Cybersquatting: The Law, the Remedies, and What They Cost

What is cybersquatting?

Cybersquatting is registering or holding a domain name that matches someone else’s trademark, in bad faith, usually to resell it to the brand or to profit from the brand’s reputation. The value sits in the name itself rather than in any traffic the domain receives.

A typical case: a store trades as Sunrise Coffee on sunrisecoffee.shop. Someone registers sunrisecoffee.com, puts a for-sale page on it, and asks for four figures.

Registering a domain that happens to match a brand name is not automatically cybersquatting. Bad faith is a required element, and it has to be shown rather than assumed. Someone with a genuine business, a matching personal name, or a legitimate non-commercial use may hold a confusingly similar domain lawfully.

This page explains how the processes work. It is not legal advice, and a dispute worth pursuing is worth discussing with qualified counsel.

Is cybersquatting the same as domain squatting?

In practice, yes — “domain squatting” is the everyday term for the same behaviour, and people use the two interchangeably.

“Cybersquatting” is the term used in the law. It appears in the Anticybersquatting Consumer Protection Act and in the arbitration practice built around ICANN’s dispute policy. If you are searching for a remedy, search the legal term. If you are describing the problem to a colleague, either works.

Both differ from ordinary domain investing, which is legal. A registrant who buys generic or descriptive names to resell is running a business. A registrant who targets your mark specifically is the one the law addresses.

How is cybersquatting different from typosquatting?

The distinction is what the registrant is trying to capture, and it changes which remedy fits.

	Cybersquatting	Typosquatting
Targets	Your name	Your customers’ typing mistakes
Typical domain	yourbrand.com held for resale	yuorbrand.com
Where the value is	The name’s resale or leverage value	Intercepted traffic
Usual page	For-sale or parked page	Redirect, ads, or a copied storefront
Best first route	Trademark process — UDRP or ACPA	Abuse or phishing report on the behaviour

The categories overlap and one domain can be both. A misspelling held for resale is a typosquat with a cybersquatter’s motive.

What does cybersquatting look like?

Four patterns come up repeatedly for ecommerce brands.

• The extension you skipped. You own .shop; someone takes .com. New extensions keep creating fresh openings.
• The resale approach. A for-sale page appears, or an unsolicited email offers you the domain “before another buyer takes it.”
• The name held ahead of you. A registrant watching trademark filings or funding announcements registers the domain before the brand does.
• The pattern registrant. One party holds dozens of domains matching unrelated brands. Under the UDRP a demonstrated pattern is itself evidence of bad faith.

An important non-example: a parked domain with no attempt to sell and no use of your brand on the page may be difficult to act against. See the bad-faith element below for why.

Is cybersquatting illegal?

Sometimes. In the United States the ACPA, 15 U.S.C. § 1125(d), makes it unlawful to register, traffic in, or use a domain name with bad faith intent to profit from a mark, where the domain is identical or confusingly similar to a distinctive mark, or identical, confusingly similar, or dilutive of a famous mark.

Two points merchants often get wrong. The mark must have been distinctive or famous at the time the domain was registered. And you do not have to show actual confusion or that you compete with the registrant.

The statute lists nine factors a court may weigh on bad faith, including whether the registrant has trademark rights of their own, whether the domain is their legal name, any prior good-faith use, an intent to divert consumers, an offer to sell without having used the domain, false registration details, and whether they registered multiple infringing domains.

Outside the US, national trademark law varies. The UDRP applies regardless of where either party sits, which is why it is usually the practical starting point.

What must you prove to win a UDRP complaint?

All three elements of paragraph 4(a), together. Failing any one loses the case.

1. The domain is identical or confusingly similar to a trademark or service mark in which you have rights. This is largely a standing threshold and a direct comparison.
2. The registrant has no rights or legitimate interests in the domain. Paragraph 4(c) lists the defences: a bona fide offering of goods or services begun before notice of the dispute, being commonly known by the name, or legitimate non-commercial or fair use.
3. The domain was registered and is being used in bad faith. Paragraph 4(b) gives examples: acquiring it primarily to sell to the mark owner above out-of-pocket costs, a pattern of blocking registrations, or registering primarily to disrupt a competitor.

The third element is the one that surprises people, and the conjunction is the reason. You generally need bad faith at registration and in the use. A domain registered innocently years ago and only later pointed somewhere objectionable is a harder case than it looks. So, sometimes, is a genuinely dormant domain — which is why an abuse report on observed behaviour can be the faster route when a page is actually deceiving customers.

A registrant’s silence does not hand you the case. Panels have held that a default is not an admission, and you still have to prove all three.

What does a UDRP complaint cost?

WIPO publishes its fee schedule. The complainant pays.

