Cybersquatting and UDRP: How Domain Disputes Actually Work (and How to Win Them)

Someone registers your company name as a domain before you get to it, then offers to sell it back for $15,000. This happens thousands of times a year. WIPO handled 6,192 UDRP cases in 2024, covering 13,033 domain names.

Complainants win roughly 85 to 90 percent of the time. But most people who find themselves on the wrong end of a squatted domain don't know that a structured, relatively fast, and surprisingly affordable process exists to get it back.

This article explains what cybersquatting is, how the Uniform Domain-Name Dispute-Resolution Policy (UDRP) works in practice, and when it makes sense to pursue litigation instead. It is educational, not legal advice. Consult a trademark attorney for guidance specific to your situation.

What Cybersquatting Actually Is (and Isn't)

Cybersquatting is the bad-faith registration or use of a domain name that is identical or confusingly similar to someone else's trademark. A cybersquatting domain is one registered not for legitimate use, but to profit from someone else's brand. The defining feature is intent: the registrant doesn't plan to build a legitimate business at that domain. They plan to profit from the trademark owner's brand, whether by selling the domain back at an inflated price, redirecting traffic to competitors, or hosting pay-per-click advertising that capitalizes on the brand's search traffic.

Three elements define cybersquatting in practice. First, the domain name is identical or confusingly similar to a trademark in which the complainant has rights. Second, the registrant has no legitimate interest in the domain. Third, the domain was registered and is being used in bad faith. These three elements also form the backbone of a UDRP complaint, which makes the legal definition and the practical enforcement mechanism unusually well aligned.

Common Patterns

Cybersquatting takes several recognizable forms. Typosquatting is the registration of common misspellings or keyboard-adjacent variations of a brand name, like "gogle.com" or "amzon.com." This is one of the most pervasive patterns because users make predictable typing errors, and squatters exploit that predictability systematically. For a deeper look at how typosquatting works and how to detect it, see the guide to typosquatting and brand protection.

Name-jacking targets personal names, typically of celebrities or public figures, registering domains like "elonmusk.com" before the individual secures them. Combo squatting appends common terms to a brand, such as "nikeoutlet.com" or "applesupport.net," creating domains that look like official subbrands but aren't. And reverse cybersquatting is worth mentioning because it's not cybersquatting at all: it's when a trademark owner files a bad-faith UDRP complaint to wrest away a domain that someone else registered legitimately. Panels treat this seriously and can make findings of reverse domain name hijacking.

What It Is Not

Not every domain dispute is cybersquatting. If someone registered a domain containing a common word before you trademarked it, that's likely a legitimate registration. If someone uses your brand name in a criticism or commentary site ("yourbrandsucks.com"), UDRP panels have split on this, but US courts generally protect it as free speech. If the domain contains a generic word that also happens to be your trademark ("apple.org" registered by an orchard), the analysis depends heavily on context and timing.

Cybersquatting persists because the economics favor the squatter in the absence of enforcement. Registering a domain costs under $15 a year. If even a small fraction of trademark owners pay ransom rather than filing a dispute, the expected return is positive. The UDRP exists precisely to shift that calculus, making enforcement cheaper and faster than paying a squatter's asking price.

The Legal Framework: UDRP vs. ACPA vs. Litigation

Two primary legal mechanisms address cybersquatting, and choosing the right one depends on what you need: a domain transfer, monetary damages, or both.

UDRP: The Global Administrative Process

The Uniform Domain-Name Dispute-Resolution Policy is the primary domain name dispute resolution mechanism, an administrative procedure created by ICANN (the Internet Corporation for Assigned Names and Numbers) in 1999. It applies to all generic top-level domains (.com, .net, .org, .info, and the newer gTLDs like .app and .tech) and is administered by approved dispute-resolution providers, primarily WIPO and the National Arbitration Forum (NAF).

UDRP is not litigation. It is a streamlined administrative proceeding in which a panel of one or three experts reviews written submissions and issues a decision. There is no discovery, no depositions, no courtroom. The only remedies are transfer of the domain to the complainant or cancellation of the registration. No monetary damages are available.

The advantages are speed and cost. UDRP proceedings typically resolve in 45 to 60 days. Filing costs approximately $1,500 for one to five domain names with a single panelist. And because it operates through ICANN's registrar agreements, the decision is enforceable globally regardless of where the registrant is located. That last point matters enormously: if a squatter is in a jurisdiction where local courts are slow or unreliable, UDRP sidesteps the problem entirely.

ACPA: The US Federal Statute

The Anticybersquatting Consumer Protection Act (ACPA), codified at 15 U.S.C. 1125(d), is a US federal law enacted in 1999, the same year as the UDRP. Unlike UDRP, the ACPA is a cause of action filed in federal court and allows statutory damages of $1,000 to $100,000 per domain name at the court's discretion. For a broader look at how trademark infringement works in US courts, including the likelihood-of-confusion test that underpins both ACPA and other infringement claims, see the guide to trademark infringement.

