How to recover a .jp domain used for phishing
A phishing site running under a .jp domain bearing your brand name causes immediate, measurable harm. Customers receive fraudulent emails, submit credentials, and attribute the damage to you. The registry and the hosting provider may act fast on abuse reports – but they will not transfer the domain to you. For that, you need a dispute procedure.
To recover a .jp domain used for phishing, the primary route is the JP-DRP – Japan's dedicated domain dispute resolution policy, administered by the Japan Intellectual Property Arbitration Center (JIPAC). The JP-DRP applies to .jp domains and tracks the UDRP's three-element test: confusing similarity to your mark, no legitimate interest on the registrant's side, and registration or use in bad faith. A phishing campaign is among the clearest bad-faith patterns a panel ever sees. The only remedies are transfer or cancellation; no damages are awarded through this channel.
This page covers the JP-DRP test, the evidence that wins these cases, the realistic timeline and cost structure, and how the dispute route interacts with parallel abuse-reporting and court options.
What procedure governs .jp – and why the UDRP does not apply directly?
The UDRP, adopted by ICANN in 1999, applies to domains registered under accredited generic-TLD registrars – .com, .net, .org, and other gTLDs. It does not govern .jp by default. Japan's ccTLD is administered by JPRS (Japan Registry Services), and JPRS has adopted the JP Domain Name Dispute Resolution Policy – universally abbreviated JP-DRP – as the applicable dispute mechanism for .jp registrations.
The JP-DRP is closely modeled on the UDRP. The three-element framework, the burden of proof on the complainant, and the remedy menu (transfer or cancellation, nothing else) are all parallel to the UDRP. The critical structural difference is that JIPAC administers JP-DRP proceedings rather than WIPO or the Forum. That matters for filing logistics, language requirements, and fee structure – but the doctrinal analysis a practitioner applies is substantially the same.
One practical point: if the phishing actor has also registered a .com or other gTLD version of your mark, those domains can be pursued simultaneously through WIPO or the Forum under the UDRP, and the bad-faith evidence you develop for the .jp proceeding carries directly over. We regularly advise brand owners who face a coordinated campaign across multiple zones and who want both tracks running in parallel.
Do the three UDRP elements apply to a JP-DRP complaint?
Yes. The JP-DRP requires the complainant to satisfy all three elements that mirror Paragraph 4(a) of the UDRP: (1) the disputed .jp domain is identical or confusingly similar to a trademark or service mark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain has been registered or used in bad faith. Note the conjunction in element three: Japan's policy, like Nominet's .uk DRS and unlike the core UDRP, is generally read to permit a finding on registration OR use in bad faith independently – a nuance that sometimes advantages brand owners when the registration predates the abuse but the phishing use is clearly bad faith.
In a phishing scenario, elements two and three are typically the least contested. A registrant operating a fraudulent credential-harvesting site has no bona fide offering of goods or services, no legitimate noncommercial use, and no claim to be commonly known by the brand name. The phishing use itself – impersonating the brand to deceive consumers – is a textbook bad-faith use regardless of registration intent. The evidence question therefore usually reduces to element one: can you demonstrate trademark rights in the name the phishing domain imitates?
What trademark rights satisfy element one in a .jp proceeding?
You do not need a Japanese trademark registration, though holding one simplifies the filing. JP-DRP panels, following the UDRP consensus view, accept rights established by registration in any jurisdiction. A US, EU, or UK trademark registration covering the relevant goods or services is sufficient, provided the mark predates the domain registration or, in a use-based bad-faith scenario, predates the phishing campaign.
Unregistered or common-law rights are accepted where the complainant can demonstrate substantial reputation and market recognition. Brand owners with significant Japanese consumer-facing operations who have not yet registered in Japan still have a viable claim if the broader trademark record is strong. In our practice, we have advanced successful JP-DRP complaints on the strength of non-Japanese registrations alone, supported by evidence of local consumer exposure.
The confusing similarity analysis is straightforward in most phishing cases. Phishing domains are designed to deceive – they are typically identical to the brand mark or differ only by a common typo, a generic word addition ("secure-[brand].jp", "[brand]-japan.jp"), or a hyphen. Panels regularly find confusing similarity in these patterns without extended analysis.
If you have a trademark record and a .jp phishing domain in front of you, the preliminary assessment is quick. For a read on whether the three JP-DRP elements are met in your situation, reach us at info@cognomenlaw.com.
What evidence wins a JP-DRP phishing case?
