Cybersquatting in Australia and how to get your domain name back

Someone else owns a domain name built around your business name. Maybe a customer forwarded you a phishing email sent from a lookalike address. Maybe you typed your brand into a browser and landed on a page you did not build. Maybe you searched for your own domain and found it for sale. However you found out, the same question follows: what can you actually do about it under Australian law?

What cybersquatting is and the patterns to watch for

Cybersquatting is the registration or use of a domain name that is identical or confusingly similar to someone else's name or brand, usually for a purpose the legitimate owner would not approve. The registrant might want to sell the domain back at a profit, park it with advertising, divert customers to a competitor, or use it to send emails that look like they come from you.

The patterns that show up most often with Australian small businesses:

Different extension: yourbrand.net or yourbrand.org registered when you hold yourbrand.com.au.
Typosquatting: misspellings and transposed letters, like yourbradn.com.au or your-brand.com.au, that catch traffic from typing errors.
Brand plus generic words: gets-yourbrand.com or yourbrand-reviews.com, aimed at intercepting search traffic and paid ads.
Other country codes: yourbrand.co or yourbrand.io, which matter more if you trade internationally.
The .au direct space: since .au direct names opened to general registration in March 2022, yourbrand.au can sit in different hands from yourbrand.com.au.

Not every similar domain is cybersquatting. Another business can legitimately hold a name that resembles yours, and the dispute systems are built around testing whether the holder has a genuine interest. What turns a registration into a problem is the combination of similarity, an absence of legitimate interest, and bad faith.

The damage to a small business is usually practical before it is legal: diverted sales, customers unsure which site is real, phishing sent under your brand, and the slow erosion of the goodwill you have spent years building. None of it resolves itself, so knowing your options matters.

Prevention is cheaper than recovery

A few inexpensive habits stop most cybersquatting before it starts:

Register defensively, early: when you secure your main domain, also take the core set around it. Yourbrand.com.au, yourbrand.au and yourbrand.com, plus the handful of obvious misspellings, hyphenated versions and brand-plus-industry terms a bad actor would realistically take. Set auto-renewal and calendar reminders, because a lapse is when squatters move in.
Understand .au eligibility: under the auDA Licensing Rules in force since April 2021, .au domain names are licences carrying no proprietary rights, and they are only available to registrants with an Australian presence. Names in the com.au and net.au spaces must also have a close and substantial connection to the registrant, meaning the name must match or closely correspond to the registrant's own name or registered trade mark. This cuts both ways: it keeps you eligible to hold the names you want, and it gives you a lever if someone who plainly does not qualify is holding one.
Register your trade marks: a registered trade mark is the single strongest asset in a domain dispute. It gives nationwide exclusive rights, it is the cleanest evidence of rights for an auDRP or UDRP complaint, and it is the foundation of an infringement claim under s 120 of the Trade Marks Act 1995 (Cth). Apply for the classes that reflect how you actually trade, including online retail, so your registration covers the goods and services a squatter is likely to trade in.
Know what a business name does and does not do: a registered business name is a public record of who is trading under a name. It does not give you exclusive property rights in the name itself. It is useful evidence of priority and use, and it can support an auDRP complaint, but it is not a substitute for a trade mark.
Monitor the edges of your brand: set alerts for your business name, search domain marketplaces and WHOIS records occasionally, and keep a dated log of anything suspicious. Screenshots and dates become your evidence if you need it.

If you find a lookalike domain, act in this order

Work through these six steps in order, from the cheapest and fastest response to the most involved:

Capture evidence first: screenshot the site, its content, its ads and any pages that use your branding. Record the WHOIS or registry details if you can access them, the date you first noticed the domain, how you became aware of it, and any harm you can point to, such as lost orders or customer complaints. Registrants sometimes change or transfer a domain the moment they are contacted, and your record is what you have left.
Work out what rights you actually hold: a registered trade mark is the strongest, but a pending application, a business name registration, long use of the name and a demonstrable reputation can all matter. Write down how the domain overlaps with your name, your goods and your customers.
Decide whether buying is the right move: for a generic-sounding domain with no sign of bad faith, a commercial purchase can be the sensible, cheap outcome. But paying an inflated price funds the pattern, so assess your legal position before you negotiate. You may hold grounds to recover the domain without paying.
Send a professional demand letter: set out your rights, explain how the domain overlaps with them, and give a clear deadline for transfer or cessation. A specific, professional letter resolves a surprising number of cases quickly. Avoid aggression and threats you cannot substantiate; they rarely help and can complicate a later dispute.
Escalate to an administrative dispute: file a complaint under the auDRP or UDRP. This is the main formal route, and the next section sets out how it works.
Run parallel actions where they fit: report impersonation to hosting providers, platforms and the registrar, report phishing to the relevant authorities, tighten your own email authentication and DNS settings, and consider court proceedings if the behaviour or the loss justifies it.

How the auDRP and UDRP work

Two administrative systems handle most domain disputes, and which one applies depends on where the domain sits:

The auDRP (the .au Dispute Resolution Policy) applies to licences in the .au namespace, including com.au, net.au, org.au and .au direct. It is administered by auDA, the .au administrator, and the current policy dates from 2016, with the policy first adopted in 2001.
The UDRP (the Uniform Domain Name Dispute Resolution Policy) applies to global domains such as .com, .org and .net, under ICANN's policy.

Both are paper-based: a complaint is filed with an approved provider such as WIPO, the registrant can respond, and a panel decides on the written submissions. No hearings, no court appearances. That is why they are faster and cheaper than litigation.

