Step-by-step: recover a .au domain from a serial cybersquatter

Step-by-step: recover a .au domain from a serial cybersquatter. UDRP and ccTLD domain recovery and defense across .au. Email the firm to assess your case.

A brand owner discovers that a .au domain matching its registered trademark is held by a registrant with a portfolio of dozens of similar registrations — names that shadow real companies, demand buy-back fees, and redirect traffic to pay-per-click landing pages. The question is not whether this is cybersquatting. The question is how to get the domain back efficiently under the rules that govern .au.

To recover a .au domain from a serial cybersquatter, the standard route is the auDRP — Australia's adaptation of the UDRP — which closely tracks the three-element test in Paragraph 4(a). You must show that the domain is confusingly similar to a mark you hold, that the registrant has no legitimate interest, and that the domain was registered or used in bad faith. A standard case typically concludes within approximately two months; the only remedies are transfer or cancellation. Evidence of a pattern of cybersquatting is a recognized bad-faith indicator and often the decisive factor against a serial registrant.

This guide follows the five decisions a brand owner must make — in order — and flags the trap concealed in each step.

Step 1: Confirm that the auDRP applies to your .au domain

The auDRP is Australia's procedure for .au second-level domain disputes. It covers .com.au, .net.au, .org.au, and the newer direct .au registrations. The procedure applies when the registrant of a .au domain is accused of bad-faith registration. The complaint is filed with an approved dispute-resolution provider operating under auDRP rules.

The trap here is assuming the auDRP is identical to the UDRP. It is closely aligned, but bad faith under the auDRP is sometimes read as "registered or used" abusively rather than the UDRP's cumulative "registered and used" standard. That distinction matters when a registrant registered the domain passively years ago and has barely used it since. Under the UDRP's strict cumulative reading, passive holding alone may not satisfy both limbs. Under the auDRP, a passive but commercially motivated registration can still satisfy the bad-faith element. Panels have found bad faith from the mere act of registration where the domain corresponds closely to a known mark and the registrant held no plausible legitimate reason to register it.

The first concrete step: pull the WHOIS/RDDS record and identify the current registrant. If the same contact name, privacy-shield entity, or linked email address appears across multiple .au registrations — especially registrations that mirror third-party brand names — document that pattern carefully. It will be central evidence later.

Step 2: Map the three auDRP elements to your facts

All three elements of Paragraph 4(a) must be satisfied before a panel will order transfer. Failing any single one defeats the complaint. Work through them in order and identify where your case is strongest and where the respondent has room to argue.

Element 1 — confusing similarity. This element is largely mechanical. The panel compares the domain to the trademark in a side-by-side textual comparison, without reference to how a consumer actually perceives the domain in use. If your registered mark appears in the domain (with or without a generic suffix, a hyphen, or an obvious misspelling), the element is almost always met. The trap: if your only trademark rights are in an unregistered mark or a trade name rather than a registered trademark, confirm that the auDRP procedure accepts unregistered rights — and prepare evidence of use, market recognition, and distinctiveness. The mark does not need to be an Australian registration, but you must be able to demonstrate that you hold rights in the name.

Element 2 — no legitimate interest. Proving a negative is never straightforward. The standard approach is to make a prima facie showing that the registrant cannot claim any of the Paragraph 4(c) safe harbors: no bona fide use of the domain before notice of the dispute, not commonly known by the name, and no legitimate noncommercial or fair use. For a serial cybersquatter, this element is typically easy to establish once you document the portfolio pattern. A registrant holding dozens of brand-name domains across multiple industries has limited credibility when claiming it simply wanted this particular .au name for independent reasons. The trap: make sure you conduct the registrant search thoroughly. If the registrant operates any legitimate business under a name that partially overlaps the domain, that overlap must be addressed and distinguished in the complaint.