Domains in the complaint	Single panelist	Three panelists
1–5	$1,500	$4,000
6–10	$2,000	$5,000
More than 10	By consultation	By consultation

Expedited handling is available for a single-panel case of up to five domains at a complainant fee of $4,000.

These are the filing fees only. Counsel to draft the complaint is a separate cost, and it is usually the larger one. Litigation under the ACPA runs into a different order of magnitude entirely.

What can you actually win?

It depends entirely on which route you take, and the difference is larger than most merchants expect.

Under the UDRP: transfer or cancellation of the domain. That is the whole remedy. There are no monetary damages, no costs award, and no injunction against future registrations. You get the name.

Under the ACPA: injunctive relief, forfeiture or transfer of the domain, and money. A plaintiff may elect statutory damages of not less than $1,000 and not more than $100,000 per domain name, as the court considers just, at any time before final judgment — 15 U.S.C. § 1117(d).

That gap explains the usual sequencing. The UDRP is faster and far cheaper, so it handles most cases. Litigation is for a registrant causing real, provable harm, or holding domains worth more than the cost of suing.

Should you just buy the domain instead?

Often, yes — and it is worth pricing honestly rather than treating a purchase as surrender.

A UDRP filing starts at $1,500 before counsel, takes roughly two to three months, and can fail on the bad-faith element. If the asking price is below your total expected cost and the domain genuinely matters to your customers, buying is the rational choice.

Buy when the asking price is near the filing fee, the domain protects a real customer route, and your trademark position is weak or unregistered.

File when the price is opportunistic, the registrant holds several of your names, you have a registered mark, or paying would invite a repeat.

Two cautions. Approaching the registrant can raise the price, and it can also produce evidence — an offer to sell above out-of-pocket costs is one of the paragraph 4(b) bad-faith examples. Capture the page and the correspondence before you negotiate.

How do you know if your brand is being squatted?

You have to look, because nothing tells you. Nobody is notified when a domain matching their brand is registered.

The 2026 Shopify Brand Protection Report scanned 2,000 leading Shopify stores and found that 90.3% had at least one third-party-registered lookalike domain, and 40% had one sitting on a parked or for-sale page — the classic cybersquatting posture. Across the 1,991 stores tracked over a 61-day window, 581 new lookalikes were registered, and 32.5% of stores gained at least one.

Three things to check on any domain you find, in this order: who registered it and when, what the page currently serves, and whether the registrant holds other names matching other brands. The registration date matters more here than in most brand-abuse work, because the ACPA turns on your mark’s status at that date, and the UDRP turns on intent at registration.

What does Recon do about cybersquatting?

Recon finds the domains and preserves what you need to act on them. It generates 100+ lookalike variations of your domain, checks them across 1,500+ TLDs, and records registry data, redirects, page content, certificate state, and public threat-list results next to each finding. Registration dates come from registry records, which is the detail both the UDRP and the ACPA turn on.

Detection runs in real time on every plan. Alerting is where the plans differ, and it is worth being precise: the free plan watches 10 lookalike domains and reports in a monthly digest, so a domain registered today may not reach you for up to four weeks. The paid plan is $24/month or $220/year, tracks 200 domains, sweeps daily, and sends alerts as findings appear. It includes a 14-day free trial.

Recon does not file UDRP complaints, negotiate purchases, or send takedowns for you. It tells you what exists, what it is doing, and when it changed, and it gives you the evidence and templates to act. The decision to buy, file, or watch is yours, and for anything contested it is one to take with counsel.

FAQ

Q: Do I need a registered trademark?

A: It helps enormously and is close to essential for the ACPA, which requires a distinctive or famous mark. The UDRP accepts unregistered rights established through use in commerce, but proving them adds work and risk to a case you already have to win on all three elements.

Q: How long does a UDRP case take?

A: Roughly two to three months from filing to decision in a straightforward case, and longer if the registrant responds substantively or the panel requests further submissions. Expedited handling is available at a higher fee.

Q: The squatter is running a real business on the domain. Can I still act?

A: It becomes considerably harder. A bona fide offering of goods or services begun before notice of the dispute is an explicit paragraph 4(c) defence. Take advice before filing, because a losing complaint costs the fee and signals that the name is valuable to you.

Q: Can I recover a domain someone registered before my brand existed?

A: Generally no. Both routes look at the position when the domain was registered. If your mark did not exist or was not distinctive then, the registrant cannot have acted in bad faith toward it.

Q: Should I register my brand in every extension to prevent this?

A: No. There are more extensions than any brand can hold, and unused registrations still cost renewals. Cover the extensions your customers actually use, then monitor the rest — defensive registration covers the decision in detail.