Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking

Summary. The UDRP resolves most domain disputes, but a meaningful share of real cases fall outside it: a brand squatted under .io or .ai, a .uk or .de registration, an anonymous registrant beyond any court's reach, or a domain investor who has just been branded a cybersquatter and wants the decision undone. This article explains the alternatives in detail. It covers the Uniform Rapid Suspension System and its clear-and-convincing standard, the country-code policies that govern .us, .uk, .ca, .eu, .cn, .au, .de, .io, .co, and .ai, and the in rem action under 15 U.S.C. § 1125(d)(2) that lets a trademark owner sue the domain itself in the Eastern District of Virginia. It then turns to the registrant's side: reverse domain name hijacking findings under UDRP Rule 15(e), the federal cause of action in 15 U.S.C. § 1114(2)(D)(v), and the ten-business-day window that stops a transfer. A decision matrix compares every option on cost, speed, remedy, standard of proof, and appeal, and two worked examples show how the choices play out.

A payments startup called Ledgerline raised its Series A on a Tuesday. By Thursday, ledgerline.io, ledgerline.ai, and ledgerline.co.uk were all registered to someone in a jurisdiction the company's lawyers could not pronounce, each parked on a page offering the name "for serious inquiries." The general counsel asked the obvious question: "Can't we just file a UDRP?" The honest answer was "for one of them, yes; for the other two, it depends; and for none of them will the UDRP get you money, an injunction, or the registrant's name."

That answer is the subject of this article. The UDRP is the workhorse of domain disputes, and our existing coverage of it is thorough: start with Domain Name Disputes: Cybersquatting, the ACPA, and the UDRP for the framework, How to File a UDRP Complaint for Domain Name Disputes for the mechanics, and Recovering a Domain Name: A Practical Guide for the full recovery workflow. This article is about everything else: the fast-but-limited Uniform Rapid Suspension System, the national policies that govern country-code domains, the in rem lawsuit that lets you sue a domain name when you cannot sue its owner, and the law that protects registrants from trademark owners who overreach.

The short answer

There are six ways to resolve a fight over a domain name, and they differ on five dimensions: what it costs, how long it takes, what you win, how much you must prove, and whether anyone can appeal.

1. The UDRP (the Uniform Domain-Name Dispute-Resolution Policy, the contractual procedure every registrant of a generic top-level domain agrees to) gets you a transfer or cancellation in about two months for a few thousand dollars, on a preponderance standard, with no appeal except a lawsuit.
2. The URS (the Uniform Rapid Suspension System, a stripped-down procedure for newer generic top-level domains) gets you a suspension, not a transfer, in about three weeks for a few hundred dollars, but only on clear and convincing evidence, and with a de novo appeal.
3. A country-code policy (whatever the national registry for .uk, .ca, .us, .eu, .cn, or .au has adopted) gets you whatever that registry allows, which ranges from a UDRP clone to a mediation-first system to nothing at all.
4. An in personam action under the Anticybersquatting Consumer Protection Act (ACPA), 15 U.S.C. § 1125(d)(1), gets you transfer plus statutory damages of up to $100,000 per domain and, in exceptional cases, attorney's fees, but requires personal jurisdiction over the registrant, a year or more, and real litigation money.
5. An in rem action under 15 U.S.C. § 1125(d)(2) lets you sue the domain name itself where its registry or registrar sits (for .com, the Eastern District of Virginia) when the registrant is unreachable, but the remedy is limited to forfeiture, cancellation, or transfer.
6. Buying the domain is often the cheapest and fastest option of all, and sometimes the only honest one, because not every domain you want was registered in bad faith.

For the registrant on the other end, the law offers two shields. A UDRP panel can brand an overreaching complainant a reverse domain name hijacker under Rule 15(e) of the UDRP Rules, and a registrant who loses a UDRP can sue in federal court under 15 U.S.C. § 1114(2)(D)(v) for a declaration that the registration was lawful and an order returning the name. Filing that suit in the right court, and getting a file-stamped copy to the registrar within ten business days of the decision, freezes the transfer.

The rest of this article walks through each tool, the cases that define it, and a matrix for choosing among them. For the step-by-step procedure, see the companion guide, Choosing the Right Domain Name Dispute Procedure: A Practical Guide; for the forum-selection questions in checklist form, see Domain Name Dispute Forum Selection Checklist: A Practical Checklist; and for templates, see Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses.

Why the UDRP is not enough

The UDRP's reach is contractual. It binds registrants because ICANN (the Internet Corporation for Assigned Names and Numbers, the nonprofit that coordinates the global domain name system) requires every accredited registrar of a generic top-level domain to put the Policy into its registration agreement. That reach ends in four places.

First, the UDRP does not reach country-code top-level domains (ccTLDs, the two-letter spaces such as .uk, .de, or .cn that are delegated to national operators) unless the national operator has chosen to adopt it. Many have, often with modifications; some have written their own policies; a few have nothing. For a primer on the difference between generic and country-code spaces, see Top-Level Domain Names: An Overview.

