You registered yourbrand.com.au when you started the business, connected it to your website, and put it out of your mind. Then one morning you search your own name online and the first result is not your site. It is yourbrand.com.au, a domain you never registered, resolving to a page of pay-per-click ads. Two days later an email arrives offering to sell that domain back to you for A$2,500, before it is "offered to anyone else". The sender registered it eleven days ago.
Why this is a legal problem, not just an annoyance
Domain squatting, sometimes called cybersquatting, is the practice of registering, holding, or using a domain name that trades on someone else's business name, brand, or reputation. Not every similar domain is squatting. Two unrelated businesses can legitimately share a word, and generic names get registered all the time. What makes the conduct objectionable is the use: registering your name to sell it back at an inflated price, to divert your traffic, to run ads off your reputation, or to impersonate you.
The harm lands quickly. Customers who mistype or guess the address end up somewhere that is not you. If the squatter hosts ads, spam, or misleading content under your name, your reputation takes the hit; if they use your logos and details, customers can be tricked into paying a fake invoice or sending money to a fake account. Australian law treats this seriously. Misleading or deceptive conduct in trade or commerce is prohibited by s 18 of the Australian Consumer Law (ACL), which is Schedule 2 of the Competition and Consumer Act 2010 (Cth). In CSR Limited v Resource Capital Australia Pty Ltd [2003] FCA 279, a company registered a business name and domains containing the letters "CSR" on the same day, then offered to sell a related domain to CSR for A$25,000 to A$30,000. The Federal Court held the registration was misleading or deceptive conduct in trade or commerce under s 52 of the Trade Practices Act 1974 (Cth), the predecessor of ACL s 18, and ordered the transfer of the domain, injunctions, and costs. The judge described the practice as conduct that "verges on the criminal".
A five-step response plan
For most small businesses the fastest fix is not court. It is a sequence of steps you can take in the first days after you discover the problem, in an order that preserves your evidence and your options. Two of the steps, capturing evidence and identifying the holder, can run in parallel, since each informs the other.
Step 1: capture the evidence before you contact anyone
The most common mistake is to email the squatter first. A single message can tip them off. Websites get taken down, domains get transferred, and records get scrubbed. Under the dispute policies described in step 5, you carry the burden of proving the elements of your case, and proof has a short shelf life if you do not capture it now.
Before you send anything, save:
- the exact domain name and the URL as it appears in your browser;
- dated screenshots of what the website shows, taken from a logged-out browser, including the address bar;
- any redirects, for example to a competitor's site or a parked page;
- any advertising, copied logos, copied copy, or your business details appearing on the site;
- any emails or messages offering to sell you the domain, including headers and dates; and
- any WHOIS details you can see before they change.
Store these where you cannot lose them, with the dates attached. If the dispute later goes to a panel or a court, this folder is your case.
Step 2: find out who actually holds the domain
Run a WHOIS lookup. For .au domains, auDA provides a .au WHOIS tool on its website. For international domains such as .com, the registrar or a lookup service will show the registration details. Privacy settings may hide the registrant's identity, but even then the lookup usually reveals the registrar, the creation date, and the renewal date, all of which matter.
What you are looking for:
- the registrant's name, and whether it is an individual or a company;
- the registrar that issued the registration;
- the registration and renewal dates, which show whether the domain predates or postdates your own use of the name;
- a contact channel for a formal notice, if one is visible.
There is an Australian wrinkle worth knowing. A .au domain is a licence granted under auDA's rules, not an outright purchase, and the licence holder must meet the eligibility requirements for the namespace. The .au Dispute Resolution Policy (auDRP) treats a false or misleading eligibility declaration as evidence of bad faith in its own right, which can help your case if the squatter has gamed the rules to hold the name.
Step 3: identify the rights you can prove in the name
Domain disputes turn on rights, and you need to know what you can prove before you choose a route. The good news for Australian businesses is that you do not need a registered trade mark to start an auDRP complaint for a .au domain. The policy defines a "name in which the complainant has rights" to include your company, business, or other legal or trading name as registered with the relevant Australian government authority, or your personal name.
What can support your position:
- a registered trade mark in your brand name, filed through IP Australia;
- your company or business name registration;
- how long you have traded under the name;
- your website and social media history, with dates;
- domain registration records, including invoices and renewal confirmations; and
- customer confusion, such as emails from customers who believed the squatter was you.
Two cautions. First, for international domains under the UDRP the standard is different: the complainant must hold trade mark rights, not merely a business name. Second, a business name registration does not give you exclusive rights to use that name everywhere, and it does not stop someone with a legitimate business of their own from using a similar name. What it does do is establish the rights limb for an auDRP complaint, which is often all you need at this stage.
