How to recover a .ae domain used for phishing

How to recover a .ae domain used for phishing. UDRP and ccTLD domain recovery and defense across .ae. Email the firm to assess your case. Transparent fees, res…

A phishing domain bearing your brand's name in the .ae zone is not a theoretical risk. It redirects customers, intercepts credentials, and damages the trust your UAE operations depend on. You want the domain transferred or taken down. The question is which procedure applies and whether your evidence meets the standard.

To recover a .ae domain used for phishing, the governing procedure is the aeDRP – the UAE's .ae Domain Dispute Resolution Policy, administered through WIPO and closely modeled on the UDRP. You must prove all three elements of the aeDRP test: that the domain is identical or confusingly similar to a mark in which you have rights, that the registrant has no rights or legitimate interests, and that the domain was registered and is used in bad faith. A phishing campaign is strong bad-faith evidence. The standard timeline runs roughly two months to a decision, and the only remedies available are transfer or cancellation – no monetary award.

This page covers the aeDRP test, the evidence that decides phishing cases, the step-by-step process, costs, and the next step if you are ready to file.

What is the aeDRP and how does it govern .ae domain disputes?

The aeDRP is the UAE registry's mandatory dispute-resolution policy for .ae domain names, and WIPO administers it under rules that mirror the UDRP almost element-for-element. When a .ae domain is registered through any accredited .ae registrar, the registrant contractually submits to the aeDRP for any dispute a trademark owner brings. That submission is automatic – you do not need to sue to compel it.

The practical effect is significant. A brand owner in Dubai, Abu Dhabi, or anywhere in the world holding a mark with UAE recognition can file a complaint directly with WIPO and pursue transfer without entering the UAE court system. The process runs in English or Arabic. WIPO appoints an independent panelist, and the panel's decision is binding on the registrar.

One threshold point: the aeDRP is distinct from the general UDRP that covers .com and other gTLDs, even though they share the same three-element structure. The zone matters. A .ae phishing domain requires a .ae filing. If the same actor has also registered a .com copy, that second domain requires a separate UDRP complaint before WIPO, the Forum, or another accredited provider. We regularly advise brand owners who need to move against both zones simultaneously, and the filings can be coordinated.

How does the three-element test apply to a .ae phishing domain?

Under Paragraph 4(a) of the UDRP – reproduced in substantively identical form in the aeDRP – a complainant must establish all three elements independently, and the panel will not transfer a domain unless each one is satisfied.

Element one: identical or confusingly similar to a trademark. For a phishing domain, this element is almost always the easiest. Phishers register names that look like the target brand precisely to deceive users. A domain that adds a hyphen, a country code, or the word "bank" or "secure" to your mark is confusingly similar under the overwhelming consensus of WIPO panels. The panel compares the domain to your mark alone – it does not weigh the real-world likelihood of confusion in the way a trademark infringement court would. If you hold a UAE trademark, an international registration designating the UAE, or a well-known mark with demonstrable UAE recognition, element one is typically met.

Element two: no rights or legitimate interests. Phishers, by definition, have none. They are not known by the name, they are not making a bona fide offering of goods or services, and their use is neither noncommercial nor fair. The difficulty here is that the complainant carries the initial burden of making a prima facie case, after which the burden shifts to the registrant to demonstrate any legitimate interest. In a phishing scenario, a registrant who built a fraudulent site mimicking your login page cannot point to any safe harbor under the Policy. Panels have consistently held that use of a domain to impersonate or defraud consumers is inherently inconsistent with any legitimate interest.

Element three: registered and used in bad faith. This is where phishing cases are strongest. Paragraph 4(b) lists non-exhaustive bad-faith indicators, and phishing goes beyond them. Panels have found that using a domain to conduct a phishing campaign – capturing credentials, impersonating the brand owner's services, or redirecting users for fraudulent commercial gain – establishes bad faith conclusively. The cumulative requirement ("registered AND used") is met when the domain was registered with the complainant's mark in mind and then deployed for fraud. Passive holding alone can also establish bad faith where the circumstances make any legitimate use implausible.

If you have identified a .ae domain impersonating your brand and need a rapid read on whether the three elements are met, reach us at info@cognomenlaw.com.

What evidence decides a .ae phishing case?

Evidence is where most aeDRP complaints are won or lost. A well-pleaded complaint anchors each element to specific, documentary proof. For a phishing domain, the evidentiary record should cover the following.

Trademark rights. Provide the registration certificate for your UAE mark or your international registration designating the UAE. If you rely on common-law or well-known status, document the scope of use in the UAE market: consumer reach, media coverage, commercial presence. The earlier your priority date relative to the domain's registration, the stronger your position.

