Checklist · Intellectual Property

Recovering a Domain Name Through the UDRP: A Practical Checklist

Type: Checklist
Jurisdiction: National
Date: 2024-11-16
Topic: Intellectual Property

The Uniform Domain-Name Dispute-Resolution Policy is the fastest, cheapest lawful route to pry a domain name out of a cybersquatter's hands, but it works only on clean cases and punishes overreach. This checklist takes a trademark owner and its counsel from triage through transfer: confirming the dispute actually fits the UDRP, capturing perishable evidence element by element, and proving all three cumulative requirements of Policy paragraph 4(a). It explains each element in depth, from the standing and side-by-side comparison of element one, through the burden-shifting prima facie case of element two, to the conjunctive registered-and-used-in-bad-faith standard and Telstra passive-holding analysis of element three. It walks the provider choice, panel election, Rule 3 drafting requirements, the registrar lock and mutual-jurisdiction statement, the response window, the ten-business-day court window, and the ACPA civil action that gives either side a de novo second look. WHY notes and traps flag reverse-domain-name-hijacking exposure and the cases better sent to federal court. Confirm current provider fees and rules before filing.

Recovering a Domain Name Through the UDRP: A Practical Checklist

Intellectual Property > Domain Name Disputes | Published 16 November 2024 - Updated 23 November 2024 | UpLaw - uplaw.us

A working checklist for recovering a domain name from a cybersquatter under ICANN's Uniform Domain-Name Dispute-Resolution Policy: how to confirm the case fits, capture evidence before it vanishes, prove all three cumulative elements, run the provider and panel choices, survive the mutual-jurisdiction and lock mechanics, and avoid a published finding of reverse domain name hijacking.

Keywords: UDRP, domain name recovery, cybersquatting, ICANN, WIPO, FORUM, identical or confusingly similar, rights or legitimate interests, bad faith registration and use, Telstra passive holding, WIPO Overview 3.0, mutual jurisdiction, registrar lock, reverse domain name hijacking, ACPA, URS, typosquatting, in rem jurisdiction

A cybersquatter is a peculiar kind of thief. He does not break anything, does not touch your servers, and often does not even build a website. He simply registers yourbrand.co before you get around to it, points it at a page of automated advertising links, and waits for you to notice. When you do, he is happy to sell it back for a five-figure sum. The Uniform Domain-Name Dispute-Resolution Policy exists to make that business model unprofitable.

The UDRP is a contractual arbitration regime, not a court. Every person who registers a domain in a generic top-level domain (a gTLD such as .com, .net, .org, or one of the newer strings like .io or .shop) agrees, in the registration agreement, to submit to it. That single contractual hook is why the UDRP can do something a lawsuit cannot: reach a squatter in another country, with no served summons, no personal-jurisdiction fight, and no discovery, and order the registrar to hand you the domain in roughly two months for a filing fee in the low thousands. For the architecture of the domain-name system that makes this possible, see Top-Level Domains and Trademark Rights: An Overview.

Speed and cheapness come at a price: the UDRP is a blunt instrument built for obvious cases. It gives you exactly one remedy, transfer or cancellation of the domain, and nothing else. No damages. No injunction against future squatting. No binding precedent. And it will bite the hand that overreaches: a complainant who files a meritless case to strong-arm a legitimate registrant can walk away with a published finding of reverse domain name hijacking stamped on the decision. The published win rate for complainants hovers near 85 percent, but that number reflects who chooses to file, not a rubber stamp. The panels reject the overreaching cases, and they do so in writing, under the complainant's name, forever searchable.

This checklist runs the whole route: triage, evidence capture, the three elements in depth, provider and panel selection, drafting, filing and the lock, the decision, and the court window that follows. Each phase carries WHY notes and traps. For a narrative companion that reads the doctrine as a story rather than a task list, see the field guide, Recovering a Domain From a Cybersquatter: A UDRP Complaint Field Guide. To situate the UDRP inside the wider enforcement program, see Defending a Brand on the Internet: A Strategic Enforcement Playbook and the Defending a Brand Across the Digital Ecosystem toolkit.

A running hypothetical will keep the doctrine concrete. Suppose Harborlight Coffee Roasters, a fictional specialty roaster, owns a federal registration for HARBORLIGHT for coffee and runs its business at harborlight.com. One morning a customer forwards a screenshot: harborlight-coffee.co shows a page of "sponsored listings" for competing coffee brands, and a small text box reads "This domain may be for sale." Harborlight wants it back. Everything below tells its counsel what to do, and where the case could go wrong.

The three elements at a glance

Before any task list, fix the target. To win a transfer, a complainant must prove all three of the following, and the conjunctions are not decoration:

The domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights. (Policy paragraph 4(a)(i).)
The registrant has no rights or legitimate interests in the domain name. (Policy paragraph 4(a)(ii).)
The domain name has been registered and is being used in bad faith. (Policy paragraph 4(a)(iii).)

Uniform Domain-Name Dispute-Resolution Policy (ICANN, adopted Aug. 26, 1999, in effect Jan. 1, 2000), paragraph 4(a). The elements are cumulative: fail any one and the complaint fails, no matter how strong the other two. Element three is itself conjunctive, requiring bad faith in both registration and use. That second conjunction is where the UDRP is narrower than the Anticybersquatting Consumer Protection Act, and it is where careless complainants lose winnable-looking cases. Hold that thought; it recurs throughout.

