Cybersquatting is registering or using a domain that matches someone else's trademark in bad faith, usually to sell it to them, divert their customers or impersonate them. Victims can file a UDRP complaint, which at WIPO starts at USD 1,500 for up to five domains, or sue under laws such as the US Anticybersquatting Consumer Protection Act.
A small software company launches a product, and two days later someone has registered the .com, the .net and three misspellings. A week after that, an email arrives offering all five names “at a fair price”. This is cybersquatting in its most familiar form, and it’s been around since the 1990s, when companies first found their names taken by people who had registered them faster.
The term covers more than ransom-style resale. Typosquatting, impersonation and diverting traffic with ads all fall under it. What they share is a domain that targets someone else’s brand, registered in bad faith.
What counts as cybersquatting?
| Type | Example pattern | Usual goal |
|---|---|---|
| Brand grab | brandname.com before the owner registers it | Sell to the owner |
| Typosquatting | brnadname.com, brandnmae.com | Catch mistyped traffic, ads, phishing |
| Combo-squatting | brandname-login.com, brandname-support.co | Phishing, fake support |
| New extension grab | brandname.shop, brandname.app | Resale or diversion |
| Lapsed-domain grab | Your old domain after you forgot to renew | Resale, traffic, impersonation |
| Fan or gripe site with ads | brandname-sucks.com with competitor ads | Monetise the brand’s name |
Not everything that resembles a brand is cybersquatting. Someone who registered their own surname years before your company adopted the same word has a legitimate interest. A generic word like “apple” or “orange” can be held for its normal meaning.
How do you get a squatted domain back?
You have four realistic options, roughly from cheapest to most expensive.
Ask, or buy it quietly
Sometimes the cheapest route is to buy the name through a broker without revealing who you are. If the price is close to what a UDRP case costs, many companies just pay. Be careful, though: once you’ve negotiated, your later UDRP complaint has to explain why you’re now claiming bad faith. The process for buying is in buying a taken domain.
UDRP complaint
For .com, .net, .org and all new gTLDs, the UDRP is the standard tool. You must show:
- The domain is identical or confusingly similar to your trademark.
- The holder has no rights or legitimate interests in it.
- It was registered and is being used in bad faith.
At WIPO, a complaint over one to five domains decided by a single panelist costs USD 1,500 (USD 1,000 for the panelist, USD 500 for WIPO). A three-member panel costs more. The procedure is written only, and the only remedies are transfer or cancellation. You find the filing guides on WIPO’s domain dispute pages.
The UDRP weak point is timing. If the domain was registered before your trademark existed, you’ll struggle to show bad faith at the time of registration.
Nominet DRS for .uk
For .uk names, Nominet’s Dispute Resolution Service applies instead. It begins with mediation at no cost. If that fails, you can pay for an expert decision. The test is whether the registration is abusive.
Court action
In the US, the Anticybersquatting Consumer Protection Act (15 U.S.C. § 1125(d)) lets trademark owners sue. Courts can order transfer and award statutory damages between USD 1,000 and 100,000 per domain, plus in some cases attorney fees. There is also an in-rem option against the domain itself when the registrant can’t be found. Outside the US, claims usually rely on trademark infringement or passing off.
What evidence helps a complaint?
Panels decide on documents. Collect them before you file:
- Trademark registrations with dates and classes
- Screenshots of the domain’s content, with dates (also save Wayback Machine captures)
- Any emails in which the holder offers to sell
- Evidence of confusion: customer emails, support requests, misdirected orders
- RDAP records showing registration date and registrar
- Other domains the same holder registered that target brands
A sale offer for more than out-of-pocket costs is one of the clearest signs of bad faith under UDRP. That’s also why holders who are offered money by a trademark owner should be careful how they answer.
When you’re accused
If you hold a domain and receive a UDRP complaint, you have 20 days to respond at WIPO. Things that help your case: you registered before the mark existed, you use the name for its ordinary meaning, you’re commonly known by it, or you run a genuine non-commercial site. Ad pages that show the complainant’s competitors hurt. The legal background is in domain trademark law.
If a complainant tries to take a name they know you hold legitimately, the panel can find reverse domain name hijacking against them.
Prevention costs less than a dispute
For brand owners, a few defensive registrations are cheap insurance. A .com at betadomain costs €14.99 a year and a .uk domain €15.99. Put renewals on auto-renew, because a lapsed domain is one of the easiest squats.
Squatted domains are also a common base for phishing, covered in domain scams. If you’re launching a brand, check your name across extensions before the announcement, not after.
Found your domain? You can check and register it directly at betadomain – yearly price from €2.99.
FAQ
Is cybersquatting illegal?
In the US, the Anticybersquatting Consumer Protection Act makes bad-faith registration of a confusingly similar domain actionable in civil court. Other countries rely on trademark law, unfair competition and passing off. UDRP is a contractual procedure, not a criminal process.
Is buying domains to resell them cybersquatting?
Not in itself. Domain investing in generic words and phrases is legal. It becomes cybersquatting when a name targets a specific trademark and the intent is to profit from that brand.
How long does a UDRP case take?
WIPO cases are usually decided within about two months of filing. If the panel orders a transfer, the registrar waits ten business days before implementing it, giving the respondent time to file a court case.
What is reverse domain name hijacking?
It's a finding a UDRP panel can make when a complainant uses the procedure in bad faith, for example to grab a legitimately held domain after a failed purchase attempt. There's no financial penalty under UDRP, but the finding is public.