Step-by-step: recover a .biz domain used for phishing

A phishing operator registers a domain that mirrors your brand in .biz — shifting one letter, adding a word — and uses it to intercept customers, spoof invoices, or harvest credentials. You want it gone, and ideally transferred to you. The question is not whether the law supports that result. The question is whether you build the record correctly, in the right forum, before the damage compounds.

To recover a .biz domain used for phishing, a brand owner files a UDRP complaint before WIPO or another accredited provider. The UDRP applies to .biz as a gTLD. You must prove all three elements of Paragraph 4(a): confusing similarity to a mark you hold, no legitimate interest on the registrant's side, and registration plus use in bad faith. A phishing use is among the clearest bad-faith signals in the consensus case record. A standard single-member panel case runs about two months from filing; the WIPO filing fee begins at USD 1,500.

This guide walks each step in order, flags the trap concealed in each one, and addresses what evidence actually decides the outcome.

Why the UDRP applies to .biz — and what it can (and cannot) do

The UDRP applies to .biz because the registry is ICANN-accredited and has adopted the Policy as a mandatory condition of registration. That means every .biz registrant agreed, at the moment of registration, to submit to a UDRP proceeding brought by a party with trademark rights. There is no opt-out and no territorial jurisdiction question to resolve first.

The remedies are limited by design. A UDRP panel may order only two outcomes: transfer of the domain to the complainant, or cancellation. There are no monetary damages. There is no injunction against the registrant's other conduct. If you need compensation for fraud losses, or you want to sue for trademark infringement, a UDRP proceeding does not reach that. A separate court action — in our practice, handled with local litigation counsel in the relevant jurisdiction — is the vehicle for damages claims.

That limitation matters tactically. Where phishing is active and ongoing, a UDRP transfer stops the domain-based attack vector. It does not shut down the actor's email infrastructure or their other domains. Do not treat a UDRP transfer as the end of the threat assessment — treat it as one component of a broader response.

The trap at this step: brand owners sometimes wait for conclusive forensic attribution before filing. The UDRP does not require you to identify the individual behind the registration. It requires you to prove bad faith in the domain's registration and use. A phishing page, a spoofed login portal, or a malicious email header tracing back to the domain is typically enough to establish use. Delay allows the operator to cycle content, delete evidence, or transfer the domain to a new registrant — restarting the clock and the dispute.

Step 1: Confirm your trademark rights — the first UDRP element

The first element of Paragraph 4(a) requires that the domain be identical or confusingly similar to a trademark or service mark in which you have rights. This element is normally the easiest to satisfy, but it contains the most common administrative trap in a phishing scenario.

Panels assess confusing similarity on a visual and phonetic comparison between the domain (stripping the TLD) and your mark. A typosquat — one transposed letter, a hyphen inserted, a generic word appended — almost always meets the test. A homograph (a character that looks like a Latin letter but is encoded differently) requires additional evidence of visual similarity, but panels have consistently found that deceptively similar strings satisfy the element.

The trap: rights must exist as of the date the complaint is filed. If your mark is unregistered, you may still satisfy this element by demonstrating common-law trademark rights through evidence of use, recognition, and secondary meaning. That evidence must be assembled before filing — not promised in the complaint as a document to be produced. A complaint filed without a registrations certificate or a substantiated common-law rights exhibit routinely fails at element one, wasting the filing fee and alerting the phishing operator.

Practical check: pull your trademark registration certificate and verify the goods/services match the industry context in which the phishing attack occurred. A registration in Class 9 for software does not automatically support a complaint about phishing of financial services customers, even if the brand is recognizable. Scope matters.

Step 2: Build the legitimate-interest record — the second element

The second UDRP element requires the complainant to establish a prima facie case that the registrant has no rights or legitimate interests in the domain. The burden then shifts to the registrant to produce evidence of a legitimate interest. In a phishing scenario, that shift is decisive — no legitimate business operates a credential-harvesting site.

Paragraph 4(c) of the UDRP lists the principal safe harbors: a bona fide offering of goods or services before any notice of the dispute; being commonly known by the domain name; and legitimate noncommercial or fair use without intent to mislead or tarnish. A phishing operator cannot plausibly rely on any of these. Panels have consistently held that a fraudulent use of a domain — one designed to deceive consumers — cannot constitute a bona fide offering regardless of when it began.

The trap here is evidentiary, not legal. To make the prima facie case, you need a contemporaneous record of what the domain was actually doing — not just an assertion that it "appeared to be" a phishing site. Screenshots with visible URL bars, WHOIS/RDDS records timestamped to the relevant period, email header logs showing the domain in the spoofed sender address, and any consumer complaints received are the materials that turn an assertion into a record. Panels do not conduct their own investigation. They decide on the record you submit.