Second, the UDRP cannot award money. The complainant's only remedies are transfer or cancellation. A registrant who has squatted on fifty variants of your brand pays nothing for the privilege, and nothing stops the fifty-first registration.

Third, the UDRP decides nothing finally. Paragraph 4(k) of the Policy preserves either party's right to go to court before, during, or after the proceeding, and the courts give panel decisions no deference at all. A UDRP win is a strong practical result and a weak legal one.

Fourth, the UDRP is slow and expensive relative to the clearest cases. A two-month proceeding costing $1,500 to $5,000 in fees alone, before counsel, is a poor fit for a phishing domain that will do its damage in a week. That gap is the reason the URS exists.

The Uniform Rapid Suspension System

What the URS is and where it applies

When ICANN opened its New gTLD Program in 2012 and began delegating hundreds of new generic top-level domains (.app, .shop, .xyz, .bank, and the rest) the following year, it required every new registry to offer rights-protection mechanisms beyond the UDRP, including a sunrise period for trademark owners and the URS. The URS Procedure and the URS Rules, both published by ICANN, are incorporated into each new gTLD registry agreement. Several legacy registries took on the URS when their contracts were renewed (.travel, .pro, and .cat in 2015, and .org in 2019, over objections from registrant advocates), but .com and .net have not. If the domain you are chasing is a .com or .net, the URS is not available, and you can skip to the next section.

The URS was designed to be the cheap, fast complement to the UDRP for cases so clear that no reasonable examiner could decide them the other way. Every feature of the procedure follows from that design choice: the heightened standard, the short pleadings, the quick timeline, and the limited remedy.

The elements and the standard of proof

The URS Procedure requires the complainant to prove three things by clear and convincing evidence: that the registered domain name is identical or confusingly similar to a word mark for which the complainant holds a valid national or regional registration that is in current use (or a mark validated through court proceedings or protected by statute or treaty); that the registrant has no legitimate right or interest in the domain name; and that the domain was registered and is being used in bad faith. The three elements track the UDRP's, and examiners borrow UDRP precedent freely, but the standard does not. The UDRP asks for a preponderance. The URS asks for clear and convincing evidence, and the Procedure states that where the examiner finds a genuine issue of material fact, the complaint must be denied.

Two consequences follow. A URS complaint against a domain that is being used for an arguably legitimate purpose (a fan site, a reseller, a descriptive-term business, a gripe site) will usually fail even if the same facts would win a UDRP. And a URS complaint that fails is not precluded from being refiled as a UDRP, so the real cost of a failed URS is the filing fee and the time.

The word-mark limitation also matters. A design mark, a stylized logo, or a mark whose registration covers only a figurative element does not qualify. The Trademark Clearinghouse (the central database of validated marks that ICANN created for the new gTLD program) is the usual way to prove that a mark qualifies, and a Clearinghouse record showing proof of use satisfies the "current use" requirement without further evidence.

The 500-word complaint

The URS complaint is filed electronically with an approved provider. The Forum (formerly the National Arbitration Forum) handles the large majority of cases; the Asian Domain Name Dispute Resolution Centre and MFSD in Italy also provide URS services. The form asks for the parties, the domain names, the mark and its registration details, and then allows a free-text explanation of why the registration is abusive that is limited to 500 words. Attachments are allowed, and a screenshot of the resolving page, a copy of the registration certificate, and any communications with the registrant are the usual exhibits.

Five hundred words is not much. It is enough to state the mark, the registration number, the date of registration, the fact that the domain reproduces the mark exactly, and the bad-faith indicia: a pay-per-click parking page linked to competing services, an offer to sell, a pattern of other abusive registrations, use for phishing or malware, or a page impersonating the complainant. It is not enough to argue about whether a term is descriptive or whether the registrant's business is bona fide. If you find yourself needing the space, you have the wrong tool.

Do not count on amending. A UDRP complainant routinely amends once the registrar reveals the true registrant behind a privacy service; the URS was built around a single, final complaint, and whatever room exists to update the registrant details after the provider's disclosure is narrow. Draft it as the only complaint you will get.

Lock, notice, response, determination

Within 24 hours of receiving the complaint from the provider, the registry operator must lock the domain, which freezes any change to the registration data and any transfer but leaves the domain resolving. The provider then sends notice to the registrant by email, fax where available, and post, and the registrant has 14 days to respond, extendable by up to seven days for good cause. The response is limited to 2,500 words. A registrant who does not respond is in default, and the examiner decides on the complaint alone, though default alone is not an admission.

The examiner's determination is expected within three to five business days of the response or the default. The whole process, from filing to determination, typically takes between three and four weeks. The determination is brief, often a page or two, and is published.

Suspension, not transfer

If the complainant prevails, the registry suspends the domain for the remainder of its registration period. Suspension means the domain resolves to a placeholder page stating that it has been suspended under the URS; the registrant keeps the registration but cannot use it, transfer it, or change its records. The complainant may pay to extend the suspension for one additional year beyond the current expiry. When the registration finally lapses, the domain becomes available to anyone, including the same registrant or a new one. Nothing in the URS gives the complainant the name.

