Domain Names & Cybersquatting: A 2026 Guide

A domain name is one of the first things customers type and one of the easiest things for a bad actor to grab. Because the system that hands out domains and the system that grants trademarks are completely separate, a competitor, a reseller, or an outright scammer can register a web address that looks like your brand before you do. This guide explains, in plain English, how domain names and cybersquatting fit together, what your real options are, and where each remedy actually leads. It is the hub for a set of deeper cluster guides linked throughout.

What is cybersquatting?

Cybersquatting is registering, trafficking in, or using a domain name that is identical or confusingly similar to a trademark or a personal name, in bad faith, in order to profit from the goodwill someone else built. The U.S. cybersquatting statute, the Anticybersquatting Consumer Protection Act, was enacted in 1999 precisely to attack this behavior.

The “bad faith” part matters. Owning a domain that happens to match a common word, or registering a name you genuinely plan to use, is not cybersquatting. The problem arises when the registration is meant to exploit a brand: holding the domain hostage to resell it at a markup, parking it on pay-per-click ads, diverting customers, or impersonating the brand to phish. Common variations include grabbing a brand the moment it appears in the news, registering a brand across many extensions, and “typosquatting” — registering misspellings of a popular site to catch traffic from fat-fingered visitors.

For a fuller breakdown of how panels and courts decide whether conduct crosses the line, see What is cybersquatting?.

How are domain names and trademarks related?

They feel like the same thing to customers, but legally they are not. A domain name is a technical address you lease through a registrar on a first-come, first-served basis; nobody checks whether it conflicts with a brand before selling it to you. A trademark is a right in a word, phrase, or logo that identifies the source of goods or services, earned through use and strengthened by registration with an office like the U.S. Patent and Trademark Office.

Two consequences follow. First, registering a domain gives you no trademark rights by itself, and owning a trademark does not automatically reserve the matching domain. Second, when the two collide — someone else holds the domain that matches your mark — the dispute is resolved under trademark-based rules, not under “I registered it first.” That is why brand owners increasingly secure the domain and the trademark together; see Trademark vs. domain name for how the two systems interact and overlap.

The three remedies: UDRP vs. URS vs. ACPA

When a domain copies your brand, there are three principal paths. They are not interchangeable, because each delivers a different result.

UDRP (Uniform Domain-Name Dispute-Resolution Policy). This is an ICANN administrative process built into virtually every registration agreement. A trademark owner files a complaint with an approved provider (such as WIPO or the Forum), and a panel decides the case on the documents. The only remedies a UDRP panel can order are cancellation of the domain or transfer of it to the complainant — no money. To win, the complainant must show the domain is identical or confusingly similar to its mark, that the registrant has no legitimate interest in it, and that it was registered and is being used in bad faith. After a decision, the registrar generally waits ten business days before implementing it, giving the losing registrant a window to file a court case. The UDRP applies broadly, including to .com.

URS (Uniform Rapid Suspension). The URS is a streamlined, lower-cost mechanism aimed at the clearest, “open and shut” cases. It is typically faster — often resolved in around three weeks — and cheaper than the UDRP, but it carries a higher burden of proof (clear and convincing evidence). Its big limitation is the result: the URS only suspends the domain for the remainder of its registration period (with an option to extend by a year). It does not transfer the domain to you. When the registration eventually lapses, the name is available again, so some owners use the URS for speed and follow up with a UDRP or a purchase. The URS generally applies to the newer generic top-level domains (gTLDs) from ICANN’s 2012 expansion, not to legacy extensions like .com or .net.

ACPA (Anticybersquatting Consumer Protection Act, 15 U.S.C. 1125(d)). This is a U.S. federal lawsuit rather than an administrative case. It is slower and more expensive, but it offers the most. A court can order forfeiture, cancellation, or transfer of the domain, and — unlike the UDRP and URS — it can award money: actual damages and profits, or, at the plaintiff’s election, statutory damages ranging from $1,000 to $100,000 per domain name when bad faith is proven, plus possibly attorneys’ fees. The ACPA also offers an “in rem” action against the domain itself when the registrant cannot be located or is overseas, which can be valuable against anonymous squatters.

For a side-by-side comparison with cost ranges, timelines, and strategy, see UDRP vs. URS vs. ACPA.

How do I recover a domain name that copies my brand?

The process is roughly the same regardless of which remedy you choose. Start by confirming your trademark rights — a registration helps, but unregistered (common-law) rights built through use can also support a claim. Next, document the squatter’s conduct: screenshots of the site, any offer to sell the domain, evidence of confusion, and the registration record (WHOIS) data. That bad-faith evidence is the heart of every cybersquatting case.

Then match the remedy to your goal. Want to own the domain and stop the problem permanently? The UDRP (or an ACPA suit) can transfer it to you. Need a troublesome new-gTLD site taken down fast and cheaply? The URS can suspend it quickly. Want compensation, or facing an anonymous foreign registrant? The ACPA’s damages and in rem options may fit. Sometimes the cheapest fix is simply buying the domain — though paying a squatter can invite more of the same.

A walk-through of evidence-gathering, provider selection, and what to expect at each stage is in How to recover a domain name.

Can you trademark a generic.com domain?

A common question is whether you can own a brand right in something like “yourcategory.com.” The leading authority is USPTO v. Booking.com (2020), where the Supreme Court rejected a flat rule that a generic word plus “.com” is automatically generic and therefore unregistrable. Instead, the Court held that a “generic.com” term is generic only if it has that meaning to consumers. Because only one entity can hold a given domain, consumers may perceive a “generic.com” term as identifying a single source — a brand — rather than a whole category.

In practice, that means a term like Booking.com can be registered as a trademark if marketplace and survey evidence shows consumers treat it as a brand, while a term that buyers still read only as a category name plus “.com” generally cannot. Even when registrable, such marks are often narrow and require strong proof of consumer recognition. The mechanics, evidence, and limits are covered in Can you trademark a generic.com domain?.

How do I protect against typosquatting and defensive domains?

The cheapest dispute is the one you never have. Two practices do most of the work. Defensive registration means securing the domains a squatter would most want before they can — your exact brand across the key extensions (.com, .net, .org, and relevant country or industry gTLDs), plus the variations customers actually type. Anti-typosquatting focuses on the predictable misspellings, missing letters, swapped characters, and hyphenated forms of your name, which scammers register to siphon traffic or run phishing pages.

Layer on monitoring. Domain-watch services and registry tools (including ICANN’s Trademark Clearinghouse, which feeds notices for registered marks during new-gTLD launches) alert you when someone registers a name close to yours, so you can act early — often with a quick URS suspension or a UDRP transfer — before the damage spreads. A practical checklist of which variations to register and how to monitor them is in Typosquatting & defensive domains.

How does this connect to your broader brand protection?

Domain strategy is one piece of a larger trademark program. The stronger and better-documented your trademark rights, the easier every domain remedy becomes — panels and courts both start by asking what rights you actually own. If you have not yet secured federal registration, start with How to Trademark Your Business, and browse real disputes and outcomes in the trademark case archive to see how these principles play out.

The bottom line

A domain name and a trademark are separate rights, and the space between them is where cybersquatting lives. If someone grabs a web address that copies your brand, you have real options: the UDRP and URS handle it administratively (transfer/cancel, or fast suspension), while the ACPA adds a federal lawsuit with money damages. Pick the remedy that matches your goal, document bad faith early, and register defensively so disputes rarely start.

This guide is general legal education, not legal advice, and does not create an attorney-client relationship; for advice about your situation, consult an attorney licensed in your jurisdiction.