What cybersquatting is, and why the domain stays put
Cybersquatting is the registration or holding of a domain name that matches somebody else's trademark, in bad faith — usually to sell it back to the mark owner at a profit, or to trade off recognition the name already carries. The act that starts it is unremarkable. Registration in a gTLD (a generic top-level domain such as .com, .org or .app, as opposed to a two-letter country-code TLD like .uk or .de) is first-come, first-served, and nothing in the registry record distinguishes a squatted name from any other.
That is the whole difficulty. I classify cybersquatting as disputed rather than recoverable, because the registrant holds the name lawfully until a panel or a court rules otherwise. There is no stolen-property analogy to lean on, no fraudulent transfer to unwind, no registrar error to reverse. Every route to the name — an administrative proceeding, a lawsuit, or a negotiated purchase — is adversarial and decided on the merits.
Three regimes matter: the UDRP, the URS and the ACPA. They test different things, run on different clocks, and deliver different remedies. Choosing among them is a legal decision and needs a trademark attorney, not a checklist.
The three elements of a UDRP complaint
The Uniform Domain-Name Dispute-Resolution Policy — the UDRP, the contractual dispute process every gTLD registrant agrees to at registration, decided on paper by a panel rather than in court — is written into the registration agreement of every ICANN-accredited gTLD registrar. Registering a .com means agreeing in advance to a mandatory administrative proceeding before an approved provider: WIPO, the Forum, CAC, ADNDRC or CIIDRC.
Under Paragraph 4(a) of the Policy, the complainant must prove all three of the following:
- the domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights;
- the registrant has no rights or legitimate interests in respect of the domain name; and
- the domain name has been registered and is being used in bad faith.
The third element is conjunctive, and that one word does more work than anything else in the Policy. Both halves must be shown. A domain registered before the complainant's mark existed generally cannot satisfy it, because at the moment of registration there was nothing to target. Chronology disposes of a great many complaints long before anyone argues about the website.
Bad faith under 4(b), legitimate interest under 4(c)
Paragraph 4(b) sets out four circumstances that evidence bad faith registration and use. The list is not exhaustive:
- registering primarily to sell, rent or transfer the name to the mark owner or a competitor for consideration above documented out-of-pocket costs;
- registering to prevent the mark owner from reflecting the mark in a domain, where there is a pattern of that conduct;
- registering primarily to disrupt a competitor's business; and
- using the domain to attract users intentionally, for commercial gain, by creating a likelihood of confusion as to source, sponsorship, affiliation or endorsement.
Paragraph 4(c) gives the registrant three answers, also non-exhaustive: a bona fide offering of goods or services — genuine commercial use, not a pretext assembled after the dispute began — or demonstrable preparations for one, before any notice of the dispute; being commonly known by the domain name even without trademark rights; and legitimate noncommercial or fair use without intent for commercial gain.
That phrase, before any notice of the dispute, decides more cases than its length suggests. A storefront that appears the week after a demand letter is not evidence of a bona fide offering. One that has been selling for a decade is a different matter.
The timetable, and the ten days after a decision
The Rules for the UDRP run a compressed schedule. A respondent has 20 days from commencement to file a response, with an automatic four-day extension available on request. For a single-member panel, appointment follows within five calendar days of the provider receiving the response, and the decision is due within 14 days of appointment absent exceptional circumstances.
Then comes the provision people miss. Under Paragraph 4(k), once the provider notifies the registrar that a domain is to be cancelled or transferred, the registrar waits ten business days before implementing it. Documented court proceedings filed in a mutual jurisdiction within that window suspend implementation. Mutual jurisdiction means the court location the complainant itself agreed to when it filed — and it is where a losing registrant may go to stop a transfer.
Ten business days is not long. In my experience the window gets treated as a formality by parties who assume an adverse decision is already final. It is not final until it is implemented. Whether to use that window, and where, is a question for counsel admitted in the relevant court.
