Back to Blog

Domain Name Disputes: 7 Critical Steps to Win a UDRP

April 26, 2026 Aruna 14 min read
Domain Name Disputes — intellectual property law and protection

Domain name disputes at the intersection of trademark law have become one of the most common IP enforcement challenges businesses face in the digital era. Cybersquatters register domain names incorporating famous trademarks with the intent to profit from the goodwill associated with those marks. Whether you are facing a cybersquatter holding your brand name hostage or defending against a domain name complaint, understanding the UDRP process and how trademark rights apply to domain names is essential. PerspireIP guides clients through domain name disputes from initial assessment through resolution.

What Is Cybersquatting?

Cybersquatting is the practice of registering, trafficking in, or using a domain name that is identical or confusingly similar to a trademark, with bad faith intent to profit from the trademark owner’s goodwill. Cybersquatters operate in several ways: they may register brand-identical domains and offer to sell them back to the trademark owner at inflated prices, they may use the domain to divert internet traffic to competing websites, or they may use the domain to harm the trademark owner’s reputation.

The scope of cybersquatting has expanded far beyond domain names to include social media usernames, app store names, and other digital identifiers. While the legal frameworks for these additional forms of digital brand squatting are still evolving, trademark rights provide a foundation for enforcement across all these channels.

The Uniform Domain Name Dispute Resolution Policy (UDRP)

The Uniform Domain Name Dispute Resolution Policy (UDRP) is a mandatory administrative dispute resolution process established by the Internet Corporation for Assigned Names and Numbers (ICANN) and applicable to generic top-level domain (gTLD) registrations such as .com, .net, .org, and many others. The UDRP provides a faster and less expensive alternative to court litigation for resolving domain name disputes involving trademark rights.

To succeed in a UDRP proceeding, the complainant must prove three elements. First, the disputed domain name must be identical or confusingly similar to a trademark or service mark in which the complainant has rights. Second, the respondent must have no rights or legitimate interests in the domain name. Third, the domain name must have been registered and is being used in bad faith.

Proving Bad Faith in Domain Name Disputes

Bad faith is the most contested element in most domain name disputes. The UDRP policy provides a non-exhaustive list of circumstances that evidence bad faith registration and use.

  • Circumstances indicating the domain was registered primarily to sell it to the trademark owner for more than out-of-pocket costs
  • Registration of the domain to prevent the trademark owner from registering it in a corresponding domain
  • Registration of the domain primarily to disrupt the business of a competitor
  • Using the domain to intentionally attract internet users to the respondent’s website for commercial gain by creating a likelihood of confusion with the trademark
  • Providing false contact information in the registration

Legitimate Interests: The Respondent’s Defense

Not all domain name registrations that incorporate trademark terms are cybersquatting. Respondents in UDRP proceedings may demonstrate legitimate interests in the domain name in several ways. A respondent who has made bona fide use of the domain before any notice of the dispute, who is commonly known by the domain name, or who is making legitimate noncommercial or fair use of the domain may have a valid defense.

Resellers and distributors of the trademark owner’s products sometimes have legitimate interests in domain names that incorporate the trademark. Fan sites and criticism sites may also be able to establish legitimate interests, though this is more complex when the site is commercial in nature. PerspireIP analyzes the strength of respondent defenses before filing a UDRP complaint to ensure our clients have a strong likelihood of success.

UDRP Providers and the Process

UDRP proceedings are administered by accredited dispute resolution providers including the World Intellectual Property Organization (WIPO), the National Arbitration Forum (NAF), and the Czech Arbitration Court. WIPO is the largest and most commonly used provider for international domain name disputes.

The UDRP process involves filing a complaint with the chosen provider, serving the complaint on the respondent, a 20-day period for the respondent to file a response, appointment of a panel of one or three panelists, and a decision typically issued within 14 days of appointment. The entire process typically takes 60 to 90 days — much faster than federal court litigation. Filing fees depend on the provider and the number of domain names in dispute, typically ranging from $1,500 to $5,000 for a one-panelist proceeding.

The Anti-Cybersquatting Consumer Protection Act (ACPA)

In addition to the UDRP, trademark owners in the United States can pursue cybersquatters through the courts under the Anti-Cybersquatting Consumer Protection Act (ACPA). The ACPA provides for statutory damages of $1,000 to $100,000 per domain name, injunctive relief including transfer of the domain, and attorney’s fees in exceptional cases. Unlike the UDRP, which can only result in cancellation or transfer of the domain, the ACPA allows recovery of monetary damages.

The ACPA also provides a mechanism called in rem jurisdiction, allowing a trademark owner to file suit against the domain name itself when the cybersquatter cannot be located or is in a foreign jurisdiction. This provision has proven particularly useful against anonymous cybersquatters.

