What Is Cybersquatting, and What Can You Do About It?

You launch a product, announce it publicly, and a week later discover that someone has registered the matching .com, put up a page of competitor ads, and is offering to "sell" it to you for a sum that makes your eyes water. That is cybersquatting, and it happens to startups, global brands, celebrities, and local businesses alike. The good news is that trademark owners have well-established remedies, some of them faster and cheaper than going to court. This article explains what cybersquatting is, the forms it takes, how to tell it apart from legitimate domain investing, what your options are when it happens, and how to make it less likely in the first place. For the step-by-step dispute process, see our companion guide on what the UDRP is and how it works.

What Is Cybersquatting?

Cybersquatting is registering, trafficking in, or using a domain name that is identical or confusingly similar to someone else's trademark, with bad-faith intent to profit from that trademark. The squatter usually has no legitimate connection to the name and aims to:

• Sell the domain to the trademark owner (or a competitor) at an inflated price.
• Earn money from traffic intended for the brand, often through ads.
• Divert customers to a competitor or a counterfeit store.
• Use the name for phishing, fraud, or malware.
• Damage the brand's reputation.

The bad-faith element is what matters. Owning a domain that happens to match a word someone else has trademarked is not automatically cybersquatting. Registering apple-something to sell fruit is very different from registering it to sell fake phones.

Common Forms of Cybersquatting

Form	What it looks like	Typical goal
Exact-match squatting	The brand name in a TLD the owner did not register, such as .net or a new gTLD	Resale, ad revenue
Typosquatting	Misspellings like a dropped or swapped letter	Capturing mistyped traffic, phishing
Combo-squatting	Brand plus a word: brand-login, brandsupport, brand-sale	Phishing, counterfeit sales
Lookalike and homograph domains	Characters that look like the brand, including non-Latin letters	Phishing
Expired-name sniping	Registering a brand's domain the moment it lapses	Resale, exploiting existing traffic and email
Name-jacking	Domains matching a celebrity's or public figure's name	Ad revenue, impersonation
Anticipatory squatting	Registering names for products or mergers before they are announced	Resale

Typosquatting is common enough to deserve its own guide: what typosquatting is and how to protect your brand. Lookalike characters are covered in homograph attacks and lookalike domains.

Cybersquatting vs. Legitimate Domain Investing

Domain investors buy and sell names every day, and that is legal. The line falls at whether the domain targets a specific trademark:

Legitimate	Likely cybersquatting
Generic or dictionary words (bluewidgets.com)	A well-known brand name or a misspelling of it
Brandable invented names with no existing trademark	Names registered right after a brand or product launch
Names registered before a trademark existed	Names registered with clear knowledge of the brand
Parked with neutral or generic content	Parked with ads for the brand's competitors
Offered for sale publicly to anyone	Offered specifically to the brand owner at a price tied to their brand

Dispute panels look at the whole picture. Panels have often found bad faith where a domain matching a trademark showed pay-per-click links related to the brand's industry, which is one reason parking a trademark-adjacent domain is risky (see what domain parking is).

How to Investigate a Suspected Cybersquat

Before taking action, gather evidence. Start with the registration record:

whois brand-example.com | grep -iE "creation date|registrar:|registrar abuse|status|name server"

Or use RDAP for structured output:

curl -sL https://rdap.org/domain/brand-example.com \
  | jq '{events: .events, status: .status, nameservers: [.nameservers[]?.ldhName]}'

The registrant's identity is often redacted, but you will usually see:

• The creation date, which you can compare to your trademark registration and first use.
• The registrar and its abuse contact.
• The name servers, which may point to a parking service or hosting provider.

Read what WHOIS is for help interpreting records. Then document what the domain does:

• Take dated screenshots of the website, including any ads, products, or "for sale" messages.
• Save copies of any emails or offers from the registrant.
• Check whether the domain has MX records, which can indicate phishing email:

dig MX brand-example.com +short

• Check certificate transparency logs for related subdomains:

curl -s "https://crt.sh/?q=brand-example.com&output=json" | jq -r '.[].name_value' | sort -u

This evidence supports every option below, and having it ready makes lawyers and dispute providers more effective.

What You Can Do About It

There is no single right answer. The best path depends on how harmful the domain is, how strong your trademark is, and how much you are willing to spend.

Option 1: Do Nothing (and Monitor)

If the domain is inactive, harmless, and not confusing customers, monitoring it may be enough. Many squatted domains expire unrenewed. Set an alert so you can try to register it if it drops.

Option 2: Send a Cease-and-Desist Letter

A formal letter, ideally from a lawyer, stating your trademark rights and demanding transfer or cessation can resolve some cases quickly. Be careful: an aggressive letter to a legitimate owner of a generic name can backfire, and threatening litigation you will not pursue weakens your position.

Option 3: Buy It

Sometimes the cheapest solution is paying a reasonable price, especially when the squatter's price is below the cost of a dispute. If you do, consider using an anonymous broker so the seller does not inflate the price after seeing your company name, and always use escrow. Note that buying it can also reward the behavior, so many brands have a policy of not paying squatters.

Option 4: Report Abuse

If the domain is used for phishing, malware, or fraud, report it to:

• The registrar's abuse contact (from WHOIS/RDAP). ICANN-accredited registrars are required to maintain an abuse contact and investigate reports.
• The hosting provider (find it from the A record's IP address).
• Google Safe Browsing and other browser blocklists.

Abuse reports address harmful use, not trademark ownership. They can get a phishing site taken down within hours or days, but the domain may stay registered to the squatter.

