Someone registered a domain that copies your business name, misspells it by one letter, or tacks your brand onto a word like "support" or "shop." The site may host ads, a phishing page, or nothing at all. Your recovery options come down to three routes: a Uniform Domain-Name Dispute-Resolution Policy (UDRP) proceeding decided by an arbitration provider, a federal lawsuit under the Anticybersquatting Consumer Protection Act (ACPA), or a private deal to buy the name. Most trademark owners with clear rights choose the UDRP because it is faster and cheaper than court — but it only awards transfer or cancellation of the domain, never money.
Which route makes sense depends on the strength of your trademark rights, what the registrant is doing with the domain, and whether you need damages or just the name.
What a UDRP complaint must prove
The UDRP is a mandatory administrative policy that ICANN builds into every generic-TLD registration agreement. By registering the domain, the registrant agreed to arbitrate disputes under it. A complainant must establish all three of the following elements:
- Identical or confusingly similar. The domain matches your trademark or is confusingly similar to it. Panels routinely find one-letter typos, added generic words ("brand-login.com"), and hyphenated variants confusingly similar. The TLD itself (.com, .shop) is usually ignored in the comparison.
- No rights or legitimate interests. The registrant has no trademark of its own in the name, is not commonly known by it, and is not making a bona fide offering of goods or a legitimate noncommercial use. The complainant makes a prima facie showing; the burden then shifts to the registrant to demonstrate an interest.
- Registered and used in bad faith. Both registration and use must be in bad faith. Classic indicators include acquiring the domain primarily to sell it to the trademark owner at a profit, a pattern of blocking registrations, disrupting a competitor, or attracting users for commercial gain through confusion.
Failing any one element defeats the complaint. Panels have also warned against "reverse domain name hijacking" — filing a UDRP complaint in bad faith against a legitimate registrant can earn a formal finding of abuse, which becomes part of the public record.
How the proceeding actually runs
You file with an ICANN-approved provider. The WIPO Arbitration and Mediation Center is the busiest; Forum and several regional providers also handle cases. Filing fees are posted on each provider's site and depend on the number of domains and whether you elect a one- or three-member panel; a single-panelist case over a few domains typically costs in the low four figures, far below litigation.
After a compliance check, the provider notifies the registrant, who generally has 20 days to respond. Many respondents default. The panel decides on the written record — there is no discovery, no hearing, and no live testimony. Most cases finish within roughly two to three months of filing. If the panel orders transfer, the registrar implements it after a short waiting period, unless the losing registrant files a lawsuit in a court of "mutual jurisdiction" within ten business days, which suspends the transfer while the court case proceeds.
Watch out: a UDRP win is not final in the way a judgment is. Either side can still go to court, and a U.S. court reviewing the dispute under the ACPA decides the case fresh — it owes no deference to the panel's reasoning.
The ACPA: suing in federal court
The Anticybersquatting Consumer Protection Act, codified at 15 U.S.C. § 1125(d), creates a civil claim against anyone who registers, traffics in, or uses a domain that is identical or confusingly similar to a distinctive mark — or dilutive of a famous one — with a bad-faith intent to profit. The statute lists nine non-exclusive bad-faith factors, including the registrant's own rights in the name, prior legitimate use, intent to divert consumers, and offers to sell the domain without having used it.
The ACPA offers tools the UDRP cannot match. A prevailing plaintiff may recover actual damages and profits or elect statutory damages per infringing domain, along with transfer of the name. Where the registrant is anonymous or beyond the court's personal jurisdiction, the statute allows an in rem action against the domain itself in the judicial district of the registrar or registry — a significant lever when the registrant hides behind privacy services overseas. The tradeoff is cost and time: an ACPA case is ordinary federal litigation, with pleadings, discovery, and motion practice that can run a year or more. Our overview of how a civil lawsuit unfolds stage by stage gives a realistic picture of that commitment.
