L’Oréal v Haley Wall et al. (WIPO Case No. D2026-0199)

L’Oréal successfully pursued 705 domain names in a single complaint. The domains were all variations on the L’ORÉAL mark combined with recruitment-related terms and were registered in a short window between 23 December 2025 and 15 January 2026. Even though the registrant details differed, the panel was satisfied that the domains were under common control based on a combination of factors, including shared infrastructure, repeated use of the same email addresses, and batch-style registrations.

This case sits among the largest modern UDRP filings. In 2026, Empower, a financial services company, also recovered 537 domains involving a large-scale typosquatting operation, where the domains were used as part of a sophisticated phishing scheme [WIPO Case No. D2026-0344]).

Similarly, in 2025, Novartis recovered over 350 domains across two complaints (here and here).

“Here comes the science bit”: consolidation 

Despite the growing acceptance of large complaints, consolidation remains fundamental. 

The ability to consolidate complaints was hampered in May 2018, when new GDPR laws meant that the WHOis records for domains were redacted. Panels are now taking a more pragmatic approach where the facts justify consolidation, and WIPO’s new early termination system allowing complainants to access underlying WHOis details for $20 per domain means the landscape is more favourable.

Panels still require evidence that the domains are subject to common control and that consolidation is fair and efficient (see Rule 3(c)). There is no substitute for detailed investigations and credible submissions.

In L’Oréal, the threshold was clearly met. The panel emphasised the short registration window, the uniform structure of the domain names, and the limited pool of underlying contact details. Together, these pointed to a single coordinated operation, likely linked to phishing or recruitment scams.

Cancellation at scale

Unusually, L’Oréal requested cancellation of all 705 domains, whereas most successful complaints result in transfer.

The rationale appears pragmatic: managing and renewing hundreds of domains carries cost, and many of the disputed names may have had little value to retain. However, cancellation introduces risk. Once cancelled, domains can be re-registered, particularly where they have been used for fraud or phishing and may form part of a wider fraud toolkit.

Split strategy opportunity?

The L’Oréal decision raises the question of whether a split strategy would have been preferable. For example, one complaint could seek transfer of higher-risk domains, while another seeks cancellation of lower-value names. This might secure control over the most dangerous domains while avoiding the cost of maintaining a large portfolio. However, it would also involve paying two sets of official fees.

Other options might include allowing domains to lapse on renewal after a period or consolidating them with a secondary, cost-effective registrar.

Key lessons

Bulk UDRP complaints may now be a practical necessity for some brands and industry sectors, and panels are prepared to deal with them where the evidence stacks up. 

Consolidation, evidence and remedy should be aligned with the real risk posed by the domains, though, rather than driven solely by the immediate outcome of the case. Cancellation may be cheaper and simpler, but it leaves open the possibility of reuse. In a landscape where scams are increasingly convincing, often aided by AI generated content, those domains can readily reappear as part of credible phishing operations.

It remains to be seen if winning a cancellation-as-remedy UDRP at this scale is a case of hair today, gone tomorrow.