Cybersquatting is the registration, trafficking in, or use of a domain name that is identical or confusingly similar to someone else’s trademark, done in bad faith with the intent to profit from that mark. The profit can take several forms: selling the domain back to the brand owner at a markup, collecting pay-per-click revenue from mistyped visits, diverting customers to a competitor, or hosting a phishing page that borrows the brand’s credibility. What makes it cybersquatting rather than ordinary domain registration is the combination of a protected mark, confusing similarity and bad faith. All three must be present.
What cybersquatting is, and what it is not
The term is applied loosely to any domain a brand owner wishes it had, so the boundaries matter. Three neighboring practices are regularly confused with it.
Typosquatting is a subset of cybersquatting in which the domain is a misspelling or keyboard-slip variant of a brand (gooogle, amazom, paypa1) that relies on typing errors rather than deliberate visits. Because the domain still imitates a mark for profit, it is treated as cybersquatting under both the UDRP and the ACPA; our typosquatting guide covers how those variants are generated and detected.
Domain investing in generic or descriptive terms is lawful. Registering carinsurance.com, buying an expired dictionary-word domain, or holding a short acronym for resale infringes no one’s rights, because no single company owns those words for all purposes. The UDRP has repeatedly protected this kind of registrant: some 7,000 cases have been dismissed in favor of the registrant, according to the WIPO-ICA UDRP Review Project Team initial report, and a brand owner who files against a legitimate investor risks a finding of reverse domain name hijacking (an abusive attempt to use the UDRP to take a domain the complainant has no right to).
Domain hijacking is theft, not squatting. A hijacker takes control of a domain you already own, usually by compromising your registrar account or your email, and transfers it elsewhere. The sex.com case is the clearest example: the district court entered a $65 million judgment in Gary Kremen’s favor against Stephen Cohen for the theft of the domain, as the Ninth Circuit recorded in Kremen v. Cohen (9th Cir. 2003). That was conversion of property, not trademark infringement, and the remedies differ. Our domain hijacking hub covers that path.
Why cybersquatting is illegal
Cybersquatting is unlawful in the United States under a federal statute and prohibited worldwide by the contract every gTLD registrant signs; our explainer on whether cybersquatting is illegal covers both in more detail.
The Anticybersquatting Consumer Protection Act
The ACPA, enacted in 1999 and codified at 15 U.S.C. 1125(d), gives the owner of a distinctive or famous mark a civil claim against anyone who registers, traffics in, or uses a domain name that is identical or confusingly similar to the mark (or dilutive of a famous mark) with a bad-faith intent to profit. The statute lists nine factors a court may weigh in assessing bad faith, including whether the registrant has any rights in the name, whether it has used the domain for a genuine offering of goods or services, whether it intended to divert consumers from the mark owner’s site, whether it offered to sell the domain without having used it, whether it gave false contact information, and whether it has a pattern of registering domains that match other people’s marks. No single factor is decisive, and the statute protects a registrant who reasonably believed its use was lawful.
The remedies are what give the ACPA its weight. A court can order transfer or cancellation, issue an injunction, and award damages. The plaintiff may elect statutory damages of “not less than $1,000 and not more than $100,000 per domain name, as the court considers just,” according to Senate Report 106-140, the legislative history of the Act; the same range appears in the current statute at 15 U.S.C. 1117(d). Courts have since read the statute to cover related conduct. In DSPT International v. Nahum (9th Cir. 2010), the Ninth Circuit affirmed a $152,000 verdict against a former employee who registered his employer’s domain and withheld it to extract disputed commissions, holding that “holding the domain name for ransom” is a bad-faith intent to profit from the mark.
The UDRP as the global administrative route
Outside a US courtroom, the main weapon against cybersquatting is the UDRP (Uniform Domain-Name Dispute-Resolution Policy). Every registrar of a generic top-level domain must include it in its registration agreement, so a registrant anywhere in the world has already agreed to be bound by a panel decision. The complainant files with a provider such as WIPO (the World Intellectual Property Organization) or Forum, proves confusing similarity, lack of rights or legitimate interests, and bad-faith registration and use, and the panel orders the domain transferred or canceled. There are no damages, but there is also no discovery and no hearing.
The volume shows how central the UDRP has become. WIPO received 6,282 UDRP-based complaints in 2025, “the largest number of filings ever received by the Center,” and has administered over 80,000 cases since December 1999, according to the WIPO Secretariat’s update to the Standing Committee on the Law of Trademarks. Across all providers, ICANN’s status report covering 2013 through 2020 found that complainants obtained the disputed domain in about 78% of cases, according to the ICANN GNSO UDRP status report. A well-prepared UDRP complaint against a genuine squatter is therefore very likely to succeed, and our UDRP hub walks through the process. For narrower cases, the URS (Uniform Rapid Suspension system) suspends a domain in a new gTLD within days, and the ACPA remains available when damages are the point; our comparison of UDRP, URS and ACPA explains when each fits.
