Cybersquatting

01

Cybersquatting, explained

Two main remedies apply. The UDRP, an administrative procedure that covers all gTLDs and many ccTLDs, requires a trademark owner to prove three elements: the domain is identical or confusingly similar to its mark, the registrant has no rights or legitimate interests in it, and the name was registered and is being used in bad faith. A panel can order the name transferred or cancelled but cannot award money. In the United States, the Anticybersquatting Consumer Protection Act lets a court award statutory damages of $1,000 to $100,000 per domain name.

Buying domains to resell is not cybersquatting in itself. WIPO's panel guidance states that registering a name for later resale, including at a profit, does not by itself show bad faith, and that panels will not normally find bad faith where a name was registered before the complainant's trademark rights existed. Dictionary words are generally defensible when used for their ordinary meaning; the same word becomes a problem when it is parked with ads aimed at the brand that owns it.

In practice, the risk sits in a few habits: registering a brand, a misspelling of one or a brand plus a generic word; pointing names at ads in the brand's industry; and offering a name to the company whose mark it contains. Search trademark databases before you buy, consider how the name would look to a panel, and consult a qualified attorney if a complaint or cease-and-desist letter arrives. Disputes are not rare: WIPO handled a record 6,282 domain name disputes in 2025.

AI adds two risks. Name generators can produce names that echo existing brands, so screen their output against trademark databases. And registering a newly announced AI product or company name right after the announcement is the kind of registration panels treat as bad faith even before a trademark exists, because WIPO's guidance makes an exception for names registered in anticipation of a mark.

Go deeper Is Domain Flipping Legal? Investing vs. Cybersquatting