The standard of proof is the civil "balance of probabilities" (more likely than not), applied by a neutral panelist or three-member panel on a written record. There is no hearing, no cross-examination, and, in the ordinary case, no reply brief. The complaint and its annexes are the case. Panels are guided, though not strictly bound, by a remarkable body of self-generated jurisprudence: the WIPO Jurisprudential Overview of WIPO Panel Views on Selected UDRP Questions (3rd ed. 2017), universally cited as the "WIPO Overview 3.0," which distills consensus positions from hundreds of panelists across many thousands of decided cases. Treat it as the closest thing the UDRP has to a treatise and a citator combined.

Phase 1 — Triage: is the UDRP the right instrument?

Not every domain grievance belongs here. Spend an hour up front deciding whether the UDRP fits, or whether the ACPA, the lighter URS, a cease-and-desist letter, or a negotiated purchase is the better tool.

[ ] Confirm the string is covered. The disputed name must sit in a gTLD, or in a country-code TLD (ccTLD) whose registry has adopted the UDRP or a close analogue. Many ccTLDs run their own policies (.uk, .eu, .us, and others each have variants), so check the governing policy for the specific TLD before assuming the UDRP applies.
[ ] Confirm the remedy you want is the one the UDRP gives. Your only prizes are transfer of the domain to you or cancellation of the registration. If you need money, evidence through discovery, an order against a serial squatter's future conduct, or a precedent you can cite, the UDRP cannot deliver it.
[ ] Confirm the facts are clean cybersquatting. The UDRP is a sorting machine for the obvious: a squatter with no plausible connection to the term, sitting on your mark. Genuinely contested cases, two businesses with real competing claims to the same word, belong in court.
[ ] Run the timeline. Pull the domain's creation date and compare it to the date your trademark rights arose. If your rights postdate the registration, stop and reconsider; bad-faith registration is usually impossible, and filing anyway courts a hijacking finding (see Phase 5 and the reverse-hijacking section).
[ ] Screen for the generic-word trap. If the second-level string is an ordinary dictionary word, a common surname, or a term with obvious uses beyond your brand, ask whether you truly own it to the exclusion of the registrant. You may not.
[ ] Decide whether the URS is enough. The Uniform Rapid Suspension System is a stripped-down, cheaper cousin that only suspends a domain, it does not transfer it, on a "clear and convincing" showing. It is the right call when your goal is to kill an active phishing or fraud site fast, not to acquire the name. URS complaints are filed online, are far shorter, and cannot be amended.
[ ] Decide whether the ACPA is the better route for money, discovery, in rem jurisdiction, or a court order.

WHY / traps. The single most common way to lose a UDRP case is to file one where your mark did not exist when the domain was registered. If Harborlight had adopted its brand in 2022 but harborlight-coffee.co was registered in 2015, the squatter could not have targeted a mark that did not yet exist, and element three collapses. The mismatch is fatal and, worse, invites sanction. Before committing, confirm rights predate registration or that a recognized exception applies. For the parallel decision of which forum to use for a broader dispute, see Choosing a Dispute-Resolution Forum: Litigation, Arbitration, and Mediation Compared.

Phase 2 — Investigation and evidence capture, element by element

Evidence in domain cases is perishable. Parked pages rotate their advertising links automatically; a registrant who senses a complaint coming will "clean up" the site, drop the for-sale notice, or move the name to a different registrar overnight. Capture everything the day you open the file, dated, with the URL visible in the frame, and organize it by element so drafting is fast and complete later. For the evidentiary standards that make a screenshot stick, see Getting Website Evidence Admitted: A Practical Authentication Checklist and Authenticating Website Screenshots and Web Evidence in Federal Court; the UDRP is less formal than a federal courtroom, but the same instincts, contemporaneous capture, visible URLs and timestamps, archived copies, protect you if the case later moves to court.

[ ] Pull and preserve the current WHOIS record. Expect much of it to read "Redacted for Privacy." Since the EU General Data Protection Regulation took effect in 2018 and ICANN issued its Temporary Specification for gTLD Registration Data, registrars mask most registrant details behind privacy shields. Redaction only delays unmasking; you can still file, and the registrar will disclose the underlying registrant to the provider after filing (see Phase 8).
[ ] Screenshot the live resolving page, dated, with the full URL in view, before anything changes. Capture the sponsored-listing categories specifically, they matter to elements two and three.
[ ] Pull Wayback Machine archives (the Internet Archive at web.archive.org) showing how the name has been used, or not used, over time. A history of nothing but parking, or of rotating pay-per-click pages, is powerful.
[ ] Capture any offer to sell, ransom demand, "make an offer" widget, or correspondence. If you or a broker approach the registrant, do so carefully; an unsolicited high offer from you can later be waved around as evidence that you set the price, not the squatter.
[ ] Fix the domain's creation and expiration dates and lay them beside your rights timeline (first use in commerce, application filing date, registration date).
[ ] Search the registrant's name and email across prior UDRP decisions (WIPO and FORUM both publish searchable databases). A documented pattern of losing squatting cases is direct evidence under Policy paragraph 4(b)(ii).
[ ] Element-one file (rights): trademark registration certificate(s) and current status from the USPTO or the relevant registry; for unregistered marks, the secondary-meaning proof, sales figures, advertising spend, media coverage, and duration of use.
[ ] Element-two file (no legitimate interest): the WHOIS, page screenshots, and anything showing the registrant is not commonly known by the name, holds no corresponding mark, and was never licensed or authorized by you.
[ ] Element-three file (bad faith): dated captures of the pay-per-click or impersonation content, the sale offer, the prior-decision pattern, other trademark-matching domains in the registrant's portfolio, and any false or proxy WHOIS data.