Element 3 — bad faith. Paragraph 4(b) of the UDRP (incorporated into the auDRP) lists recognized bad-faith circumstances. For a serial cybersquatter, the most directly applicable indicator is a demonstrated pattern of registering domains corresponding to marks belonging to others without legitimate use. Document every domain in the registrant's portfolio that you can tie to a real brand. Each one reinforces the pattern. Panels have consistently held that a demonstrated pattern of abusive registrations satisfies this element even where the specific domain in dispute has not yet been actively used.

For a read on whether the three auDRP elements are met in your specific situation, reach us at info@cognomenlaw.com.

How strong is the evidence record against a serial cybersquatter?

Evidence quality is often the margin between a transfer order and a denial. A pattern of cybersquatting alone does not substitute for proper evidence. It amplifies the evidence you already have.

The most useful categories of evidence for an auDRP complaint targeting a serial registrant are as follows.

• Trademark certificate and filing date. Confirm that your mark predates the domain registration. If the domain was registered before your trademark filing, you must show that the mark had acquired distinctiveness or that the registrant was aware of your unregistered brand at the time of registration.
• Domain registration record and WHOIS/RDDS history. Capture the current registration data and any available historical snapshots. Privacy shields do not block the complaint; they are identified as the registrant of record, and the provider notifies them.
• Portfolio documentation. Compile a list of other domains registered by the same entity or linked contact, with evidence (screenshots, registration dates, WHOIS records) that those domains correspond to third-party marks. The longer the list, the stronger the pattern argument.
• Content screenshots. Capture the landing page content on each domain in the portfolio, dated and archived. Pay-per-click pages, redirect pages, and "this domain is for sale" pages are each independently recognized as bad-faith use under Paragraph 4(b).
• Prior demand or offer. If the registrant has contacted you (or any third party, if you can document it) demanding payment for the domain, that is a Paragraph 4(b)(i) indicator. Preserve all email, Escrow correspondence, and broker messages.
• Passive holding evidence. If there is no active use, document the absence — a blank page, a parking service, a default registrar page. Under the auDRP's arguably broader bad-faith reading, passive holding in the shadow of a known mark can support the element.

The trap at this step is assembling screenshots without provenance. Panels look for dated, archivable evidence. Use a web-archiving service to capture pages at a known point in time before filing. Undated printouts printed from a live browser carry less weight and can be challenged on authenticity grounds.

In a recent matter (a .com.au dispute, spring 2025), we documented a registrant holding approximately fifteen domains — each mirroring a consumer brand — with pay-per-click revenue visible in page source code. The pattern evidence anchored the bad-faith argument decisively. The transfer was ordered within the standard timeline.

Step 3: Choose your dispute-resolution provider and file the complaint

The auDRP uses approved providers. The filing process, required documents, and fees follow each provider's supplemental rules; confirm the current schedule directly with the provider before filing. Unlike the WIPO filing fee of USD 1,500 for 1–5 domains under the UDRP, auDRP fees are set by the Australian-approved provider and should be verified at the time of filing. Describe the fee as an official administrative charge that is separate from any legal fee.

What forum selection involves in practice:

• Confirm that the provider is approved for auDRP proceedings under the current registry rules.
• Confirm whether you are filing for a .com.au, .net.au, .org.au, or a direct .au registration — procedural nuances may differ slightly.
• If the same serial cybersquatter holds multiple .au domains you want to recover, check whether a single complaint can cover multiple domains registered by the same entity. This can reduce the per-domain cost substantially.

The complaint itself must contain the full domain name, the complainant's contact details, the trademark and its registration particulars, the three-element analysis, and the evidence. A complaint that omits or barely addresses element 2 or element 3 gives the panel a ground for denial even if the other two elements are clearly met. Do not file a thin complaint against a serial cybersquatter and expect the pattern to do all the work. The pattern supports a well-constructed complaint; it does not replace one.

Step 4: Manage the 20-day response window

After the provider formally commences the case — typically a few days after your complaint is accepted — the respondent has 20 days to file a response. Serial cybersquatters do not always respond; many default. A default does not automatically mean you win. The panel must still verify that the complaint establishes all three elements on the available evidence. A weak complaint can be denied even without a response.