Step 4: send a precise letter before you escalate
A carefully drawn letter can end the matter quickly, because many squatters are opportunistic and will fold rather than defend a formal complaint. The letter should identify you and the rights you can prove, name the domain and the conduct complained of, state what you require (transfer, cancellation, or cessation of use), and give a reasonable deadline, typically 14 days.
Drafting discipline matters. If you overstate your rights or threaten action you cannot back, the letter can be used against you later, and an aggressive or inaccurate letter can turn a negotiable situation into a fight. Have the letter checked before it goes out, and treat it as part of the evidence trail rather than the end of the process. In the CSR case, the company's lawyers wrote demanding undertakings and a transfer; the squatter refused and claimed he was protecting the company's shareholders, and the matter ended in court. A letter works when the other side is rational, and it documents your position when they are not.
Step 5: pick the dispute route that fits the domain
If the squatter will not cooperate, the efficient path is usually an administrative dispute, not litigation. The right route depends on the extension.
- For .au domains: disputes run under the auDRP, which applies to licences issued or renewed since 1 August 2002 across the .au namespaces, including .com.au and the shorter .au direct names. You file a complaint with one of the auDA-approved providers. You must show three things: the domain is identical or confusingly similar to a name, trade mark, or service mark in which you have rights; the registrant has no rights or legitimate interests in it; and it was registered or subsequently used in bad faith. Bad faith is typically shown by an intention to sell at a profit, to block you from the name, to disrupt your business, or to attract traffic by creating confusion with your name.
- For .com and other international domains: disputes run under ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP), which all registrars of generic top-level domains must follow. The test is the same in structure, but the complainant must hold trade mark rights. Proceedings are administered by ICANN-approved providers, most commonly the WIPO Arbitration and Mediation Centre, which was the provider in the tullochwines.com dispute described in the CSR judgment.
What you can get is transfer or cancellation, not compensation. A panel can order the domain transferred to you if you are eligible to hold it, or cancelled so that it returns to the pool. The process is faster and cheaper than court: a response is due within 20 days of notification, panel fees start at about A$2,000 for a single-member panel covering up to five domains, and the respondent only pays half the costs if they elect a three-member panel. Panel decisions are binding and there is no appeal, but the registrar waits 10 business days before implementing a transfer, so a party who wants to litigate can still go to court.
Where the administrative route does not fit, court remains available. If the squatter is impersonating you, running phishing, or otherwise misleading customers, ACL s 18 gives you a claim for misleading or deceptive conduct, as the CSR case shows. Court is slower and more expensive, but it can deliver injunctions, delivery up of materials, and costs, which the administrative policies cannot.
When you should bring in a lawyer, and what we would do
You can gather evidence and run a WHOIS lookup yourself, but there are situations where advice is worth having before you act: the domain is being used for phishing or impersonation; the squatter holds several domains that include your name; you are close to a launch or a raise where the name is critical; the other side is litigious; or you have been trading under the name for years and the value at stake is real.
If you brought this situation to us, the steps would look like this. We would take the evidence you have captured and assess which rights you can prove, then advise on the route that fits the domain and the facts: auDRP, UDRP, a court claim under ACL s 18, or negotiation. We would check the practical details that trip people up, such as eligibility for a transfer, the complaint deadlines, and whether the facts satisfy the bad faith indicators. We would draft the complaint or response, including the evidence annexure, so the panel can see the case without wading through screenshots themselves. If the other side is willing to settle, we would negotiate the transfer on terms that include the release you need. And if a decision goes against you, or the other side refuses to comply, we would advise on the court options that remain, including the window before a transfer is implemented.
The order of your first 48 hours decides how much leverage you keep
The step people skip is the first one. Almost everyone wants to email the squatter, demand an explanation, or offer a lower price. The single most valuable thing you can do is capture the evidence before you make contact. Screenshots, WHOIS details, and the offer email cost you nothing and take an hour, and they are the difference between a dispute you can run and a dispute you cannot prove. Proof has a shelf life, and the squatter has every reason to shorten it.
The rest of the plan is straightforward once the evidence is safe. Confirm who holds the domain, work out the rights you can prove in the name, send a precise letter, and if that fails, file under the auDRP for .au domains or the UDRP for international ones, with a court claim under ACL s 18 in reserve for the serious cases. For most small businesses the administrative route, not litigation, is the fastest way to get your name back. And if you are reading this before anyone has squatted your name, registering the key variations of your domain and keeping the renewals in your own hands is cheaper than any of these steps.