WHY / traps. Organizing by element is not busywork. The complaint is your entire case; a well-built evidence set drops straight into the annex index and the element-by-element argument. If Harborlight's counsel captures the .co page today, with its coffee-competitor listings and for-sale box visible, that single dated screenshot supports the confusing-similarity comparison (element one), the absence of bona fide use (element two), and the commercial-gain-through-confusion theory (element three) all at once.

Phase 3 — Element one: identical or confusingly similar

Element one is a low but real threshold. It asks two things: (a) does the complainant have rights in a mark, and (b) is the domain identical or confusingly similar to it?

Rights. Any trademark or service mark rights suffice, registered or unregistered. A federal registration is the cleanest proof and carries a presumption of validity; for what that registration actually buys, see What Federal Trademark Registration Actually Buys You. But the UDRP also recognizes common-law marks proven through secondary meaning, which matters for unregistered brands and for complainants outside the United States. If Harborlight had never registered but had sold coffee under the name for a decade with real market recognition, it could still clear element one on secondary-meaning evidence. For the contours of unregistered rights, see Unregistered Trademark Rights at Common Law and The Geographic Reach of Common-Law Trademark Rights. Note a quirk that trips up newcomers: the UDRP is a global policy, so where in the world your rights sit is largely irrelevant to element one. A registration anywhere generally establishes rights for this threshold; territoriality does its real work later, in the bad-faith and legitimate-interest analysis.

The comparison. Panels perform a "side-by-side" comparison of the mark and the domain's second-level string, testing for aural, visual, and conceptual similarity. Two conventions structure the analysis, both reflected in the WIPO Overview 3.0:

The TLD is disregarded. Whether the string is .com, .co, .net, or .coffee is treated as a technical requirement of registration and generally ignored in the similarity comparison, unless the TLD itself carries trademark meaning. So harborlight-coffee.co is compared as "harborlight-coffee."
Added or altered terms rarely dispel confusion. Tacking a descriptive or geographic term onto a mark, adding "coffee," "shop," "official," "-usa," does not avoid confusing similarity; if anything, adding a term that describes the complainant's own goods sharpens it. Misspellings, character swaps, and homoglyphs, the practice known as typosquatting, are treated as confusingly similar almost by definition. Panels have long ordered transfers of deliberate misspellings; see, e.g., Hewlett-Packard Co. v. Zuccarini (FORUM/NAF, transferring hewlitpackard.com) and Bama Rags, Inc. v. Zuccarini (transferring common misspellings of DAVE MATTHEWS BAND). A near-miss like harbor1ight.com, substituting the numeral 1 for the letter l, is a textbook typosquat.

WHY / traps. Element one is a comparison of strings, not a full likelihood-of-confusion analysis. Do not import the multi-factor market inquiry courts use for infringement, that belongs to the ACPA and to court litigation, not to UDRP element one. Keep this section tight and let element three carry the weight. For the fuller confusion framework you will not need here but will need if the fight moves to court, see Likelihood of Confusion in Trademark Law: A Brand Owner's Guide.

[ ] Attach the registration certificate (or marshal secondary-meaning proof for a common-law mark).
[ ] State the mark, its registration number and date, and the goods/services.
[ ] Do the side-by-side comparison; note that the TLD is disregarded.
[ ] Explain why any added, dropped, or misspelled characters fail to dispel confusion.
[ ] Keep it short; over-arguing element one signals a weak element three.

Phase 4 — Element two: no rights or legitimate interests

Element two asks you to prove a negative, that the registrant has no legitimate reason to hold the name. Because the facts lie in the registrant's hands, panels use a burden-shifting device reflected in WIPO Overview 3.0 section 2.1: the complainant need only make out a prima facie case of no rights or legitimate interests, whereupon the burden of production shifts to the registrant to come forward with evidence of a legitimate interest. If the registrant defaults or offers nothing credible, the prima facie case carries the element.

Policy paragraph 4(c) gives the registrant three non-exhaustive ways to show a legitimate interest, and your prima facie case should pre-empt each:

4(c)(i) — bona fide offering. Before notice of the dispute, the registrant used (or demonstrably prepared to use) the name in connection with a bona fide offering of goods or services. Parking a name on pay-per-click links that trade on the complainant's mark is not bona fide; panels have said so consistently. A genuine, unrelated business under the name is another matter.
4(c)(ii) — commonly known by the name. The registrant (an individual, business, or organization) has itself been commonly known by the domain name, even without trademark rights. A person actually named Harper Borlight would have a real argument for harborlight.xyz; a shell registrant with no such history does not.
4(c)(iii) — legitimate noncommercial or fair use, without intent for commercial gain to misleadingly divert consumers or to tarnish the mark. This is the home of genuine criticism and commentary sites.

