Recover a .us domain used for phishing: what panels actually decide

Recover a .us domain used for phishing: what panels actually decide. UDRP and ccTLD domain recovery and defense across .us. Email the firm to assess your case.

A fraudster registers a .us domain that mirrors your brand name, stands up a convincing replica of your sign-in page, and begins harvesting customer credentials. Your legal team wants it stopped. The question is which procedure reaches a .us registration, how quickly it can act, and what the panel record actually shows about phishing cases.

The .us country-code zone operates under the usDRP – a dispute procedure modeled closely on the UDRP and administered through the National Arbitration Forum (the Forum). A complainant must satisfy all three elements of the test: the domain is identical or confusingly similar to a mark in which the complainant has rights; the registrant has no rights or legitimate interests; and the domain was registered or is being used in bad faith. Evidence of active phishing – spoofed login pages, fraudulent email headers, or impersonation of the brand owner – has consistently driven panels toward transfer. A standard proceeding runs roughly two months from filing to decision.

This analysis covers the governing rules, the consensus panel approach to phishing evidence, the points on which panels divide, and what a realistic recovery strategy looks like.

What governs .us domain disputes and how the usDRP tracks the UDRP

The usDRP applies to all .us registrations and closely mirrors the UDRP structure, but the two procedures are not identical. The usDRP shares the three-element test, the same remedy menu – transfer or cancellation, no monetary award – and comparable timelines. Several differences matter in practice.

First, the bad-faith limb in the usDRP is sometimes read by panels as "registered or used in bad faith" rather than the UDRP's cumulative "registered and used." That single word carries real consequence: a complainant who cannot show bad faith at the moment of registration – because the registrant's intent was initially unclear – can still prevail if current use is demonstrably abusive. Phishing is almost invariably current abusive use, so this distinction often benefits complainants in .us matters.

Second, the .us zone carries a nexus requirement: registrants must have a bona fide US presence (citizenship, permanent residency, or a qualifying US organization). Panels have occasionally factored a false or thin nexus declaration into their bad-faith finding. A phishing operator who fabricated a US nexus adds a further layer to the bad-faith record.

Third, the Forum is the primary – and in practice nearly exclusive – provider for usDRP cases. WIPO administers the UDRP but is not the designated provider for .us. Filing a UDRP complaint against a .us domain at WIPO will not produce a transfer of the .us registration; the correct forum is the Forum under the usDRP.

In our practice, counsel familiar with the usDRP procedural rules, and not simply with the UDRP, avoids the misfiling errors that can delay recovery by weeks.

For an assessment of your domain dispute, contact info@cognomenlaw.com.

Do the three usDRP elements actually differ when the domain is used for phishing?

The three elements are formally the same as UDRP Paragraph 4(a), but phishing cases create a distinctive evidentiary texture at each step.

Element one – confusing similarity is usually the easiest to satisfy in a phishing matter. The fraudster's entire business model depends on deceiving users, which means the domain must look like the brand. Panels treating the confusing similarity test as a straightforward comparison between the mark and the domain string almost always find it met when the domain incorporates the mark in full, with only a generic term – "secure," "login," "verify," "account" – added as a prefix or suffix. The addition of those terms does not dispel confusion; it deepens it, because they are precisely the words a user expects to see in an authentic brand URL.

We have handled matters where the domain combined the brand in full with a country indicator – a pattern that occasionally raises a question about whether the country term weakens the mark's footprint. Panels have generally rejected that argument: the mark remains recognizable, and the intent to deceive is evident from the live use.

Element two – no legitimate interest is likewise straightforward where phishing is proven. None of the Paragraph 4(c) safe harbors survive contact with impersonation evidence. The registrant is not making a bona fide offering under the mark; it is not commonly known by the name; and phishing is not legitimate noncommercial or fair use. Panels have treated an active phishing page as self-defeating evidence of a legitimate interest defense.

Element three – bad faith is where phishing cases generate the most instructive panel writing. Panels assess bad faith under the non-exhaustive list of Paragraph 4(b) circumstances, but phishing rarely fits neatly into the enumerated categories (which address conduct like offering to sell to the mark owner or attracting users for commercial gain by confusion). Instead, panels draw on the open-ended nature of Paragraph 4(b) and treat intentional deception – creating a fake brand page to steal credentials or payment information – as per se bad faith. The question is not whether bad faith exists; it is whether the complainant's evidence is sufficient to establish it.

What evidence actually persuades panels to order a transfer?

Evidence quality is the variable that separates a swift transfer from a protracted dispute. Panels cannot independently investigate; they decide on the record the parties supply. In phishing cases, the most persuasive record typically contains several elements.

A screenshot or archived capture of the fraudulent page, time-stamped and showing the spoofed brand elements, is foundational. Web archive services preserve pages that the fraudster may take down immediately on receiving the complaint. Counsel routinely advises collecting this evidence before filing, because a live page that disappears before the panel looks is weaker than a documented one.

