Assess my case

How to recover a .br domain used for phishing

By Cordelia Roe, UDRP complainant practice & gTLD recovery ·

A phishing site is live under your brand's .br domain. Customers are receiving fraudulent invoices, fake login pages are harvesting credentials, and every hour the domain remains active compounds the damage. The question is not whether to act — it is which procedure applies in Brazil and how fast it can reach a transfer order.

To recover a .br domain used for phishing, the governing procedure is SACI-Adm, Brazil's administrative dispute-resolution mechanism operated by the Comitê Gestor da Internet no Brasil (CGI.br) and its registry arm, NIC.br. The test tracks the UDRP closely: the complainant must establish that the domain is identical or confusingly similar to a name or mark in which it has rights, that the registrant has no legitimate interest, and that the domain was registered or is being used in bad faith. Phishing is among the clearest fact patterns of bad-faith use recognized under any domain-dispute procedure. Remedies are limited to transfer or cancellation — no monetary damages and no injunction issue from an administrative panel.

This page sets out the legal test, the evidence that decides the outcome, the timeline and costs, and the cross-border dimensions that arise when phishing targets a brand with a simultaneous .com presence.

What Governs .br Domain Disputes — and Why UDRP Panels Are Not Enough

The .br ccTLD is administered by NIC.br. Unlike the roughly 87 ccTLDs that have appointed WIPO as their dispute-resolution provider and effectively operate under the UDRP, .br is governed by SACI-Adm, a Brazilian administrative procedure with its own rules, language requirements, and panelist pool. A UDRP complaint filed at WIPO or the Forum has no jurisdictional reach over a .br domain — the two procedures run on parallel tracks.

That distinction matters immediately in a phishing scenario. Brand owners who instinctively file a UDRP complaint for a domain ending in .br will receive a rejection on jurisdictional grounds. The filing fee is lost, and — critically — the phishing site remains active. We regularly advise clients who have discovered this error after the fact, and the remediation path doubles the timeline unnecessarily.

SACI-Adm was modeled on the UDRP. Its three-element test is substantively similar to Paragraph 4(a) of the UDRP, and panel reasoning in .br cases draws on UDRP consensus views, making cross-jurisdictional precedent analysis genuinely useful. The key procedural difference is that filings and most procedural communications must be conducted in Portuguese, which is an operational constraint for foreign brand owners acting without Brazil-experienced counsel.

One further nuance: where the phishing operation also uses a .com domain — often simultaneously — the brand owner may pursue a parallel UDRP complaint for the .com while the SACI-Adm proceeding handles the .br. Parallel filings are permissible and, in active fraud scenarios, often advisable. The proceedings are independent; an order in one does not automatically resolve the other.

The Three Elements That Decide Whether You Can Recover a .br Domain Used for Phishing

Under SACI-Adm, a complainant must satisfy all three elements of the applicable test to obtain a transfer or cancellation order. Failing even one means the complaint is denied — and the phishing domain stays in the registrant's hands.

Element one: confusing similarity to a mark or name in which you have rights. For a phishing domain, this element is almost always met. Phishing operators deliberately choose a domain that mimics the target brand — a transposition of letters, the addition of a hyphen, or the insertion of a generic word such as "secure" or "bank." Panels consistently find confusing similarity where the disputed domain is a recognizable variant of the complainant's registered trademark or trade name. Proof of a registered trademark in Brazil, or in a major jurisdiction with a recognizable connection to the complainant's operations, is the strongest evidence base. Unregistered brand rights may also qualify, but the evidentiary burden is higher.

Element two: no legitimate interest. A phishing operator has no rights or legitimate interest in a domain by definition. No bona fide offering of goods or services exists; no legitimate noncommercial or fair use exists. The Paragraph 4(c) safe harbors — which track the same language in SACI-Adm — simply do not apply to fraudulent impersonation. Documentary evidence of the phishing activity itself (screenshots of the fake login page, headers of fraudulent emails, a cybersecurity firm's takedown report) tends to be the most efficient way to establish this element.

Element three: bad faith registration and use. Phishing is textbook bad faith. Panels across every major domain-dispute forum — and Brazilian panels applying SACI-Adm — treat deliberate impersonation of a mark owner to deceive internet users as a paradigm case of bad-faith use under what is equivalent to Paragraph 4(b)(iv) of the UDRP: using the domain to attract users by creating a likelihood of confusion with the complainant's mark for commercial gain. The gain need not be direct revenue from the phishing site itself; harvesting credentials is treated as commercial exploitation.

A significant practical advantage in phishing cases: because the fraudulent use is affirmative and documented, the third element rarely turns on inference alone. That contrasts with passive-holding cases, where panels must weigh circumstantial factors. Evidence of active phishing is direct proof of bad-faith use — which is why the case for recovery is typically stronger here than in most other domain-dispute scenarios.

For a read on whether the three elements are met in your specific .br phishing scenario, reach us at info@cognomenlaw.com.

What Evidence Should You Gather Before Filing?