The phishing infrastructure. Capture the live website at the domain – a screenshot or a PDF render with the URL and date visible. Document what the site does: credential harvesting forms, brand logos used without authorization, misleading communications sent to consumers. If you have received consumer complaints or phishing alerts from your IT security team, include them. WIPO panels regularly credit contemporaneous incident reports as corroborating bad faith.

WHOIS and registration date. The WHOIS or RDDS record (as published or available through the registrar) establishes when the domain was registered relative to your trademark. A registration date after your brand acquired recognition strongly supports the inference that the registrant targeted your mark. Privacy or proxy registration does not shelter a phisher; panels routinely look through proxy shields in phishing cases.

Consumer harm. Phishing cases benefit from direct evidence of harm: phishing emails sent to customers, financial fraud reports, takedown requests previously submitted to the registrar. These records underscore the urgency and reinforce bad faith at both registration and use.

In a recent matter – a .ae credential-harvesting operation impersonating a financial services brand, spring 2025 – we assembled the complaint in under a week once the client provided the phishing email chain and the existing UAE trademark certificate. The panel transferred the domain within seven weeks of filing, citing the fraudulent nature of the site as dispositive on elements two and three.

What is the step-by-step aeDRP process and how long does it take?

The aeDRP process runs in five stages, and the standard timeline to a decision is roughly two months from filing, assuming no procedural complications.

1. Complaint drafting and filing. The complaint sets out the three elements, attaches the evidence, and identifies the requested remedy (transfer or cancellation). It is filed directly with WIPO in accordance with the aeDRP Supplemental Rules. WIPO conducts a formal compliance check – if the complaint meets the filing requirements, it formally commences the case.
2. Commencement and service. WIPO notifies the registrant and the registrar. The registrar is required to lock the domain against transfer during the proceedings.
3. Response window: 20 days. The respondent has 20 days from commencement to file a response. In phishing cases, respondents frequently default – filing no response at all. A default does not mean automatic transfer; the panel still evaluates the complaint on its merits, but the absence of a rebuttal leaves the complainant's evidence uncontested.
4. Panel appointment and decision. WIPO appoints a single panelist (or a three-member panel if either party requests one and pays the additional fee). The panelist reviews the record and issues a written decision, typically within 14 days of appointment.
5. Registrar implementation. If the panel orders transfer or cancellation, the registrar implements the decision after a short waiting period, absent a court filing by the losing party to stay implementation.

Does speed matter in a phishing case? It does. Every day the domain is live, consumers may be deceived and your brand's reputation erodes. The aeDRP's roughly two-month standard timeline is faster than UAE court proceedings for comparable relief. Where the phishing infrastructure is active and causing ongoing consumer harm, framing the complaint for WIPO's expedited track – where available – is worth examining at the outset.

To assess the three aeDRP elements for your specific .ae domain and get a filing timeline, email info@cognomenlaw.com.

What does it cost to recover a .ae phishing domain?

The costs fall into two separate buckets: the WIPO forum filing fee and the legal fee for preparing and managing the complaint.

For the aeDRP filed at WIPO, the forum fee for a single-domain, single-member panel case is USD 1,500. That fee is paid by the complainant. If a three-member panel is requested – by the complainant or the respondent – the fee rises to USD 4,000, and where the respondent requests the three-member panel, the parties generally split the additional cost. WIPO offers a partial refund of approximately USD 1,000 of the single-member fee if the case is withdrawn or terminated before panel appointment.

Legal fees for a straightforward single-domain phishing complaint are typically in the USD 3,000–7,000 range on a flat-fee basis, separate from the forum fee. The specific amount depends on the complexity of the trademark rights issue, the volume of phishing evidence requiring review and organization, and whether the matter raises any unusual procedural questions. We present transparent, written fee estimates before engagement – a practice we hold to in every matter.

A note on the decision matrix: if the .ae phishing domain is part of a broader campaign that also uses .com or other gTLD domains, the combined filing and legal cost rises, but so does the protection. A .ae-only complaint leaves the .com mirror site operational. In our experience, phishing operations that target UAE brands frequently register both zones. We have defended and prosecuted multi-zone complaints at WIPO and can structure the proceedings to run concurrently where efficiency and cost warrant it.

How does the aeDRP compare to UAE court action for a phishing domain?

Choosing between the aeDRP and UAE court proceedings is a genuine strategic question, not a formality. The right answer depends on what you need.

