Case study: bring a court action when UDRP cannot reach a .au domain

Case study: bring a court action when UDRP cannot reach a .au domain. UDRP and ccTLD domain recovery and defense across .au. Email the firm to assess your case.

A brand owner in the technology sector discovered, in early 2026, that the .au domain matching its registered Australian trademark had been transferred away from its account without authorization. The registrant of record was now an entity the brand owner had never heard of. The domain was resolving to a phishing page designed to intercept customer login credentials. Time was the immediate problem: every hour the page remained live caused measurable commercial harm.

When a .au domain is involved in a dispute, the governing instrument is the auDRP – Australia's adaptation of the UDRP, administered under its own rules and closely tracking the three UDRP elements. However, where the domain has been stolen rather than registered abusively by a third party, arbitration under the auDRP may not reach the full remedy needed. A court action, coordinated with a registrar-escalation and transfer-reversal request, is often the more direct path to recovery and to stopping ongoing harm.

This case study walks through the situation, the strategy chosen, and the outcome – with notes on what the evidence record looked like and what a brand owner facing the same facts should do next.

Situation: a stolen .au domain and a phishing page

The client held the .au domain through an Australian registrar and had done so for several years. The domain was central to its customer-facing operations: email, invoices, and the main product site all ran through it. In autumn 2025, the client's IT team noticed an anomalous outbound authentication request from the registrar account. By the time the account password was reset, the domain's WHOIS record had already been changed and a transfer had been initiated to a second registrar. The transfer completed before any lock could be placed.

The new registrant was a shell entity with no apparent business presence. The domain was pointed, within hours of the transfer, at a convincing clone of the client's own website – designed to capture customer credentials and payment data. We were contacted roughly 36 hours after the transfer completed.

The immediate question was not which arbitration forum to file with. It was how to get the domain offline and back under the client's control before further harm occurred.

Why the auDRP alone was not the right route here

The auDRP tracks the three-element UDRP structure: confusing similarity to a mark, absence of legitimate interest, and bad faith in registration or use. In ordinary cybersquatting cases – where a third party registers a domain that conflicts with a brand owner's mark – the auDRP is an efficient, cost-effective path. Standard cases are decided in a matter of weeks.

This situation was different for two reasons. First, the "registrant" was a stolen-account artifact: the domain had not been independently registered by a cybersquatter; it had been taken from the rightful holder through an account compromise. The dispute was fundamentally one of unauthorized transfer, not of abusive registration. Second, the ongoing phishing operation created criminal-law and consumer-protection dimensions that an arbitration panel has no power to address. A panel under the auDRP – or the UDRP – can transfer or cancel a domain. It cannot compel a registrar to act on an emergency basis, it cannot seek injunctive relief, and it cannot coordinate with law-enforcement referrals.

Court action, by contrast, offered injunctive relief on an expedited basis, the ability to compel the receiving registrar to lock the domain pending resolution, and a judgment that could support a law-enforcement referral. We advised the client that the arbitration route would be slower and would not reach all the harm in play.

For an assessment of whether your .au situation calls for court action, registrar escalation, or an auDRP filing, contact info@cognomenlaw.com.

Strategy: registrar escalation plus court action

We moved on two tracks simultaneously. On the first track, we prepared a detailed registrar-escalation package addressed to both the original registrar (through which the account had been compromised) and the receiving registrar (which now held the registration). That package documented the account compromise chronologically: the anomalous authentication event, the timestamps of the WHOIS changes, the transfer initiation and completion, and the absence of any authorization from the legitimate account holder. Many registrars have internal abuse procedures that move faster than any formal dispute mechanism when presented with clear evidence of unauthorized transfer. The receiving registrar placed a clientHold on the domain within approximately 48 hours of receiving our submission.

On the second track, we coordinated with local litigation counsel in Australia to prepare an urgent application for injunctive relief in the relevant Australian court. The application sought an order directing the receiving registrar to maintain the domain lock pending the hearing, and an order directing restoration of the domain to the original registrant once the lock was confirmed. The evidence before the court included the authentication logs, a forensic summary of the account compromise, historical WHOIS records establishing years of continuous ownership by the client, and the client's Australian trademark registration.

The court's interim order was granted within a few days of the application. That order, combined with the registrar's clientHold, effectively neutralized the phishing page. The domain was no longer resolving to any active content.

Evidence that decided the outcome

Several categories of evidence proved decisive. Authentication and access logs from the registrar account – showing the anomalous login event originating from an IP address in a jurisdiction the client had never operated in – established the unauthorized-access fact clearly. Without those logs, the claim that the transfer was unauthorized would have rested on assertion alone.

Historical WHOIS and registrar records, pulled by our team before the new registrant had any opportunity to alter them further, confirmed unbroken ownership by the client from the original registration date. Domain age and continuous use records carry significant weight in both court and arbitration proceedings in this context.

The client's Australian trademark registration provided the legal nexus the court needed to connect the brand harm to the domain. Without a mark, the court action would have needed to proceed on a narrower unauthorized-computer-access theory alone – workable, but slower and less certain in outcome.

Finally, the technical evidence of the phishing operation itself – screenshots, DNS propagation records, and a brief forensic note on the credential-capture mechanism – supported both the injunctive relief argument (ongoing irreparable harm) and the law-enforcement referral that followed the recovery.

Outcome and lessons for brand owners

The domain was restored to the client's registrar account within approximately three weeks of our initial instruction, a timeline that would have been difficult to match through arbitration alone. The phishing operation was disrupted within the first 48 hours through the registrar escalation. The client suffered no further credential-interception events after the clientHold was placed.

What does this case teach? Four points stand out. First, when a .au domain is stolen rather than abusively registered, the arbitration route and the court route serve different functions – and the correct choice depends on the specific harm and the speed required. Second, the registrar-escalation track should run in parallel with, not sequentially after, any formal proceeding: it is frequently faster and can neutralize the operational harm while the legal process runs. Third, authentication logs and WHOIS history are the foundation of the evidence record; preserving them immediately on discovery of a compromise is essential. Fourth, a registered trademark in the relevant jurisdiction materially strengthens both the registrar submission and the court application.

To plan recovery of a stolen or hijacked .au domain – including whether court action, registrar escalation, or an auDRP filing is the right first step – contact info@cognomenlaw.com.

Related at COGNOMEN

• Court action and domain theft recovery – full service overview
• Alert: enforcing a UDRP decision in the .au zone
• FAQ: responding within the deadline in cross-border ccTLD disputes