Cybersquatting is registering, trafficking in, or using a domain name that matches or closely imitates someone else's trademark, in bad faith, to profit from that brand. Squatters typically try to sell the domain back to the owner, divert its traffic to ads or competitors, or use it for phishing. You can usually recover the domain through a UDRP complaint, a court action, or a negotiated purchase. The right route depends on your trademark rights and on what the squatter is doing with the name.
How Cybersquatting Works
Domain names are registered first-come, first-served, and registrars don't check whether a name infringes a trademark. Anyone can register a domain that matches your brand for the price of a registration fee. That low cost is why cybersquatting persists.
Once a squatter holds the name, they make money from it in a few predictable ways:
- Ransom resale: offering the domain to the brand owner at a price far above registration cost.
- Parking and ad revenue: pointing the domain at a pay-per-click page that earns money from visitors looking for the real brand.
- Traffic diversion: redirecting visitors to a competitor, an affiliate offer, or a counterfeit store.
- Phishing and fraud: hosting a fake login page, or setting up email on the domain to impersonate your staff in invoice or payroll scams.
The last one causes the most direct harm. If a lookalike domain has MX records configured, it can send and receive email, so an attacker can write to your customers or vendors from an address that looks almost exactly like yours.
Common Types of Cybersquatting
Cybersquatting covers several techniques. Knowing them helps you see how many variants of your name are exposed.
- Exact-match squatting: registering your brand on a top-level domain you don't own, such as your name on .net or .org when you hold only .com.
- Typosquatting: registering common misspellings, such as swapped, missing, or doubled letters, to catch mistyped URLs.
- Homoglyph and IDN attacks: using characters that look identical, such as a Cyrillic "а" in place of a Latin "a", or "rn" in place of "m". Internationalized domain names make these visually indistinguishable in some contexts.
- Combosquatting: adding a word to your brand, such as "login," "support," "secure," or "billing." These read as legitimate and are common in phishing.
- Expired-domain sniping: grabbing a domain the moment a company lets it lapse, then capturing its residual traffic, backlinks, and sometimes email meant for the old owner.
- Name-jacking: registering the personal name of a founder, executive, or public figure.
How to Tell Whether a Domain Is Cybersquatting
Not every similar domain is bad faith. A business with a legitimately similar name, a fan site, or a genuine critic may have a right to its domain. These signs point toward cybersquatting:
- The domain was registered after your brand became known, with no connection to the registrant's own name or business.
- It shows a parked page, a "for sale" notice, or ads related to your industry.
- The registrant has contacted you, or a broker has, offering to sell it.
- It has MX records set up even though no visible business runs on it.
- A TLS certificate has been issued for it, which suggests someone is preparing a live, convincing site.
- It redirects to a competitor, a counterfeit shop, or a login page that imitates yours.
- The registrant uses a privacy service and holds many other domains that match well-known brands, which is a pattern dispute panels treat as bad faith.
How to Get a Domain Back
Before you act, collect evidence: screenshots of the site, any sale offers, the registration date, and proof of when your trademark rights began. Then choose the route that fits your situation.
File a UDRP complaint
The Uniform Domain-Name Dispute-Resolution Policy (UDRP) applies to all generic top-level domains, such as .com, .net, and .org, and to many country-code domains. It is an administrative process, not a lawsuit. It is usually faster and cheaper than going to court. To win, you must show all three of the following:
- The domain is identical or confusingly similar to a trademark in which you have rights.
- The registrant has no rights or legitimate interests in the domain.
- The domain was registered and is being used in bad faith.
If you win, the panel can order the domain transferred to you or cancelled. A UDRP panel cannot award money damages. Many country-code registries run their own dispute policies built on similar principles.
Use URS for clear-cut cases
For many newer generic TLDs, the Uniform Rapid Suspension (URS) system offers a faster, lower-cost option when the abuse is obvious. The trade-off is that URS only suspends the domain. It does not transfer it to you.
Go to court
In the United States, the Anticybersquatting Consumer Protection Act (ACPA) lets trademark owners sue. Unlike UDRP, a court can award damages as well as order a transfer. This route costs more and takes longer. It makes sense when the harm is serious or when you want financial compensation.
Negotiate or buy it
When the domain is cheap and the squatter will sell, buying it can be faster than any dispute. Use an intermediary so the seller doesn't know a well-funded brand is asking, and use escrow so payment and transfer happen together. Keep a record of any inflated demand they make, because it can count as evidence of bad faith if negotiations fail.
Request a takedown for active abuse
If the domain is hosting phishing or malware, report it to the registrar's and hosting provider's abuse contacts. Abuse teams often act on live fraud much faster than a dispute process concludes.
How to Prevent Cybersquatting
- Register your trademark. Every recovery route above depends on enforceable trademark rights.
- Register key variants defensively. Cover your main TLDs, obvious misspellings, and the combosquat terms an attacker would pick first, such as your brand plus "login" or "support."
- Never let important domains lapse. Turn on auto-renew and registrar lock for every domain you depend on.
- Monitor continuously. New lookalikes get registered all the time. Catching one before it has MX records or a TLS certificate gives you time to act before it is used against you.
Next Step: See Which Lookalikes Already Exist
Run a free brand scan at dokyma.com. Dokyma generates the typosquat, homoglyph, TLD-swap, and combosquat variants of your domain. It then checks which ones are registered, reviews their DNS and WHOIS data, flags any with mail servers configured, and watches certificate transparency logs for newly issued certificates. You'll have a prioritized list of suspect domains and the evidence you need to file a UDRP complaint, request a takedown, or open a negotiation.