Protecting Your Digital Identity

How Brand Owners Can Combat Fraudulent Domain Use in Indonesia

Domain names are among the most exposed elements of a company’s digital identity. A single fraudulent registration can redirect customers to phishing pages, intercept business emails, and damage a brand’s reputation. In 2025, WIPO administered 6,282 domain name dispute cases. That figure represents the highest volume in the mechanism’s 25-year history.

For brand owners operating in Indonesia, the risk is particularly relevant. As e-commerce continues to grow, the risk of fraudulent domain registrations targeting Indonesian businesses is likely to increase as well. As a result, brand protection in Indonesia now requires a structured approach to domain security.

We’ll explore the most common forms of domain abuse, outlines practical prevention and enforcement strategies, and explain the domain dispute resolution mechanisms available in Indonesia.

Common Types of Domain Abuse

Before taking action, brand owners should understand the main categories of domain abuse.

Cybersquatting occurs when someone registers a domain name that is identical or confusingly similar to a registered trademark. The registrant typically acts in bad faith, intending to sell the domain at an inflated price or divert traffic for commercial gain.

Typosquatting involves registering common misspellings of a brand’s domain name. For example, a typosquatter might register “brandnmae.com” or “brandnaem.com” to capture users who mistype the URL.

Phishing domains impersonate a legitimate business to deceive users. Their purpose is to harvest login credentials, payment details, or personal data. These domains often mimic the target brand’s visual identity. In addition, they may include mail exchange (MX) records configured for email-based fraud.

Brand impersonation extends beyond domain names. It includes fake websites, social media accounts, and email addresses that replicate a brand’s identity. Domain registrations often serve as the anchor for these schemes.

The industries most frequently targeted are financial services, retail, and technology. In these sectors, high-value customer data and transaction volumes make impersonation particularly profitable.

Step 1: Secure Key Domain Names Early

The most effective form of domain protection is proactive registration. Brand owners should register their core brand names across relevant top-level domains (TLDs). These include .com, .id, .co.id, and any TLDs associated with their industry or target markets. They should also consider registering common misspellings and abbreviations.

For businesses operating in Indonesia, registering .id and .co.id domains through Pengelola Nama Domain Internet Indonesia (PANDI) is a straightforward step. It closes a common attack surface at minimal cost. Additionally, brand owners should monitor newly lapsed or expired domains. Domains that carry residual brand association or search engine trust signals should be re-registered promptly.

Step 2: Monitor Domain Registrations and Online Activity

Proactive monitoring helps brand owners identify fraudulent domain registrations before they cause harm. Monitoring should cover new registrations that incorporate the brand name or close variations. It should also track changes to existing domain configurations, such as MX records, which may indicate phishing infrastructure.

However, monitoring should not stop at domain names. Brand owners should also track social media accounts, marketplace listings, and search engine results. Indonesia’s Permenkum 47/2025 now provides a structured reporting mechanism for online IP infringements identified through this kind of monitoring. Similarly, executive names should be monitored, because impersonation attacks increasingly target individual decision-makers rather than corporate brands.

To coordinate this effort effectively, brand owners should establish a cross-functional domain security team. This team should include representatives from legal, IT, marketing, and compliance. It should meet regularly to review monitoring results, assess threats, and coordinate responses.

Step 3: Strengthen Trademark Protection

A registered trademark forms the foundation for any enforcement action against fraudulent domain use. Without a valid registration, rights holders cannot invoke the Uniform Domain-Name Dispute-Resolution Policy (UDRP) or PANDI’s Penyelesaian Perselisihan Nama Domain (PPND). Brand owners should ensure their trademark portfolios are up to date and cover the relevant jurisdictions and classes. In Indonesia, a trademark registered with the DGIP provides the evidentiary basis for both domain dispute proceedings and broader IP enforcement actions.

Recent regulatory changes have also affected the trademark registration process in Indonesia.

Step 4: Gather Evidence of Infringement

When a fraudulent domain is identified, brand owners should immediately document and preserve evidence, as such domains are often modified or taken down once enforcement begins.