This is the feature that limits the URS to a narrow set of cases. If you want the domain, the URS does not help. If you want the harm to stop today and do not care who holds the registration, the URS is the fastest route available in a new gTLD. The usual pattern for a brand owner who wants both is to file the URS first, obtain suspension within weeks, and then file a UDRP for the transfer at leisure, because a URS determination has no preclusive effect on a later UDRP, and the suspended domain cannot be moved while the UDRP is pending.

The de novo appeal and the default reply

The URS provides an appeal, which the UDRP does not. Either party may appeal the determination within 14 days to an appeal panel (one examiner or three, depending on what the appellant pays for), which reviews the record de novo (that is, afresh, without deference to the first examiner). The appellant pays the appeal fee, and the Procedure allows the introduction of a limited amount of new evidence that predates the complaint. A registrant who defaulted is given a separate window to seek de novo review: six months from the notice of default, extendable by another six months if requested before the first period runs out, during which the registrant may file a response and have the matter decided as if no default had occurred. A complainant who wins a URS by default should assume the win is provisional for a year.

Penalties for abusive complaints

The URS Procedure includes its own deterrent against overreaching. An examiner who finds that a complaint was abusive (filed to harass, or containing deliberate material falsehoods) can say so, and a complainant with two abusive-complaint findings, or one finding of deliberate material falsehood, is barred from using the URS for a year, and two findings of deliberate material falsehood bar it permanently. The sanction is rarely imposed, but it is why counsel should treat the URS certification of accuracy seriously.

What it costs and when it is the right tool

As of this writing, the Forum charges $375 for a URS complaint covering up to 14 domain names, with higher tiers for larger groups. The respondent pays nothing unless the complaint covers 15 or more names, in which case a response fee applies and is refunded to the prevailing party. Appeal fees are modest as well: at the Forum, a few hundred dollars for a single examiner and roughly $1,000 for three, more if the appellant adds new evidence. A URS filed by in-house counsel using the provider's form may cost nothing beyond the fee; a URS filed by outside counsel typically runs $1,500 to $3,500 all in.

The URS is the right tool when all of the following are true: the domain is in a gTLD that offers the URS; your mark is a registered word mark in current use; the domain reproduces it exactly or nearly so; the registrant's use is unmistakably abusive (phishing, impersonation, parked competitive advertising, or an outright offer to sell); and you need the harm stopped quickly more than you need the name. It is the wrong tool when the domain is a .com or .net, when the mark is a logo, when the registrant has any colorable story, or when you intend to use the domain yourself and cannot wait for a later UDRP.

Country-code domains: a different rulebook behind every flag

Country-code top-level domains are not ICANN's to regulate the way generic domains are. Each ccTLD is delegated to a national manager (a government agency, a nonprofit, a university, or a private contractor), and that manager writes its own registration agreement and its own dispute policy. ICANN cannot impose the UDRP on .uk or .de; it can only hold the UDRP up as a model. The result is three families of policy, and the first job in any ccTLD dispute is figuring out which family you are in.

1. Straight UDRP adopters. Registries such as .co (Colombia) and .ai (Anguilla) have adopted the UDRP itself, usually with WIPO as the designated provider. A standard UDRP complaint works, filed with the provider the registry names.
2. UDRP variants. The United States, the United Kingdom, Canada, the European Union, China, Australia, and the British Indian Ocean Territory (.io) run policies that borrow the UDRP's architecture but change one or more of its working parts: the bad-faith test, the eligibility rules, the language, the courts, or the addition of a mediation stage.
3. Courts only. Germany's .de is the best-known example of a registry that offers no administrative procedure at all. The claimant goes to court.

WIPO publishes a database of the policies that ccTLD registries have adopted, and each registry posts its current policy on its own site. Read both before drafting anything, and check the version date, because ccTLD policies change more often than the UDRP does. For background on how country-code spaces are delegated and who runs them, see Top-Level Domain Names: An Overview.

.us: the usDRP, the usRS, and the nexus requirement

The .us space is administered under a contract with the U.S. Department of Commerce, and every registrant must meet the usTLD nexus requirements: a U.S. citizen or permanent resident, an organization formed under U.S. law, or a foreign entity with a bona fide presence in the United States. A trademark owner has three tools.

The usDRP tracks the UDRP closely, with two differences that matter. Its bad-faith element is disjunctive: the complainant must show that the domain "has been registered or is being used in bad faith," not both. And it adds a legitimate-interest factor for a registrant that owns a trademark identical to the domain name. The remedies are transfer or cancellation, as under the UDRP. The usRS (the usTLD Rapid Suspension Dispute Policy, in force since July 2014) is the URS's twin: clear and convincing evidence, a short complaint, suspension only, and Forum filing fees that start around $375, but with the same disjunctive bad-faith test as the usDRP. It is rarely used, which is a reason to consider it rather than a reason to avoid it. Finally, the nexus requirement itself is a weapon: a foreign squatter with no U.S. presence has no business holding a .us name, and the registry polices nexus compliance and accepts complaints about registrants who do not qualify.

Because .us is the one country-code space anchored in the United States, a .us registration is also the easiest ccTLD to reach under the ACPA, discussed below.