We regularly advise brand owners who discover phishing domains to treat the first 24 to 48 hours as an evidence-collection window. Capture the live site. Download the page source. Log the IP. If the site is still returning content, that content is your exhibit. If it has gone dark before you file — common once the operator detects attention — the absence of content raises, but does not resolve, the legitimate-interest question. You will need supplemental indicators: prior-consumer-complaint records, threat-intelligence feeds, DNS history tools, or abuse-report logs from your email security vendor.

Assessing whether your evidence package is strong enough before filing is worth an hour of focused review. For an assessment of your domain dispute, contact info@cognomenlaw.com.

Step 3: Establish bad faith in registration and use — the third element

The third UDRP element is conjunctive: the domain must have been registered and used in bad faith. Both limbs must be satisfied. This is the element where a phishing case is typically strongest — but also where a poorly assembled complaint can still fail.

Paragraph 4(b) lists non-exhaustive bad-faith circumstances. In a phishing scenario, the most directly applicable are: registration primarily to disrupt the complainant's business; and intentional use to attract users for commercial gain by creating a likelihood of confusion with the complainant's mark. Panels have also treated fraudulent impersonation — using a domain to deceive consumers into believing they are dealing with the brand owner — as paradigmatic bad faith, even where no direct financial gain to the registrant is visible on the record.

The registration limb requires showing that, at the moment of registration, the registrant acted in bad faith. Where a domain is an obvious typographical variant of a famous or well-known mark, panels regularly infer that the registrant knew of the mark at registration. Where the mark is less prominent, you must affirmatively show awareness — through geographic proximity, industry-specific recognition, or the specificity of the phishing target (a spoofed login page for your specific product, for example, demonstrates knowledge).

The use limb is where your evidence of the phishing activity carries its primary weight. A live phishing page, a spoofed sender domain, an MX record pointing to mail infrastructure, consumer-reported deception — each element supports the use finding. In a recent matter (a .biz phishing domain targeting a financial services brand, autumn 2025), we assembled a record combining RDDS history, a threat-intelligence report, and forwarded phishing emails from affected customers. The panel found bad faith on both limbs without requiring us to attribute the fraud to a named individual.

The trap: do not overlook passive holding. If the phishing campaign has already ended and the domain now resolves to a blank page, panels may still find bad faith where the domain's obvious target was your mark and no credible alternative use is apparent. Document the historical use before the site went dark.

Step 4: Choose the forum and file the complaint

For a .biz domain, the UDRP-accredited providers are WIPO, the Forum, the Czech Arbitration Court (CAC), and the ADNDRC. The choice of forum shapes the filing fee, the panel pool, and in some cases the response culture. WIPO and the Forum together handle roughly 97% of all UDRP proceedings. For a phishing case, both are appropriate, but the practical considerations differ.

WIPO charges a USD 1,500 filing fee for one to five domains before a single-member panel, and USD 4,000 for a three-member panel in that range. The Forum's single-member fee begins around USD 1,300 for one to two domains. CAC is the lowest-entry option, beginning around USD 500 to 800. For a straightforward phishing dispute with clear bad faith, a single-member panel at WIPO or the Forum is typically sufficient.

Should you request a three-member panel? In a phishing case, single-member panels almost always suffice. Three-member panels cost more and take marginally longer. Request a three-member panel if the case involves a significant monetary value beyond the domain itself, a genuinely contested question of trademark scope, or a respondent likely to challenge the outcome in court. Phishing disputes rarely present those facts.

The complaint itself must include: the domain at issue; the registration history; your trademark rights evidence; the bad-faith evidence; a certification of accuracy; and a request for the remedy sought (transfer, not just cancellation, if you want the domain in your portfolio). Once filed and accepted, the provider commences the proceeding and notifies the registrant. The registrant then has 20 days to file a response. Default — filing nothing — is common in phishing cases, because the registrant cannot credibly defend a fraudulent use. Default does not mean automatic transfer; the panel still reviews the complaint on its merits.

The trap: WIPO's partial refund of approximately USD 1,000 of the USD 1,500 filing fee is available only if the case is withdrawn or terminated before panel appointment. If you discover a fatal defect in your complaint after panel appointment, there is no refund and no restart. File correctly the first time.

Step 5: Manage the response window and anticipate the registrant's moves

The 20-day response window is fixed by the UDRP Rules. In a phishing matter, the most common scenario is default — the registrant files nothing. But a fraction of phishing operators do respond, and the responses follow recognizable patterns.