Prevention built into new gTLDs: the Trademark Clearinghouse
When ICANN opened hundreds of new extensions from 2013 onward, it built a prevention layer into each. The Trademark Clearinghouse (TMCH) is a central database of verified trademarks. A mark recorded there gives its owner two rights in each new gTLD: priority registration of the matching domain during the Sunrise period before general availability, and a Claims notice served on anyone who later tries to register that exact string, warning them that it matches a recorded mark. The independent review of the Clearinghouse reconstructed about 1.8 million registration attempts that triggered a Claims notice, of which 93.7% were abandoned, according to ICANN’s revised independent review of the Trademark Clearinghouse. The review cautioned that it could not determine how much of that abandonment the notices caused, but a clear warning at the point of registration plainly deters many would-be squatters.
Cybersquatting examples
The cases that reach a UDRP panel follow a few recognizable patterns. The most common is the parked typo or brand-plus-keyword domain (brandname-login, brandname-support, brandnameoutlet) that displays pay-per-click advertising, often for the brand’s own competitors. A second is the resale play, in which the registrant parks the domain with a “may be for sale” banner and waits for an offer; an unsolicited demand for a price well above registration cost is among the strongest evidence of bad faith a complainant can present. A third is the impersonation site that copies the brand’s login page to harvest credentials. A fourth is the employee or contractor who registers the company’s name in his own account and refuses to release it, the conduct at issue in DSPT v. Nahum.
The industries targeted track where the money is. Retail, banking and finance, and biotechnology and pharmaceuticals led WIPO’s 2024 caseload by sector, according to the WIPO Domain Name Report 2024, because a lookalike in those sectors can be turned into money quickly through counterfeit sales, credential theft or diverted prescriptions.
How to detect cybersquatting
Most brand owners learn of a squatted domain from a customer who was fooled by it. Domain monitoring (a service that watches new registrations and DNS changes for strings resembling your marks) catches new lookalikes within hours of registration, before they have been loaded with content or used in a phishing campaign. The strings to watch include the exact mark in every extension, common misspellings, the mark plus words such as login, support and pay, and homoglyphs (characters from other scripts that look identical to Latin letters). A new lookalike that acquires MX (mail exchange) records is an early warning that it is being prepared to send email in your name. Our DNShield domain name monitoring service watches for exactly these patterns, and the domain monitoring hub explains how to tune alerts so the ones you receive are worth acting on.
How to respond to cybersquatting
The response should match the harm. If the domain is parked and no one is being deceived, a cease-and-desist letter from counsel is the cheapest first step; many squatters release a domain rather than face a proceeding. If the letter is ignored or the domain is clearly held for resale, file a UDRP complaint built around documentary evidence: your registration certificate, dated screenshots of the parked page, the WHOIS and RDAP records, any sale listing or demand, and evidence that the same registrant holds other brand-matching domains.
If the domain sits in a new gTLD and the case is clear-cut, the URS can suspend it faster and for a lower fee, at the cost of not getting the name transferred. If the registrant holds many infringing domains or has caused measurable losses, an ACPA lawsuit is the only route to damages and an injunction. If the domain is actively hosting phishing content, do not wait for any proceeding: file an abuse report with the registrar and the hosting provider the same day, because registrars are contractually required to act on well-founded reports of DNS abuse, and a responsive one will suspend a phishing domain within hours.
How to prevent cybersquatting
The traditional method is defensive registration, in which the brand owner registers its mark and the likeliest variants in the extensions that matter to its market. INTA members reported spending an average of $150,000 per year on defensive actions and registering an average of 352 domains (median 78) over the prior two years, according to the INTA New gTLD Cost Impact Survey, a small survey of 33 respondents but a useful indication of what a serious program costs. Defensive registration has a ceiling: no company can register every variant in every new gTLD, and every registration must be renewed.
Domain blocking products take a different approach. Instead of registering a name in each extension, the brand owner pays participating registries to block its mark from registration across many extensions at once. The GlobalBlock service covers 558 domain extensions, with GlobalBlock+ adding automatic blocking of homoglyph variants, according to the Markmonitor GlobalBlock datasheet; the extension count changes as registries join. We offer GlobalBlock, NameBlock and BrandLock, each covering a different set of registries, and our guide to domain blocking compares them against defensive registration. For most brands the right answer is a combination: register the domains you will actually use, block the mark across the extensions you never will, record the mark in the TMCH so that Sunrise and Claims apply when new extensions launch, and monitor everything else.
Underlying all of this is the trademark itself. A registered mark is the foundation of every remedy on this page; without one, a brand owner will struggle to prove rights under either the UDRP or the ACPA. Our guide on how to trademark a domain name explains what can be registered and how the mark and the domain reinforce each other.
How DNAccess helps
We work on cybersquatting from both directions. On the prevention side, our online brand protection service builds the combination described above: a defensive registration list sized to your actual risk, blocking across the extensions you will never use, TMCH recordal, and DNShield monitoring to catch the lookalikes that slip through. On the enforcement side, we prepare the evidence a panel, an examiner or a court will need: the registration and DNS history of the squatted domain, archived content, the registrant’s other holdings, and a timeline that ties them together. I have served as an expert witness on domain name matters, and we work with your counsel to decide whether a letter, a UDRP, a URS or an ACPA action is the right response. If a lookalike of your brand has appeared, contact us and we will tell you who is behind it and what to do about it.