How to recover a .ca domain used for phishing

A phishing site is live under a .ca domain that mirrors your brand. Customers are receiving fake invoices. The domain is registered in Canada by someone with no connection to your organization. You need it transferred – fast. The question is which procedure applies and what it takes to win.

To recover a .ca domain used for phishing, the governing procedure is the CIRA Canadian Internet Registration Authority Dispute Resolution Policy, commonly called the CDRP. The complainant must show (1) rights in a name or mark confusingly similar to the domain, (2) that the registrant has no legitimate interest, and (3) that the domain was registered or is being used in bad faith. An active phishing campaign is among the strongest bad-faith showings a panel can consider. The only remedies are transfer or cancellation – no monetary damages are available under the CDRP.

This page covers the CDRP test in full, the evidence that decides phishing cases, the timeline and cost structure, and how to choose between the CDRP and court if the CDRP is not the right fit.

What is the CIRA CDRP and why does it apply to .ca phishing disputes?

The CIRA Canadian Internet Registration Authority Dispute Resolution Policy is the mandatory procedure for disputes over .ca domain names – and it is the primary route for any brand owner seeking to recover a .ca domain used for phishing. CIRA requires all .ca registrants to submit to the CDRP as a condition of registration, which means the registrant cannot simply refuse to participate.

The CDRP tracks the structure of the UDRP but differs in two important respects. First, the complainant must generally establish CIRA Canadian Presence Requirements to hold the domain once it is transferred. Second, like the UDRP, the CDRP does not award money damages. The only outcomes are transfer to the complainant or cancellation of the registration. Where a complainant cannot satisfy Canadian presence, cancellation may be the practical remedy.

The CDRP also inherits the UDRP's "registered or used in bad faith" construction in ways that matter for phishing cases. A live phishing site meets both limbs simultaneously: the domain was registered and it is being used in bad faith. Panels reviewing phishing scenarios have consistently treated active consumer deception as compelling evidence on the bad-faith element, and we see that pattern hold across cases we assess.

The UDRP itself does not govern .ca – it governs accredited gTLDs such as .com, .net, and .org. A brand owner who also holds a .com version of the phishing domain can pursue separate UDRP proceedings at WIPO or the Forum for that gTLD registration while simultaneously filing the CDRP complaint for .ca. Running parallel proceedings is permissible and often tactically sound when a phishing campaign spans multiple zones.

If you are identifying whether the CDRP, the UDRP, or a combination is the right route for your situation, contact info@cognomenlaw.com for an assessment of your domain dispute.

What are the three elements you must prove to recover a .ca domain under the CDRP?

A CDRP complaint must satisfy all three elements of the test: confusing similarity to a mark, absence of legitimate interest, and bad faith registration or use. Miss any one element and the complaint fails, regardless of how obvious the phishing is in fact.

The first element – confusing similarity – is a low bar in phishing cases. Phishers typically register the complainant's exact brand name or a close variation: adding a hyphen, a country identifier ("-ca"), or a transactional suffix ("-secure", "-login", "-verify"). Any of those constructions will normally satisfy this element. The domain is compared to the complainant's trademark as it appears in the registration record, with the ".ca" suffix disregarded as standard policy.

The second element requires showing the registrant has no rights or legitimate interests. A phisher has none by definition. No CDRP panel will find that operating a fraudulent credential-harvesting site constitutes a bona fide offering of goods or services. The complainant's burden here is effectively met by establishing the phishing facts. The complainant need only make a prima facie showing; the evidential burden then shifts to the registrant to rebut.

The third element is where phishing cases are at their strongest. Bad faith under the CDRP encompasses intentional attempts to attract users for commercial gain by creating confusion with the complainant's mark. A site that spoofs a bank's login page or reproduces a retailer's checkout flow is bad faith by design. The registrant cannot offer a plausible innocent explanation, and a default or non-appearance – common in phishing disputes – does not help the registrant.

In our practice, we regularly assess phishing complaints where the bad-faith element is clear but the complainant has not yet assembled sufficient evidence on element one or two. A trademark registration that predates the domain registration by a clear margin, combined with evidence that the phishing site reproduces the complainant's trade dress, typically seals all three elements without the need for extraordinary proof.