If the respondent does respond, expect a boilerplate defense claiming the domain corresponds to a generic phrase, a legitimate business concept, or a prior unrelated use. Against a demonstrably serial cybersquatter, those defenses rarely succeed — provided your pattern evidence is solid and filed with the complaint rather than submitted later as a supplement. Most providers' rules limit supplemental filings. Get your best evidence in front of the panel at the outset.

The 20-day window also triggers a strategic question on your side: should you approach settlement during the response period? Some brand owners prefer a negotiated transfer to avoid any litigation risk, even a modest one. Others prefer the formal process to establish a clean chain of title and a public record of the abusive registration. Both choices are legitimate; the right one depends on your tolerance for cost and the breadth of the registrant's portfolio. If the same registrant holds five .au domains you want, a single negotiated deal or a single multi-domain complaint may be more economical than sequential filings.

If a complaint is already filed or a prior filing produced an unexpected outcome, email info@cognomenlaw.com for a review of the elements that may have been missed.

Step 5: After the decision — implementation and what to watch for

An auDRP panel that orders transfer notifies the registry and the registrar. There is a brief lock period during which the losing registrant may seek court review before the transfer executes. That window is short, and serial cybersquatters rarely pursue it — the economics of contesting an auDRP outcome in court rarely make sense for a registrant who holds the domain purely as an asset for resale or traffic. Nonetheless, confirm with your provider that the registrar has executed the transfer before you update DNS, redirect the domain, or communicate the recovery publicly.

The trap here is overlooking the rest of the portfolio. A transfer order covers the domain named in the complaint. It does not reach the registrant's other .au domains. If the same serial cybersquatter holds additional .au registrations that correspond to your brand's sub-brands, product names, or geographic variations, each one requires its own complaint or a separately negotiated transfer. A post-decision portfolio audit — run within days of the first transfer — positions you to move on remaining targets before the registrant retransfers or obfuscates ownership.

In a recent matter (a .net.au and two .com.au registrations held by the same serial registrant, autumn 2024), we secured transfer of all three domains through a combination of a two-domain complaint and a separately negotiated transfer. The combined approach concluded within approximately three months of the initial filing, avoiding the delay of sequential individual filings.

What about the cross-border dimension — UDRP or auDRP?

Brand owners holding international marks frequently face a parallel problem: the same serial cybersquatter has registered both the .com and the .au version of the brand name. The right path depends on the zone and the goal.

For the .com, the UDRP at WIPO or the Forum is the correct procedure. The WIPO filing fee is USD 1,500 for a single-member panel covering 1–5 domains. The timeline is approximately two months, the same general window as the auDRP. The bad-faith standard is the strict cumulative test — registered and used in bad faith — which means passive holding alone under the UDRP requires careful construction of the argument drawing on additional contextual facts. For the .com.au or direct .au, the auDRP applies, with the potentially broader bad-faith reading described above. Where the complainant qualifies on both fronts, filing both proceedings in parallel — with closely aligned evidence packages — is efficient and creates a consistent public record against the serial registrant.

For zones beyond .com and .au — say, a .co.uk — the Nominet DRS applies and has its own "abusive registration" test. That test reads "registered or used" abusively, similar in breadth to the auDRP's approach. If the serial cybersquatter's portfolio spans multiple zones, a coordinated multi-forum strategy, sequenced around shared evidence, is almost always more effective than isolated individual filings in each zone independently.

If the domain in dispute is a .de, neither the UDRP nor the auDRP applies. Disputes over .de domains are resolved through the German courts, with a DENIC DISPUTE entry available to block transfer while litigation proceeds. That is a substantially longer and costlier process, handled with local litigation counsel in the relevant jurisdiction.

Related at COGNOMEN

• UDRP domain recovery: full-service complaints before WIPO, the Forum, CAC, and ADNDRC
• Filing a UDRP complaint for financial-sector brands and domain disputes
• FAQ: ccTLD mediation and dispute resolution for .tv and related zones