Is Domain Flipping Legal? Investing vs. Cybersquatting

01

Where investing ends and cybersquatting begins

Buying and selling domain names turns into cybersquatting, also called domain squatting, when you register, use or sell a name to target someone else's trademark. A trademark protects a name as the sign of one business's goods or services; it does not give that business every use of an ordinary word, although famous marks get wider protection. That is why domain investing can be a lawful business: you buy names for their meaning, length or sound, and sell them to whoever needs them. If you are new to the model, start with what domain flipping is.

The dispute system says so directly. WIPO's Overview 3.1, its published summary of UDRP panel views, states that "the practice as such of registering a domain name for subsequent resale (including for a profit) would not by itself support a claim" that the name was registered in bad faith to sell to a trademark owner.

Targeting means registering a name because of a mark, using it to trade on that mark, or offering it to the mark owner or a competitor. Panels look at evidence, not labels. The overview lists the signals they weigh, including the distinctiveness of the mark, your likely knowledge of it, a pattern of abusive registrations, content that targets the mark, and the lack of a credible, evidence-backed reason for the registration. Calling a name "brandable" is not a defense on its own: in a 2025 case (WIPO Case No. D2025-3938), the panel asked the respondent to show that the name, taken as a whole, had a meaning independent of the complainant's mark.

Timing matters too. If you acquired a name before the complainant's trademark rights existed, panels will not normally find bad faith. But the date that counts is the date you acquired it, not the date it was first registered, so an aged name bought after the brand appeared gets no head start.

02

Safe and risky names: examples

In this table, "BrandName" stands for any distinctive or famous trademark.

The same ordinary word appears as low and high risk; the difference is use. WIPO's overview says pay-per-click links that compete with or trade on a complainant's mark do not support a legitimate interest, and that you cannot disclaim responsibility because a registrar or platform generated them automatically. Links tied to the dictionary meaning are acceptable, and blocking brand keywords counts in your favor. See PPC parking.

03

How the UDRP works

The UDRP, ICANN's Uniform Domain Name Dispute Resolution Policy, is part of the registration agreement for every name in a generic TLD such as .com, and some country-code registries use it too, including .ai.

The three elements

A complainant must prove all three:

1. Confusing similarity. Your domain is identical or confusingly similar to a trademark in which the complainant has rights. Panels normally ignore the extension in this comparison, but may read the whole name when the extension completes the mark.
2. No rights or legitimate interests. You can show a legitimate interest through use, or demonstrable preparations to use the name, for a bona fide offering before notice of the dispute; by being commonly known by the name; or by legitimate noncommercial or fair use. For investors, a dictionary term can count when your use, or intended use, matches its dictionary meaning and does not trade on someone's mark.
3. Bad-faith registration and use. The policy's examples: acquiring the name mainly to sell it to the mark owner or a competitor for more than your out-of-pocket costs, blocking the owner as part of a pattern, disrupting a competitor, or attracting users for commercial gain by creating confusion with the mark.

The only remedies are transfer of the name to the complainant or its cancellation. Panels cannot award damages.

How a case runs

1. The complainant files with one of the five providers ICANN approves (WIPO, the Forum, the Czech Arbitration Court, ADNDRC and CIIDRC) and pays the fee, which at WIPO is $1,500 for one to five names before a single panelist.
2. Within two business days, the registrar confirms a lock that blocks changes of registrant and registrar. The name keeps resolving and can still be renewed.
3. You have 20 days from the start of the proceeding to respond, plus four calendar days if you ask. If you stay silent, the panel decides on the complaint alone.
4. One or three panelists are appointed. If the complainant chose one and you want three, you pay half of the three-member fee.
5. The panel normally decides within 14 days of appointment. WIPO says a case without procedural issues should finish within two months of filing.
6. If you lose, the registrar waits 10 business days before acting. A lawsuit against the complainant, filed within that window in the agreed court jurisdiction, puts the decision on hold.

04

The ACPA: US law with damages

The ACPA (Anticybersquatting Consumer Protection Act) added cybersquatting to US trademark law in November 1999, at 15 U.S.C. § 1125(d). In plain terms, a mark owner can sue you if you have a bad-faith intent to profit from its mark and you register, traffic in or use a domain that is identical or confusingly similar to a mark that was distinctive when the name was registered, or that dilutes a mark that was then famous. "Traffics in" covers sales, purchases, licenses and other transfers for value, so buying a cybersquatted name does not clean it.

Courts weigh nine non-exclusive factors, among them your own rights in the name, prior good-faith use, intent to divert the mark owner's customers, offers to sell without having used the name, false contact details, and holding multiple names that match others' marks. Bad faith is not found if you believed, with reasonable grounds, that your use was fair or otherwise lawful.

The stakes exceed a UDRP. A court can order the name forfeited, cancelled or transferred, and the mark owner can elect statutory damages of $1,000 to $100,000 per domain name instead of actual damages, under 15 U.S.C. § 1117(d). In exceptional cases the court can award attorney fees to the winner. If the owner cannot find you or sue you in a US court, it can bring an in rem case against the domain itself where the registrar or registry is located. Outside the US, claims usually run through national trademark, passing-off or unfair-competition law, and many country-code registries run their own dispute policies, some modeled on the UDRP.

