Escalate a registrar lock to secure a .au domain: what panels actuall…

Escalate a registrar lock to secure a .au domain: what panels actuall. UDRP and ccTLD domain recovery and defense across .au. Email the firm to assess your cas…

A domain disappears from your account overnight. The registrar shows it locked – but under someone else's management. You know the name is yours. The question is what the .au system actually gives you, at each stage of escalation, to get it back.

To escalate a registrar lock to secure a .au domain, a registrant must move through at least two phases: a registrar-level complaint to freeze any further transfer, followed – if that fails to produce a resolution – by either the auDRP procedure or an application to the Australian courts. The auDRP closely tracks the three UDRP elements but applies a "registered or used" bad-faith reading in certain respects, which matters when the transfer was recent. No single remedy is automatic; each phase requires specific evidence and carries its own timeline and cost.

This analysis covers the governing procedure for .au, the registrar-lock mechanics, the point at which a court route becomes necessary, and the evidence that decides outcomes at each stage.

What governs domain disputes for .au: the auDRP and its relationship to the UDRP

The auDRP is Australia's adaptation of the UDRP and is administered for .com.au, .net.au, .org.au, and related second-level zones under .au. It is not identical to the UDRP, and the differences matter when a registrant or brand owner is deciding how hard to push a registrar-lock escalation before filing a formal complaint. The core three-element test is present: the complainant must show the domain is confusingly similar to a name or mark in which it has rights, that the registrant has no rights or legitimate interests, and that the domain was registered in bad faith or is being used in bad faith. That final limb – "registered or used" in some interpretations, rather than the UDRP's cumulative "registered and used" – is potentially significant. Under the UDRP, a panel that finds the domain was registered innocently and only later deployed abusively faces a higher hurdle to order transfer. Under the auDRP, the "or" reading may allow a complainant to succeed on use alone, though panels have been inconsistent on this point and the consensus is unsettled.

Who applies the auDRP? auDA, the .au domain authority, designates approved dispute resolution providers. WIPO administers auDRP cases, as it does for a large number of ccTLD procedures globally. The mechanics of filing, the response window, and the panel-appointment process track the standard UDRP model closely. The significant structural difference is at the eligibility layer: to register a .com.au domain, a registrant must satisfy auDA's eligibility criteria, which generally require an Australian Business Number, a registered trademark in Australia, or another qualifying nexus. Those criteria create a natural authenticity check at registration – and they also give a legitimate registrant a powerful argument in the rights-or-legitimate-interests element, because eligibility documentation forms part of the registration record.

We regularly advise registrants and complainants who conflate the auDRP with the UDRP. The two procedures share a shape, but the zone rules, the eligibility architecture, and the "registered or used" interpretive question each require separate analysis before you decide how to escalate.

How does a registrar lock work for .au, and when does escalation begin?

A registrar lock in the .au system is a transfer-prevention mechanism applied at the registrar level. When a lock is in place, the registrar will not process an outbound transfer instruction. The lock can be set by the registrant (a standard security feature) or imposed administratively following a dispute notification. These are functionally different states, and the distinction matters when you are trying to escalate.

In a typical domain-theft scenario – account compromise, stolen credentials, or social-engineering of a registrar's support team – the attacker first removes or bypasses the lock, then initiates a transfer. By the time the legitimate registrant discovers the loss, the domain may already be at a new registrar. A registrar lock imposed after a transfer has completed does not reverse the transfer; it merely freezes further movement. That is the critical asymmetry. Escalation to secure the domain therefore must achieve two distinct things: first, a lock at the receiving registrar to prevent a second outward transfer; second, a separate legal or procedural step to reverse the first transfer.

The escalation sequence in practice runs as follows. The legitimate registrant contacts the original registrar first, reporting the unauthorized transfer and requesting that it notate the dispute in the RDDS record and notify the receiving registrar. The legitimate registrant then contacts the receiving registrar directly, providing evidence of the compromise – account access logs, identity documentation, and any fraud report lodged with Australian authorities. Most reputable registrars will impose a precautionary lock on receipt of credible evidence. But "most" is not "all," and the receiving registrar has no contractual obligation to the dispossessed registrant. That is where auDA and formal escalation enter.

If a registrar lock is in place but no resolution is moving, the options ahead divide into the auDRP and the courts. For a read on which route fits your evidence and timeline, contact info@cognomenlaw.com.

When does the auDRP apply to a registrar-lock dispute, and when does it fall short?

