Case study: recover a typosquatted .br domain
A brand owner in Latin America found a near-identical copy of its registered mark sitting at a .br domain — one letter transposed, parked on a page mimicking its checkout flow. Customers were landing there by accident. Some were submitting payment details. The brand had to act fast, and the clock was already running.
To recover a typosquatted .br domain, the governing procedure is the SACI-Adm process administered by CGI.br, Brazil's Internet Steering Committee. Like the UDRP, it requires proof of all three core elements: a confusingly similar domain, no legitimate interest on the registrant's part, and registration or use in bad faith. The process typically resolves within a matter of weeks from filing, and the available remedy is transfer or cancellation — not damages. This case study shows how those elements were built and what decided the outcome.
Below: the situation, the strategy we applied, and the result — anonymized throughout, with no real names or case numbers.
What Was the Situation?
A mid-sized Brazilian consumer brand discovered in early 2025 that a single-character typosquat of its .br domain had been registered by an unknown party. The registrant's identity was masked behind a privacy proxy. The infringing domain resolved to a near-perfect replica of the brand's own site, including a cloned login page and a spoofed payment form.
The brand held a registered trademark in Brazil covering its core goods category. The .br domain for its actual name had been in continuous use for several years. The typosquatted domain was younger — registered within weeks of the brand's most recent product launch, a timing detail that would later carry significant weight.
What made the matter urgent was user harm. Several customers had submitted credentials through the fake page before the brand became aware of the situation. The brand engaged COGNOMEN in late spring 2025, requesting both immediate registrar-level escalation and an assessment of the formal dispute route.
What Was the Strategy?
We began with a parallel approach. First, we documented the infringing content through timestamped screenshots and RDDS records before the registrant could alter or take down the site. Evidence that disappears before filing can leave a complaint with no record of actual bad-faith use. Preservation came first.
Second, we assessed the governing procedure. The .br zone sits under Registro.br, which operates the SACI-Adm dispute system — Brazil's own administrative procedure, distinct from the standard UDRP that applies to .com and other generic top-level domains. SACI-Adm tracks the three-element logic of the UDRP but applies Brazilian-specific eligibility rules and is conducted before appointed arbitrators recognized by CGI.br.
The three elements were clear on the facts. On identity or confusing similarity, the typosquat differed from the brand's registered mark by a single transposed letter — panels consistently find such variations confusingly similar to the underlying mark. On legitimate interest, the registrant had no trade history, no business under that name, and the domain was used solely to impersonate the brand's site. On bad faith, the combination of the replica page, the proximity to the product launch date, and the phishing-oriented content satisfied multiple bad-faith indicators recognized in administrative proceedings of this kind.
We prepared a structured complaint assembling: the trademark registration certificates, a chronology of the brand's prior domain use, the RDDS records showing registration date relative to the launch, the archived screenshots of the fake checkout page, and a brief tracing the consumer harm to the registrant's conduct. The registrant was given the standard window to file a response.
If a .br typosquat mirrors a brand's live site and collects user data, the urgency is not only legal — it is operational. Preservation of evidence and rapid registrar notification run in parallel with, not after, the formal filing.
No response was filed. The panel proceeded on the complaint record alone.
If your brand has a .br typosquat in circulation — or a phishing replica in any zone — the first step is an evidence audit, not a demand letter. For an assessment of your domain dispute, contact info@cognomenlaw.com.
What Was the Outcome?
The panel ordered transfer of the domain to the brand owner. The decision rested primarily on the bad-faith use — the replica checkout page was treated as conclusive evidence of an attempt to attract users through confusion for commercial gain, one of the classic bad-faith indicators recognized under the UDRP and equivalent national procedures. The timing of registration, immediately following the product launch, reinforced the finding that the registrant had targeted the brand deliberately.
The full process — from our initial filing to the registrar's implementation of the transfer — ran approximately eight weeks. That timeline included the response window and the panel's deliberation period. There were no procedural complications, no supplemental filings, and no appeal.
The brand also pursued a parallel registrar-abuse notification, which resulted in temporary suspension of the phishing page within days of the complaint being filed — before the administrative process ran its course. The two tracks operated independently but produced complementary relief.
What decided the matter was not the strength of the trademark alone. It was the completeness of the evidence package: the archived pages, the RDDS timestamps, the registration timeline, and the direct documentation of consumer harm. In proceedings where the registrant defaults, the quality of the complaint record is everything.
To weigh UDRP against a court action for your case, or to plan a filing before a ccTLD procedure, email info@cognomenlaw.com.
Related at COGNOMEN
Frequently asked questions
What was the situation?
A mid-sized Brazilian brand discovered that a single-character typosquat of its .br domain — registered by an anonymous party — was running a cloned version of its site, including a spoofed payment page harvesting customer credentials. The brand held a registered Brazilian trademark. The infringing domain had been registered shortly after a major product launch, which was central to the bad-faith finding.
What did the firm do?
COGNOMEN preserved the infringing content through timestamped RDDS records and archived screenshots before filing. We assessed the SACI-Adm procedure governing .br disputes, built the complaint across the three required elements — confusing similarity, no legitimate interest, and bad faith — and filed a structured evidence package. We also coordinated a parallel registrar-abuse notification that suspended the phishing page within days of filing.
What was the outcome?
The panel ordered transfer of the domain to the brand owner in approximately eight weeks from filing. The registrant did not respond. The decision turned on the replica checkout page and the registration timeline relative to the product launch. A parallel registrar-abuse track produced interim suspension of the phishing content ahead of the formal decision.
Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.