The most common defensive move is a claim that the domain was registered for a generic descriptive purpose unrelated to your brand. A .biz domain combining a common noun with your industry — "securepayments," "accountverify," "trustedlogin" — may generate this argument. The counter is the specificity of the phishing attack: if the registrant's "generic" site was in fact a pixel-for-pixel replica of your login page, the generic-intent argument collapses. A second defensive move is a claim that the complainant's mark postdates the registration. Check the registration date against your priority date before filing; if that gap is close, address it in the complaint rather than waiting for the response.

If the respondent requests a three-member panel after a complainant selected a single-member panel, the parties generally split the higher three-member fee. Budget for that possibility, particularly where the domain has obvious commercial value beyond the phishing use.

We have defended registrants in UDRP proceedings — and we understand the respondent's playbook from both sides. In a phishing case, the respondent has almost no credible route to element two. A well-assembled complaint leaves that defensive space very narrow.

Step 6: The decision and what happens after

A standard UDRP case before WIPO or the Forum is typically completed within about two months of filing, absent procedural complications. Once the panel issues its decision, the registrar is notified. A mandatory ten-business-day grace period follows, during which the losing registrant may seek a court stay in the jurisdiction of the registrar or the domain holder. If no stay is obtained, the registrar implements the transfer.

In practice, phishing operators rarely seek court stays. The registration is typically made with false WHOIS/RDDS contact details — a characteristic that itself supports the bad-faith finding — and the registrant has no credible legal position to defend in a national court. The domain transfers, and the phishing attack vector tied to it is neutralized.

What to do after transfer? First, take the domain to a secure registrar under your own account. Set the DNS to a controlled page — a holding page or a redirect to your legitimate site — and monitor the email infrastructure for residual inbound traffic. Phishing campaigns sometimes produce mail queued against the domain even after it transfers; that traffic carries forensic value. Second, file the domain in your brand-protection monitoring system to catch future near-miss registrations before they can be weaponized. Third, if the phishing attack produced consumer harm — fraud complaints, credential theft, reputational damage — evaluate whether anticybersquatting litigation or other civil remedies in the relevant jurisdiction are warranted. That path involves local litigation counsel and is outside the scope of a UDRP proceeding, but it is not foreclosed by a UDRP transfer.

In a recent matter (a .biz phishing campaign targeting a retail payments brand, spring 2025), the domain transferred approximately eight weeks after filing. The operator had already abandoned the phishing page. Our client redirected the domain to their fraud-awareness page, capturing residual inbound traffic and turning the evidence of the attack into a consumer-protection communication.

If a phishing domain is active now, each day of delay is a day of potential consumer harm. For a read on whether the three UDRP elements are met, reach us at info@cognomenlaw.com.

Cross-zone considerations: what if the attack spans multiple domains?

Phishing operators rarely stop at one domain. A coordinated campaign may deploy a .biz domain alongside a .com variant, a new-gTLD string (.bank, .secure, .online), or a ccTLD in the target market. Each zone requires a separate analysis.

For other gTLDs — .com, .net, .org, .online — the UDRP applies directly, and a single UDRP complaint may cover multiple domains if the registrant of record is identical. That condition is important: if the operator has distributed the domains across different registrant names (a common tactic), each group must be filed separately or the complaint will be rejected for improper consolidation.

For URS (Uniform Rapid Suspension), available for new-gTLD domains, the remedy is suspension — not transfer — and the evidentiary standard is higher. URS is faster and cheaper, but it does not put the domain in your portfolio. For a phishing domain you want to control and monitor, a UDRP transfer is the stronger outcome.

For ccTLDs, the picture is more varied. A .de domain dispute proceeds through the German courts, with a DENIC DISPUTE entry available to block transfer while the claim is pending — there is no UDRP equivalent. A .uk domain goes through the Nominet DRS, which tests for "abusive registration" and reads the bad-faith limb as registration or use — a lower standard than the UDRP's cumulative requirement. A .eu domain is handled through ADR.eu at the Czech Arbitration Court, with eligibility requirements for the complainant. Each requires a separate filing and a separate strategy.

The decision on route depends on the remedy you need and the timeline. If the .biz domain is the active attack vector and the others are dormant near-misses, start with the .biz UDRP and file the others in parallel if resources allow. Waiting for one outcome before filing the next gives the operator time to reload the dormant strings.

Related at COGNOMEN

• UDRP recovery services — assess your complaint, select your forum, and file
• Recovering a typosquat domain — strategy for brand-identical near-misses
• Defending a generic domain against a UDRP complaint at .org

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.