Choosing a route: side-by-side
| Factor | UDRP | ACPA lawsuit | Purchase |
|---|---|---|---|
| Typical timeline | Around 2–3 months | Often a year or longer | Days to weeks |
| Remedies | Transfer or cancellation only | Transfer plus damages, possibly attorney's fees | Ownership by agreement |
| Cost profile | Fixed provider fee plus drafting | Full litigation budget | Whatever the seller demands |
| Anonymous registrant | Works — provider serves via registrar contacts | In rem action available | Brokers can approach anonymously |
| Weak or unregistered mark | Risky; complaint may fail | Risky and expensive | Often the practical answer |
| Finality | Loser may still sue in court | Judgment is binding | Contract is binding |
A fourth option exists for newer generic TLDs: the Uniform Rapid Suspension system, which is faster and cheaper than the UDRP but only suspends the domain for the rest of its registration term rather than transferring it. It suits clear-cut abuse where you do not actually want the name.
Build the record before you file
UDRP panels decide on paper, so the complaint's exhibits carry the case. Before filing anything — including a demand letter that may prompt the registrant to move the domain — preserve the evidence:
- Dated screenshots of the offending site, including any pages that mimic your branding or display pay-per-click ads
- WHOIS or registrar records showing the registration date and any privacy shielding
- Your trademark registration certificates, or proof of first use and marketplace recognition for a common-law mark
- Any correspondence in which the registrant offered to sell the domain, and the price demanded
- Archived versions of the site over time, which can show a shift toward infringing use
- Evidence of actual confusion: misdirected emails, customer complaints, support tickets
Practical step: a quiet, capped-budget purchase attempt through a broker often costs less than a contested proceeding — but be careful with direct outreach. An unsolicited inflated counteroffer helps prove bad faith later, while your own aggressive first offer can complicate the story.
Reducing the next dispute
Registering your core mark federally, plus a handful of obvious variants and typos as domains, is cheaper than any proceeding. Bear in mind that a determined copycat rarely stops at the name: the same operator often clones the site layout or the app's screens, which the UDRP cannot touch at all, and claiming the look of an interface demands its own proof of distinctiveness and non-functionality. Businesses that license their brand to resellers or affiliates should address domain registration explicitly in those agreements, the same way well-drafted software and service contracts allocate data and IP rights up front. Note that the UDRP is a creature of contract between registrant and registrar — it binds domain registrants automatically, unlike consumer-facing arbitration clauses that must be accepted in a contract to apply. More disputes in this space, from privacy statutes to AI governance, are collected in our Technology, Privacy & IP pathway.
Quick answers
Can I use the UDRP without a registered trademark?
Yes, but you must prove common-law trademark rights: evidence that consumers associate the name with your goods or services, such as sales history, advertising spend, and media coverage. Panels scrutinize these claims closely, and descriptive names are hard to protect. A federal registration removes most of that argument, which is why many owners register before filing.
The registrant is hidden behind a privacy service. Can I still file?
Yes. In a UDRP case, the provider notifies the registrant through the registrar, and registrars typically disclose the underlying contact once a complaint is filed. In court, the ACPA's in rem provision lets you proceed against the domain itself in the district of the registrar or registry when the registrant cannot be identified or served personally.
What happens if I lose a UDRP case?
The domain stays with the registrant, and you can still sue under the ACPA or trademark law — the panel decision does not bind a court. But a loss on the merits, especially a reverse-domain-name-hijacking finding, is public and can be cited against you. Weigh a marginal complaint carefully before filing.
Someone is squatting on a .us or foreign country-code domain. Does the UDRP apply?
Not automatically. Country-code registries adopt their own policies. Some mirror the UDRP closely; others change the elements — for example, requiring bad-faith registration or use rather than both. Check the specific registry's dispute policy, often administered through WIPO, before assuming the standard three-part test applies.
Your next moves
Start by documenting the domain's current use and confirming when it was registered relative to your trademark rights. If your mark is registered and the bad faith is obvious, get quotes for a single-panelist UDRP filing and compare them against a brokered purchase price. Reserve the ACPA for cases where you need damages, face a repeat offender, or expect the registrant to fight past a panel decision. And whichever route you take, lock down your own defensive registrations first — the cheapest domain dispute is the one that never starts.