.uk: Nominet's Dispute Resolution Service

Nominet, the .uk registry, runs the Dispute Resolution Service (DRS), which predates much of the modern UDRP case law and differs from it in instructive ways. The complainant must prove, on the balance of probabilities, two things: that it has Rights in a name or mark identical or similar to the domain name, and that the domain name, in the hands of the respondent, is an Abusive Registration. "Rights" means rights enforceable by the complainant under English law or otherwise, so unregistered goodwill of the kind that supports a passing-off claim can qualify. An Abusive Registration is one that either was registered or acquired in a manner that, at the time, took unfair advantage of or was unfairly detrimental to the complainant's Rights, or has been used in a manner that did so. Registration or use; the UDRP's conjunctive trap does not exist.

The procedure is built around early settlement. After the complaint is forwarded, the respondent has 15 working days to respond and the complainant 5 to reply. If there is a response, Nominet's mediators try to broker a deal, at no charge, over roughly ten working days. If mediation fails, the complainant pays for a decision by an independent expert, currently £750 for a full decision. If the respondent never responds, the complainant can instead request a summary decision for £200. Either party can appeal to a panel of three experts by giving notice of intention within ten working days and paying £3,000 in total (VAT has applied to these fees where chargeable). The expert can order transfer, suspension, cancellation, or amendment of the registration.

The policy lists non-exhaustive factors pointing toward abuse (registration primarily to sell to the complainant for more than out-of-pocket costs, blocking registrations, disrupting the complainant's business, confusing use, a pattern of abusive registrations, false contact details) and factors pointing away from it (genuine prior use, being commonly known by the name, fair use including tribute and criticism sites, and the express recognition that trading in domain names and holding large portfolios are lawful activities in themselves). Nominet publishes an Experts' Overview that plays the role the WIPO Overview plays for the UDRP, and DRS experts can also find that a complaint was brought in bad faith.

The courts remain available. The leading English case, British Telecommunications plc v. One in a Million Ltd. [1999] 1 WLR 903 (C.A.), held that a dealer who registered famous British brands as domain names to sell them back was liable for passing off and trade mark infringement because the names were "instruments of fraud." The DRS is cheaper and faster, but a court is the only place to get damages or an injunction against the next registration.

.ca: CIRA's CDRP and the Canadian presence rule

The Canadian Internet Registration Authority's Domain Name Dispute Resolution Policy (CDRP) begins with a gate the UDRP does not have: the complainant itself must satisfy CIRA's Canadian Presence Requirements, typically by being a Canadian entity or by owning a Canadian trademark registration whose exact word component appears in the domain name. A foreign brand owner with no Canadian registration may not be able to file at all, which is a strong argument for registering the mark in Canada before you need it.

On the merits, the complainant must show that the .ca domain name is confusingly similar to a mark in which it had rights before the domain was registered and still has rights, that the registrant registered the domain in bad faith, and some evidence that the registrant has no legitimate interest. The registrant then bears the burden of proving a legitimate interest on the balance of probabilities. The bad-faith element focuses on registration and on the circumstances the policy enumerates (selling to the complainant or a competitor, a pattern of blocking registrations, disrupting a competitor's business, or confusing users for commercial gain). The remedies are deletion or transfer, and transfer requires the complainant to keep meeting the presence requirements. The CDRP also has a feature registrants love: a panel may order a complainant that brought the case unfairly and without colour of right to pay up to CAD $5,000 toward the registrant's costs. The principal provider, CIIDRC, charges a CAD $1,000 commencement fee plus panel fees.

.eu: ADR under the .eu Regulation

The .eu space is governed by EU legislation, now Regulation (EU) 2019/517, and run by EURid. Eligibility is restricted to EU and EEA residents, EU citizens wherever they live, and undertakings and organizations established in the EU or EEA, which is why many UK-only businesses lost their .eu names after Brexit. The alternative dispute resolution procedure is administered by the Czech Arbitration Court and, more recently, WIPO.

The .eu test is the most complainant-friendly of the major policies. The complainant must show that the domain is identical or confusingly similar to a name in which a right is recognized or established by national or EU law, and then either that the registrant has no rights or legitimate interest in the name, or that the name was registered or is being used in bad faith. Bad faith is therefore not even required where the registrant has no legitimate interest. The remedies are revocation and, if the complainant itself meets the eligibility criteria, transfer. The proceeding runs in the language of the registration agreement, which can be any official EU language; a complainant who has to litigate in Czech or Portuguese should budget for translation.

.cn: the CNDRP and its time bar

The China Internet Network Information Center (CNNIC) administers .cn under the CNNIC Domain Name Dispute Resolution Policy (CNDRP), with cases heard by the China International Economic and Trade Arbitration Commission (CIETAC) and the Hong Kong International Arbitration Centre. The elements look familiar (identical or confusingly similar to a name or mark in which the complainant has civil rights or interests; no right or legitimate interest; registration or use in bad faith), and the bad-faith element is again disjunctive. The difference that decides cases is the time bar: the providers will not accept a complaint against a domain name that has been registered for more than three years. Until a 2019 revision the limit was two years, and older commentary still says so. The clock generally runs from the original registration date, so a brand owner who discovers a .cn squatter in year four has lost the administrative route and must sue in a Chinese court, where the Supreme People's Court's 2001 interpretation on domain-name civil disputes supplies the framework. Proceedings default to Chinese. Remedies are cancellation or transfer.