If your primary goal is transfer or cancellation of the domain, the aeDRP is faster, cheaper, and purpose-built for the task. The two-month timeline compares favorably to court proceedings, which involve service requirements, procedural steps, and docket uncertainty that extend the timeline significantly. The aeDRP panelist decides on the written record, without hearings. For a phishing domain where the facts are clear – the site impersonates your brand, the registrant is anonymous or unresponsive – this focused procedure is usually the right first choice.

If you also want monetary damages – compensation for the consumer harm the phishing operation caused – the aeDRP cannot deliver that. The only remedies under the Policy are transfer or cancellation. A damages claim requires a UAE court action or, if the registrant is US-based and the circumstances qualify, a US anticybersquatting action in federal court. See our guide to US court action for cybersquatting for the court route where damages are a priority.

If the registrant is unidentifiable through WHOIS – a common situation in phishing cases given proxy registrations – court proceedings that can compel disclosure of registrant identity may be warranted alongside or after the aeDRP, particularly where criminal referral is contemplated. The aeDRP can proceed against the privacy service as the record registrant, but a criminal or civil damages action requires identifying the actual perpetrator. We work with local litigation counsel in the relevant jurisdiction for that downstream enforcement.

In a second recent matter – a .ae financial phishing operation, autumn 2024 – the complainant initially considered a UAE court injunction. After reviewing the evidence and timeline, we recommended filing the aeDRP complaint immediately for transfer while preserving the option to pursue damages separately. The transfer was ordered in under eight weeks. The parallel litigation question was assessed once the domain was secured.

The comparison table below summarizes the decision points:

Scenario	Recommended route	Timeline	Remedy
Transfer or cancellation only, phishing domain	aeDRP at WIPO	~2 months	Transfer or cancellation
Transfer + monetary damages	aeDRP + UAE / US court action	Longer; court sets timeline	Transfer (aeDRP); damages (court)
Same brand, .com phishing copy also active	aeDRP (.ae) + UDRP (.com) concurrently	~2 months each	Transfer or cancellation per zone
Registrant identity needed for criminal referral	aeDRP + court discovery / local counsel	Concurrent; court timeline varies	Transfer (aeDRP); identity disclosure (court)

What common mistakes undermine a .ae phishing domain recovery?

A common myth is that a phishing complaint is so obviously meritorious that it files itself. In practice, the complaints that fail or produce delays share predictable errors. We see them regularly when clients come to us after an initial filing has stalled.

The first mistake is relying on a UAE trademark application rather than a registration. A pending application does not satisfy element one. If your UAE registration is still pending, you will need to ground element one in a different registered right – an international registration designating the UAE, or a well-known mark argument supported by substantial documentary evidence. Building that alternative record takes time and care.

The second mistake is capturing only the phishing site's home page. Panels want to see the entire fraudulent infrastructure: credential forms, spoofed login pages, brand assets used without authorization, and any evidence of consumer interaction. A single screenshot of a landing page rarely tells the full story.

The third mistake is ignoring the registration date. If the domain was registered before your trademark was established, element three becomes significantly harder. Some complainants proceed without checking this point and encounter a panel finding that bad faith at registration is not established. A preliminary assessment of the registration chronology is a critical first step.

The fourth mistake is filing without first locking the domain. While the aeDRP complaint itself triggers a registrar lock, a complainant who alerts the registrant prematurely – by sending a cease-and-desist before filing – may prompt a transfer or deletion of the domain before the lock takes effect. The better practice is to file the complaint promptly and allow the procedural lock to operate.

What is COGNOMEN's process for a .ae phishing domain recovery?

Our process for a .ae phishing domain matter follows a defined sequence. We assess the three aeDRP elements against your trademark record and the available WHOIS and site evidence. We identify the strongest evidentiary angle for bad faith – in phishing cases that is almost always the use of the domain for consumer fraud. We draft the complaint, coordinate the WIPO filing, and manage the proceeding through to the panel decision. Where the matter spans multiple zones, we coordinate the .ae and .com filings so both cases run in parallel.

For matters where court action is warranted alongside the aeDRP – whether for damages, registrant identification, or injunctive relief – we work with local litigation counsel in the relevant jurisdiction and manage the coordination from our side.

Our fee estimates are presented in writing before any engagement. We do not obscure the forum fee inside a flat package: the WIPO filing fee and our legal fee are stated separately, clearly, at the outset. That is a practice standard we apply to every .ae domain dispute we handle.

• Related at COGNOMEN
• UDRP Domain Recovery – recover any gTLD or WIPO-administered ccTLD domain
• Confusingly similar trademark in the cloud – element one analysis across zones
• US court action for cybersquatting – when you need damages or court-compelled transfer