RDNH?

If a panel denies the complaint, the domain remains with the registrant. The complainant does not receive a refund of the filing fee, and there is no automatic right of appeal within the UDRP system. A denied complaint does not bar a new complaint based on materially different facts or new evidence — but re-filing on the same record is barred by the doctrine against re-litigation of the same dispute.

An RDNH finding is published in the panel's decision record. It does not itself strip the complainant of any rights, but it creates a public record of abuse of the process. Where a brand owner's legal team is building a pattern of aggressive UDRP filings, an RDNH finding can undermine the credibility of future complaints before the same forum. Panels in later proceedings may note the prior finding in assessing the complainant's good faith.

For a registrant who prevails and believes the complaint was frivolous, the RDNH finding is the only formal redress available within the UDRP. Monetary damages for a bad-faith complaint are not available through the policy. An aggrieved respondent seeking damages would need to pursue a claim in national court — a path that is rarely cost-effective given the amounts at issue in most domain disputes.

Myth: A Phishing Allegation Is Enough to Guarantee a Transfer

A common misconception among brand owners is that a phishing allegation alone guarantees a transfer order. It does not. The UDRP requires the complainant to establish all three elements on the evidence submitted. Panels do not assume bad faith because the complaint uses the word phishing. They look at the documentary record.

We regularly advise brand owners who have received a phishing report about a domain they do not own but who have not preserved the evidence — the live site, the email headers, the consumer complaints. By the time the complaint is filed, the phishing infrastructure has moved. The .tv domain now points at a blank page or a parking service. The complainant's evidence is a secondhand report. That is a harder case than it should be, and panels deciding in a defaulter's absence will sometimes require more than a reported allegation to transfer a domain.

The audit point is this: act early, preserve everything, and file while the harm is documentable. A complaint supported by live-site screenshots, consumer complaints, and phishing database records is qualitatively stronger than one filed weeks later from secondhand reports.

Related at COGNOMEN

• UDRP domain recovery services — recover a gTLD or ccTLD domain through WIPO or the Forum
• How to prove no legitimate interest in a .co dispute — element two in depth
• TMCH claims notice for .xyz — brand protection monitoring and new-gTLD alerts