Two recurring fact patterns deserve their own note:

The reseller/distributor safe harbor. A reseller or authorized distributor can sometimes hold a domain reflecting the mark, but only under tight conditions: it must actually offer the trademarked goods, use the site to sell only those goods (not bait-and-switch to competitors), accurately disclose its relationship (or lack of one) with the trademark owner, and not corner the market in domains. That is the widely followed test of Oki Data Americas, Inc. v. ASD, Inc., WIPO Case No. D2001-0903, refined in later cases. A gray-market reseller who fails any prong loses the safe harbor.

Gripe sites and criticism. A registrant using trademarksucks.com for genuine, noncommercial criticism has a colorable fair-use defense; a registrant using the bare mark to divert traffic and sell ads does not. Panels split on the pure <mark>.com criticism site, and U.S. courts are more speech-protective than many panels, one reason a determined critic may prefer to litigate. Compare the ACPA gripe-site cases discussed below, Lamparello v. Falwell and Bosley Medical Institute, Inc. v. Kremer.

WHY / traps. State the prima facie case crisply, not commonly known by the name, holds no corresponding mark, never licensed or authorized, no bona fide or fair use, and support each assertion with an annex. Then pre-rebut the registrant's most likely story. If the parked page shows coffee-competitor ads, quote the categories; that single fact defeats the bona-fide-offering and fair-use arguments before the registrant can raise them.

[ ] Assert the prima facie case, point by point, against paragraph 4(c).
[ ] Attach the WHOIS and page captures that support each point.
[ ] Address the reseller safe harbor if the registrant could plausibly claim it.
[ ] Anticipate and neutralize the likely legitimate-interest defense.

Phase 5 — Element three: bad faith registration AND use

Element three is where cases are won and lost, and where the UDRP's defining limitation lives. Policy paragraph 4(a)(iii) requires that the domain "has been registered and is being used in bad faith." Both halves must be satisfied. A name registered in good faith but later misused generally does not violate the UDRP, even though the same facts might violate the ACPA, which reaches bad-faith use standing alone.

Paragraph 4(b) lists four non-exhaustive circumstances that, if proven, establish bad-faith registration and use:

4(b)(i) — the registrant acquired the name primarily to sell, rent, or transfer it to the complainant (or a competitor) for more than its out-of-pocket costs. The for-sale box on Harborlight's .co page, especially paired with an inflated asking price, points straight here.
4(b)(ii) — the registrant registered to prevent the mark owner from reflecting the mark in a domain, provided the registrant has engaged in a pattern of such conduct. This is where the prior-decision search from Phase 2 pays off.
4(b)(iii) — the registrant registered primarily to disrupt a competitor's business.
4(b)(iv) — the registrant used the name to attract, for commercial gain, internet users by creating a likelihood of confusion with the mark as to source, sponsorship, affiliation, or endorsement. Pay-per-click parking that trades on the mark is the paradigm case; panels routinely find 4(b)(iv) bad faith where a confusingly similar name resolves to sponsored listings, as in Spotify AB v. Rexford (FORUM) and Motul v. Ong Ho Anh Tung (WIPO).

These four are illustrative, not exclusive. Panels also find bad faith outside the enumerated list under the general standard of paragraph 4(a)(iii), for example, where the totality shows the registrant targeted the complainant.

Targeting and knowledge. The intuitive core of bad faith is that the registrant had the complainant's mark in mind. Panels infer this from the fame or distinctiveness of the mark, the timing (a registration days after a product launch or a merger announcement), the exactness of a typo, false WHOIS data, and the implausibility of any innocent explanation. A fanciful, famous mark is nearly impossible to have registered by coincidence; a short dictionary word is easy. This is why the generic-word trap is so dangerous for complainants: if the string is an ordinary word the registrant could have wanted for a hundred reasons, you cannot easily prove targeting.

Passive holding: the Telstra doctrine. What if the domain resolves to nothing, no website, no ads, no content? A literal reading of "is being used in bad faith" might seem to let an inert squatter escape. The landmark decision Telstra Corp. Ltd. v. Nuclear Marshmallows, WIPO Case No. D2000-0003, closed that loophole. The panel held that passive holding can itself constitute bad-faith use where the totality of circumstances shows no good-faith use is plausible, factors include the strength and fame of the mark, the absence of any conceivable legitimate use, the registrant's concealment of identity, and the provision of false contact details. WIPO Overview 3.0 section 3.3 collects the modern application. So if a fictional Vanterra Pharmaceuticals finds vanterra-pharma.com registered by an anonymous party and resolving to a blank page, Telstra supplies the theory: a distinctive pharmaceutical mark, a hidden registrant, and no imaginable good-faith use together prove bad-faith use despite the silence.

The registration-in-bad-faith knot. Because element three requires bad faith at registration, two edge cases recur. First, renewals and re-registrations: the consensus UDRP view assesses bad faith as of the original registration, so a name registered in good faith does not become UDRP-actionable merely because the holder later renews it or misuses it, one of the sharpest UDRP/ACPA divergences, since U.S. courts have treated re-registration as a fresh registration for ACPA purposes (GoPets Ltd. v. Hise, 657 F.3d 1024 (9th Cir. 2011); Jysk Bed'N Linen v. Dutta-Roy, 810 F.3d 767 (11th Cir. 2015)). Second, rights that postdate the domain: if the mark did not exist when the name was registered, the registrant could not have targeted it, and element three fails almost automatically. That is the fatal-mismatch scenario from Phase 1, and the classic setup for a reverse-hijacking finding.