.au: the auDRP

The .au Domain Administration (auDA) runs the auDRP, with WIPO and the Resolution Institute as providers. The complainant must show that the domain is identical or confusingly similar to a name, trademark, or service mark in which it has rights (and "name" extends to company and business names registered with Australian authorities and to personal names), that the registrant has no rights or legitimate interests, and that the domain was registered or subsequently used in bad faith. The remedies are cancellation or transfer, and transfer requires that the complainant be eligible to hold a .au name under auDA's licensing rules, which generally require an Australian presence. Since 2022, registrants can also hold names directly under .au (example.au), which created a fresh wave of priority disputes.

.de: no policy at all, and the DISPUTE entry

DENIC, the .de registry, offers no administrative dispute procedure. A claimant sues in the German courts under the Trade Mark Act or the name right in § 12 of the German Civil Code. The famous shell.de decision of the Federal Court of Justice (2001) awarded the domain's release to the oil company over a private individual named Shell, but it also illustrates a German peculiarity: courts generally order the holder to release (delete) the name rather than to transfer it.

DENIC's DISPUTE entry solves that problem. A claimant who shows a plausible right to the name can have a DISPUTE entry placed on the registration. The current holder may keep using the domain but cannot transfer it to anyone else, and if the domain is released, the holder of the DISPUTE entry automatically becomes the new holder. The entry lasts a year and can be extended on proof that the dispute remains unresolved. The German playbook is therefore: DISPUTE entry first, then a demand letter or an application for a preliminary injunction, then a deletion order that delivers the name to you through the entry. German preliminary injunction practice is fast, and DENIC itself suggests that a court case combined with a DISPUTE entry is quicker and cheaper than an arbitration-style procedure.

.io, .co, and .ai: the startup extensions

The three country codes that technology companies actually build brands on are, legally speaking, close cousins of the UDRP.

• .io (British Indian Ocean Territory) uses the .IO Domain Name Dispute Resolution Policy, a modified UDRP administered by WIPO. The complainant need only show bad faith in registration or use, and the remedies are cancellation or transfer. A registrant who loses and wants to stop the transfer must sue in the courts of England within the policy's ten-business-day window, not in a U.S. court. The 2025 agreement to transfer sovereignty over the Chagos Archipelago to Mauritius has raised questions about the long-term future of the IO country code; nothing has changed for registrants yet, and ICANN's ccTLD retirement process contemplates a multi-year wind-down rather than an overnight disappearance, but a company whose only domain is a .io should have a plan B.
• .co (Colombia) applies the UDRP, with WIPO as provider. Because .co sits one keystroke from .com, it has long been among the most disputed ccTLDs, and typosquatting arguments come up constantly.
• .ai (Anguilla) also applies the UDRP through WIPO. The rush of artificial-intelligence branding has made .ai one of the most valuable and most squatted country codes.

For all three, the substantive analysis is the UDRP analysis, and the practical questions are which registrar holds the name, how quickly it implements decisions, and whether any registrar or registry in the chain sits in the United States (which matters for the in rem action discussed next).

The country-code policies at a glance

Fees change; confirm them with the provider before you quote a client a number.

Suing the domain itself: the in rem action under § 1125(d)(2)

Before 1999, a trademark owner facing an anonymous or offshore registrant had no good answer. Courts declined to let owners sue domain names directly; in Porsche Cars North America, Inc. v. Porsch.com, 51 F. Supp. 2d 707 (E.D. Va. 1999), the court dismissed an in rem dilution action because the dilution statute contemplated suits against people, not property. Congress responded in the ACPA by creating an action in rem (that is, against the thing itself, here the domain registration, rather than against its owner). The legislative history quoted in Prudential Insurance Co. of America v. Shenzhen Stone Network Information Ltd., 58 F.4th 785 (4th Cir. 2023) explains the problem Congress had in mind: cybersquatters registering under fictitious names, using offshore addresses, and avoiding accountability entirely.

The idea that a domain name is a thing a court can control is less exotic than it sounds. In Kremen v. Cohen, 337 F.3d 1024 (9th Cir. 2003), the Ninth Circuit held that a domain name is intangible property that can be converted under California law, and in Office Depot, Inc. v. Zuccarini, 596 F.3d 696 (9th Cir. 2010), it held that domain names are located where the registry is located for the purpose of a judgment creditor's levy, which let a creditor seize and auction a notorious typosquatter's portfolio. The in rem action applies the same logic to trademark claims.

The statutory conditions

Under 15 U.S.C. § 1125(d)(2)(A), the owner of a mark registered with the USPTO or protected under § 1125(a) or (c) may file an in rem action against a domain name if the domain name violates any right of the owner and the court finds that the owner either:

1. cannot obtain personal jurisdiction over a person who would have been a defendant in an ordinary ACPA suit; or
2. through due diligence could not find such a person, after sending notice of the alleged violation and of its intent to proceed in rem to the registrant's postal and email addresses on file with the registrar, and publishing notice of the action as the court directs promptly after filing.