Option 5: File a UDRP Complaint

The Uniform Domain-Name Dispute-Resolution Policy (UDRP) is ICANN's mandatory administrative process for gTLDs like .com, .net, and .org, and for many ccTLDs that have adopted it. Every registrant agrees to it in their registration agreement. To win, you generally need to show three things:

1. The domain is identical or confusingly similar to a trademark in which you have rights.
2. The registrant has no rights or legitimate interests in the domain.
3. The domain was registered and is being used in bad faith.

The remedy is transfer or cancellation of the domain, not money. Cases are decided on written submissions, typically within a couple of months, and cost far less than litigation. The full process, providers, and fees are covered in our UDRP guide linked above.

Option 6: Use the URS for New gTLDs

The Uniform Rapid Suspension System (URS) applies to new gTLDs such as .shop, .app, or .online. It requires a higher standard of proof ("clear and convincing evidence") but is faster and cheaper than the UDRP. The remedy is suspension of the domain for the rest of its registration period, not transfer, so the domain may become available again later.

Option 7: Go to Court

In the United States, the Anticybersquatting Consumer Protection Act (ACPA) lets trademark owners sue cybersquatters. Unlike the UDRP, it can award money damages, including statutory damages of up to 100,000 US dollars per domain name, in addition to transfer. Courts can also act in rem against the domain itself when the registrant cannot be found. Other countries rely on general trademark, passing-off, or unfair competition law. Litigation is expensive and slow, so it is usually reserved for serious or repeat offenders.

ccTLD Dispute Policies

Many country-code TLDs have their own procedures. For example, .uk uses Nominet's Dispute Resolution Service, and other registries run similar systems. Check the specific registry's policy before choosing a route.

Comparison

Remedy	Speed	Relative cost	Outcome
Abuse report	Hours to days	Free	Content or domain suspended for abuse
Cease and desist	Days to weeks	Low	Voluntary transfer, if the registrant agrees
Negotiated purchase	Days to weeks	Varies	Transfer for a price
URS	Weeks	Low	Suspension
UDRP	About 2 months	Moderate	Transfer or cancellation
Lawsuit (e.g. ACPA)	Months to years	High	Transfer plus possible damages

Watch Out for Reverse Domain Name Hijacking

Trademark owners can overreach too. Reverse domain name hijacking (RDNH) is a finding that a complainant used the UDRP in bad faith to try to take a domain from a legitimate owner, for example a generic name registered long before the trademark existed. Panels can declare RDNH, which is public and embarrassing. Make sure your claim is genuinely strong before filing.

How to Prevent Cybersquatting

Register Key Domains Early

Register your brand name in .com, your country-code TLD, and any extensions that matter in your market before you announce a product. You do not need every TLD; focus on the ones customers would plausibly type. Our guide on whether to buy multiple domain extensions helps prioritize.

Register Your Trademark

Every remedy above depends on trademark rights. A registered trademark makes disputes much simpler. Unregistered (common-law) rights can work in some cases but require more evidence.

Use the Trademark Clearinghouse

The Trademark Clearinghouse (TMCH) is a central database of verified trademarks used for new gTLD launches. Recording your mark gives you access to sunrise periods (early registration before the public) and claims notices that warn anyone trying to register a matching name, and notify you if they proceed anyway. Some registries also offer paid blocking services that prevent registration of your mark across many of their TLDs.

Monitor Continuously

Set up monitoring so you hear about new registrations quickly. Commercial brand protection services do this at scale, but you can build a simple monitor. This Python script checks a list of domains against RDAP and prints any that are registered:

import time
import urllib.error
import urllib.request

BRAND = "examplebrand"
TLDS = ["com", "net", "org", "co", "io", "shop", "store", "online", "app"]

def is_registered(domain):
    try:
        with urllib.request.urlopen(f"https://rdap.org/domain/{domain}", timeout=20):
            return True
    except urllib.error.HTTPError as e:
        if e.code == 404:
            return False
        return None  # unknown: rate limited or registry not supported
    except urllib.error.URLError:
        return None

for tld in TLDS:
    domain = f"{BRAND}.{tld}"
    status = is_registered(domain)
    label = {True: "REGISTERED", False: "available", None: "unknown"}[status]
    print(f"{domain:30} {label}")
    time.sleep(1)  # be polite to RDAP servers

Run it on a schedule, store the results, and alert when a status changes. Pair it with a certificate transparency search for your brand keyword to catch combo-squats and subdomains used for phishing.

Keep Your Own Domains Renewed

A surprising number of cybersquatting cases start with a brand forgetting to renew its own domain. Enable auto-renew, keep billing details current, and lock important names.

Cybersquatting FAQ

Conclusion

Cybersquatting is the bad-faith registration or use of a domain that exploits someone else's trademark, whether through exact matches in other TLDs, misspellings, combo names, or lookalikes. It differs from legitimate domain investing in intent: targeting a specific brand to profit from its reputation. Trademark owners have a ladder of remedies, from abuse reports and negotiation, through the UDRP and URS, up to lawsuits with damages.

The cheapest remedy is prevention. Register your key domains before announcing anything, register your trademark, record it in the Trademark Clearinghouse, keep your own domains renewed, and monitor new registrations. When a squatter does appear, document everything first, then choose the remedy that fits the harm.

Here are some useful references for going deeper on cybersquatting:

1. ICANN: Uniform Domain-Name Dispute-Resolution Policy — the policy text every gTLD registrant agrees to.
2. WIPO: Domain Name Dispute Resolution — the leading UDRP provider's resources, filing guidance, and case search.
3. WIPO: WIPO Jurisprudential Overview 3.0 — consensus panel views on bad faith, legitimate interests, and RDNH.
4. Cornell Law School LII: 15 U.S. Code 1125 — the US statute containing the Anticybersquatting Consumer Protection Act provisions.
5. ICANN: Uniform Rapid Suspension System (URS) — the fast suspension process for new gTLDs.