How to Dispute a Cybersquatted Domain Name

Cybersquatting means registering a domain name that matches or imitates someone else’s trademark in order to profit from it: selling it back at an inflated price, parking it with ads that ride on the brand, diverting customers, or running phishing pages. If you have found a domain like that targeting your business, you have more options than sending angry emails. This guide walks through the main legal routes, what each one can and cannot achieve, roughly what they cost, and when a quiet negotiation is the smarter move.

This article is general information, not legal advice. Rules and fees change, and the right strategy depends on your facts, so speak to a qualified lawyer before filing anything.

First, confirm it really is cybersquatting

Not every similar domain is abusive. A small bakery called “Apex” that registered apex-bakery.com long before your “Apex” software brand existed is probably a legitimate user, not a squatter. Before you invest time and money, ask a few honest questions:

• Do you have trademark rights? A registered mark is strongest, but unregistered (common-law) rights can count in some proceedings if you can show the name is distinctive and known for your goods or services.
• When was the domain registered? If it predates your brand, proving bad-faith registration becomes very hard.
• How is it used? Pay-per-click links to competitors, a “this domain is for sale” page aimed at you, impersonation or phishing are typical bad-faith signals.
• Who holds it? Many registrants use privacy services, but the registrar, creation date and status codes are still public.

A WHOIS / RDAP lookup on TLDix gives you the registrar, creation and expiry dates and nameservers in seconds. Screenshot the website and lookup results with dates; this record becomes your evidence.

The UDRP: the standard route for gTLDs

The Uniform Domain-Name Dispute-Resolution Policy (UDRP) was adopted by ICANN in 1999 and is binding on every registrant of a generic top-level domain such as .com, .net, .org and the new gTLDs. Registrants accept it in their registration agreement, so you do not need the registrant’s consent to start a case. Several ccTLDs have also adopted the UDRP or a close variant.

The three elements you must prove

1. Identical or confusingly similar: the domain is identical or confusingly similar to a trademark or service mark in which you have rights.
2. No rights or legitimate interests: the registrant has no rights or legitimate interests in the name. You make a prima facie case, and the burden then shifts to the respondent to show, for example, a genuine prior business use or that they are commonly known by the name.
3. Bad faith: the domain was registered and is being used in bad faith. The policy lists examples such as acquiring it mainly to sell to the mark owner, blocking a competitor, disrupting a competitor’s business, or attracting users for commercial gain by creating confusion.

All three must be proven. Panels regularly deny complaints that are strong on the first element but weak on bad faith, and a complainant who files in obvious bad faith risks a finding of Reverse Domain Name Hijacking.

Providers and procedure

Complaints are filed with an ICANN-approved provider. The best known is the WIPO Arbitration and Mediation Center; others include Forum (formerly the National Arbitration Forum), the Czech Arbitration Court, the Asian Domain Name Dispute Resolution Centre and the Canadian International Internet Dispute Resolution Centre. The process is written: you file a complaint with evidence, the registrar locks the domain, the respondent has a set period to reply, and one or three panelists decide. Cases commonly conclude within about two months. If the panel orders a transfer, the registrar implements it after a short waiting period unless the losing party shows it has started a court case.

The key limit: the UDRP can only transfer or cancel a domain. It does not award damages or costs.

The URS: a fast lane for clear-cut cases

The Uniform Rapid Suspension System (URS) was created for the new gTLD programme and applies mainly to newer extensions and some legacy TLDs that adopted it through their registry agreements. It is designed for obvious abuse. The elements resemble the UDRP, but the standard of proof is higher: “clear and convincing evidence.”

The remedy is also narrower. A successful URS suspends the domain for the rest of its registration period (with an option to extend by one year); it does not transfer the name to you. When the registration lapses, it can be registered again, possibly by another squatter. URS is useful for stopping an active phishing or counterfeit site quickly and cheaply, less so when you actually want to own the domain.

Going to court: the ACPA in the United States

In the US, the Anticybersquatting Consumer Protection Act (ACPA, 15 U.S.C. § 1125(d)) lets trademark owners sue anyone who, with a bad-faith intent to profit, registers, traffics in or uses a domain that is identical or confusingly similar to a distinctive mark (or dilutive of a famous one). Unlike the UDRP, a court can award money: actual damages or statutory damages of between $1,000 and $100,000 per domain, as the court considers just. Where the registrant cannot be found or is outside US jurisdiction, an in rem action against the domain itself may be possible, typically where the registry or registrar is located.

Litigation is slower and far more expensive than a UDRP, so it is usually reserved for serious cases: large-scale squatting, real financial harm, or a respondent who ignores a UDRP decision. Other countries rely on general trademark, unfair competition or passing-off law rather than a dedicated statute.

Country-code domains have their own rules

ccTLD registries set their own policies, so check the registry’s website before choosing a route. Some examples:

• .uk: Nominet runs its Dispute Resolution Service (DRS), which includes a free mediation stage before a paid expert decision.
• .eu: disputes go to an ADR procedure administered by the Czech Arbitration Court.
• .tr: since the move to the TRABIS system managed by the Information and Communication Technologies Authority (BTK), disputes over .tr names are handled by dispute resolution service providers approved by BTK, under the .tr domain name regulations.
• .de: DENIC has no UDRP-style procedure; rights holders typically go to court and may request a DENIC “DISPUTE” entry, which stops the domain being transferred while the claim is pursued.

Many smaller ccTLDs simply adopt the UDRP, sometimes through WIPO. The registry’s policy page is the authoritative source.

Comparing the options

These are only rough ranges. Always check the provider’s current fee schedule, as fees differ by number of domains and panelists and are revised from time to time.

Alternatives to a formal dispute

A formal proceeding is not always the best business decision. Consider these options first:

• Cease-and-desist letter: a firm letter citing your marks and the relevant policy sometimes resolves the matter, especially with careless rather than malicious registrants. Be careful with tone; overreaching letters can backfire.
• Anonymous purchase: if the asking price is below what a dispute would cost you, buying through a broker or an escrow-protected marketplace can be faster. Be aware that offering to buy may be cited by the registrant, and that paying can encourage further squatting. Our guide to buying and selling domains on the aftermarket explains escrow and transfers.
• Abuse reports: for phishing or malware, reporting to the registrar, the hosting provider and browser safe-browsing services can take a site offline within hours, even if the domain stays registered.
• Wait for expiry: if the name is not actively harmful, monitoring its expiry date and backordering it can work, though popular names are often renewed or caught by drop-catchers.

Preventing the next case

Disputes are reactive and costly, so prevention pays. Register your core brand in the main extensions and the ccTLDs of your key markets, consider the Trademark Clearinghouse for sunrise registrations in new gTLDs, and keep your own domains on auto-renew so they never lapse into a squatter’s hands. Monitor new registrations that contain your brand; our article on protecting your brand with domain watchlists shows how. Tracking your portfolio’s expiry dates in the TLDix domain panel closes the most embarrassing gap of all: losing your own name by forgetting to renew.

A practical checklist before you file

1. Gather proof of trademark rights (registration certificates, evidence of use and reputation).
2. Record WHOIS/RDAP data, website screenshots, archived copies and any correspondence, with dates.
3. Check which policy applies to the extension and the provider’s current fees.
4. Assess the respondent’s possible defences honestly, especially prior use or a generic meaning.
5. Decide what you want: ownership (UDRP or court), a quick takedown (URS or abuse reports) or a cheap resolution (negotiation).