FAQ: recover a .dev domain used for phishing

What does it mean to recover a .dev domain used for phishing?

Recovery means obtaining a UDRP transfer order that moves the domain from the current registrant to the complainant — or, if the complainant does not want to hold the domain itself, cancellation of the registration. Phishing use means the domain is being operated to deceive users: typically by mimicking a legitimate brand's login page, payment portal, or communications infrastructure to steal credentials or funds. Under Paragraph 4(b) of the UDRP, using a domain to attract users by creating a likelihood of confusion with the complainant's mark — including for fraudulent or harmful purposes — is an express bad-faith indicator. Panels have consistently treated active phishing use as a strong, often decisive, bad-faith finding. Recovery does not produce damages or an injunction; those require court action in the relevant jurisdiction.

What is the legal basis for recovering a .dev domain under the UDRP?

The .dev registry has adopted the UDRP, so the standard ICANN dispute process applies. A complainant must satisfy all three elements of Paragraph 4(a) cumulatively: (1) the disputed domain is identical or confusingly similar to a trademark or service mark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain was registered and is being used in bad faith. In a phishing scenario, element three is usually the strongest: active use to deceive users squarely fits the Paragraph 4(b) confusion-for-gain language, and panels have also applied the Paragraph 4(b) pattern-of-abuse factor where multiple domains are involved. Element two follows naturally — no legitimate operator runs a credential-harvesting site. Element one requires that you hold a trademark, whether registered or, in some jurisdictions, established by use, that the domain replicates or closely resembles.

What evidence is needed to recover a .dev domain used for phishing?

Evidence of your trademark rights comes first — a registration certificate, or documented common-law use establishing distinctiveness if registration is absent. Screenshots of the phishing page, captured with timestamps and preferably via an independent archiving service, form the core of the bad-faith record. WHOIS or RDDS data showing registration date relative to your mark's first use matters: registration after your mark was publicly known strongly supports an inference of targeting. Any communications from the registrant — ransom demands, spoofed emails sent from the domain — are highly persuasive. Network-level data showing the domain resolves to a known malicious IP address or hosting infrastructure can reinforce the panel's view. Where the phishing operation is active and causing ongoing harm, a complainant may also request a registrar lock through registrar abuse-reporting channels in parallel with the UDRP filing — these are separate processes that do not replace the dispute proceeding but can limit immediate damage.

How long does it take to recover a .dev domain used for phishing?

A standard UDRP proceeding at WIPO runs about two months from filing to a panel decision. The registrant has 20 days to file a response after formal commencement; if no response is filed — common in phishing cases, where the registrant has no legitimate story to tell — the case proceeds on the complaint alone. After the response period closes, a single panelist is appointed and typically delivers a decision within two weeks of appointment. The registrar then implements the transfer or cancellation, usually within ten business days of the decision becoming final. WIPO also offers an expedited procedure for straightforward single-panel cases covering up to five domains, which can deliver a decision in roughly one month. That option is worth considering when the phishing harm is ongoing. No procedure — UDRP or otherwise — guarantees a specific timeline; panel workloads and any supplemental filing requests add time.

What does it cost to recover a .dev domain used for phishing at WIPO?

WIPO's filing fee for a single-panel complaint covering one to five domains is USD 1,500. A three-member panel raises the fee to USD 4,000. If you withdraw before panel appointment, WIPO commonly refunds approximately USD 1,000 of the single-member fee. Legal fees for preparing and filing a straightforward UDRP complaint are separate from the forum fee; market rates for single-domain, clear-cut matters typically fall in the USD 3,000–7,000 range, though the actual cost depends on the complexity of the trademark record, the number of domains, and whether a response is filed. The Forum (formerly the National Arbitration Forum) is an alternative provider with fees beginning around USD 1,300 for one to two domains, single-member panel. WIPO and the Forum together handle roughly 97% of all UDRP filings. The Czech Arbitration Court (CAC) offers a lower entry fee — around USD 500–800 — but is less commonly used. No cost awards are available under the UDRP: even if the registrant is clearly a phishing operator, you cannot recover your legal expenses through the proceeding.

Can I recover a .dev domain used for phishing for more than one domain at once?

Yes, but with a condition. A single UDRP complaint may cover multiple domains where the registrant of record is the same holder. If a phishing campaign uses several .dev domains — or a mix of .dev and other gTLD domains — all registered to the same entity or individual, one complaint can address all of them simultaneously. Combining domains in one complaint is cost-efficient: WIPO's fee scales from USD 1,500 (one to five domains) to USD 2,000 for six to ten domains on a single-member panel, rather than multiplying the base fee per domain. Where different registrants appear in RDDS data despite what looks like a coordinated campaign, separate complaints are required. In phishing operations, privacy proxies or data-protection redactions are common; a panel can sometimes pierce these where the complainant provides evidence of a common actor, but the procedural default is to treat each listed registrant separately.

What are the possible outcomes when you recover a .dev domain used for phishing?

The UDRP offers exactly two remedies: transfer of the domain to the complainant, or cancellation of the registration. Transfer is the more common request. Cancellation is sometimes preferred when the complainant has no wish to hold the domain and simply wants it removed from use — though cancellation frees the name to be registered by anyone, including the same bad actor through a proxy, so transfer is usually the more durable outcome. A panel may also find in the registrant's favor if the complainant fails to establish all three elements — uncommon in a genuine phishing scenario, but possible if the trademark record is thin or the domain predates the mark. There is no monetary remedy available in the UDRP: no damages, no attorneys' fee award, and no injunction. If financial compensation for phishing harm is the goal, that requires separate litigation — in the United States, US anticybersquatting litigation is one route; elsewhere, the applicable national law governs and would be handled with local litigation counsel in the relevant jurisdiction. A Reverse Domain Name Hijacking finding against a complainant is theoretically available but rarely relevant in a genuine phishing scenario; it arises where a complainant files without a credible case to strip a legitimate registrant of a name.