Evidence quality — not the legal argument — is usually what separates a clean transfer order from a denial or a protracted proceeding. In a phishing scenario, the record you file with the complaint is essentially the record the panel decides on; supplemental filings are disfavored and procedurally limited.

The following categories of evidence are most material in a .br phishing recovery:

We have filed phishing complaints where a thorough evidence package resolved the proceeding at the single-panelist level without a supplemental exchange. Conversely, thin or disorganized evidence files invite a respondent's counter-narrative — or a default that nonetheless draws closer scrutiny than expected. Gather evidence before contacting the registrar or sending a cease-and-desist; either action can prompt a registrant to alter the site and complicate the record.

How Long Does the .br Phishing Domain Recovery Process Take?

A standard SACI-Adm proceeding runs to a decision in a matter of weeks to a few months, depending on whether the respondent files a response and whether any procedural complications arise. The 20-day response window after commencement is a structural feature common to both the UDRP and SACI-Adm — it is the outer limit of the respondent's right to answer, and it runs regardless of whether the registrant engages.

Default cases — where the phishing operator does not respond — are common in fraud scenarios. The operator's anonymity is part of the scheme, and engaging in a formal administrative proceeding would require disclosing or creating an identity. Defaults do not automatically produce a transfer; the panel still reviews the complaint on its merits. However, the absence of a response means the panel may draw adverse inferences from the complainant's unrebutted evidence, which in a phishing case is typically sufficient.

A realistic end-to-end timeline — from the decision to file to a transfer order and the domain being redirected to the complainant's registrar — should be planned as roughly two to three months for a straightforward case. That estimate assumes a competent, complete complaint at first filing and no procedural suspension for settlement. Cases involving multiple disputed domains or a respondent who files a substantive response will take longer.

Emergency or interim measures are worth addressing directly. The SACI-Adm procedure does not itself include an interim suspension mechanism equivalent to the Uniform Rapid Suspension system available for new gTLDs. If the phishing site is actively harming customers during the proceeding, parallel tracks — registrar-level abuse reports, hosting-provider takedown requests, and engagement with Brazil's Computer Emergency Response Team (CERT.br) — can sometimes achieve a faster operational takedown of the content even while the domain itself remains in the registrant's name pending the administrative outcome. We coordinate these parallel measures alongside the formal filing.

What Does It Cost to Recover a .br Domain Through SACI-Adm?

Cost structure for a .br dispute has two components: the official filing fee charged by the dispute-resolution provider and the legal fee for preparation and management of the complaint.

SACI-Adm's published filing fees are set by NIC.br and are modest relative to WIPO's schedule (where a single-domain, single-member panel costs USD 1,500 for a .com case). For .br proceedings, the official fee is a fraction of the WIPO rate — verify the current NIC.br schedule directly, as it is published in BRL and subject to revision. Legal fees for a phishing complaint — gathering and organizing the evidence record, drafting the complaint in Portuguese, managing the proceeding, and coordinating any parallel operational measures — are separate and fact-dependent. Market rates for a straightforward single-domain phishing complaint typically fall in the range comparable to a UDRP complaint with a similarly well-documented record.

Two cost factors distinguish phishing cases from ordinary cybersquatting cases. First, the evidence-gathering phase is often more intensive: phishing incidents generate a broader document set than a parked domain, and that set must be organized coherently for the panel. Second, where parallel .com proceedings are advisable, the total budget covers two separate forum fees plus coordinated legal work across both filings. We provide transparent fee ranges at the outset of each matter, with the official filing fees and legal fees presented separately — not bundled.

To weigh the .br SACI-Adm route against a parallel UDRP action for your case, email info@cognomenlaw.com.

Parallel .com Phishing Campaigns — Choosing Between UDRP and SACI-Adm

Phishing operations rarely target a single domain extension. A well-resourced fraud campaign will register the target brand's variant across .com, .br, and sometimes additional ccTLDs simultaneously — presenting a multi-zone enforcement problem rather than a single-domain dispute.

The right route depends on the zone and the goal. Where the domain is a .com and transfer is the objective, the UDRP at WIPO or the Forum is the standard path: a single-member panel costs USD 1,500 at WIPO, the proceeding is conducted in English, and a straightforward case reaches a decision in roughly two months. Where the domain is a .br, SACI-Adm controls, the proceeding is in Portuguese, and the official fee is lower but local procedural fluency matters more. Where speed of content removal is the priority over a formal transfer order — for example, where the domain is a new gTLD — the Uniform Rapid Suspension system delivers a suspension decision faster and at lower cost, though URS does not transfer ownership.

In a typical multi-zone phishing campaign, the preferred approach is a coordinated filing: the UDRP complaint for the .com and any other UDRP-eligible domains, and the SACI-Adm complaint for the .br, timed to run simultaneously. The domain community refers to this as a "portfolio action," though technically each complaint is filed in a separate forum under separate rules. In our practice, synchronized filings in phishing matters prevent the operator from migrating the fraudulent operation to whichever domain survives a single-zone action.