Key evidence includes screenshots showing URLs and timestamps, cached / archived copies of web pages, source codes, WHOIS records, email communications, and details of the domain’s registration and use. For potential dispute resolution or court proceedings, evidence should be preserved in a manner that maintains its integrity and supports a clear chain of custody.

Step 5: Assess Available Enforcement Options

Effective enforcement addresses three factors: the type of domain abuse, the urgency of the threat, and the outcome the brand owner seeks.

WIPO UDRP (Uniform Domain-Name Dispute Resolution Policy). ICANN established the UDRP as an administrative procedure for resolving disputes involving generic TLDs such as .com, .net, .org. To succeed, a complainant must prove three things:

• First, the domain name is identical or confusingly similar to its trademark.
• Second, the registrant has no rights or legitimate interest in the domain.
• Third, the registrant registered and used the domain in bad faith.

The standard process typically takes 60 to 90 days and results in a transfer or cancellation order. WIPO now also offers an expedited procedure with a 30-day target. The UDRP works best when the goal is domain transfer or cancellation, not monetary damages.

PANDI PPND (Penyelesaian Perselisihan Nama Domain). The PPND is a non-litigation body that handles domain disputes related to trademarks, registered names, and matters of decency. It applies a similar three-part test. The complainant must show that the domain is identical or similar to its trademark, that the respondent has no legitimate interest, and that the domain was registered or used in bad faith. Complaints go through PANDI’s portal at ppnd.pandi.id. Under PANDI Domain Name Dispute Resolution Policy Version 8.0, the rules now include streamlined complaint grounds, mandatory verification, and mediation provisions. Panel decisions are final and binding if no claim is filed to the Court within the prescribed timeframe.

SKC Law’s recovery of the sennheiser.co.id domain illustrates how the PPND process works in practice.

Registrar and hosting provider abuse complaints. In parallel with formal proceedings, brand owners can submit abuse complaints directly to the domain registrar or hosting provider. These complaints may result in faster domain suspension than UDRP or PPND proceedings. However, registrar responses vary, and documentation thresholds are not standardised.

Court proceedings. Where the threat is urgent, court proceedings may be necessary. Active phishing, fraud, or data theft may justify a temporary restraining order or injunction. Courts are also the appropriate route when the brand owner seeks monetary damages. In Indonesia, the relevant legal bases include the ITE Law and the Criminal Code (KUHP).

Step 6: Take Action Against Fraudulent Domains

Once evidence is gathered and the enforcement pathway is selected, the brand owner should act promptly. Delay allows fraudulent domains to cause ongoing harm. It also complicates evidence preservation.

For UDRP or PPND proceedings, the complaint should include trademark certificates, evidence of infringing use, WHOIS records, and relevant correspondence. Brand owners should prepare powers of attorney in advance to avoid delays.

Where multiple fraudulent domains target the same brand, consolidated complaints can address several domains in a single proceeding. This approach reduces cost and administrative burden.

In parallel, brand owners should consider internal blocking measures. Flagging known fraudulent domains within the corporate email and web filtering infrastructure prevents employees from interacting with these domains while enforcement proceeds.

Practical Checklist for Brand Owners

The following steps provide a baseline for protecting a brand’s digital identity:

Key Takeaways

Domain-related fraud is a growing risk for businesses. However, there are tried and tested enforcement options that do work.

The most effective strategies combine proactive domain registration and monitoring with a clear enforcement framework. That framework should include the UDRP, PANDI’s PPND, registrar abuse complaints, and court proceedings as appropriate.

A registered trademark remains the prerequisite for formal enforcement. Without one, the dispute resolution mechanisms described in this article cannot be invoked. Brand owners should treat domain security as part of their broader intellectual property protection strategy. It sits alongside trademark registration, customs recordal, and online and physical enforcement programmes.

Contact us for enquiries about domain dispute resolution, brand protection, or digital identity enforcement in Indonesia.

Read more about our enforcement capabilities on our website, or follow us on LinkedIn for regular updates.

This content is provided for general information only and does not constitute legal advice. For advice on specific matters, contact enquiries@skclaw.id.