WHY / traps. Do not blur "registered and used" into a single showing. Prove each half. And match effort to where the fight is: if the domain resolves to obvious infringing content, 4(b)(iv) is nearly self-proving and you should spend your energy on the registration half; if the domain is inert, build the full Telstra passive-holding case. Cite the WIPO Overview 3.0 consensus views throughout, panels expect it.

[ ] Lay out the chronology tying the registration to knowledge of the mark.
[ ] Reach the inference of targeting (fame, timing, exact typo, false WHOIS).
[ ] Prove bad-faith use under the applicable 4(b) circumstance.
[ ] If the name is inert, run the Telstra passive-holding analysis in full.
[ ] Confirm bad faith existed at registration, not merely later.

Phase 6 — Choose the provider, the panel, and read the rules

[ ] Select an accredited provider. The two dominant dispute-resolution service providers are the WIPO Arbitration and Mediation Center (the deepest and most cited jurisprudence, favored for complex, high-value, or international disputes) and FORUM (formerly the National Arbitration Forum, efficient and cost-effective for domestic squats). Other ICANN-accredited centers, including the Asian Domain Name Dispute Resolution Centre and the Czech Arbitration Court, are also available. The substantive Policy is identical across providers; the procedural supplemental rules are not.
[ ] Read the three layers of rules before drafting a word: the Policy itself (the substantive paragraph 4 standards), the Rules for UDRP (the procedure, current version effective July 31, 2015), and the provider's Supplemental Rules (formatting, word or page limits, fee schedules, filing mechanics). These differ by provider, WIPO and FORUM impose different length caps, and a complaint that violates them draws a deficiency notice.
[ ] Elect a single- or three-member panel. A single member is the default and cheaper. A three-member panel costs more (the complainant bears the full cost unless the respondent elects three, in which case the parties split it) but buys insulation against a single aberrational, "rogue," panelist, worth it in a serious, well-resourced, or precedent-sensitive case.
[ ] Confirm the current fee schedule with the chosen provider before you budget or file.

WHY / traps. The Policy is uniform, but a complaint that ignores a provider's page limit or filing format can be bounced on administrative-compliance grounds before a panelist ever reads the merits. Read the Supplemental Rules first, not last.

Phase 7 — Draft the complaint (Rule 3 contents)

The complaint is the entire case. Rule 3(b) of the Rules for UDRP specifies its required contents; omit one and the provider issues a deficiency notice. Build the document around this spine:

[ ] A request that the dispute be decided under the UDRP and Rules.
[ ] Complainant and representative contact information, and the preferred method for communications.
[ ] The panel election (single or three members; if three, nominate candidates per Rule 3(b)(iv)).
[ ] The respondent's information, matched to the WHOIS record (and updated after the registrar discloses the underlying registrant, see Phase 8).
[ ] The disputed domain name(s) and the registrar(s) with which they are registered.
[ ] The mark(s) on which the complaint is based and the goods/services they cover.
[ ] The factual and legal grounds, argued element by element against paragraph 4(a), citing WIPO Overview 3.0 consensus views and representative decisions. Useful models for the standard parked-page case include Nasdaq, Inc. v. Wang Chun Lei (FORUM) on the absence of legitimate interest and G.D. Searle & Co. v. Celebrex Drugstore (FORUM) on 4(b)(iv) commercial-gain bad faith.
[ ] The remedy sought (transfer or cancellation).
[ ] A statement of other legal proceedings commenced or terminated in connection with the domain.
[ ] The mutual-jurisdiction statement (below).
[ ] The certification (below).
[ ] The annexes, indexed, one exhibit per proof point.

The mutual-jurisdiction statement. Under Rule 3(b)(xiii), the complainant must submit, with respect to any court challenge to a decision cancelling or transferring the domain, to the jurisdiction of the courts in at least one specified mutual jurisdiction, defined as the location of either the registrar's principal office or the registrant's address as shown in the registrar's WHOIS at the time of filing. This is the hook that lets a losing registrant take the fight to a real court (Phase 9). Draft it deliberately, and be ready to amend it once the registrar reveals the registrant's true location.

The certification. The complainant certifies that the information is complete and accurate to the best of its knowledge, that the complaint is not being presented for any improper purpose "such as to harass," and that its assertions are warranted under the Rules and applicable law. This is not boilerplate. It is the textual hook for a reverse-domain-name-hijacking finding under Rule 15(e). Do not certify a complaint you would be embarrassed to defend.

WHY / traps. Because there is no discovery, no hearing, and ordinarily no reply, front-load everything. The conjunctions govern the architecture: paragraph 4(a) is cumulative and paragraph 4(a)(iii) is itself conjunctive, so the drafting must independently satisfy each element and each half of element three. And proportion your effort, do not spend three pages proving element one when element three decides the case.

Phase 8 — File, lock, serve, and the response window

The UDRP handles service and locking for you. Do not try to serve the registrant yourself.

[ ] File the complaint and annexes with the provider, not with the respondent. The provider serves the respondent and commences the proceeding.
[ ] Confirm the registrar lock. Within roughly two business days of the provider's notice, the registrar "locks" the domain, freezing transfers and registrar changes, before the registrant is formally notified. The lock exists to prevent cyberflight: a squatter's last-second transfer of the name to a new registrant or registrar to evade the proceeding.
[ ] Amend to name the real registrant once the registrar discloses the underlying WHOIS behind a privacy shield. Update the respondent details and, if necessary, the mutual-jurisdiction statement. Under the Rules, a deficiency-driven amendment is generally due within five calendar days of notice.
[ ] Calendar the response window. The registrant has twenty days from commencement to file a response addressing each allegation and asserting any basis to keep the name. Watch for a request for a short extension, which providers grant in exceptional cases or on the parties' stipulation.