The URS, and what suspension actually gets you
Uniform Rapid Suspension — the URS — is a faster, cheaper track intended for clear-cut cases and decided on a higher evidentiary standard than the UDRP. Its remedy is where the confusion sits. A successful URS complaint suspends the domain for the balance of the registration period and redirects its nameservers to an informational page; the registration record is otherwise unchanged. The name does not transfer. It stays with the registrant, and when the registration period runs out, so does the suspension.
The URS clock: a response is due within 14 calendar days of the Notice of Complaint; a respondent who defaults may still seek de novo review — a fresh look at the whole matter from the start, rather than a review of the earlier decision for error — for up to six months after the Default notice, extendable by six more; and an appeal runs 14 days from a Default or Final Determination.
One scope caveat gets glossed over constantly. ICANN's URS materials state that the information applies to the 2012 round of the New gTLD Program only. Whether a specific TLD falls within URS scope is a threshold question to verify against that registry's agreement, not an assumption to build a strategy on.
What the ACPA adds, and where it stops
The Anticybersquatting Consumer Protection Act, 15 U.S.C. § 1125(d), enacted 29 November 1999, is United States federal law and reaches only as far as a US court does. It creates liability for a person with a bad faith intent to profit from a mark who registers, traffics in, or uses a domain identical or confusingly similar to a distinctive mark — or identical to, confusingly similar to, or dilutive of a famous one.
The statute lists nine non-exclusive factors a court weighs. Among them: the defendant's own intellectual property rights in the name; whether the name is their legal name; prior bona fide commercial or noncommercial use; an intent to divert consumers in a way that harms goodwill; an offer to sell without bona fide use; false contact information at registration, or failure to keep it accurate; registering multiple domains known to be others' distinctive marks; and the mark's own distinctiveness and fame. A safe harbor follows: bad faith shall not be found where the court determines the person believed, and had reasonable grounds to believe, that the use was a fair use or otherwise lawful.
Two features have no UDRP equivalent. Section 1125(d)(2) allows an in rem action — a suit against the property itself, here the domain, rather than against a person — in the district of the registrar or registry, where personal jurisdiction cannot be obtained or the registrant cannot be found after due diligence. And the ACPA carries money: a plaintiff may elect statutory damages, a fixed range set by statute in place of proving actual loss, of not less than $1,000 and not more than $100,000 per domain name, at any time before final judgment is rendered by the trial court. The UDRP awards nothing of the kind.
Where complaints go wrong
- Treating element three as a choice. Registered and used in bad faith. A name that predates the mark usually fails on the first half.
- Filing on the back of a failed purchase. Approaching the registrant, being quoted a high price, then filing on the strength of that price is a recognized pattern that panels have called out as reverse domain name hijacking.
- Expecting damages from a UDRP. There are none — no damages, no costs, no injunction. Cancellation or transfer is the whole menu.
- Assuming a URS win moves the name. It suspends the name.
- Asserting bad faith instead of evidencing it. Captures of the resolving page, the sale offer and the consideration named in it, the pattern of other registrations — that is what a Paragraph 4(b) showing is built from.
- Letting the Paragraph 4(k) window lapse. Ten business days, counted from the provider's notice to the registrar.
Scale, and why counsel is not optional here
This is not a fringe problem. WIPO alone — one of five UDRP providers — has recorded more than 84,000 domain name cases since the first one in 1999, with annual filings running above six thousand in recent years (WIPO case statistics).
Everything above describes what the instruments say and how the procedures run. It is not advice and cannot be. The choice among a UDRP, a URS, a federal action and a negotiated purchase turns on facts a reference page cannot see: the strength and date of the mark, where the registrant is and whether they can be identified, whether the domain is causing harm right now, and what outcome is actually wanted. A UDRP complaint is a pleading. It gets one attempt, on paper, with no live testimony, and a poorly built one can produce a formal finding against the party that filed it. Engage a trademark attorney experienced in domain disputes before filing anything. Note too that ccTLDs — country-code top-level domains — run their own policies, such as Nominet's DRS for .uk, so the UDRP may not apply at all.