The ACPA requires proving that the domain was registered with a bad-faith intent to profit from the mark. Courts consider nine statutory factors, including whether the registrant has trademark rights of their own, whether the domain contains the registrant's legal name, and whether the registrant offered to sell the domain to the mark owner.

Which Path to Choose

The decision between UDRP and ACPA (or full litigation) depends on a few variables.

For most single-domain disputes where the facts are straightforward, UDRP is the rational choice. It is faster, cheaper, and the complainant win rate is exceptionally high. For cases requiring anticybersquatting damages, the ACPA is the stronger tool. Reserve litigation for cases where you need damages to deter a serial squatter, where the facts are complex enough to benefit from discovery, or where you need precedent.

How to File a UDRP Complaint (Step by Step)

Filing a UDRP complaint requires proving three elements, each of which must be satisfied for the complaint to succeed.

The Three Elements

Element 1: The domain is identical or confusingly similar to your trademark. This is typically the easiest element to establish. Panels generally disregard the top-level domain (.com, .net) and compare the second-level domain to the mark. Minor variations, added generic words, and typosquatting variants usually satisfy this element. You need a trademark registration or at least demonstrated common-law trademark rights.

Element 2: The respondent has no rights or legitimate interests in the domain. The complainant must make a prima facie case (an initial showing sufficient to shift the burden), after which the respondent must demonstrate a legitimate interest. Legitimate interests include using the domain for a bona fide offering of goods or services, being commonly known by the domain name, or making noncommercial fair use of the domain.

Element 3: The domain was registered and is being used in bad faith. This is the most contested element. Note the conjunction: under the UDRP, both registration and use must be in bad faith, though "use" has been interpreted broadly to include passive holding in certain circumstances. Bad faith indicators include offering the domain for sale to the trademark owner, registering the domain to prevent the owner from reflecting their mark in a domain, registering the domain to disrupt a competitor's business, or using the domain to attract users for commercial gain by creating confusion with the mark.

The Process

Step 1: Choose a provider. WIPO is the most widely used provider and handles the largest share of cases globally. NAF is the other major option and is often preferred for straightforward US-centric disputes. Both have their own supplemental rules, but the core UDRP policy is the same.

Step 2: Draft the complaint. The complaint is a written submission, typically 10 to 20 pages, that addresses each of the three elements with supporting evidence. Key evidence includes your trademark registration certificate, screenshots of the disputed domain showing how it's being used (or not used), WHOIS records, any communications from the registrant (especially offers to sell), and evidence of your mark's reputation.

Step 3: Pay the filing fee. Approximately $1,500 for one to five domain names with a single panelist. A three-member panel costs more (around $4,000) but provides additional safeguards for complex cases.

Step 4: The provider notifies the respondent. The respondent has 20 days to submit a response. Many respondents don't respond at all, which generally works in the complainant's favor (though the panel must still evaluate the evidence).

Step 5: Panel decision. The panel issues a written decision, typically within 14 days of appointment. The decision is published (WIPO maintains a searchable database of all decisions). If the complainant wins, the registrar is instructed to transfer the domain. The respondent has 10 business days to file a lawsuit in a court of mutual jurisdiction to prevent the transfer.

The entire process, from filing to transfer, typically takes 45 to 60 days. That speed is one of the UDRP's primary advantages over litigation.

How UDRP Panels Decide Cybersquatting Cases

The complainant win rate of 85 to 90 percent might suggest that UDRP is a rubber stamp. It isn't. Panels take the three elements seriously, and complaints fail for identifiable reasons.

Bad Faith Indicators

Panels have developed a substantial body of case law around what constitutes bad faith. The strongest indicators include:

• The respondent registered the domain after the complainant's trademark became well known
• The respondent offered to sell the domain for an amount exceeding registration costs
• The domain resolves to pay-per-click advertising using the complainant's brand terms
• The respondent has a pattern of registering domains corresponding to third-party trademarks
• The respondent used WHOIS privacy services to conceal their identity in conjunction with other bad-faith indicators (privacy alone is not bad faith, but it's a factor panels consider alongside other evidence)

When Respondents Win

Respondents successfully defend UDRP complaints in several recurring scenarios. The respondent can demonstrate they were using or preparing to use the domain for a legitimate business before receiving notice of the dispute. The domain contains a generic or descriptive term that the respondent has a right to use ("delta" is a trademark, but it's also a geographic term, a mathematical symbol, and a common English word). The respondent is using the domain for genuine noncommercial commentary or criticism. Or the complainant's trademark is weak, geographically limited, or postdates the domain registration.

Notable Precedents Worth Knowing

A few WIPO panel decisions have shaped UDRP practice in important ways. The passive holding doctrine established that a domain doesn't need to resolve to an active website to be used in bad faith. If the circumstances indicate that the domain was registered to exploit the trademark, passive holding of the domain still satisfies the "use in bad faith" requirement. This closed what would otherwise be an obvious loophole.

