How do you recover a domain name someone registered in bad faith?

A look-alike domain can carry your customers to parked ads, a competitor, or a scam, and the person holding it may hope you will simply pay. Our page on internet law and online brand enforcement explains how domain disputes fit with takedowns and impersonation. This page walks through the two legal tools for getting the domain back: ICANN's Uniform Domain Name Dispute Resolution Policy (UDRP) and the federal anticybersquatting statute.

How a UDRP case runs, step by step

1. Choose a provider and file. You pick one of the ICANN-approved providers and file your complaint with it (UDRP Policy, paragraph 4(d)). One complaint may cover several domain names if the same holder registered them (UDRP Rules, paragraph 3(c)). You pay the provider's fees, unless the holder asks for a three-member panel, in which case fees are split (Policy 4(g)).
2. The domain is locked. The provider asks the registrar to verify the registration data and lock the domain. The registrar has two business days to confirm the lock, and it may not tell the holder about the case until the lock is in place (Rules 4(b)).
3. The holder gets notice. If the complaint passes the provider's compliance check, the provider sends it to the holder within three calendar days after receiving your fee. A deficient complaint can be fixed within five calendar days or it is treated as withdrawn (Rules 4(c) and 4(d)).
4. The holder has 20 days to respond. The response is due 20 days after the proceeding formally begins, and the holder can get an automatic extra four calendar days just by asking (Rules 5(a) and 5(b)). If no response arrives, the panel decides on your complaint anyway (Rules 14(a)).
5. A panel is appointed and decides. A single panelist is appointed within five calendar days after the response or the missed deadline, and the decision is due within 14 days of appointment, absent exceptional circumstances (Rules 6(b) and 15(b)).
6. The registrar waits ten business days. The provider sends the decision to the parties and the registrar within three business days (Rules 16(a)). The registrar then waits ten business days before transferring or canceling, and holds off if the holder files a lawsuit against you in the right court during that window (Policy 4(k)).

WIPO, one of the approved providers, says a case without procedural problems "normally should be completed within 2 months" from the date it receives the complaint (WIPO Guide to the UDRP).

Should you file a UDRP complaint or sue in federal court?

The UDRP is built for one job: moving or deleting a domain. Paragraph 4(i) limits the remedies to "the cancellation of your domain name or the transfer of your domain name registration to the complainant." The Anticybersquatting Consumer Protection Act, codified at 15 U.S.C. 1125(d), does more but asks more. You must show a "bad faith intent to profit" from your mark, and the case follows a federal court schedule like the one our page on an IP lawsuit in Atlanta federal court describes.

WIPO describes the UDRP as faster and more cost effective than litigation, decided on a single round of written pleadings. A lawsuit makes more sense when the domain is part of a larger scheme, such as a cloned store selling fakes, which our page on stopping counterfeit sellers online covers, or when you want money and a court order that reaches the person behind the domain.

What counts as bad faith under each route?

The UDRP lists four situations that show registration and use in bad faith (Policy 4(b)): buying the domain mainly to sell it to the mark owner or a competitor for more than documented out-of-pocket costs; registering it to block you, as part of a pattern of doing so; registering it mainly to disrupt a competitor; and using it to attract people for commercial gain by creating confusion about source, sponsorship, affiliation or endorsement.

The federal statute gives courts nine factors instead (1125(d)(1)(B)(i)). Some favor the holder: their own trademark rights in the name, their legal name, prior good-faith business use, and noncommercial or fair use. Others point toward bad faith: intent to divert your customers, offers to sell without ever using the domain, false contact information, and collecting many domains that match other people's marks. Bad faith cannot be found where the holder believed, with reasonable grounds, that the use was fair or otherwise lawful (1125(d)(1)(B)(ii)).

False registration details matter twice. They are one of the nine factors, and knowingly giving a registrar materially false contact information creates a rebuttable presumption that the violation was willful (15 U.S.C. 1117(e)). If the same person also copied your site's photos or text, our page on what a DMCA takedown notice must include explains the separate copyright route.

What if the holder has a legitimate reason to own it?

Not every unwelcome registration is cybersquatting. Under Policy 4(c), a holder can show legitimate interests by proving a good-faith business use that began before notice of the dispute, that it is commonly known by the domain name, or that it is making a legitimate noncommercial or fair use without intent to mislead consumers for profit. A business with the same name in a different field may have every right to the domain.

Filing anyway carries a risk. If the panel finds the complaint was brought in bad faith, for example to take a domain from its rightful holder, it must say so in its decision as "Reverse Domain Name Hijacking," and that part of the decision is published (Rules 15(e) and 16(b)). Testing your claim against the holder's likely answer before filing protects both your money and your reputation.