The auDRP is well suited to abusive-registration disputes – a party who registered the domain intending to profit from a brand's trademark rights, or who is using a domain to attract confused consumers. It is less well suited to domain-theft disputes, where the issue is not the legitimacy of the original registration but the validity of an intervening transfer. Panels have noted this distinction in the context of analogous disputes under the UDRP: the Policy is a complaint mechanism, not a title-recovery mechanism, and it presupposes that the named respondent is the current registrant making a claim of legitimate interest.

Where an unauthorized transfer has occurred and the thief is the current registrant, the complainant can frame the auDRP complaint around the thief's lack of rights and the bad-faith nature of the transfer-and-use. Panels have accepted such complaints where the evidence of compromise is clear. But there is a procedural complication: the auDRP, like the UDRP, only produces a transfer order. It does not freeze assets, award damages, or compel anyone to produce evidence. If the current registrant simply defaults – files no response and provides no information – the panel may transfer the domain on the complainant's evidence alone, which in a theft scenario may actually be the fastest path. Default rates in domain theft cases are comparatively high precisely because the thief has no plausible story to tell.

Where the theft involved a third party in a different jurisdiction, or where the receiving registrar itself is not cooperating with a precautionary lock, the auDRP's reach has limits. An auDRP transfer order is implemented by the registrar of record. If that registrar is not an auDA-accredited registrar and the domain has been transferred to an overseas registrar in breach of the .au transfer rules, implementation may require separate enforcement action. This is the scenario in which Australian court jurisdiction becomes not merely useful but necessary.

What evidence decides the outcome at each stage of escalation?

Evidence is the variable that determines which escalation path is viable, how long it takes, and whether a registrar imposes a precautionary lock without a formal demand. At each stage, the evidentiary bar is different.

At the registrar stage, the threshold is credibility, not proof. A registrant who provides contemporaneous account-access logs showing a login from an unrecognized IP address or device, a fraud report reference number from the Australian Federal Police or a state police force, and original registration documentation (the auDA eligibility credential, the ABN or trademark reference) will almost always obtain a precautionary lock from a cooperative receiving registrar within a matter of days. The point is not to prove the case; it is to demonstrate that a genuine dispute exists and that further transfer would expose the registrar to liability.

At the auDRP stage, the complainant must satisfy the three elements affirmatively. For a theft-based complaint, element one (confusing similarity) is trivial if the stolen domain is the complainant's own name. Element two (no rights or legitimate interests) is equally straightforward where the respondent is a thief with no auDA eligibility. Element three requires evidence that the registration-as-it-now-stands – or the use – is in bad faith. Panels have found bad faith on the basis of: the domain being offered for sale to the original owner or to third parties at a marked-up price; the domain being used to impersonate the original registrant or to redirect traffic; and passive holding combined with implausible denial of knowledge of the original registrant's rights.

At the court stage, the evidentiary standard is higher and the discovery tools are broader. An applicant for an interlocutory injunction – the Australian equivalent of a temporary restraining order – must show a serious question to be tried, that the balance of convenience favors the grant, and that damages would not be an adequate remedy. For a stolen domain that is live and redirecting customer traffic, each of those elements is typically arguable. A court can also order third-party disclosure from a registrar that the auDRP cannot compel.

In a matter we handled in late 2024, a .com.au domain was transferred out of a client's account after credential compromise. The receiving registrar refused to impose a voluntary lock despite credible evidence. We escalated to an auDA complaint and simultaneously filed for an urgent interlocutory order in the relevant Australian court. The court's interim order froze further transfer within days; the auDRP complaint proceeded concurrently and produced a transfer order roughly eight weeks later. The combination – interim relief from the court plus a formal auDRP transfer order – gave the client a durable result. Neither route alone would have been as fast or as complete.

How does the court route compare to the auDRP for .au lock escalation?

The right escalation path depends on what you need, how quickly you need it, and what you can prove. No route is universally superior.

If the domain was registered by an identifiable party in bad faith (a cybersquatter, not a thief), and that party is in Australia or has submitted to the auDA dispute process, the auDRP is normally the faster and cheaper route. The filing fee is modest by international standards, the process is paperless, and a decision is typically available within a period comparable to the UDRP – commonly within about two months. The only remedy is transfer or cancellation; if damages matter, the court is the only route.