05

URS and typosquatting

The URS (Uniform Rapid Suspension) is, in ICANN's words, "a lower-cost, faster path to relief for rights holders experiencing the most clear-cut cases of infringement." It applies to names under an ICANN gTLD registry agreement, including all new gTLDs approved after 2012. The complainant must meet a clear-and-convincing evidence standard, you get 14 calendar days to respond, and, according to ICANN, a decision typically takes under three weeks. The only remedy is suspension for the rest of the registration period, which the complainant can extend by one year; after that, anyone can register the name again.

Typosquatting is cybersquatting in its plainest form. WIPO's overview treats common, obvious or intentional misspellings of a mark as confusingly similar, including adjacent keyboard letters, look-alike characters, swapped letters and added terms, and panels normally read the misspelling itself as intent to confuse. A typo of a brand has no ordinary meaning to fall back on. Filter typos out of drop lists and AI-generated name lists before you bid or register; see expired domains and drop catching.

06

Reverse domain name hijacking: what it means for investors

Reverse domain name hijacking (RDNH) is defined in the UDRP Rules as "using the Policy in bad faith to attempt to deprive a registered domain-name holder of a domain name." A panel that finds it declares the complaint an abuse of the proceeding. Reasons in WIPO's overview include a complainant who knew it could not win, for example because the name was registered well before its trademark rights; a complaint filed after an unsuccessful attempt to buy the name with no plausible legal basis; and false or intentionally incomplete evidence. Losing is not enough on its own.

Under the UDRP, an RDNH finding is a public record, not a fine. Courts can go further. In the US, a registrant whose name was suspended, disabled or transferred under a policy such as the UDRP can sue to establish that its registration or use is lawful and ask for the name back, and anyone whose knowing, material misrepresentation caused that action is liable for damages, costs and attorney fees (15 U.S.C. § 1114(2)(D)). The practical lesson for investors is documentation: a dated record of when and why you bought each name lets a panel see a weak complaint for what it is.

07

How to check trademarks before you buy

The UDRP puts this on you: "It is your responsibility to determine whether your domain name registration infringes or violates someone else's rights." A basic check takes minutes per name.

1. Search the USPTO's Trademark Search system for the exact term, plurals, spacing variants and close spellings, and note each live mark's goods and services.
2. Search WIPO's Global Brand Database, which covers international registrations under the Madrid System and marks from participating national and regional offices. WIPO advises also checking national registers.
3. Search the web, app stores and company registries. Unregistered marks can support a complaint too.
4. Run a Wayback Machine check: a name that hosted a business can carry that business's goodwill.
5. Check the timing. Panels have found bad faith where a name was registered just after a merger announcement, a product launch or a trademark filing, or by an insider.
6. Screen at scale. WIPO's overview says panels have held that investors making bulk purchases or automated registrations have an affirmative obligation to avoid trademark-abusive names, and that deliberately failing to screen against available databases can count as willful blindness. If an AI domain name generator or a script builds your lists, put the screening in the same pipeline.
7. Save a dated note of what you searched and why you bought the name.

08

If you get a cease-and-desist letter or a UDRP complaint

This section describes the general process; it is not legal advice. A cease-and-desist letter is a demand, not a court order. A UDRP complaint is a formal proceeding with a deadline.

1. Read the claim and the deadline. Identify the mark, its owner, its registration date and the goods or services it covers.
2. Gather evidence: purchase date and receipt, why you bought the name, any use or lander history, parking settings and your trademark searches.
3. Compare dates. If you acquired the name before the complainant's rights existed, prove it.
4. Choose a path: defend, negotiate a sale or transfer, or let the name go. Consult a qualified attorney before you act, especially if a US lawsuit is threatened. If you agree to sell, see how to sell a domain name.
5. For a UDRP, answer within the deadline with documents, not assertions, and decide whether to request three panelists.
6. Check every AI-drafted word. In a 2025 case (WIPO Case No. D2025-2916), a panel said a response that appears to be generated by an AI tool "is unlikely to inspire confidence" in its accuracy, unless the panel can see the prompts and is satisfied the text was reviewed for accuracy and truth.
7. Do not try to move the name. During a UDRP, and for 15 business days after it ends, the policy bars transfers to a new holder or registrar.

09

Dispute volumes, and why .ai stands out

WIPO handled a record 6,282 domain name disputes in 2025, up from 6,168 in 2024, according to Domain Name Wire; WIPO reports more than 80,000 cases over 25 years. The system is busier than ever, and investors should expect weak complaints as well as strong ones.

The .ai extension stands out. WIPO lists it among the top three country-code domains by case filings in 2025, and .ai disputes run under the UDRP, with WIPO handling them. In one 2025 case (WIPO Case No. DAI2025-0060), the panel said the .ai extension, which formed part of the complainant's trademark, tipped the balance toward targeting rather than a dictionary or brandable purchase. With .ai, the extension can finish a mark in a way .com cannot. More in .ai domain investing.

10