Those notice steps "shall constitute service of process" under § 1125(d)(2)(B). The registrant can still appear and defend, as the Chinese, British, and Argentine registrants did in several of the cases discussed below, but the case proceeds against the domain whether or not anyone shows up.

The Fourth Circuit settled the scope of the action in Harrods Ltd. v. Sixty Internet Domain Names, 302 F.3d 214 (4th Cir. 2002). Harrods of London sued sixty Harrods-formative domain names registered in Virginia by an unrelated Argentine company long known as Harrods Buenos Aires. The court held that the in rem provision reaches infringement claims under 15 U.S.C. § 1114 and § 1125(a) and dilution claims under § 1125(c), not just bad-faith registration claims under § 1125(d)(1); that bad faith under § 1125(d)(1) is proved by a preponderance of the evidence, not clear and convincing evidence; and that exercising in rem jurisdiction over Virginia-registered domain names satisfies due process under Shaffer v. Heitner, 433 U.S. 186 (1977), because claims to the property itself are the source of the controversy. Earlier, Caesars World, Inc. v. Caesars-Palace.com, 112 F. Supp. 2d 502 (E.D. Va. 2000), had rejected a facial due process challenge on the same reasoning: when the domain name is the entire subject matter of the suit, minimum contacts for personal jurisdiction are not required.

Because an in rem plaintiff can proceed on an infringement theory, bad faith is not always required. In Cable News Network L.P. v. CNNews.com, 162 F. Supp. 2d 484 (E.D. Va. 2001), CNN sued cnnews.com, a Chinese-language news site run by a Hong Kong company that had moved the registration to a Chinese registrar. The district court held that jurisdiction followed the .com registry into Virginia, later granted summary judgment and ordered the transfer, and the Fourth Circuit affirmed in relevant part in Cable News Network, LP v. CNNews.com, 56 F. App'x 599 (4th Cir. 2003), vacating only the portion of the judgment that rested on bad faith, which Harrods had made unnecessary for an infringement claim. One caution for the future: the Supreme Court's decision in Abitron Austria GmbH v. Hetronic International, Inc., 600 U.S. 412 (2023), limits §§ 1114(1)(a) and 1125(a)(1) to domestic uses in commerce. CNN treated the U.S.-located registration as making the case domestic, but a foreign registrant targeting only foreign users now has a sharper argument against in rem infringement theories. Bad-faith claims under § 1125(d)(1), which turn on registration rather than on use in commerce, are less exposed.

Where to file: the situs rule and the Eastern District of Virginia

The in rem action may be filed only in the judicial district where the registrar, registry, or other domain name authority that registered or assigned the name is located. The Second Circuit read that language strictly in Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002): Mattel sued dozens of Barbie domain names in New York, persuaded the registrars to deposit their registrar certificates with the New York court, and argued that the deposit created a situs there under § 1125(d)(2)(C)(ii). The court disagreed, holding that the plaintiff must file in the registrar's or registry's district "and no other," and that the deposit provision only confirms the court's control after a proper filing. FleetBoston Financial Corp. v. FleetBostonFinancial.com, 138 F. Supp. 2d 121 (D. Mass. 2001), reached the same result and sent the registration certificate back, and a Nevada court in SMP GmbH & Co. KG v. ONU.com, No. 16-cv-2147, 2016 WL 6156175 (D. Nev. Oct. 21, 2016), transferred a dispute between a German and an Austrian company to Virginia for the same reason.

That rule is why so much in rem practice happens in Alexandria. VeriSign, the registry for every .com and .net name, is located in the Eastern District of Virginia, so every .com and .net domain can be sued there no matter where its registrar sits. In CNN the registrar was in China; in Prudential it was GoDaddy in Arizona; in both, Virginia had jurisdiction through the registry. Public Interest Registry, which runs .org, is also in the district, as America Online, Inc. v. AOL.org, 259 F. Supp. 2d 449 (E.D. Va. 2003), confirms. For other spaces, look up the registry's location and the registrar's. A .io or .ai name registered through a U.S. registrar can be sued in that registrar's district, but whether a foreign registry will honor the resulting order is a practical question the statute cannot answer.

Proving that you cannot sue the registrant

The in rem action is a fallback, and courts enforce the condition. Heathmount A.E. Corp. v. Technodome.com, 106 F. Supp. 2d 860 (E.D. Va. 2000), recognized that asking a plaintiff to prove the absence of personal jurisdiction means proving a negative, and settled on a workable standard: the plaintiff must show some indicia of diligence in trying to establish jurisdiction. The court also held that a Canadian registrant's contract with a Virginia registrar was not, by itself, a minimum contact with Virginia, so the in rem route was open.

Three timing rules follow from the cases.