In a recent matter involving a financial-services brand (a coordinated .com and .br phishing campaign, autumn 2025), we filed at WIPO for the .com and at SACI-Adm for the .br within the same week. The .com transfer order arrived approximately eight weeks after filing; the .br proceeding followed shortly after. The operator defaulted in both proceedings and the phishing operation lost its domain infrastructure entirely. No new registrations in the target brand's name appeared in either zone in the months following — the synchronized takedown removed the operational base.

What Happens If the Respondent Contests the Complaint?

Most phishing operators default. The operator's goal is anonymity, and participating in a formal proceeding would mean revealing (or fabricating) an identity and engaging with the substance of the fraud allegation. However, a minority of respondents — particularly those running sophisticated fraud campaigns or those who have invested significantly in the phishing infrastructure — do file responses.

A respondent's response in a phishing case typically follows one of three patterns. First, a bare denial: the registrant claims the domain was registered for an unrelated legitimate purpose and denies any knowledge of phishing. Second, a legitimate-interest assertion: the registrant claims the domain represents a descriptive or generic term, a personal name, or some business purpose that pre-dates the dispute. Third, a reverse challenge: the registrant claims the complainant lacks trademark rights sufficient to sustain the first element, usually by attacking the scope or validity of the asserted mark.

Bare denials and unsupported legitimate-interest assertions rarely succeed against a documented phishing record. The evidence of fraudulent use is direct, and panels are not obliged to accept self-serving characterizations without corroboration. The third pattern — attacking trademark rights — deserves more care, particularly where the complainant relies on an unregistered mark or a mark in a jurisdiction with limited connection to the .br domain's use. This is where the quality of the evidence base assembled before filing matters most.

In a recent matter (a .br financial phishing complaint, spring 2025), the respondent filed a substantive response asserting that the disputed domain had been registered for a legitimate commercial purpose and that the phishing allegation was unsupported. We supplemented the complaint record with forensic analysis of the domain's DNS history, a detailed timeline of the phishing campaign corroborated by the client's fraud-response team, and archived captures of the fraudulent site. The panel transferred the domain, finding bad-faith use clearly established by the contemporaneous technical evidence notwithstanding the respondent's denial.

Can You Recover the .br Domain If It Has Been Transferred After the Phishing Was Discovered?

A phishing operator who becomes aware of an imminent complaint may attempt to transfer the domain to a different registrant — a practice sometimes called "cyberflight." NIC.br's procedural rules, like the UDRP's, include provisions addressing transfers made after a dispute has been initiated. Once a SACI-Adm complaint is formally filed, the domain is generally locked against transfers pending the proceeding's resolution. That lock is the administrative equivalent of the registrar lock applied in UDRP proceedings under ICANN's inter-registrar transfer policy.

The risk period is before filing, not after. A registrant who anticipates a complaint but has not yet been served may attempt a pre-filing transfer. If the domain has already changed hands by the time the complaint is prepared, the new registrant becomes the respondent — provided the transfer was not a bona fide arms-length transaction but rather a device to frustrate the dispute. Panels in UDRP proceedings have consistently treated pre-complaint cyberflight as an aggravating indicator of bad faith, and that reasoning is available to panels in SACI-Adm as well.

If a transfer has already occurred and the new registrant appears to be part of the same operation — a common pattern where the "buyer" uses the same contact details, hosting infrastructure, or phishing templates — the complaint should be filed against the new registrant and the circumstantial continuity of the fraud operation should be documented in the evidentiary record. We have successfully argued continuity of bad faith in cases where the domain changed registrant identity but the phishing site remained structurally identical.

Related at COGNOMEN

Frequently asked questions

Is it worth it to recover a .br domain used for phishing?

For most brand owners, yes — both commercially and operationally. A phishing domain that impersonates your brand continues to cause reputational harm, customer fraud losses, and potential regulatory exposure for as long as it remains active. Recovering it through SACI-Adm removes the infrastructure the operator relies on. The costs of a SACI-Adm proceeding are modest relative to the fraud losses a sustained phishing campaign generates. That said, if the registrant is sophisticated and likely to immediately register replacement domains, recovery should be paired with a broader monitoring and enforcement strategy rather than treated as a complete solution in isolation.

What are the most common mistakes when you recover a .br domain used for phishing?

Three errors appear repeatedly. First, filing a UDRP complaint for a .br domain — the UDRP has no jurisdiction over .br, and the filing is rejected without reaching the merits. Second, sending a cease-and-desist or contacting the registrar before evidence is captured — this alerts the operator, who may take the phishing site offline and destroy the evidentiary record before the complaint is filed. Third, submitting an incomplete evidence package: panels decide on the record at filing, and a thin complaint against a contested phishing allegation creates unnecessary risk of denial or delay.

Can a three-member panel change the outcome?

In phishing cases, a single-member panel is almost always sufficient. The bad-faith use is direct and documented; the case does not typically turn on nuanced trademark questions or competing legitimate-interest arguments. A three-member panel is worth considering where the complainant's trademark rights are contested, where the respondent is expected to mount a sophisticated defense, or where a definitive precedential record is commercially useful. In straightforward phishing scenarios, the additional cost and modest additional time of a three-member panel rarely produce a materially different outcome than a well-supported single-member decision.

Author: — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.