WHY / traps. A registrant's default is not an automatic win. Even against silence, the panel must still find all three elements satisfied on the complaint and its record; a thin complaint can lose uncontested. GDPR redaction only delays the unmasking of the registrant until after filing, it never prevents recovery. If the registrant turns out to be based abroad and the case later escalates to litigation, service and remedies get much harder; see Service and Ex Parte Remedies Against Chinese Defendants in IP Litigation for what the ACPA route looks like against an offshore registrant.

Phase 9 — The decision, the ten-day window, and the appeal to court

[ ] Read the decision. A transfer order directs the registrar to move the name to the complainant.
[ ] Note the ten-business-day window. The registrar does not implement a transfer immediately. Under Policy paragraph 4(k), it waits ten business days, during which the losing registrant may file a court action in a mutual jurisdiction and notify the registrar. If that happens, the registrar withholds transfer pending the court's decision.
[ ] If no court action lands, confirm the transfer and verify the domain has actually moved into your account, do not assume; check the registrar record.
[ ] If you lost, evaluate the ACPA. A UDRP loss is not preclusive. You can sue in federal court, where the standards differ and money is on the table.

The court is not an appeals court, it is a do-over. Policy paragraph 4(k) preserves both parties' right to take the dispute to a court of competent jurisdiction, and U.S. courts have made clear that a civil action after a UDRP decision is not an appeal or review of the panel's work. The court owes the panel no deference and analyzes the ACPA claim de novo, without regard to the UDRP findings. Storey v. Cello Holdings, L.L.C., 347 F.3d 370, 374 (2d Cir. 2003); Barcelona.com, Inc. v. Excelentisimo Ayuntamiento de Barcelona, 330 F.3d 617, 623 (4th Cir. 2003). The statutory vehicle for the losing registrant is 15 U.S.C. § 1114(2)(D)(v), which lets a registrant whose name was suspended, disabled, or transferred under a policy like the UDRP sue for a declaration that its registration or use was lawful and recover the name; the seminal recognition of that remedy is Sallen v. Corinthians Licenciamentos LTDA, 273 F.3d 14 (1st Cir. 2001). In short: winning the UDRP gets you the name, but a determined, well-funded opponent can pull it back into court and start over. Most decisions stand only because most losing squatters lack the resources or the defenses to fund a federal suit.

Reverse domain name hijacking: how not to become the villain

The UDRP has a built-in sanction for its abusers. Rule 15(e) directs the panel, if it finds that the complaint "was brought in bad faith, for example in an attempt at Reverse Domain Name Hijacking or was brought primarily to harass the domain-name holder," to declare so in the decision. There are no damages, the sanction is reputational, but the finding is public, permanent, searchable under the complainant's name, and quotable by every future adversary.

Panels are historically cautious about the finding, but they make it, and they make it more readily against sophisticated complainants represented by counsel who should have known better. The recurring fact patterns:

Rights that postdate the domain. Filing when your mark did not exist at registration is the classic RDNH setup; you are asking the panel to find bad-faith targeting of a mark that had not been adopted.
Chasing a generic or dictionary word you do not exclusively own, using the UDRP to extract a valuable name from a legitimate holder.
A "Plan B" filing after a failed negotiation, using the UDRP as leverage when your own conduct shows you knew the registrant had a legitimate interest.
Material misstatement or omission in a complaint you certified as complete and accurate.

Terminology is worth untangling, because "reverse domain name hijacking" means two different things in two different regimes. In the UDRP, it is the Rule 15(e) finding just described, an abusive complaint. In U.S. litigation, courts loosely call the § 1114(2)(D)(v) civil action a "reverse domain name hijacking" claim, but as Professor McCarthy notes, that label is a misnomer: the registrant-plaintiff need only show its registration or use was lawful, not that the trademark owner did anything wrong. The genuine anti-abuse litigation remedy is the separate 15 U.S.C. § 1114(2)(D)(iv), which lets a registrant recover damages, costs, and attorneys' fees where the trademark owner obtained the UDRP transfer through a knowing and material misrepresentation. See 5 J. Thomas McCarthy, McCarthy on Trademarks and Unfair Competition § 25A:69 (5th ed.). The practical lesson is the same in both regimes: file clean cases, certify honestly, and do not use the UDRP as a crowbar. For the broader family of doctrines that punish over-aggressive rights assertion, see Equitable Defenses: Laches, Acquiescence, Waiver, and Equitable Estoppel, and, on the enforcement-letter side, Answering a Trademark Cease-and-Desist Letter.

When to skip the UDRP and sue under the ACPA

Sometimes the administrative route is the wrong route. The Anticybersquatting Consumer Protection Act, 15 U.S.C. § 1125(d), enacted in 1999 as Section 43(d) of the Lanham Act, is the litigation alternative, and it can do things the UDRP cannot. Choose the ACPA when you need money, discovery to develop a serial squatter's intent, in rem jurisdiction over a name whose owner you cannot identify or reach, or a court order and precedent. For how domain recovery fits within the larger arsenal, see Trademark Infringement and Related Rights: The Enforcement Landscape and the Trademark Enforcement and Litigation Lifecycle toolkit.