• You cannot run both tracks at once. Alitalia-Linee Aeree Italiane S.p.A. v. Casinoalitalia.com, 128 F. Supp. 2d 340 (E.D. Va. 2001), held that the in personam and in rem avenues are mutually exclusive. The Italian airline had sued both the Dominican online casino and its domain; because the casino's interactive gambling site gave Virginia personal jurisdiction over it, the in rem claim had to go.
• Jurisdiction is measured when you file. Prudential held that whether the plaintiff could obtain personal jurisdiction over a suitable defendant is decided as of the filing date, so a foreign registrant cannot defeat the in rem case by consenting to jurisdiction somewhere convenient after being sued. The court also rejected the argument that the registrar's form agreement, or the mutual-jurisdiction stipulation in an abandoned UDRP complaint, amounted to consent to personal jurisdiction in Arizona for an ACPA suit. Similarly, in Porsche Cars North America, Inc. v. Porsche.net, 302 F.3d 248 (4th Cir. 2002), a British registrant's offer to submit to jurisdiction in California three days before trial came far too late to divest the Virginia court.
• Diligence takes time. In Lucent Technologies, Inc. v. Lucentsucks.com, 95 F. Supp. 2d 528 (E.D. Va. 2000), Lucent mailed and emailed its notice of intent to proceed in rem and filed suit eight days later. The court dismissed: eight days was not a reasonable time under the due process standard of Mullane v. Central Hanover Bank & Trust Co., 339 U.S. 306 (1950), and the registrant, who had simply moved and left a forwarding address, was a findable person who could have been sued directly.

The flip side of the condition is personal jurisdiction over foreign registrants generally. Under Fed. R. Civ. P. 4(k)(2), a federal court can exercise jurisdiction over a foreign defendant with sufficient contacts with the United States as a whole, even if no single state has jurisdiction; Graduate Management Admission Council v. Raju, 241 F. Supp. 2d 589 (E.D. Va. 2003), used it against an Indian website operator who targeted American test-takers. If Rule 4(k)(2) reaches the registrant, the in rem condition may not be met. For the full analysis, see Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor.

Notice, publication, and the registrar certificate

The notice and publication steps are where in rem cases are won or delayed. In GlobalSantaFe Corp. v. GlobalSantaFe.com, 250 F. Supp. 2d 610 (E.D. Va. 2003), the plaintiff sent notice to the registrant's listed postal and email addresses and published notice in two Korean newspapers under the court's publication order. In Banco Inverlat, S.A. v. www.inverlat.com, 112 F. Supp. 2d 521 (E.D. Va. 2000), the court held that it has discretion to excuse publication where notice was actually accomplished through the registrant's postal and email addresses. After GDPR redaction, those addresses usually have to come from the registrar rather than a public lookup, a problem taken up below.

Filing triggers the registrar's duties. On written notice of a filed, stamped complaint, the registrar or registry must deposit with the court documents establishing the court's control over the registration (the registrar certificate) and must not transfer, suspend, or modify the domain while the case is pending except on court order. A registrar or registry is not liable for injunctive or monetary relief under the in rem provision except for bad faith or reckless disregard, including willful failure to comply with the court's order. Registrars rarely resist; the certificate is usually on file within days.

The remedy, and what to do when a foreign registrar balks

The remedies in an in rem action "shall be limited to" forfeiture, cancellation, or transfer of the domain name. No damages, no injunction against future registrations, and ordinarily no fees. One Eastern District of Virginia decision, Agri-Supply Co. v. Agrisupply.com, 457 F. Supp. 2d 660 (E.D. Va. 2006), went further and awarded costs and attorney's fees against a serial cybersquatter that ignored the case, reasoning that § 1125(d)(3) preserves the remedies of 15 U.S.C. § 1117(a). It is an outlier on a default record against a defendant with a long history; do not build a budget on it, and remember that a fee award against an absent offshore entity is only worth what you can collect.

The more common problem is a foreign registrar that will not implement the judgment. The Eastern District of Virginia's answer has been to go up the chain to the registry. In GlobalSantaFe, a Korean registrar refused to transfer the name because a Seoul court had enjoined it from doing so at the registrant's request; Judge Ellis ordered VeriSign to disable the domain by removing it from the .com zone file, holding that the first court to exercise jurisdiction over the property need not yield to a later foreign injunction obtained to block its judgment. In AOL.org, a Chinese registrar ignored the transfer order and moved the name to a Korean registrar, and the court directed the .org registry to transfer it. In Agri-Supply, the court ordered VeriSign to change the registrar of record to one the plaintiff selected. If even that fails, Fed. R. Civ. P. 70 lets a court direct another person to perform an act a judgment requires. For the broader problem of competing foreign orders, see Anti-Suit Injunctions and Parallel Proceedings: Racing to Judgment Across Borders.

Timeline and cost of an in rem case

An uncontested in rem case in the Eastern District of Virginia usually runs three to six months: complaint and notice to the registrar; registrar certificate; motion for an order directing publication; publication and the response period the court sets; request for entry of default and a motion for default judgment under Fed. R. Civ. P. 55, often referred to a magistrate judge for a report and recommendation; and a final order directing the registrar or registry to transfer. The out-of-pocket costs are modest (the federal filing fee, publication, and local counsel), and total fees for a clean default commonly land in the low-to-mid five figures. A contested case, like Harrods or Prudential, is ordinary federal litigation and costs accordingly. For the pleading and motion papers, see Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses.