Evidence assembly is where these cases are decided. A panel needs to see, in the complaint record, a complete chain from "here is my trademark" to "here is the fraudulent use" to "here is why the registrant has no defense." Below is the standard evidence set we assemble for phishing complaints.
Trademark evidence. Certified copies or official printouts of trademark registration certificates; for common-law rights, evidence of first use, advertising spend, market recognition, and consumer reach. The mark must be shown to be the same name or close enough to the domain to satisfy confusing similarity.
Phishing documentation. Screenshots of the fraudulent website, captured with a forensic timestamp and the full URL visible in the browser bar. Where the site impersonates a login page, customer portal, or payment form, document that in full. If you have received consumer complaints, abuse reports, or law-enforcement notices referencing the .jp domain, include those as exhibits.
WHOIS and registration data. Current RDDS output showing the registrant's identity (often anonymized or false), the registration date, and the registrar. A registration date that postdates your trademark's priority date and coincides with a brand launch or product announcement is a powerful chronological fact.
Abuse and malware flags. Third-party security service reports flagging the domain as malicious, as well as any registrar or hosting abuse submissions you have made, show the public record of the harm. Panels treat these as corroborating the bad-faith use allegation.
Absence of a legitimate interest. Demonstrate that the registrant has no trademark rights, no business commonly known by the name, and no plausible noncommercial purpose. A WHOIS that shows a false or generic registrant name, combined with a site that does nothing except impersonate your brand, is usually sufficient to shift the burden.
In a matter we handled involving a .jp phishing domain targeting a financial services brand (spring 2025), the evidence record included timestamped screenshots of a cloned login portal, a consumer fraud report submitted to the relevant financial regulator, and RDDS data showing the domain had been registered within days of the brand's regional product launch. The panel found all three elements met and ordered a transfer.
How long does a JP-DRP proceeding take, and what happens step by step?
A JP-DRP proceeding, once filed in proper form, typically follows a structured sequence from submission through registrar implementation. While the JP-DRP has its own procedural calendar administered by JIPAC, the stages are closely analogous to the UDRP – and brand owners familiar with UDRP timelines will find the process recognizable.
The sequence runs: complaint filing and formal review → commencement and service on registrant → response period (typically around 20 days from commencement, paralleling the UDRP standard) → panel appointment → decision → implementation by the registrar. A standard, undefended phishing case is unlikely to extend beyond roughly two months from filing to a decision on the merits.
Phishing cases rarely produce a substantive response from the registrant. Actors who register domains for fraudulent campaigns do not typically file legal defenses. A default does not mean automatic transfer – the panel still examines the complaint record independently – but a strong, well-evidenced complaint without opposition moves efficiently through the process.
One procedural note: language requirements at JIPAC favor Japanese, and filings in Japanese are the default. English filings are permitted in some circumstances, but a party unfamiliar with JIPAC's current procedural rules should confirm the language protocol with counsel before drafting. We work with Japanese-language filing support for JP-DRP matters.
If a phishing site under a .jp domain is live right now, time is a factor. To assess the JP-DRP route and begin evidence assembly, email info@cognomenlaw.com.
Should you also pursue the hosting provider and registrar in parallel?
Yes – and the two tracks are not mutually exclusive. While the JP-DRP proceeding is underway, abuse escalation to the hosting provider and the registrar is worth pursuing simultaneously. Hosting providers act on phishing reports faster than dispute panels do; if the fraudulent site can be taken offline even while the domain itself remains in the registrant's name, the immediate consumer harm is reduced.
JPRS, as the .jp registry, also maintains an abuse policy and accepts reports of fraudulent use. A registry-level abuse report will not transfer the domain to you – that requires a JP-DRP decision or a court order – but it may result in the domain being locked or suspended during the proceeding, which prevents the registrant from transferring it to a new holder or pointing it to a different server.
For the dispute proceeding itself, evidence that you made a timely abuse report and received no remedial response from the registrant or registrar strengthens the bad-faith record. Panels have consistently treated a registrant's failure to respond to abuse notices as consistent with, and corroborative of, a lack of legitimate interest.
What if the JP-DRP is not enough – when does court action become relevant?
The JP-DRP delivers transfer or cancellation. It does not deliver damages, injunctive relief targeting the fraud operation beyond the domain, or criminal referral. Where the phishing campaign has caused quantifiable financial loss – customer fraud, diverted payments, reputational injury – a civil court action in Japan is the avenue for monetary relief. That route runs through the Japanese courts with local litigation counsel in Japan, and proceeds on trademark infringement and unfair competition theories under the applicable national legislation.