Email headers or forwarding logs showing that the domain was used to send phishing messages carry significant weight. Panels treat active email-based phishing – where the domain appears in the "From" or "Return-Path" header – as clear evidence of intentional deception for commercial gain or harm. That is a bad-faith circumstance even when none of the Paragraph 4(b) enumerated categories fits perfectly.

Consumer complaints, fraud reports filed with relevant authorities, or brand-protection monitoring reports that document the phishing campaign establish the scope of harm and reinforce bad faith. They also support the narrative that the registrant had actual knowledge of the mark at the time of registration – a point that matters under the UDRP's "registered and used" formulation and remains relevant even under the usDRP's more permissive reading.

WHOIS or RDDS data – particularly privacy or proxy registrations, false contact details, or a nexus declaration that does not withstand scrutiny – adds to the bad-faith picture. Panels have noted that a registrant who cannot be identified, or who registered under false details, has made the legitimate-interest showing harder for themselves.

Finally, prior UDRP or usDRP decisions against the same registrant, or evidence of a pattern of abusive .us registrations by the same actor, can drive a finding under the "pattern of conduct" bad-faith circumstance. This matters most when the fraudster is a repeat operator using multiple domains in a phishing campaign.

Where panels divide: the minority and contrary positions in phishing cases

The consensus view strongly favors the complainant in a well-evidenced phishing matter. Minority positions exist, and practitioners who overlook them file weaker complaints.

One persistent division concerns passive holding after a phishing campaign ends. A registrant who initially used a domain for phishing but then took down the fraudulent page and left the domain parked may argue that bad faith has ceased. The majority panel view, tracking the UDRP consensus on passive holding, holds that prior abusive use is not erased by subsequent inactivity – bad faith "crystallized" at the time of the phishing use. A minority position has held, in some UDRP contexts, that a panel must assess current use and that a bare parking page with no evidence of ongoing harm warrants more scrutiny before transfer. In our experience advising complainants, the safer evidentiary move is to document both the historical phishing activity and the current registration status, so the panel has no gap to exploit.

A second area of occasional division concerns defaulting registrants. When a registrant files no response – which is common in phishing matters, since the operator has no legitimate story to tell – the panel still cannot simply accept the complaint as proven. The complainant's factual case must stand on its own evidence. Some panels have denied transfer in default proceedings where the complainant's screenshots were unclear, the mark's scope was ambiguous, or the bad-faith allegation rested on inference rather than documented use. The lesson for complainants is that a default does not guarantee transfer; a clean evidentiary record still matters.

A third point of occasional divergence is the scope of available mark rights. The UDRP requires "rights in a mark" – which panels have read broadly to include unregistered or common law marks, provided the complainant demonstrates prior use and secondary meaning. The usDRP tracks this approach, but complainants relying on unregistered marks face a higher evidentiary bar. In phishing matters, the complainant typically holds a registered mark, so this issue arises mainly in cases involving smaller brands or geographic marks that lack federal registration.

To weigh usDRP recovery against other options for your case, email info@cognomenlaw.com.

How the .us phishing matter sits within the broader cross-zone picture

Most phishing campaigns do not target a single zone. A fraudster who registers a .us lookalike also typically holds a .com or a new-gTLD variant, and sometimes a ccTLD in the target brand's home country. The cross-zone dimension shapes both the filing strategy and the evidence record.

For the .com element of a multi-domain campaign, the UDRP at WIPO or the Forum is the correct route. WIPO filing fees start at USD 1,500 for a single-member panel covering up to five domains; the Forum's starting rate is roughly USD 1,300 for one or two domains. Both can reach .com registrations. Neither can reach .us.

A complainant holding multiple phishing domains registered by the same operator can, under both the UDRP and the usDRP, consolidate those domains into a single complaint, provided the registrant is the same holder. Consolidation is practically significant: a phishing campaign using a dozen typosquats across .com and .us would otherwise require separate filings and separate filing fees. The consolidation option reduces cost and produces a single decision record that names all the domains – useful if enforcement steps follow.

For .de phishing domains, neither the UDRP nor the usDRP applies. Disputes proceed through the German courts; DENIC offers a DISPUTE entry to block transfer while the claim is pending. For .eu phishing domains, the ADR.eu procedure administered by the Czech Arbitration Court (CAC) is the route, and remedy can include transfer where the complainant meets EU eligibility. For .uk phishing domains, Nominet's DRS applies, with a free mediation stage before any expert decision; the test is "abusive registration" under a "registered or used" standard – notably parallel to the usDRP's more permissive formulation.

In our practice we regularly advise brand owners who discover that a phishing campaign spans four or five zones. The correct strategy is to file the .com and .us proceedings first – because they are fastest – and address ccTLD variants in a coordinated second wave or simultaneously if resources allow. Speed matters: every day a phishing page is live is a day of credential theft and brand damage.

