A trademark owner who finds a domain name that imitates its mark has three formal paths: the UDRP (Uniform Domain-Name Dispute-Resolution Policy), the URS (Uniform Rapid Suspension system), and an ACPA domain name dispute in federal court under the Anticybersquatting Consumer Protection Act, 15 U.S.C. 1125(d). Each answers a different question. The UDRP asks whether the domain should be transferred to you. The URS asks whether it should be switched off quickly. The ACPA asks whether the registrant should pay. Choosing the wrong one wastes months and money, and for a stolen domain none of the three is the right tool.
The UDRP: an administrative transfer or cancellation
The UDRP is the ICANN policy that every registrar of a generic top-level domain (gTLD, an extension such as .com, .net or .shop that is not tied to a country) must write into its registration agreement. Because the registrant agreed to the policy at registration, a panel can order the registrar to transfer or cancel the domain without a court. Providers such as WIPO (the World Intellectual Property Organization) and Forum appoint a panel of one or three members, which decides on the written submissions alone. There is no hearing, no discovery and no damages.
To win, the complainant must prove that the domain is identical or confusingly similar to a trademark in which it has rights, that the registrant has no rights or legitimate interests in the domain, and that the domain was registered and is being used in bad faith. The standard is a preponderance of the evidence (more likely than not), and the UDRP complaint carries the whole case, because there is rarely a second round of filings.
ICANN’s Security and Stability Advisory Committee described a proceeding as taking “at least two months” and costing roughly USD 2,000 in provider fees in its 2005 report SAC007; fees have changed since, but the order of magnitude holds. The ICANN GNSO status report covering 2013 through 2020 found that Forum cases averaged 32 days from commencement to decision and that complainants obtained the disputed domain in about 78% of cases across all providers. Those odds are why the UDRP is the default path for most cybersquatting matters, as our UDRP hub explains.
One procedural detail matters here. After a transfer order, the registrar waits ten business days before acting, and if the losing registrant files suit in a court of mutual jurisdiction during that window, the registrar holds the domain until the court rules. A UDRP decision does not bind a court.
The URS: rapid suspension for clear-cut cases in new gTLDs
The Uniform Rapid Suspension system was created alongside the 2012 round of new gTLDs (extensions such as .xyz, .top and .online). It applies only to those new gTLDs, not to .com, .net or .org, and it is deliberately narrow. The complainant must prove the same three elements as under the UDRP, but to a higher standard: clear and convincing evidence, with no genuine issue of material fact. In exchange, the fee is lower, the filing is short, and the examiner rules within days of the response deadline.
The remedy is the other important difference. A successful URS complaint does not transfer the domain; it suspends it for the rest of its registration term behind a notice page. The registrant keeps the registration, and when the term ends the name drops back into the pool, where another squatter can register it. For a brand that wants to own the name, the URS is a stopgap. For a brand that only wants a phishing site switched off, it is often enough.
The official numbers show how the URS has been used. ICANN’s staff compilation counted 827 URS cases covering 1,861 domain names between February 2014 and December 2017, of which 723 (about 87%) ended in suspension, 59 were denied and 44 were withdrawn; 531 of the suspensions were default determinations where the registrant never answered, and only 14 appeals were filed, with the complainant prevailing in 12, according to the ICANN URS cases and initial metrics report. That data ends in 2017 but remains the most complete official compilation: the URS is used sparingly, mostly against registrants who never respond, and almost never appealed.
The ACPA: a federal lawsuit with damages and in rem jurisdiction
The Anticybersquatting Consumer Protection Act, codified at 15 U.S.C. 1125(d), makes cybersquatting a federal civil cause of action. The owner of a distinctive or famous mark can sue a person who registers, traffics in, or uses a domain name that is identical or confusingly similar to the mark with a bad-faith intent to profit from it. Unlike the UDRP and the URS, an ACPA domain name dispute is litigation: pleadings, discovery, motions and, if the case does not settle, a trial. It takes a year or more and costs far more than any administrative proceeding.
In return, the court can order the domain transferred or canceled, issue an injunction, award actual damages and the defendant’s profits, and, in exceptional cases, award attorney fees. Most important for deterrence, the plaintiff may elect statutory damages instead of proving actual loss. The Senate Judiciary Committee set that range at “not less than $1,000 and not more than $100,000 per domain name, as the court considers just,” electable at any time before final judgment, according to Senate Report 106-140; the range is unchanged in the current statute at 15 U.S.C. 1117(d).
The ACPA also offers an in rem action (a lawsuit against the property itself rather than against a person). When the plaintiff cannot locate the registrant or obtain personal jurisdiction over one abroad, it may sue the domain name itself in the district where the registry or registrar is located, after making the notice efforts the statute requires. The remedy is limited to transfer or cancellation, with no damages, but it reaches domains whose owners hide behind privacy services or foreign addresses.
