Domain name security, theft, recovery and disputes
Abstract tilted diamond illustration representing Cybersquatting

StatusDisputed

Cybersquatting

Governing policy
ICANN UDRP, Paragraph 4(a)
Window
20-day response; 10-business-day hold
Authority
ICANN UDRP, adopted 26 August 1999; page version 21 February 2024

Registering someone else's trademark as a domain in bad faith, and the three regimes built to answer it

What cybersquatting is, and why the domain stays put

Cybersquatting is the registration or holding of a domain name that matches somebody else's trademark, in bad faith — usually to sell it back to the mark owner at a profit, or to trade off recognition the name already carries. The act that starts it is unremarkable. Registration in a gTLD (a generic top-level domain such as .com, .org or .app, as opposed to a two-letter country-code TLD like .uk or .de) is first-come, first-served, and nothing in the registry record distinguishes a squatted name from any other.

That is the whole difficulty. I classify cybersquatting as disputed rather than recoverable, because the registrant holds the name lawfully until a panel or a court rules otherwise. There is no stolen-property analogy to lean on, no fraudulent transfer to unwind, no registrar error to reverse. Every route to the name — an administrative proceeding, a lawsuit, or a negotiated purchase — is adversarial and decided on the merits.

Three regimes matter: the UDRP, the URS and the ACPA. They test different things, run on different clocks, and deliver different remedies. Choosing among them is a legal decision and needs a trademark attorney, not a checklist.

The three elements of a UDRP complaint

The Uniform Domain-Name Dispute-Resolution Policy — the UDRP, the contractual dispute process every gTLD registrant agrees to at registration, decided on paper by a panel rather than in court — is written into the registration agreement of every ICANN-accredited gTLD registrar. Registering a .com means agreeing in advance to a mandatory administrative proceeding before an approved provider: WIPO, the Forum, CAC, ADNDRC or CIIDRC.

Under Paragraph 4(a) of the Policy, the complainant must prove all three of the following:

  • the domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights;
  • the registrant has no rights or legitimate interests in respect of the domain name; and
  • the domain name has been registered and is being used in bad faith.

The third element is conjunctive, and that one word does more work than anything else in the Policy. Both halves must be shown. A domain registered before the complainant's mark existed generally cannot satisfy it, because at the moment of registration there was nothing to target. Chronology disposes of a great many complaints long before anyone argues about the website.

Bad faith under 4(b), legitimate interest under 4(c)

Paragraph 4(b) sets out four circumstances that evidence bad faith registration and use. The list is not exhaustive:

  • registering primarily to sell, rent or transfer the name to the mark owner or a competitor for consideration above documented out-of-pocket costs;
  • registering to prevent the mark owner from reflecting the mark in a domain, where there is a pattern of that conduct;
  • registering primarily to disrupt a competitor's business; and
  • using the domain to attract users intentionally, for commercial gain, by creating a likelihood of confusion as to source, sponsorship, affiliation or endorsement.

Paragraph 4(c) gives the registrant three answers, also non-exhaustive: a bona fide offering of goods or services — genuine commercial use, not a pretext assembled after the dispute began — or demonstrable preparations for one, before any notice of the dispute; being commonly known by the domain name even without trademark rights; and legitimate noncommercial or fair use without intent for commercial gain.

That phrase, before any notice of the dispute, decides more cases than its length suggests. A storefront that appears the week after a demand letter is not evidence of a bona fide offering. One that has been selling for a decade is a different matter.

The timetable, and the ten days after a decision

The Rules for the UDRP run a compressed schedule. A respondent has 20 days from commencement to file a response, with an automatic four-day extension available on request. For a single-member panel, appointment follows within five calendar days of the provider receiving the response, and the decision is due within 14 days of appointment absent exceptional circumstances.

Then comes the provision people miss. Under Paragraph 4(k), once the provider notifies the registrar that a domain is to be cancelled or transferred, the registrar waits ten business days before implementing it. Documented court proceedings filed in a mutual jurisdiction within that window suspend implementation. Mutual jurisdiction means the court location the complainant itself agreed to when it filed — and it is where a losing registrant may go to stop a transfer.