Court action is substantially slower and more expensive than a JP-DRP complaint. In most phishing scenarios, the brand owner's immediate priority is stopping the fraud and recovering the domain – both of which the JP-DRP addresses directly. Court is the follow-on route where the facts justify it.
A different cross-zone scenario arises if the same threat actor operates under a .com or other gTLD in addition to the .jp. In that configuration, we recommend filing a UDRP complaint at WIPO or the Forum for the gTLD domains concurrently with the JP-DRP. Both proceedings share the same evidentiary core. The UDRP filing fee at WIPO starts at USD 1,500 for a single-member panel on one to five domains; the JP-DRP has its own fee schedule published by JIPAC. Running both tracks doubles the filing cost but ensures the registrant cannot simply redirect traffic to the surviving zone while one proceeding concludes.
If the domain was instead a .de or .eu, neither the UDRP nor the JP-DRP would apply; .de disputes proceed through German courts (with a DENIC DISPUTE entry to block transfer during litigation), and .eu disputes proceed through the ADR.eu procedure administered by the Czech Arbitration Court. Every zone has its own governing procedure – confirming the correct route before filing is essential.
How do fees work in a JP-DRP phishing case?
Two cost layers are always present in a domain dispute: the forum filing fee paid to the dispute provider and the legal fee for counsel who prepares the complaint, assembles evidence, and manages the proceeding.
For JIPAC JP-DRP proceedings, the published filing fees are set by JIPAC and should be verified against JIPAC's current schedule at the time of filing, as they are denominated in Japanese yen and are subject to revision. Unlike the UDRP fees – where WIPO's fee of USD 1,500 for a single-member panel on one to five domains is a firm published figure – JP-DRP fees are best confirmed with current JIPAC guidance. We confirm current JIPAC fees as part of every client briefing.
On the legal fee side: for a single-domain JP-DRP complaint in a straightforward phishing scenario with a strong trademark record, the legal fee is typically within the range that applies to a standard UDRP complaint – a flat fee commonly in the USD 3,000 – 7,000 range, though complexity, the size of the trademark record, and language-related filing requirements affect where a specific matter falls. Phishing cases tend toward the lower end of that range because the bad-faith element is rarely in dispute and the evidentiary record is concrete.
If the matter escalates – a respondent files a substantive defense, a three-member panel is requested, or parallel court action becomes necessary – costs increase accordingly. The respondent bears no fee for filing a defense under the JP-DRP structure, so a contested proceeding is entirely possible even if statistically uncommon in phishing scenarios.
In our practice, we quote a flat engagement fee for straightforward JP-DRP complaints and scope any escalation separately. COGNOMEN publishes its price ranges rather than requiring clients to request a quote in the dark.
Related at COGNOMEN
Frequently asked questions
How do I start to recover a .jp domain used for phishing?
The first step is confirming your trademark rights and collecting documentation of the phishing use – screenshots, RDDS data, consumer or regulator complaints. Once the evidentiary foundation is clear, a JP-DRP complaint is filed with JIPAC. We assess the three elements of the JP-DRP test, confirm the current JIPAC procedural requirements including language protocols, assemble the evidence record, and file the complaint. The process can move from initial instruction to a filed complaint in a matter of days when the trademark record is readily available.
What are the realistic outcomes when you recover a .jp domain used for phishing?
The JP-DRP offers two remedies: transfer of the domain to the complainant or cancellation of the registration. Transfer is the preferred outcome for most brand owners because it prevents the domain from being re-registered by a new bad actor. Cancellation frees the name for re-registration by anyone, which may be adequate if the brand owner wishes to let the domain lapse. No monetary damages are awarded through the JP-DRP. Outcomes depend on the specific facts of the case, the evidence submitted, and the panel's assessment – no result can be guaranteed.
How do fees split if the case escalates?
If a respondent requests a three-member panel, the additional panel fee is typically split between the parties under JIPAC's rules – paralleling the UDRP structure where the party requesting the three-member panel (or the parties together) bear the higher fee. If the matter requires parallel court action in Japan for damages, that track involves separate legal and court fees handled through local litigation counsel in Japan, and costs there are substantially higher than a JP-DRP proceeding alone. We scope escalation scenarios at the outset so you understand the full cost range before committing to a strategy.
Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.