The elements. Courts phrase them variously, but an ACPA plaintiff must show that (1) it owns a mark that was distinctive or famous as of the date the challenged domain was registered; (2) the defendant registered, trafficked in, or used the name; (3) the name is identical or confusingly similar to (or dilutive of) the mark; and (4) the defendant acted with a bad-faith intent to profit. 15 U.S.C. § 1125(d)(1)(A); DaimlerChrysler v. The Net Inc., 388 F.3d 201, 204 (6th Cir. 2004). A registration is not required; use sufficient to create common-law rights will do (Lahoti v. VeriCheck, Inc., 586 F.3d 1190 (9th Cir. 2009)), but the mark must have been distinctive at the time of registration, which is why a mark that became distinctive only later cannot support the claim (GoPets Ltd. v. Hise, 657 F.3d 1024, 1032 (9th Cir. 2011)).

Three structural differences from the UDRP drive the choice:

Use alone can violate the ACPA. Unlike the UDRP's conjunctive registered-and-used standard, the ACPA reaches bad-faith registration, trafficking, or use. So a name registered in good faith but later weaponized, the departing employee who holds the company's domain hostage (DSPT Int'l, Inc. v. Nahum, 624 F.3d 1213 (9th Cir. 2010)), or the holder who flips a legitimate site into a competing one after the mark owner shows interest (Newport News Holdings Corp. v. Virtual City Vision, Inc., 650 F.3d 423 (4th Cir. 2011)), can be liable under the ACPA even where the UDRP would not reach him.
Nine statutory bad-faith factors. Section 1125(d)(1)(B)(i) lists nine non-exclusive factors. The first four tend to negate bad faith (the defendant's own trademark or IP rights in the name; the name being the defendant's own name; prior bona fide use; noncommercial or fair use). The last five tend to establish it (intent to divert consumers; offers to sell without bona fide use; false contact information or a pattern of it; registration of multiple marks-as-domains; and the strength of the plaintiff's mark). Courts weigh them holistically and are not bound by a mechanical tally, Sporty's Farm L.L.C. v. Sportsman's Market, Inc., 202 F.3d 489, 499 (2d Cir. 2000), the first federal appellate ACPA decision, was "most moved" by the case's unique circumstances rather than the factor count.
A statutory safe harbor. It is not bad faith if the defendant "reasonably believed" its use was fair or otherwise lawful, § 1125(d)(1)(B)(ii), but courts apply the safe harbor "sparingly," and any partial bad faith usually defeats it (Lahoti, 586 F.3d at 1203; Virtual Works, Inc. v. Volkswagen of America, Inc., 238 F.3d 264 (4th Cir. 2001)).

Remedies the UDRP cannot match. A prevailing ACPA plaintiff can obtain transfer or cancellation of the name (§ 1125(d)(1)(C)) plus injunctive relief (§ 1116), and, in personal-jurisdiction cases, either actual damages and the defendant's profits or statutory damages of $1,000 to $100,000 per domain name at the court's discretion (§ 1117(d)), with attorneys' fees in exceptional cases (§ 1117(a)). Courts award the statutory maximum against egregious serial squatters. For how these measures compare across IP regimes, see What an IP Case Is Worth: A Guide to Intellectual Property Damages.

When you cannot find the squatter: in rem. If the registrant is unidentifiable or beyond U.S. personal jurisdiction, the ACPA lets you proceed in rem against the domain name itself in the judicial district where the registrar or registry sits (§ 1125(d)(2); Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002)). Because Verisign (the .com and .net registry) and the .org registry both sit in the Eastern District of Virginia, that court hears a large share of in rem cybersquatting cases (Porsche Cars N. Am., Inc. v. Porsche.net, 302 F.3d 248 (4th Cir. 2002)). The trade-off: in rem relief is limited to transfer or cancellation, no money.

Personal-name squatting. Registering a living person's name is addressed by a separate provision, 15 U.S.C. § 8131 (originally codified at § 1129), which requires a specific intent to profit by selling the name and reaches conduct the trademark-based cybersquatting cause of action does not. For the trademark side of personal names, see Registering Your Own Name as a Trademark and The Right of Publicity.

A note on the newest frontier. Cybersquatting is migrating into virtual worlds and tokenized assets, where the "domain" may be a blockchain naming record or a marketplace handle rather than a DNS entry, and the UDRP does not reach it. For that emerging terrain, see Trademark Doctrine for Virtual Goods and NFTs: The MetaBirkins Landscape.

Common mistakes

Filing when your mark postdates the domain. No bad-faith registration is possible, and you invite a Rule 15(e) hijacking finding.
Chasing a generic dictionary word you do not exclusively own; targeting cannot be inferred, and legitimate use is plausible.
Letting evidence rot. Failing to screenshot and archive before the registrant alters the site or moves the name.
Over-arguing element one, under-proving element three. Element three decides most cases; budget your pages accordingly.
Ignoring the provider's Supplemental Rules and getting bounced on administrative compliance before a panelist reads the merits.
Blurring "registered and used." Treating element three as a single showing rather than two.
Confusing the tools. The UDRP transfers but pays nothing; the ACPA pays and reaches use-alone bad faith and offshore registrants; the URS only suspends.
Certifying loosely. A material misstatement can convert your win into a § 1114(2)(D)(iv) damages exposure.