If the domain was stolen, the receiving registrar is uncooperative, or the domain is actively being used to defraud the original registrant's customers – diverting invoices, intercepting email – time is the dominant variable. Courts can grant interim relief within days. The auDRP cannot. The trade-off is cost and complexity: Australian court proceedings require local litigation counsel and carry fees that scale with the complexity of the matter. These are substantially higher than auDRP filing fees and are best treated as hourly-billed contingencies. Where the domain is core infrastructure for a business – a primary domain carrying email, e-commerce, and brand identity – that cost may be well justified by the daily revenue and reputational loss the theft is producing.

A third scenario is less common but worth noting. The domain was transferred through a chain of registrars, the current holder is offshore and unidentifiable, and neither the auDRP respondent nor a court defendant can be properly served. In that situation, the auDA policy framework for domain recovery – including auDA's own administrative channels – may be the only practical option. We have advised registrants in this position that the realistic outcome is not immediate recovery but stabilization: a lock imposed by auDA's registrar compliance process that prevents further outbound movement while identity is established.

If you need to weigh the auDRP against an urgent court application for your .au domain, email info@cognomenlaw.com to compare the routes for your specific facts.

What is the minority or contrary panel view on bad faith in auDRP theft cases?

Not all panels accept a straightforward theft-and-transfer complaint as a clean fit for the auDRP. The contrary view – present in a minority of decisions under analogous UDRP reasoning, which panels sometimes import into auDRP analysis – holds that the Policy was designed to address registration in bad faith by the registrant, not to adjudicate title disputes that arise from a subsequent unauthorized transfer. On this view, the proper respondent in a theft case is not before the panel (because the legitimate registrant is the one who filed the complaint), and the panel is being asked to determine a question of title that belongs in court.

Panels holding this minority position tend to dismiss complaints in theft scenarios and direct the complainant to the courts. The practical consequence is that a complainant who files an auDRP complaint without anticipating this objection may lose several weeks before a dismissal that sends them to the very court route they deferred. We address this risk by advising clients on the specific panel-selection considerations that arise in auDRP proceedings – and, where the theft scenario is ambiguous or the respondent may raise this objection, by preparing the court filing in parallel rather than in sequence.

The consensus view is that clear, well-documented theft cases do succeed in the auDRP where default is likely, but the minority position is real and should not be dismissed as fringe. Sophisticated respondents – and the advisers who appear for them in disputed cases – will raise it.

What are the realistic outcomes and what should a registrant expect at each stage?

Outcomes at the registrar stage range from a voluntary precautionary lock within days to a polite refusal that requires escalation. There is no binding obligation on the receiving registrar to freeze a domain on the complaint of a third party; cooperation is a matter of policy and risk tolerance, not legal obligation. Registrars accredited under the auDA framework are subject to auDA's registrar agreement, which does impose some obligations around unauthorized transfers, but enforcement of those obligations against an uncooperative registrar again requires auDA's own compliance process or a court order.

Outcomes at the auDRP stage, assuming a well-evidenced complaint against a thief-respondent who defaults, are typically a transfer order. The timing from filing to transfer is comparable to the standard UDRP timeline. Implementation requires a cooperative registrar. If the receiving registrar refuses to implement an auDRP transfer order, enforcement requires a court.

Outcomes at the court stage are fact- and judge-dependent. Interlocutory relief is not guaranteed; an applicant who cannot demonstrate urgency convincingly may be told to return on full evidence. But Australian courts are familiar with domain-theft scenarios and with the business-critical nature of a primary domain. A registrant who can show lost revenue, customer confusion, or ongoing fraud has a strong platform for an urgent application.

No escalation path guarantees recovery. Each turn depends on the evidence you present, the conduct of the current registrant, and the forum's willingness to act at the pace the situation demands.

In a second matter from spring 2025, a .net.au domain used for a professional-services firm's client portal was transferred out after a phishing attack on the firm's IT administrator. The domain was immediately pointed at a credential-harvesting page. We secured a registrar lock at the receiving registrar within 48 hours on the strength of the phishing report and the server logs, filed an auDRP complaint the following week, and the domain was returned under a transfer order approximately seven weeks later. The credential-harvesting page had been taken down by the hosting provider before the auDRP decision – but that did not resolve the title question; the transfer order did.

Related at COGNOMEN

• Court recovery and domain theft: escalation, injunctions, and transfer reversal
• FAQ: reversing an unauthorized domain transfer in .tv and other ccTLDs
• Case study: choosing between URS and UDRP for a .io domain dispute