Defensive Domain Name Registration Strategy

The best protection against domain name disputes is a proactive defensive registration strategy. Registering your brand name across all major top-level domains (.com, .net, .org, .co, country code TLDs for your key markets) before cybersquatters do eliminates the most common attack vector. Also register common misspellings and typos of your brand name, as these are frequently used for typosquatting attacks.

PerspireIP works with clients to develop defensive domain registration strategies that protect their brand online while keeping registration costs manageable. We also monitor domain name registrations for new registrations that incorporate our clients’ trademarks, enabling rapid response when cybersquatting is detected.

Using the UDRP to Recover Domains Held for Ransom

One of the most common forms of cybersquatting is registering a domain name incorporating a trademark and then demanding an inflated payment from the trademark owner to transfer the domain. This is sometimes called ransoming a domain, and it is explicitly recognized as bad faith conduct under the UDRP. Trademark owners who find themselves in this situation have a powerful remedy in the UDRP proceeding, which can result in transfer of the domain without any payment to the squatter beyond the filing fee for the proceeding itself.

To succeed in a UDRP proceeding against a domain held for ransom, the trademark owner must demonstrate the three UDRP elements: that the domain is identical or confusingly similar to their trademark, that the registrant has no legitimate rights or interests in the domain, and that the domain was registered and is being used in bad faith. The demand for an inflated payment is itself evidence of bad faith — UDRP panels have consistently found that offering to sell a domain to the trademark owner for more than out-of-pocket registration costs demonstrates bad faith registration.

PerspireIP strongly advises trademark owners not to negotiate with cybersquatters who are holding domains for ransom. Paying the ransom only encourages future squatting and establishes a precedent that your brand is willing to pay for domain recovery. In most cases, a UDRP proceeding will recover the domain far more cost-effectively than paying the squatter’s asking price. The exception is when the squatter is offering to sell the domain for a price that is genuinely less than the cost of UDRP proceedings, in which case a business decision must be made based on the specific economics of each situation.

After recovering a domain through the UDRP or other means, PerspireIP recommends implementing a defensive domain registration strategy to prevent future squatting. This includes registering your trademark across all major gTLDs and country-code TLDs relevant to your markets, monitoring for new registrations of domain names incorporating your trademark or common variations, and setting up automatic renewal for all domains in your portfolio to prevent accidental expiration that creates new squatting opportunities.

New gTLDs and Domain Trademark Protection

The introduction of hundreds of new generic top-level domains (gTLDs) — including .app, .shop, .brand, .law, .tech, and many others — has expanded the domain name trademark protection challenge significantly. Each new gTLD creates new opportunities for cybersquatters to register your trademark as a domain name in a new extension, multiplying the monitoring burden for brand owners. PerspireIP helps clients develop strategies for managing trademark protection across the expanding domain name universe.

ICANN’s Trademark Clearinghouse (TMCH) provides one tool for managing trademark rights across new gTLDs. By registering your trademark in the TMCH, you receive advance notification when someone attempts to register a domain matching your trademark in a new gTLD, and you have priority rights during the sunrise period to register your trademark as a domain name in participating gTLDs before general registration opens. PerspireIP manages TMCH registration for clients with high-profile trademark portfolios as part of a comprehensive domain name protection strategy.

Some brand owners have applied for their own branded gTLD — such as .google, .apple, or .amazon — which gives them control over all domain names in that extension. While branded gTLD applications are extremely expensive (approximately $185,000 per gTLD application plus ongoing operating costs), they provide unparalleled domain name protection for global brands. For most businesses, a more targeted defensive registration strategy combined with active monitoring and UDRP enforcement is the most cost-effective approach to domain name trademark protection in the new gTLD environment.

The URS: Faster, Cheaper, and Much Narrower

The UDRP is not the only administrative route. When ICANN opened the new generic top-level domains, it added the Uniform Rapid Suspension System (URS), and it is a genuinely different instrument rather than a cheap UDRP. Most discussions of domain name disputes skip it, and brand owners consequently file the wrong complaint.

Three differences matter:

  • The burden is higher. A URS complainant must prove its case by clear and convincing evidence, against the UDRP’s ordinary balance-of-probabilities standard. The URS is built for indisputable cases, not arguable ones.
  • The remedy is weaker. A successful URS complaint results in suspension of the domain for the balance of the registration period. The name is parked on a notice page. It is not transferred to you, and when the registration lapses the domain can return to the open market.
  • It is fast and cheap. Response windows are measured in days rather than weeks and fees are a fraction of a UDRP filing, which makes it useful at volume against obvious typosquatting.

The decision rule follows from the remedy. If you want to own the domain, the URS cannot give it to you and you should file a UDRP complaint. If the objective is simply to take an infringing site offline quickly — a phishing clone, a counterfeit storefront during a product launch — suspension in a few days may be worth more than a transfer in two months. Many brand programmes run both: URS for rapid takedown at scale, UDRP for the names worth holding.