How long does the CDRP process take and what does it cost?

The CDRP timeline is broadly comparable to the UDRP. After a complaint is filed and accepted, the respondent typically has a defined period to reply – comparable in structure to the UDRP's 20-day response window. A decision from the appointed expert follows, and CIRA then implements any transfer or cancellation order through the registrar.

For phishing cases, speed matters above other considerations. A phishing site that remains live for weeks harms customers, exposes the brand owner to regulatory scrutiny, and may generate evidence of ongoing consumer confusion that compounds the reputational damage. The CDRP does not offer an emergency suspension equivalent to the URS for new gTLDs, so the complaint must be assembled and filed promptly.

On cost: the CDRP carries its own official filing fees set by CIRA, which are separate from legal fees. Those fees should be confirmed directly from CIRA's current schedule at the time of filing, as they are subject to revision. Legal fees for a CDRP phishing complaint – assembling the evidence, drafting the complaint, and managing the proceeding – fall within the range typical for UDRP matters of comparable complexity. For a straightforward single-domain case, market rates for specialist counsel commonly run in the USD 3,000–7,000 range, separate from official filing fees; phishing cases often sit toward the lower end of that range because the bad-faith evidence is direct.

If the phishing domain was also registered under a .com or another gTLD at the same time, filing a simultaneous UDRP complaint at WIPO adds the WIPO filing fee of USD 1,500 for a single-member panel covering one to five domains. Running both proceedings in parallel adds cost but eliminates the risk of the phisher simply redirecting traffic to the surviving gTLD domain while the CDRP is pending.

What evidence decides a .ca phishing dispute?

Evidence assembly is where phishing cases are won or lost on the record. The complaint must include clear documentation of the phishing activity – not merely an assertion that phishing is occurring. Panels decide on the written record alone. There is no oral hearing.

The evidence a well-prepared CDRP phishing complaint should include falls into three categories. First, trademark proof: the complainant's trademark registration certificate, with priority date clearly predating the domain registration. A registration in Canada is strongest; registrations in the US or EU are typically accepted as evidence of rights, though counsel should confirm CIRA's current practice on cross-jurisdictional rights at the time of filing.

Second, domain and site documentation: a full-page screenshot of the phishing site (timestamped), the registrar's WHOIS/RDDS record for the disputed domain, and, if available, the registration date and registrant details. Where the phishing site has been taken down by the registrar following an abuse report before the complaint is filed, archive captures from web-archive services serve as a substitute.

Third, harm or consumer-confusion evidence: complaints from customers who received phishing emails, internal security-team incident reports, any notification from a national cybersecurity authority, or law-enforcement correspondence. This category is not strictly required but materially strengthens the bad-faith showing and can accelerate the panel's analysis.

A practical point on parallel registrar abuse reports: filing a registrar abuse report concurrently with – or just before – the CDRP complaint can result in the phishing site being suspended by the registrar under its terms of service before the dispute is resolved. That suspension does not transfer the domain. Only a CDRP decision does. But it removes the immediate consumer harm while the proceeding runs.

If you have collected initial evidence of phishing and want a read on whether the three CDRP elements are met, reach us at info@cognomenlaw.com.

What if the CDRP does not produce a transfer – when does court action apply?

The CDRP is the standard route, but it is not the only one. Three scenarios push toward court rather than – or in addition to – the CDRP.

First: the complainant cannot satisfy Canadian Presence Requirements and cancellation is not an acceptable outcome. Cancellation removes the phishing domain from the malicious registrant, which stops the immediate harm. But it does not place the domain in the complainant's hands, meaning a different bad actor could register it again. In that scenario, the complainant may need to pursue Canadian court proceedings to obtain an injunction and a transfer order, coordinating with local litigation counsel in the relevant jurisdiction.

Second: the phishing campaign is part of a larger organized fraud operation and the brand owner wants damages, the identity of the operators, or a court-ordered disclosure of registrant information that the WHOIS/RDDS record does not reveal. The CDRP has no discovery mechanism and awards no money. A court action in the relevant Canadian jurisdiction can reach both.