Ten business days is not long. In my experience the window gets treated as a formality by parties who assume an adverse decision is already final. It is not final until it is implemented. Whether to use that window, and where, is a question for counsel admitted in the relevant court.

The URS, and what suspension actually gets you

Uniform Rapid Suspension — the URS — is a faster, cheaper track intended for clear-cut cases and decided on a higher evidentiary standard than the UDRP. Its remedy is where the confusion sits. A successful URS complaint suspends the domain for the balance of the registration period and redirects its nameservers to an informational page; the registration record is otherwise unchanged. The name does not transfer. It stays with the registrant, and when the registration period runs out, so does the suspension.

The URS clock: a response is due within 14 calendar days of the Notice of Complaint; a respondent who defaults may still seek de novo review — a fresh look at the whole matter from the start, rather than a review of the earlier decision for error — for up to six months after the Default notice, extendable by six more; and an appeal runs 14 days from a Default or Final Determination.

One scope caveat gets glossed over constantly. ICANN's URS materials state that the information applies to the 2012 round of the New gTLD Program only. Whether a specific TLD falls within URS scope is a threshold question to verify against that registry's agreement, not an assumption to build a strategy on.

What the ACPA adds, and where it stops

The Anticybersquatting Consumer Protection Act, 15 U.S.C. § 1125(d), enacted 29 November 1999, is United States federal law and reaches only as far as a US court does. It creates liability for a person with a bad faith intent to profit from a mark who registers, traffics in, or uses a domain identical or confusingly similar to a distinctive mark — or identical to, confusingly similar to, or dilutive of a famous one.

The statute lists nine non-exclusive factors a court weighs. Among them: the defendant's own intellectual property rights in the name; whether the name is their legal name; prior bona fide commercial or noncommercial use; an intent to divert consumers in a way that harms goodwill; an offer to sell without bona fide use; false contact information at registration, or failure to keep it accurate; registering multiple domains known to be others' distinctive marks; and the mark's own distinctiveness and fame. A safe harbor follows: bad faith shall not be found where the court determines the person believed, and had reasonable grounds to believe, that the use was a fair use or otherwise lawful.

Two features have no UDRP equivalent. Section 1125(d)(2) allows an in rem action — a suit against the property itself, here the domain, rather than against a person — in the district of the registrar or registry, where personal jurisdiction cannot be obtained or the registrant cannot be found after due diligence. And the ACPA carries money: a plaintiff may elect statutory damages, a fixed range set by statute in place of proving actual loss, of not less than $1,000 and not more than $100,000 per domain name, at any time before final judgment is rendered by the trial court. The UDRP awards nothing of the kind.

Where complaints go wrong

  • Treating element three as a choice. Registered and used in bad faith. A name that predates the mark usually fails on the first half.
  • Filing on the back of a failed purchase. Approaching the registrant, being quoted a high price, then filing on the strength of that price is a recognized pattern that panels have called out as reverse domain name hijacking.
  • Expecting damages from a UDRP. There are none — no damages, no costs, no injunction. Cancellation or transfer is the whole menu.
  • Assuming a URS win moves the name. It suspends the name.
  • Asserting bad faith instead of evidencing it. Captures of the resolving page, the sale offer and the consideration named in it, the pattern of other registrations — that is what a Paragraph 4(b) showing is built from.
  • Letting the Paragraph 4(k) window lapse. Ten business days, counted from the provider's notice to the registrar.

Scale, and why counsel is not optional here

This is not a fringe problem. WIPO alone — one of five UDRP providers — has recorded more than 84,000 domain name cases since the first one in 1999, with annual filings running above six thousand in recent years (WIPO case statistics).

