What is cybersquatting and what can you do about it?

Cybersquatting is registering, trading in or using an internet domain name that is identical or confusingly similar to someone else's trademark, with a bad faith intent to profit. Owners can respond through a registrar-level dispute process or a lawsuit. Collect evidence first and take legal advice, since outcomes depend on facts and jurisdiction.

What does the law say?

In the United States, the Anticybersquatting Consumer Protection Act is part of the trademark statute, at 15 U.S.C. 1125(d). It covers a person who has a bad faith intent to profit from a mark and who registers, traffics in or uses a domain name that is identical or confusingly similar to a distinctive mark, or identical, confusingly similar or dilutive of a famous mark. The statute lists factors a court weighs in judging bad faith.

Outside the United States, other national laws apply. The international route is the dispute policy that all registrars follow, described next. This post is general information, not legal advice.

What is the UDRP?

ICANN's Uniform Domain-Name Dispute-Resolution Policy, the UDRP, applies to registrars of the generic top-level domains. ICANN explains that most trademark-based domain disputes must be settled by agreement, court action or arbitration before a registrar cancels, suspends or transfers a name. For abusive registrations, such as cybersquatting, a trademark owner can start an expedited administrative proceeding by filing a complaint with an approved provider.

The WIPO Arbitration and Mediation Center is one such provider and publishes information on its domain name dispute service. Under the policy, the complainant generally has to show that the domain is identical or confusingly similar to its mark, that the registrant has no rights or legitimate interests in the name, and that the name was registered and is being used in bad faith. Read the policy text for the exact wording.

Remedies in the administrative process are limited to transfer or cancellation of the domain. They do not award damages. Courts can award more under national law.

What does it look like in practice?

A constructed example. A small software firm called Northwind Labs holds the trademark and runs northwindlabs.example. A stranger registers northwind-labs-support.example and publishes a page that copies the firm's branding, offering paid "support" and collecting login details. Customers receive phishing emails from the new domain.

That is a security incident as well as a trademark problem. The immediate steps are takedown requests for fraud and abuse, plus customer warnings. The slower step is a UDRP complaint for the transfer of the name.

Not every similar name is cybersquatting. A fan site, a genuine business with a similar name or a criticism site may have legitimate interests. Registering a name before you needed it is also not automatically abusive.

How to check or apply this

1. Register obvious variants of your names early, including common misspellings and other top-level domains that fit your brand.
2. Monitor new registrations that resemble your marks, and certificate transparency logs for lookalike hostnames.
3. When you find one, capture evidence: screenshots, page source, registration data, dates, emails received, and any offers to sell.
4. Check whether the site is live and being used for fraud. If so, report it to the registrar's abuse contact and the hosting provider first.
5. Warn customers and staff, and block the domain in mail and web filters.
6. Confirm you have a registered or otherwise established trademark and the evidence of use.
7. Take legal advice on choosing between a UDRP complaint, a court action, or negotiation.
8. Consider registering your marks with a national office, which strengthens your position.
9. Use email authentication for your domains so spoofed mail is easier to reject.

Quick check

Sources

• 15 U.S.C. 1125, Cornell Legal Information Institute
• ICANN, Uniform Domain-Name Dispute-Resolution Policy
• WIPO Arbitration and Mediation Center, domain name disputes

Last reviewed: 18 October 2026.