The realistic recovery timeline and what can go wrong

A standard usDRP case runs roughly two months from filing to the registrar implementing a transfer or cancellation order. That covers the compliance review, the 20-day response window for the registrant, panel appointment, the decision itself, and the implementation period. Absent procedural complications, the timeline is reasonably predictable.

What extends it? A request for a three-member panel adds cost and can add time. A suspension for attempted settlement – which panels may grant but which is rarely wise in phishing cases, since the registrant has nothing legitimate to negotiate from – adds unpredictability. A supplemental filing by either party, which panels accept only in limited circumstances, adds a round of briefing.

What can derail a case entirely? A technically deficient complaint – wrong forum, wrong registrant name, failure to append required exhibits – leads to a deficiency notice that requires correction before the case commences. That costs days or weeks and allows the phishing page to remain operational. In an active phishing campaign, those weeks are costly.

The other real risk is that the registrant, on receiving notice of the complaint, transfers the domain to a privacy service or to another registrar in a jurisdiction that is slow to implement transfer locks. The usDRP and UDRP rules require that the registrar lock the domain on commencement of a proceeding, but the lock depends on prompt communication between the Forum and the registrar. Counsel who knows the mechanics of requesting an immediate registrar lock – and who can escalate if the lock is not applied – is a material factor in how quickly the phishing domain stops operating.

In one recent matter – a .us domain used in an email phishing campaign targeting the financial-services sector, spring 2025 – we assembled the archived page captures, the email header logs, and the WHOIS history, filed at the Forum with a consolidated complaint covering the .us registration and a companion .com under the UDRP, and secured transfer orders on both domains within approximately ten weeks of filing. The registrant defaulted. The phishing page had been archived and the domain was locked within days of commencement, ending the active campaign before the panel issued its decision.

Respondent-side considerations and reverse domain name hijacking in .us phishing cases

The discussion above assumes the complainant's position is legitimate. It is worth addressing, briefly, the respondent-side angle – both because COGNOMEN handles defense as well as complainant work, and because a small number of "phishing" complaints are not what they appear.

A registrant who holds a .us domain in good faith – operating a legitimate business under that name, or holding it as an investor for later resale at market value – may receive a complaint that characterizes its use as phishing based on a misidentification. A page that looks like a brand's login screen to a hasty reviewer may in fact be the legitimate homepage of an unrelated business that happens to use similar design conventions. These cases require a careful response within the 20-day window, supported by evidence of the good-faith registration and use: registration date predating the complainant's mark, documented business use, and an absence of any intent to deceive.

Where a complainant files a phishing complaint that is demonstrably unfounded – relying on a flimsy trademark claim, misidentifying a page's purpose, or seeking to deprive a legitimate investor of a valuable name – the panel may find reverse domain name hijacking (RDNH). An RDNH finding carries no monetary penalty but is a public reputational sanction against the complainant. We have defended registrants in these circumstances, and in our experience the RDNH finding deters future abusive filings by the same brand owner.

The lesson for legitimate registrants: a phishing allegation in a complaint does not mean the complaint will succeed. The panel decides on the evidence. A well-built response, filed on time, with clear documentation of good-faith registration and legitimate use, remains the correct answer.

What the panel record means for strategy: the decision matrix

The analysis above points toward a clear decision structure. If the domain is a .us registration, the phishing use is documented, and the complainant holds a registered mark, the usDRP at the Forum is the fastest and most cost-effective recovery route. Filing fees under the usDRP for one or two domains at the Forum start around USD 1,300 for a single-member panel; legal fees are separate and depend on complexity. Transfer is the likely outcome where the evidentiary record is complete.

If the phishing domain is a .com or covers multiple gTLD zones, the UDRP at WIPO or the Forum is the parallel route. WIPO's filing fee starts at USD 1,500 for up to five domains, single-member panel; consolidation of multiple same-registrant domains is available under both procedures. The two-month timeline is broadly comparable across forums.

If the campaign also targets a .uk domain, Nominet's DRS applies and the "abusive registration" standard is, if anything, easier to satisfy than the UDRP's cumulative bad-faith test, given the DRS's "or" formulation. If .eu domains are involved, the ADR.eu route covers EU-eligible complainants. If .de phishing domains appear, the German courts are the correct venue, with a DENIC DISPUTE entry to block transfer during litigation.

If the complainant also needs monetary compensation for the phishing campaign's damages – brand impairment, consumer fraud losses – no arbitral procedure under the UDRP or usDRP reaches money. US anticybersquatting litigation in the federal courts is the route that allows damages; it runs substantially longer and at substantially higher cost, but it is the only path that combines transfer with a damages award.

If the registrant's identity is masked by a privacy service or the WHOIS record is plainly false, counsel should consider the procedural steps available to request disclosure of the underlying registrant before or alongside the complaint. Proceeding against an accurate registrant identity strengthens the complaint and the eventual transfer order.

• Related at COGNOMEN
• UDRP domain recovery services – our full complainant practice
• Confusingly similar trademark analysis for UDRP complaints
• Case study: defending a fair-use registrant against an abusive complaint