Everything above describes what the instruments say and how the procedures run. It is not advice and cannot be. The choice among a UDRP, a URS, a federal action and a negotiated purchase turns on facts a reference page cannot see: the strength and date of the mark, where the registrant is and whether they can be identified, whether the domain is causing harm right now, and what outcome is actually wanted. A UDRP complaint is a pleading. It gets one attempt, on paper, with no live testimony, and a poorly built one can produce a formal finding against the party that filed it. Engage a trademark attorney experienced in domain disputes before filing anything. Note too that ccTLDs — country-code top-level domains — run their own policies, such as Nominet's DRS for .uk, so the UDRP may not apply at all.

Frequently Asked Questions

What must be proved to win a UDRP case?

All three elements of Paragraph 4(a), and all three must succeed. First, that the domain is identical or confusingly similar to a trademark or service mark in which the complainant has rights. Second, that the registrant has no rights or legitimate interests in the name. Third, that the domain was registered and is being used in bad faith. The third element is conjunctive: both registration and use must be shown to be in bad faith, which is why a domain registered before the mark existed usually fails.

Can a UDRP proceeding award damages?

No. The UDRP's remedies are limited to cancellation of the domain name or transfer of it to the complainant. There are no damages, no costs, no attorney's fees and no injunctive relief available in the proceeding itself. A complainant seeking money has to look to a court. In the United States the Anticybersquatting Consumer Protection Act allows a plaintiff to elect statutory damages of not less than $1,000 and not more than $100,000 per domain name, at any time before final judgment is rendered by the trial court.

Does a URS win transfer the domain to the trademark owner?

No, and this is the single most common misunderstanding about the Uniform Rapid Suspension system. A successful URS complaint suspends the domain for the balance of its registration period and redirects the nameservers to an informational page. The registration record otherwise stays as it was, with the domain still held by the registrant. When the registration period ends, the suspension ends with it. The URS is worth using where suspension is an acceptable outcome; where the goal is to own the name, it is the wrong instrument.

What happens in the ten business days after a UDRP decision?

Under Paragraph 4(k) of the Policy, once the provider notifies the registrar of a decision to cancel or transfer a domain, the registrar waits ten business days before implementing it. If documented court proceedings are filed in a mutual jurisdiction inside that window, implementation is suspended. Mutual jurisdiction is the court location the complainant agreed to when it filed the complaint. The window is short and it is easy to lose. Whether to use it, and in which court, is a decision for counsel admitted there.

Is cybersquatting illegal in the United States?

The Anticybersquatting Consumer Protection Act, 15 U.S.C. § 1125(d), enacted 29 November 1999, creates civil liability for a person with a bad faith intent to profit from a mark who registers, traffics in or uses a domain identical or confusingly similar to a distinctive mark, or dilutive of a famous one. It is a federal civil statute, not a criminal one, and it reaches only as far as a United States court's jurisdiction. Outside that reach, the contractual UDRP and URS regimes are what apply to gTLDs.

Can a domain registered before the trademark existed be cybersquatting?

Generally not, under the UDRP. The third element requires that the domain was registered and is being used in bad faith, and both halves have to be shown. If the registration predates the complainant's trademark rights, there was nothing to target at the moment of registration, so the registration half of the element usually cannot be made out. This is why pulling the registration date from the Whois or RDAP record and the historical record, and comparing it against the mark's dates, is where these matters are commonly decided.

Do I need a lawyer to file a UDRP complaint?

Yes — engage one. A UDRP complaint is a pleading decided on the documents, with no live testimony and effectively one attempt, and the choice among a UDRP, a URS, a federal action under the ACPA and a negotiated purchase turns on facts specific to the mark, the registrant and the harm. A complaint that overstates the record or ignores established panel positions can produce a formal finding of reverse domain name hijacking against the party that filed it. This page describes the procedures; it is not legal advice.
Keep reading

Read the guides

The entries describe what a mechanism is. The guides describe what to do with it, in sequence, and where each route closes.

This is a reference, not a practice. Hartzer.net sells nothing, takes no engagements, and is not legal advice. Nothing here creates any relationship or preserves any deadline.

Top