Cybersquatting
Registering a domain that matches somebody else's trademark in bad faith, usually to sell it back or profit from the brand's traffic, is cybersquatting, and the main remedy is a UDRP complaint, which transfers the domain in about two months without going to court.
The patterns
Straight brand registration. Someone registers yourbrand.com on an extension you do
not hold. The most clear-cut case, particularly where they then offer to sell it.
Typosquatting. A deliberate misspelling that catches mistyped traffic:
yourbarnd.com, yuorbrand.com, a missing letter, a doubled letter. Panels treat
deliberate misspellings of a distinctive mark as strong evidence of targeting. In
LinkedInD2015-1679 WIPO decision, 2015, swapping the second "i" in LinkedIn for an "l" was enough, and
linkedlnjobs.com was transferred.
Extension squatting. Your .com is safe but someone takes .net, .shop, .online
or a country-code version and runs a copy of your site. Virgin MediaD2016-2140 WIPO decision, 2016 transferred
virginmedia.shop in 2016, and the panel held it made no difference that Virgin had not
registered during the .shop sunrise period. More recently, Fat FaceD2024-0481 WIPO decision, 2024
transferred fatface-uk.shop, which had redirected to a store selling competing clothing.
The panel ignored the .shop ending when comparing the domain with the mark.
Parked pages. The domain shows an automatically generated page of pay-per-click ads, often for your competitors. It counts even where a parking service generated the ads without the registrant choosing them. In PyCharmD2025-2121 WIPO decision, 2025, pycharm.com, parked with pay-per-click links, was transferred to JetBrains: the respondent's only evidence of holding it since 2013 was a Word document created on the day it filed its reply. It fails where the domain has another genuine meaning: in MarlboroD2015-1128 WIPO decision, 2015, marlboro.party stayed with a registrant that held hundreds of town names, because several places are called Marlboro.
Resale demands. The registrant contacts you, or lists the domain at a price far above registration cost. Keep the correspondence. It is often the best evidence in the case.
Phishing and impersonation. The domain sends mail that appears to come from you, or hosts a copy of your login page. This is the most damaging pattern and the most urgent. A website is not needed: AccentureD2016-0367 WIPO decision, 2016 transferred accenturejobs.com, which had no site at all, because it was used for a fake recruiting email address. Lookalike domains used to send fake emails sets out what to do in the first 24 hours.
What is the difference between typosquatting and cybersquatting?
Typosquatting is one kind of cybersquatting: the domain is a misspelling of the trademark instead of an exact copy. Both are recovered under the same UDRP complaint, and section 1.9 of the WIPO Overview 3.1 treats a "common, obvious, or intentional misspelling" as confusingly similar to the trademark.
| Cybersquatting | Typosquatting | |
|---|---|---|
| The domain | Your exact trademark, or your trademark plus a word, on any extension | A misspelling of your trademark |
| Example | virginmedia.shop, transferred in Virgin MediaD2016-2140 WIPO decision, 2016 | linkedlnjobs.com, transferred in LinkedInD2015-1679 WIPO decision, 2015 |
| What it is usually for | Resale to you, ad revenue, or a copy of your site | Traffic from people who mistype, and fake emails that pass a quick glance |
| How bad faith is shown | The registrant's conduct: resale demands, ads for your competitors, impersonation | The misspelling itself. Section 1.9 says panels will normally find it "signals an intention" to confuse users |
Section 1.9 lists the misspellings panels see most: adjacent keyboard letters, lookalike characters such as a number used for a letter, letters that look alike in some fonts, accented or non-Latin characters, swapped letters, and added words or numbers.
A registrant who does it at scale loses on the pattern alone. In BritannicaD2000-0330 WIPO decision, 2000, the panel transferred four misspellings of Britannica, including brtannica.com and britannca.com, from a registrant already under a court order for the same conduct.
Where a misspelled domain sends emails pretending to be you, treat it as fraud first. Lookalike domains used to send fake emails covers the faster registrar abuse route that runs alongside the UDRP.
What to do first
Do not contact the registrant. It raises the price and their reply can be used against you.
Capture evidence instead: dated screenshots, Archive.org history, WHOIS records including the creation date, and any emails sent from the domain.
If the domain is being used for phishing or malware, report it to the registrar's abuse address and to the hosting provider in parallel. That route is measured in days rather than the two months a UDRP case takes.
When a UDRP complaint will work
You need a trademark, a registrant with no legitimate claim to the name, and bad faith at both registration and use. Classic squatting fits all three comfortably.
The case fails where the registrant has a genuine business under the name, or where the domain was registered before your trademark rights existed. Check the WHOIS creation date before you spend anything.
Preventing the next one
A trademark watch service tells you when someone files a mark similar to yours. For domains specifically, registering the obvious variants and extensions yourself costs a few hundred euros a year and removes most of the target.
Registering your trademark is what makes any of this enforceable. Without it you have no first element and no complaint.