Registered AND Used in Bad Faith: Why the Conjunction Matters

Paragraph 4(a) of the Policy sets three elements, and the third is routinely misread. It requires that the domain name has been registered and is being used in bad faith. That is conjunctive. Bad-faith use alone does not satisfy it, and neither does bad-faith registration followed by dormancy that a panel treats as passive holding without more.

The practical bite is in timing. Where a domain was registered before the complainant’s trademark rights came into existence, the registrant cannot ordinarily have registered it in bad faith — there was nothing to target. A line of decisions once flirted with a "retroactive bad faith" theory, under which later bad-faith use could retrofit the registration element. Panel consensus has firmly rejected it. If your rights post-date the registration, the UDRP is usually the wrong forum, however badly the name is being used now.

Two consequences for how you build a file in domain name disputes:

  • Date your rights precisely. First-use evidence, registration certificates and priority dates decide the registration element before anyone reaches the merits. Pull the domain’s creation date from WHOIS and historical registration records and put the two timelines side by side.
  • Watch for a change of registrant. A transfer to a new holder is generally treated as a fresh registration for Policy purposes. A domain first registered in good faith years ago may still be vulnerable if it has since changed hands.

For the consolidated view of how panels have actually decided these questions, the WIPO Jurisprudential Overview of WIPO Panel Views on Selected UDRP Questions, Version 3.0 is the standard reference. It is not binding, but it is what experienced panellists read, and citing it against the relevant section is more persuasive than stacking up individual decisions.

Reverse Domain Name Hijacking: The Risk of Overreaching

A complaint can rebound. Under Rule 15(e) of the Rules for Uniform Domain Name Dispute Resolution Policy, if a panel finds that a complaint was brought in bad faith — for instance in an attempt at reverse domain name hijacking or primarily to harass the domain holder — it must declare in its decision that the complaint was brought in bad faith and constitutes an abuse of the administrative proceeding.

There is no fine and no costs award, so the sanction is purely reputational. It is also published, permanently, under the complainant’s name. For a brand that enforces at volume, a string of RDNH findings is a liability every future respondent will cite.

Findings tend to cluster around a few recognisable patterns:

  • Chasing a domain that predates the mark while knowing the dates, which is the registration-element problem above dressed up as a complaint.
  • Attacking a generic or descriptive term in which the complainant holds rights in one sector while the registrant uses it in another, or simply holds it as a dictionary word.
  • The failed purchase. Trying to buy the name, being refused or quoted a high price, and then filing a UDRP to get it for the cost of a complaint. Panels treat the prior negotiation as evidence of what the proceeding is really for.
  • Material omissions — not disclosing a licence, a prior settlement, a coexistence agreement or an earlier failed complaint over the same name.

The screen is straightforward. Before filing, write out the respondent’s best answer to each of the three elements. If it has a real answer to any one of them, you do not have a UDRP case, and the correct response is either a negotiated purchase or court proceedings — not a complaint you expect to lose.

When the ACPA Beats a UDRP Complaint

US trademark owners have a statutory route that the UDRP cannot match on remedies, and choosing between them is a strategic decision rather than a procedural one.

The Anti-Cybersquatting Consumer Protection Act sits at 15 U.S.C. § 1125(d). Two features drive the choice:

  • Money. Under 15 U.S.C. § 1117(d), a plaintiff may elect statutory damages of not less than $1,000 and not more than $100,000 per domain name, as the court considers just. The UDRP awards nothing. Against a serial cybersquatter holding dozens of names, that arithmetic changes the case entirely.
  • Reaching an absent defendant. Section 1125(d)(2) provides in rem jurisdiction over the domain name itself where the registrant cannot be found or is beyond personal jurisdiction. The action proceeds against the name, in the judicial district of the registry or registrar.

The trade-off is cost and time. A UDRP decision typically arrives in about two months for a filing fee in the low thousands; ACPA litigation is federal court litigation, with the budget that implies. A further point that catches complainants out: a UDRP decision does not bind a court. A losing respondent can file suit to stop the transfer, and the Policy itself contemplates a stay while that happens.

A workable allocation across a portfolio of domain name disputes looks like this. Use the URS for indisputable infringement you want offline today. Use the UDRP as the default for single names you want to own. Reserve the ACPA for the cases where you need damages, where the holder is a repeat offender, where the registrant is hiding behind a privacy service in a jurisdiction you cannot otherwise reach, or where the name is commercially important enough to justify a court timetable.

Conclusion

Domain name disputes involving trademark rights are a pervasive challenge in the digital economy. The UDRP provides an efficient and relatively affordable mechanism for recovering domain names from cybersquatters, while the ACPA provides additional remedies through federal court. PerspireIP has extensive experience in domain name dispute proceedings and can guide you from initial assessment through successful domain recovery. Contact us today if you are facing a domain name dispute or want to develop a defensive domain strategy for your brand.