For the auDRP, the complainant must establish all three elements in paragraph 4(a):

the domain is identical or confusingly similar to a name, trade mark or service mark in which the complainant has rights;
the registrant has no rights or legitimate interests in the domain; and
the domain was registered or subsequently used in bad faith.

Two features of the auDRP matter a lot for small businesses. First, the policy's definition of "name" includes a company, business or other legal or trading name registered with an Australian government authority, as well as personal names. That means a registered business name can support a complaint even without a trade mark. Second, the bad faith limb is broad: evidence includes registering the domain primarily to sell, rent or transfer it for more than your documented out-of-pocket costs, registering it to prevent the owner from reflecting its name in a corresponding domain, registering it to disrupt someone's business, or using it to attract internet users for commercial gain by creating a likelihood of confusion.

The UDRP works on the same three-part shape, with one important difference: the rights limb requires trade mark or service mark rights. For a .com domain, a registered trade mark matters much more, and a business name alone is weaker footing.

The practical mechanics under the auDRP: the complaint is filed with an auDA-approved provider, with fees of A$2,000 for one to five domain names before a single panellist at current rates. The registrant has 20 days to respond. The panel decides on the papers, and the remedies are limited to transfer or cancellation of the licence, never damages. A transfer only happens if the complainant is itself eligible to hold the domain. If transfer is ordered, the registrar waits 10 business days before implementing it, so a losing party can still go to court. There is no appeal within the system. The process is designed to run in weeks rather than months; in practice, assembling the evidence and drafting the complaint often takes longer than the proceeding itself.

The court-level rights underneath

The dispute systems get a domain transferred or cancelled. The deeper legal rights come from Australian statute and common law, and they matter when you need more than that:

Trade mark infringement: s 120 of the Trade Marks Act 1995 (Cth) is the core provision. A person infringes by using, as a trade mark, a sign that is substantially identical with, or deceptively similar to, the registered mark in relation to the goods or services for which it is registered, with additional protection where the mark is well known in Australia. A squatted domain used to sell goods or services under your brand can be exactly that sign.
Misleading or deceptive conduct: s 18 of the Australian Consumer Law, which sits in Schedule 2 of the Competition and Consumer Act 2010 (Cth), prohibits conduct in trade or commerce that is misleading or deceptive, or likely to mislead or deceive. Where a registration is designed to trade on your name or to mislead customers, this is the natural claim.
Passing off: the common law protects the goodwill attached to a name where someone misrepresents a connection to you and causes damage. It is available without a registered trade mark, if you can prove reputation.

The leading Australian cybersquatting case shows all of this working together. In CSR Ltd v Resource Capital Australia Pty Ltd [2003] FCA 279, a company registered the business name CSR Sugar Supply and, on the same day, registered csrsugar.com and csrsugar.com.au, then offered to sell them to CSR, which held registered trade marks and enormous goodwill in the CSR name. The Federal Court found misleading and deceptive conduct, under what is now s 18 of the Australian Consumer Law, and trade mark infringement. It ordered the domains transferred and restrained the respondents from using the CSR names. The judgment drew on the English cybersquatting decision in British Telecommunications plc v One in a Million Ltd [1998] 4 All ER 476.

The practical point: administrative disputes can return your domain, but they cannot compensate you. If a squatter has caused real financial loss, or refuses to comply, court action is the route to damages, injunctions and costs orders. It is slower and more expensive, which is precisely why the ADR systems exist.

When a cybersquatting dispute needs a lawyer

Most of the steps above can be started by a business owner, but several judgement calls decide whether they work:

whether your trade mark, business name or reputation actually covers the domain in question;
whether the registrant's account of a legitimate interest holds up;
whether the facts support bad faith, which usually decides the case;
whether to negotiate, file an auDRP or UDRP complaint, or go to court; and
how to build a defensive portfolio and trade mark strategy without overspending.

An intellectual property lawyer at Artificer Legal can audit your rights, organise the evidence, draft the demand letter, prepare and file the auDRP or UDRP complaint, negotiate a purchase, and run court proceedings if it comes to that. Because panels decide on the papers, the quality of the evidence and the drafting can be the difference between keeping and losing the domain. If you have found a lookalike domain, or you want to lock down your brand before a problem appears, this is where a lawyer earns their keep: assessing the strength of your position before you spend money on fees, purchases or a fight you cannot win.

Getting the domain back is not the same as getting compensated

The most useful thing to remember is the split at the centre of every cybersquatting matter. You do not need to be a large company or hold a registered trade mark to start an auDRP complaint, because a registered business name or trading name can give you rights in the domain for that purpose. But the auDRP and UDRP can only transfer or cancel the domain. They cannot award you damages for lost sales, and they will not make the squatter pay. That is why the evidence you capture on day one and the rights you hold matter more than the strength of your outrage: they determine both whether you can recover the domain cheaply and whether you can be compensated for the harm at all.

In short: register your core domains and renew them on time, put a registered trade mark behind your brand, keep a dated record of your own use and of anything suspicious, and if a lookalike appears, capture evidence first, assess your rights, send a professional demand, and escalate to the auDRP or UDRP. Trade mark infringement, misleading conduct under the Australian Consumer Law and passing off sit underneath if you need more than the domain back. A lawyer can help with the judgement calls at each step, and getting the foundations right before a dispute starts is almost always the cheapest strategy of all.