What changes the answer

• When your rights began. Policy 4(a)(iii) requires that the domain "has been registered and is being used in bad faith," and the federal statute looks at whether your mark was distinctive when the domain was registered (1125(d)(1)(A)(ii)). A domain registered before your brand existed is hard to fit into either.
• Registered or unregistered mark. The UDRP requires a mark "in which the complainant has rights," and a registration is the simplest proof. The in rem action is limited to marks registered with the USPTO or protected under 1125(a) or (c) (1125(d)(2)(A)(i)). Our page comparing common law, Georgia and federal trademark protection explains what each level gives you.
• Personal names. The federal claim covers "a personal name which is protected as a mark." A separate statute, 15 U.S.C. 8131, reaches someone who registers a living person's name without consent with the specific intent to sell it for profit.
• Who used the domain. Liability for using a domain applies only to the registrant or its authorized licensee (1125(d)(1)(D)).
• The domain ending. All ICANN-accredited registrars have adopted the UDRP, along with some country-code domains (the policy names .nu, .tv and .ws). Other country codes may have their own dispute policies.
• Unknown holders. If the court cannot get personal jurisdiction over the registrant, or you cannot find them after sending notice and publishing as the court directs, the in rem action lets you proceed against the domain itself, with remedies limited to forfeiture, cancellation or transfer (1125(d)(2)).

A worked example

Common mistakes

• Negotiating before saving the record. An offer to sell for more than out-of-pocket costs is evidence under Policy 4(b)(i). Screenshot it, with dates, before anything is deleted.
• Expecting money from a UDRP panel. The remedies stop at transfer or cancellation (Policy 4(i)). If recovering losses matters, plan for the federal statute from the start.
• Filing against a legitimate holder. A same-name business in another field, or a real critic, may defeat the complaint and earn you a Reverse Domain Name Hijacking finding.
• Ignoring the ten-day window. After a win, the holder can stop the transfer by filing suit in the mutual jurisdiction within ten business days (Policy 4(k)). Watch the registrar's implementation date.
• Leaving trademark filings unchecked. Squatters sometimes file trademark applications too. Our page on what to do when someone files a trademark for your brand covers the USPTO side.

What to do this week

1. Capture the domain's pages, ads, redirects and any sale offers, with the full URL and date visible.
2. Look up the registrar and the public registration data, and note whether a privacy service is listed.
3. Gather your registration certificate or your earliest proof of use, and confirm the dates your rights began.
4. Decide whether you need only the domain back or also money and an injunction, which points to UDRP or the federal statute.
5. Hold off on public accusations; a measured cease and desist letter can come later and should match the route you choose.
6. Check whether the same person runs fake social accounts in your name, which our page on business impersonation online addresses.

Frequently asked questions

Can a UDRP panel award money or legal fees?

No. WIPO's guide says the panel "cannot award money judgments, nor lawyers' costs," which matches Policy 4(i). Money requires a court case.

Can the losing holder challenge a UDRP decision?

Yes. Either side may go to court before or after the proceeding (Policy 4(k)). If the holder files suit in the mutual jurisdiction within ten business days of the registrar learning of the decision, the transfer waits until the case is resolved, dismissed or withdrawn.

What if the domain hides behind a privacy service?

The provider's verification request asks the registrar for the registration information, and any update revealing the underlying customer must be made within the registrar's two-business-day window, or sooner if the registrar confirms the lock first (Rules 4(b)). In court, the in rem action is designed for holders who cannot be found or reached.

Can one complaint cover several look-alike domains?

Yes, if the same holder registered them (Rules 3(c)). At WIPO, six to ten domains with one panelist cost USD 2,000, and larger cases are priced in consultation with the Center.

What if the domain uses my own name rather than a brand?

A personal name works under 1125(d) when it functions as a mark. Otherwise 15 U.S.C. 8131 reaches registration of a living person's name with intent to sell it, and our page on trademark protection for content creators explains turning a name into a mark.

Is it ever smarter to just buy the domain?

Sometimes a modest price costs less than any filing. Save the record first, because a purchase does not stop the same person from registering the next variation.

Do the same rules apply to domains registered abroad?

The UDRP applies by contract wherever the registrar has adopted it, so the holder's country does not matter for the policy itself. Protecting the brand in other markets is a separate step, covered on our page about protecting a U.S. trademark in other countries.

Zala IP Law advises brands and creators on domain disputes, impersonation and other online infringement, and Shreepal J. Zala practices federal intellectual property law nationally. If someone is holding a domain that matches your brand, request a consultation or call 404-313-1701 before you respond to an offer to sell.