Cybersquatting: What It Is, Real Cases, and How to Get a Domain Back
Cybersquatting is registering, selling or using a domain name that matches or closely imitates someone else's trademark, in bad faith, to profit from it. The squatter might demand a high price to hand the domain over, earn ad revenue from visitors looking for the real brand, or use the address to impersonate the owner. Under US law and ICANN's dispute policy, the owner can usually get the domain back.
How Cybersquatting Works
A squatter registers domains that a brand will want or that its customers will type: the exact name on a new ending, the name of a product before it launches, a misspelling, or the brand joined to a word like login or support. Registration costs a few dollars, so squatters register many and wait. The domain then earns money in one of three ways:
Ransom: the domain is offered to the brand, often at a price set just below what a lawsuit would cost.
Traffic: a parked page full of ads, frequently for the brand's competitors, collects visitors who expected the real site.
Impersonation: the domain hosts a fake login page, a fake store or sends email that looks like it came from the brand.
Types of Cybersquatting
Typosquatting: misspellings and look-alike characters, such as exmaple.com. See typosquatting for the full set of techniques.
Combosquatting: the exact brand plus a word, such as example-login.com or examplesupport.com.
TLD squatting: the exact name on another ending, such as example.shop or example.co.
Name squatting: a person's name, often a public figure's, registered to sell or to impersonate them.
Expired domain sniping: registering a brand's domain the moment it lapses, then holding it or selling it back.
Real Examples of Cybersquatting
In Panavision v. Toeppen (1998), a registrant who held panavision.com and offered it to the company for $13,000 lost in a US federal appeals court, an early case that shaped how trademark law applies to domains. In 2000, Madonna won madonna.com through a UDRP complaint at WIPO after the registrant had used it for an adult site. In 2008, Verizon won a judgment of more than $33 million against the registrar OnlineNIC over hundreds of domains confusingly similar to its marks.
Is Cybersquatting Illegal?
Yes, in most cases. In the United States, the Anticybersquatting Consumer Protection Act (1999) makes it unlawful to register, sell or use a domain that is identical or confusingly similar to a distinctive trademark with a bad faith intent to profit. Courts can order the domain transferred and award statutory damages of $1,000 to $100,000 per domain. Signs of bad faith include offering to sell the domain to the brand without ever using it, giving false contact details, and registering many domains that match other people's marks. This is general information, not legal advice.
How to Get a Domain Back From a Cybersquatter
UDRP complaint: ICANN's Uniform Domain Name Dispute Resolution Policy covers .com, .net, .org and the other generic endings, and many country codes use a similar policy. You must show that the domain is identical or confusingly similar to your mark, that the registrant has no legitimate interest in it, and that it was registered and used in bad faith. The only remedies are transfer or cancellation, no damages, and cases usually take about two months.
URS: the Uniform Rapid Suspension System is a faster, cheaper option for the newer generic endings. It suspends the domain rather than transferring it, and needs clear and convincing evidence.
Lawsuit under the ACPA: slower and more expensive, but it can award damages and suits cases where the squatter holds many domains.
Buying it: sometimes the cheapest route, but paying a squatter can encourage more registrations, so check what a UDRP case would cost first.
Bring evidence either way. WHOIS and RDAP history show when the domain was registered and by whom, and DNS history shows what it pointed to and when.
How to Protect Your Brand From Cybersquatting
Register your main name on the endings your customers use, plus the obvious misspellings and the country codes of your key markets.
Register your trademark. A registered mark makes every remedy above faster and cheaper, and lets you use the Trademark Clearinghouse for early access and warnings when new endings launch.
Set your own domains to auto-renew with a current card, so an expired domain never becomes someone else's.
Monitor for new registrations that imitate your brand, and watch for when they gain a website, mail servers or a certificate.
Keep records. Screenshots, WHOIS history and DNS changes captured at the time are what make a bad faith case.
How DNS Spy Helps
The free Typosquatting Scanner lists registered look-alikes of any domain, with no signup. Phishing Sentinel watches continuously: it checks thousands of permutations of each monitored domain, scores each registered one from 0 to 100 on its technique and infrastructure, and alerts you when a new one appears or a parked one starts hosting a site or mail. WHOIS monitoring tracks registrar, status and expiry on your own domains so none lapse into a squatter's hands. DNS Spy does not file disputes or takedowns for you, but it gives you the dated evidence a UDRP complaint needs. Phishing Sentinel is part of the Enterprise plan; see brand protection for how the pieces fit together.
Related
Typosquatting: What It Is, Real Examples, and How to Protect Your Domain
Frequently asked questions
Is cybersquatting illegal?
Yes, cybersquatting is illegal in most cases. In the US, the Anticybersquatting Consumer Protection Act lets trademark owners recover the domain and statutory damages of $1,000 to $100,000 per domain when it was registered in bad faith. Internationally, the UDRP lets owners reclaim domains without going to court. This is general information, not legal advice.
Does cybersquatting occur when keywords are inserted into a website?
No. Inserting another company's trademark into a page's keywords or meta tags to attract its searchers is keyword stuffing, which can be trademark infringement but is a different practice. Cybersquatting is registering or using a domain name that matches or imitates someone else's trademark, in bad faith, to profit from it.
What is an example of cybersquatting?
A classic example is Panavision v. Toeppen, where the registrant of panavision.com offered it to the company for $13,000 and lost in a US federal appeals court in 1998. Another is madonna.com, which Madonna recovered through a UDRP complaint in 2000 after the registrant had used it for an adult site.
How do I get a domain back from a cybersquatter?
File a UDRP complaint for most generic endings, showing the domain matches your mark, the holder has no legitimate interest, and it was registered and used in bad faith. Cases usually take about two months and end in transfer or cancellation. For damages, or many domains, a lawsuit under the ACPA is the alternative.
What is reverse domain name hijacking?
Reverse domain name hijacking is when a trademark owner files a UDRP complaint in bad faith to take a domain from someone who registered it legitimately, such as a generic word or a name registered before the mark existed. UDRP panels can make a formal finding of it, which is public, though it carries no financial penalty.