A short worked example, start to finish

Return to Harborlight. Counsel captures harborlight-coffee.co on day one, with its coffee-competitor sponsored listings and for-sale box in frame, and pulls Wayback archives showing eighteen months of nothing but rotating parking pages. WHOIS is redacted. A search of prior decisions surfaces the same registrant email losing two earlier UDRP cases over other food brands, a paragraph 4(b)(ii) pattern. Element one is easy: HARBORLIGHT is federally registered, the .co is disregarded, and "harborlight-coffee" is confusingly similar (the descriptive "coffee" sharpens rather than dispels it). Element two: the prima facie case writes itself, no license, no corresponding mark, not commonly known as Harborlight, and pay-per-click parking is not a bona fide offering. Element three: the for-sale box supports 4(b)(i); the coffee-competitor ads support 4(b)(iv); the prior-loss pattern supports 4(b)(ii). Counsel files with FORUM, elects a single member, confirms the registrar lock within two business days, and, when the registrar unmasks a registrant in Florida, amends to name him and to fix the mutual-jurisdiction statement. The registrant defaults. The panel, satisfied on the record that all three elements are met, orders transfer. Ten business days pass with no court filing, and the name comes home.

Now change one fact. Suppose Harborlight adopted its brand in 2023, but the .co was registered in 2016 by a Florida resident who once ran a small nautical-decor shop called "Harbor Light." Element three now fails, no targeting of a mark that did not exist, and the registrant has a real 4(c) story. Filing anyway is how a complainant earns a reverse-hijacking finding. The discipline of Phase 1 is what separates the two outcomes.

Primary and secondary authority

Policy and rules. Uniform Domain-Name Dispute-Resolution Policy (ICANN, adopted Aug. 26, 1999; in effect Jan. 1, 2000), paragraphs 4(a)-(c), 4(k); Rules for Uniform Domain-Name Dispute-Resolution Policy (eff. July 31, 2015), Rules 3, 4, 5, 6, 15(e); provider Supplemental Rules (WIPO; FORUM); Uniform Rapid Suspension System (URS); ICANN Temporary Specification for gTLD Registration Data (May 2018).

UDRP decisions and guidance. Telstra Corp. Ltd. v. Nuclear Marshmallows, WIPO Case No. D2000-0003 (passive holding); Oki Data Americas, Inc. v. ASD, Inc., WIPO Case No. D2001-0903 (reseller safe harbor); WIPO Jurisprudential Overview of WIPO Panel Views on Selected UDRP Questions (3d ed. 2017) ("WIPO Overview 3.0"), sections 2.1 (burden-shifting), 3.3 (passive holding), 4.16 (RDNH), among others.

ACPA and related statutes. 15 U.S.C. § 1125(d) (cybersquatting), including the nine bad-faith factors at § 1125(d)(1)(B)(i) and the safe harbor at § 1125(d)(1)(B)(ii); in rem, § 1125(d)(2); remedies, §§ 1116, 1117(a), (d); registrar/registry safe harbor and post-UDRP civil action, § 1114(2)(D)(iv)-(v); personal-name cybersquatting, § 8131.

ACPA case law. Sporty's Farm L.L.C. v. Sportsman's Market, Inc., 202 F.3d 489 (2d Cir. 2000); DaimlerChrysler v. The Net Inc., 388 F.3d 201 (6th Cir. 2004); GoPets Ltd. v. Hise, 657 F.3d 1024 (9th Cir. 2011); Newport News Holdings Corp. v. Virtual City Vision, Inc., 650 F.3d 423 (4th Cir. 2011); DSPT Int'l, Inc. v. Nahum, 624 F.3d 1213 (9th Cir. 2010); Virtual Works, Inc. v. Volkswagen of America, Inc., 238 F.3d 264 (4th Cir. 2001); Shields v. Zuccarini, 254 F.3d 476 (3d Cir. 2001); Lamparello v. Falwell, 420 F.3d 309 (4th Cir. 2005); Bosley Medical Institute, Inc. v. Kremer, 403 F.3d 672 (9th Cir. 2005); Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002); Porsche Cars N. Am., Inc. v. Porsche.net, 302 F.3d 248 (4th Cir. 2002); Sallen v. Corinthians Licenciamentos LTDA, 273 F.3d 14 (1st Cir. 2001); Barcelona.com, Inc. v. Excelentisimo Ayuntamiento de Barcelona, 330 F.3d 617 (4th Cir. 2003); Storey v. Cello Holdings, L.L.C., 347 F.3d 370 (2d Cir. 2003).

Secondary. 5 J. Thomas McCarthy, McCarthy on Trademarks and Unfair Competition §§ 25A:50, 25A:69 (5th ed.).

Resources. WIPO Arbitration and Mediation Center (wipo.int); FORUM (adrforum.com); USPTO Trademark Search (uspto.gov); Internet Archive Wayback Machine (web.archive.org).

Provider fees, panelist rosters, and supplemental rules change. Confirm current figures and current rule versions before filing.

Related UpLaw Resources

Related Guides

Related Checklists

Related Toolkits

Related Articles

This checklist is general information, not legal advice. Domain disputes turn on the governing policy for the specific TLD and on specific facts; consult qualified counsel before filing.