Panels have also addressed reverse domain name hijacking (RDNH), making findings against complainants who file UDRP complaints knowing they don't have a legitimate claim, typically to acquire a domain containing a generic word. RDNH findings are published and serve as a meaningful deterrent against abuse of the UDRP system.

Common Mistakes That Lose Cases

The most frequent complainant errors are predictable. Filing without a trademark registration or sufficient evidence of common-law rights. Failing to address all three elements with specific evidence (conclusory assertions are not enough). Underestimating the respondent's potential legitimate interest, particularly when the domain contains a dictionary word. And filing against a domain that was registered before the complainant's trademark existed, without addressing why that timing should not defeat the claim.

On the respondent side, the most common mistake is simply not responding. While default doesn't guarantee a complainant win, it means the panel has only one side's evidence and arguments. If you have a legitimate interest, present it.

Preventing Cybersquatting Before You Need UDRP

The best UDRP complaint is the one you never need to file. Prevention is cheaper than enforcement across every dimension.

Defensive Domain Registration

Register your brand across the primary TLDs (.com, .net, .org) and common misspellings before launching. This costs a few hundred dollars per year and eliminates the most obvious attack surface. For brands with significant consumer presence, consider registering in country-code TLDs for your key markets (.co.uk, .de, .jp) as well.

Trademark Registration as Foundation

A registered trademark is the single strongest asset in any domain dispute. UDRP complaints are dramatically easier to win with a registration than with common-law rights alone. If your brand is valuable enough to warrant domain protection, it's valuable enough to register as a trademark. The registration also serves as the foundation for monitoring your brand across trademark databases, not just domain registrations.

Domain Monitoring and WHOIS Surveillance

The new gTLD expansion has created a vastly larger attack surface. With hundreds of TLDs beyond .com, manual checking is no longer feasible. Automated brand protection tools that monitor new domain registrations and WHOIS changes are increasingly necessary for any brand with meaningful consumer recognition. These tools can alert you to a squatted domain within hours of registration, before the squatter has time to monetize it.

The New gTLD Problem

ICANN's expansion of generic top-level domains, from the original handful to over 1,200, multiplied the potential cybersquatting targets for every brand. A company that secured its name in .com now faces potential squatting in .app, .tech, .store, .online, and hundreds of other extensions. The .com TLD still accounts for the majority of UDRP disputes, but disputes involving newer gTLDs are growing. Defensive registration across all of them is impractical, which makes monitoring and rapid enforcement the realistic strategy.

Beyond UDRP: When Litigation Is the Right Move

UDRP handles the majority of domain disputes effectively, but there are situations where it falls short and litigation becomes the appropriate tool.

When Transfer Isn't Enough

If a squatter has been running a phishing site under your brand, redirecting your customers to competitors, or conducting fraud using your domain, getting the domain transferred doesn't make you whole. You may need damages, and UDRP doesn't provide them. The ACPA's statutory damages of $1,000 to $100,000 per domain give courts meaningful discretion to impose penalties that reflect the harm done.

Serial Squatters and Deterrence

Some respondents are repeat offenders who register dozens or hundreds of domains corresponding to third-party marks. UDRP can transfer individual domains, but it provides no mechanism for injunctive relief or damages that would deter the behavior. A federal court judgment, on the other hand, creates precedent, imposes financial consequences, and can include broad injunctive orders against future squatting of the plaintiff's marks.

Cross-Border Enforcement

Paradoxically, UDRP has an advantage over litigation for cross-border enforcement precisely because it operates through ICANN's registrar agreements rather than through courts. A UDRP decision binds the registrar regardless of where the respondent is located. But if you need to enforce a court judgment against a foreign respondent, you face all the usual challenges of international litigation, including service of process, jurisdictional disputes, and judgment recognition.

The ccTLD Gap

One significant limitation: the UDRP only applies to gTLDs (.com, .net, .org, and the newer extensions). Country-code top-level domains (.uk, .de, .cn, .jp) are governed by their own national dispute-resolution policies, which vary significantly in procedure, cost, and standards. Some ccTLD policies are modeled on the UDRP; others are quite different. If your dispute involves a ccTLD, you'll need to research the specific policy for that extension or consult an attorney who specializes in that jurisdiction.

Choosing Your Path

For a single domain dispute with clear facts and an absent or unsophisticated squatter, UDRP is almost always the right choice. For disputes involving damages, serial squatters, complex facts, or ccTLDs, litigation may be necessary. And for the rare case involving both US and international domains held by a sophisticated actor, a combined strategy (filing UDRP for the gTLDs while pursuing ACPA litigation for damages and deterrence) can be the most effective approach.

---

If you're building tools that monitor brand abuse, Signa's trademark search API can help you identify conflicting marks programmatically. Learn more at signa.so.