Third: the registrant has mounted a defense with colorable legal arguments – perhaps claiming it is a legitimate business with a right to the .ca domain under Canadian law. A contested CDRP proceeding before a single expert may produce a result that neither party finds definitive. A court proceeding, while slower and more expensive, produces a legally binding order that is harder to circumvent.

The decision matrix runs as follows. If the goal is fast transfer, the complainant has Canadian presence rights, and the evidence of phishing is documentary and direct → the CDRP is the right primary route. If transfer is not achievable through the CDRP, or if damages and disclosure matter → court action in Canada, with local litigation counsel, is the parallel track. If the phishing extends to a .com simultaneously → file a UDRP complaint at WIPO or the Forum concurrently, at the WIPO single-panel fee of USD 1,500 or the comparable Forum rate beginning around USD 1,300.

In a recent matter (a .ca phishing complaint, spring 2025), we managed a parallel CDRP and UDRP filing for a financial-services brand whose name was being spoofed across both zones simultaneously. The .com was transferred by UDRP order and the .ca was cancelled by the CDRP expert – both outcomes achieved within roughly ten weeks of the initial filing date. Cancellation, rather than transfer, was the practical remedy available under the CDRP in that matter due to the complainant's presence eligibility at the time.

What is reverse domain name hijacking and does it apply to phishing complaints?

Reverse domain name hijacking (RDNH) is a panel finding that a complainant brought a complaint in bad faith – essentially to strip a legitimate registrant of a domain it had a genuine right to hold. RDNH matters to brand owners filing phishing complaints for one practical reason: it almost never applies in genuine phishing cases, but knowing the concept helps avoid the narrow scenarios where an aggressive complaint might trigger it.

A phishing complaint targeting a domain that is demonstrably reproducing the complainant's login screen, brand identity, or transactional interface cannot plausibly be characterized as bad-faith overreach. The risk of an RDNH finding arises when a complainant targets a domain that predates its own trademark registration, or where the registrant has a colorable legitimate use that the complaint disregards. We regularly advise complainants to check the domain's registration date against the complainant's trademark priority date before filing. A domain registered before the mark was filed is a red flag for panel skepticism – even in an apparent phishing case.

The practical audit before filing: confirm that the complainant's trademark rights predate the domain registration, or that the bad-faith use (the phishing itself) began after those rights were established. If that sequence is clear, RDNH is not a serious risk. If the sequence is ambiguous, we recommend addressing it in the complaint directly rather than leaving it for the respondent to raise.

How does COGNOMEN approach recovering a .ca phishing domain?

We assess the three CDRP elements, assemble the bad-faith evidence, identify any cross-zone registrations requiring parallel UDRP proceedings, and file the complaint. On the evidence side, we work through the trademark record, the domain registration timeline, the phishing-site documentation, and any abuse-report correspondence to build a complete factual record for the expert.

We also evaluate at the outset whether Canadian Presence Requirements are satisfied for the complainant – because that question shapes the remedy the complaint should seek. Where transfer is not achievable, we advise on whether cancellation alone is sufficient or whether concurrent court action is warranted.

We defend registrants against abusive CDRP complaints as well, including seeking RDNH findings where the complaint is meritless. Genuine phishing cases rarely produce contested respondent filings, but that assessment belongs to the record – not the headline.

A note on the myth we encounter often: that phishing domains are recovered automatically once a registrar abuse report is filed. Registrar abuse reports can suspend a phishing site under the registrar's terms of service. They do not transfer the domain. Only a CDRP order (or court order) does that. A suspension that is lifted returns the domain to the phisher. The formal dispute process is the only mechanism that produces a durable transfer.

In a second recent matter (a .ca brand-impersonation domain, summer 2025), a healthcare-sector client had already filed multiple registrar abuse reports and received temporary suspensions before retaining us. We filed the CDRP complaint with the archived phishing-site captures as the primary evidence. The expert ordered cancellation within approximately eight weeks of filing.

Related at COGNOMEN

• UDRP domain recovery – filing a complaint to reclaim your domain across gTLDs
• Analysis: recovering a typosquatted domain and what the evidence record must show
• ccTLD disputes – comparing UDRP procedures and national .tv dispute routes

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.