Side-by-side comparison
| Factor | UDRP | URS | ACPA |
|---|---|---|---|
| Forum | Panel at an ICANN-approved provider (WIPO, Forum, CAC, ADNDRC) | Examiner at a URS provider (Forum, ADNDRC, MFSD) | US federal district court |
| Scope | All gTLDs plus ccTLDs that have adopted the policy | New gTLDs only | Any domain where the court has jurisdiction over the registrant, or in rem at a US registry or registrar |
| Speed | Roughly two months from filing to decision | Days to a few weeks | Months to years |
| Cost | Provider fee in the low thousands plus counsel | Lowest of the three | Highest by far: filing, discovery, experts and trial |
| Remedy | Transfer or cancellation only; no damages | Suspension for the remaining registration term; no transfer, no damages | Transfer or cancellation, injunction, actual or statutory damages ($1,000 to $100,000 per domain), attorney fees in exceptional cases |
| Burden of proof | Preponderance of the evidence on all three elements | Clear and convincing evidence, no genuine issue of material fact | Preponderance of the evidence; bad-faith intent assessed against statutory factors |
| Appeal | No internal appeal; either party may file in court, within ten business days to stay a transfer | Internal appeal, plus a right to go to court | Appeal to the federal circuit court |
Which path fits which situation
A typosquatter holding a misspelling of your registered mark
This is the UDRP’s core case. You hold a registered trademark, the domain is a near-identical variant, the registrant has no business under that name, and the site is parked or redirects to a competitor. File a UDRP complaint and expect a transfer. The URS would only suspend the name, and the ACPA would cost more than the domain is worth. Our guide to cybersquatting covers the evidence a panel expects to see.
A phishing lookalike on a new gTLD
When a new gTLD domain is hosting a credential-harvesting page, speed matters more than ownership. First, file an abuse report with the registrar and the hosting provider; ICANN’s registrar agreement requires registrars to act on well-founded reports of DNS abuse, and a responsive registrar can suspend a phishing domain within hours. If the registrar does not act, file a URS complaint; the clear-and-convincing standard is easy to meet when the site copies your login page. To own the name permanently, follow up with a UDRP once the threat is contained.
A stolen domain with no trademark behind it
None of the three paths is designed for theft. If your domain was transferred out of your registrar account without authorization, you are not a trademark owner complaining about a squatter; you are the rightful registrant trying to undo a fraudulent transfer. A UDRP panel will ask for trademark rights you may not have, and even if you win, the thief can stall the transfer by filing suit. The correct sequence is registrar escalation under the ICANN Transfer Policy, a TURF (Transfer Undo Request Form) submission to the registry where the TLD offers one, the Transfer Dispute Resolution Policy between registrars, and, if those fail, a court action for conversion. Our domain hijacking hub and the legal options for domain theft victims guide walk through each step, and our stolen domain name recovery service handles the registrar and registry work directly.
A well-funded cybersquatter with many domains, or a need for damages
When one registrant holds a portfolio of domains built on your mark, or when the squatting has caused measurable harm, the ACPA is the only path that makes the registrant pay. Statutory damages of up to $100,000 per domain, an injunction barring future registrations, and the prospect of attorney fees change the negotiation, and a single complaint can name every domain. The same logic applies when a competitor is diverting customers and you need an injunction, not just a transfer.
A registrant outside the United States
The UDRP works regardless of where the registrant lives, because the obligation comes from the registration agreement rather than from national law, which makes it the first choice against a foreign squatter. If you need a court order, the ACPA’s in rem provision lets you proceed against the domain itself at the registry or registrar’s US location without serving the registrant personally, though an in rem judgment cannot award damages.
How DNAccess helps you choose and prepare
Choosing between the UDRP, the URS and an ACPA domain name dispute is a judgment about what you need (transfer, suspension or damages), what you can prove, and what the registrant is likely to do. We help clients make that call before a filing fee is paid. Our work begins with a domain background check: the registration history, the WHOIS and RDAP records, the DNS and hosting history, and the archived content of the disputed domain, assembled into a timeline that shows when the domain was registered, what has been on it, and whether the same registrant holds other infringing names. That evidence is what a panel, an examiner or a judge will ask for.
For matters that belong in court, I have served as an expert witness on domain name and internet marketing issues, and we work alongside your counsel on declarations and exhibits. For stolen domains, our stolen domain name recovery service handles the registrar escalation, TURF and TDRP process from start to finish. If you are unsure which path fits, contact us and we will tell you plainly which one to use and why.