Case study: reverse an unauthorized transfer of a .au domain

A technology consultancy based in Australia woke one morning to find its primary .au domain had been transferred to a registrant it had never heard of. The registrar account had been accessed overnight. The domain – the same string the firm had operated under for nearly a decade – was now pointing at a blank page under a different registrar, in a different name. The firm had roughly 48 hours before downstream damage became irreversible.

Reversing an unauthorized transfer of a .au domain requires moving on two tracks simultaneously: a registrar-escalation lock to freeze any onward movement of the name, and a legal record establishing that the original transfer was made without the registrant's authority. Under Australia's auDRP, the governing policy closely tracks the three UDRP elements, but the theft scenario does not always fit neatly into an arbitral complaint – a court route or a direct registry intervention may be faster. Evidence of account compromise is the decisive factor in every forum.

This case study walks through the situation, the strategy we applied, and what the outcome illustrates for any .au registrant facing the same emergency.

The Situation: What the Firm Found – and What It Had to Prove

The consultancy came to us in spring 2025, approximately 18 hours after detecting the unauthorized transfer. The firm had received no prior notice. Its WHOIS record now showed a natural person as registrant, with contact details pointing to a mailbox in a jurisdiction outside Australia. The domain was actively resolving – not parked, not blank – to a site mimicking the consultancy's own brand. Clients were already receiving phishing emails from the domain.

Two facts defined the legal position immediately. First, the firm held a registered Australian trademark for the name at issue. That trademark predated the original .au registration by several years. Second, access logs from the registrar account – retrieved within the first 24 hours – showed a login from an IP address in a foreign jurisdiction, followed by a transfer authorization that the firm's IT administrator had never submitted. That combination: a documented account compromise plus a prior trademark right, is exactly the evidentiary core every decision-maker in this space requires.

What the firm could not prove, at least not yet, was how the account credentials had been obtained. That gap mattered for sequencing.

The Strategy: Registrar Lock First, Legal Route Second

We escalated to the losing registrar within the first hour of engagement. A formal hold request, supported by the access-log evidence and the firm's trademark registration, was transmitted by authenticated email and followed by a phone call to the registrar's abuse team. The purpose was singular: prevent any onward transfer that would move the domain to a third registrar and introduce a bona-fide-purchaser argument. In our practice, that first escalation call regularly determines whether a transfer can be reversed in days rather than months.

The gaining registrar – the entity now holding the domain – was put on notice of the dispute simultaneously. Under the applicable registry rules for .au, a domain under active dispute may not be transferred again during the dispute window. That freeze bought the time needed for a structured decision on the legal route.

The auDRP was evaluated and set aside as the primary vehicle. The reason: the auDRP complaint process is calibrated for cybersquatting – a registrant who targeted the trademark deliberately – not for a post-compromise transfer in which the nominal registrant may be a shell or an unwitting participant. Proving the bad-faith elements against a party whose identity and connection to the theft was uncertain would have introduced delay and litigation risk. A direct application to the relevant Australian court, supported by the trademark ownership record and the access-log evidence, offered a faster and more targeted remedy: an interlocutory order preserving the status quo while the full matter was resolved.

We coordinated with local litigation counsel in the relevant jurisdiction to prepare the court application. The access-log evidence, the trademark certificate, the domain registration history showing the firm as original registrant, and a technical declaration from the firm's IT administrator were assembled within 72 hours of first engagement.

The Outcome: What the Evidence Decided

The interlocutory order was granted. The domain was placed under a court-ordered lock within approximately one week of the unauthorized transfer. Onward transfer was blocked. The phishing site was taken down through a parallel abuse report to the hosting provider, filed the same day as the court application.

Full restoration of the domain to the consultancy's registrar account followed within roughly three weeks of the original incident. No payment was made to any party holding the domain. The phishing campaign – which had already generated a handful of fraudulent client inquiries – was contained before any financial loss was confirmed by the firm's clients.

What decided the outcome was not the legal theory alone. It was the speed of the access-log retrieval and the quality of the technical evidence. Registrar logs are typically retained for a limited period. A firm that waits several weeks to engage counsel after discovering a compromise may find that the window for obtaining that evidence has closed. That is the single most consequential operational fact in a .au domain-theft recovery.

If you have discovered an unauthorized transfer of a .au domain or any other ccTLD name, the evidence window closes fast. Contact COGNOMEN at info@cognomenlaw.com to assess your recovery options before that window closes.

Related at COGNOMEN

• Court action and domain theft recovery across gTLDs and ccTLDs
• Registrar-lock escalation strategy and mechanics – analysis
• How to recover a passively held .uk domain – step-by-step guide

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.