When you want money: the in personam ACPA case

The in rem action recovers a name; the in personam action under § 1125(d)(1) can also punish the person who took it. The elements and the nine statutory bad-faith factors are covered in Domain Name Disputes: Cybersquatting, the ACPA, and the UDRP, so this section focuses on the issues that decide whether litigation is worth it.

Statutory damages and the false-contact presumption

Under 15 U.S.C. § 1117(d), the plaintiff may elect, at any time before final judgment, statutory damages of $1,000 to $100,000 per domain name "as the court considers just," instead of proving actual damages or profits. Courts treat the provision like copyright statutory damages, so no proof of lost sales is required. The Fifth Circuit affirmed $25,000 per domain in E. & J. Gallo Winery v. Spider Webs Ltd., 286 F.3d 270 (5th Cir. 2002), and the Fourth Circuit upheld $80,000 for exceptional and egregious conduct in Newport News Holdings Corp. v. Virtual City Vision, Inc., 650 F.3d 423 (4th Cir. 2011). Serial typosquatters fare worst; Shields v. Zuccarini, 254 F.3d 476 (3d Cir. 2001), affirmed statutory damages of $10,000 per domain, plus attorney's fees, against a registrant who had registered misspellings of a cartoonist's domain to capture mistyped traffic.

Two provisions make the damages case easier. Section 1117(e) creates a rebuttable presumption that the violation was willful if the defendant knowingly provided materially false contact information to a registrar, registry, or other registration authority when registering, maintaining, or renewing the name. And 18 U.S.C. § 3559(g) doubles the maximum sentence (or adds seven years, whichever is less) for a felony committed using a knowingly falsely registered domain name, which is why phishing domains registered under fake identities draw prosecutors' attention. Attorney's fees remain available in exceptional cases under § 1117(a), now assessed under the totality-of-circumstances approach of Octane Fitness, LLC v. ICON Health & Fitness, Inc., 572 U.S. 545 (2014), which most circuits apply to Lanham Act cases; see Lanham Act Attorney's Fees Under 15 U.S.C. § 1117(a): A Practical Guide.

The registration problem: when does the clock start?

The ACPA protects a mark that was distinctive (or famous) "at the time of registration of the domain name." A domain registered before the mark existed is therefore immune, unless a later event counts as a new "registration." The circuits disagree about what counts.

The split matters most to domain investors, whose business is buying names that were registered years ago. In the Ninth Circuit, the purchaser of a name registered before the mark existed has a strong argument under GoPets; in the Fourth Circuit, which includes the Eastern District of Virginia where so many domain cases are filed, the purchase itself is a registration and the question becomes bad faith at the moment of purchase. Prudential found bad faith on summary judgment: the parked page showed pay-per-click links to Prudential's competitors, the registrant told an anonymous buyer it had received a six-figure offer, and the claimed plan to build a forex news site never materialized.

Bad faith can arrive later

The ACPA reaches anyone who "registers, traffics in, or uses" an infringing name with a bad-faith intent to profit, so a name registered innocently can become actionable. In Virtual Works, Inc. v. Volkswagen of America, Inc., 238 F.3d 264 (4th Cir. 2001), an internet service provider registered vw.net, acknowledged that users might associate it with Volkswagen, and later offered to sell it to the carmaker at a good price; the Fourth Circuit found bad faith and ordered the transfer. In DSPT International, Inc. v. Nahum, 624 F.3d 1213 (9th Cir. 2010), a former employee who controlled his employer's domain took the site down to gain leverage over commissions he claimed he was owed; using a domain as a bargaining chip was bad-faith use with intent to profit even though the original registration was innocent. The safe harbor does not help a registrant who acted even partly in bad faith.

The opposite case is instructive too. In Southern Grouts & Mortars, Inc. v. 3M Co., 575 F.3d 1235 (11th Cir. 2009), 3M kept renewing diamondbrite.com, a name it had acquired with a business and no longer used, to keep it away from anyone who might confuse consumers about its separate DIAMOND GRADE products. A pool-finish maker that owned the DIAMOND BRITE mark sued; the Eleventh Circuit held that passive, defensive holding without any intent to profit from the plaintiff's mark is not cybersquatting.

Gripe sites, parody, and fair use

Noncommercial criticism is the ACPA defense that wins most often. Lamparello v. Falwell, 420 F.3d 309 (4th Cir. 2005), held that a critic who used fallwell.com to rebut the Reverend Jerry Falwell's views had no bad-faith intent to profit; Lucas Nursery & Landscaping, Inc. v. Grosse, 359 F.3d 806 (6th Cir. 2004), and TMI, Inc. v. Maxwell, 368 F.3d 433 (5th Cir. 2004), reached the same result for dissatisfied customers' complaint sites, and Utah Lighthouse Ministry v. Foundation for Apologetic Information & Research, 527 F.3d 1045 (10th Cir. 2008), for a parody site. But the ACPA has no commercial-use requirement: Bosley Medical Institute, Inc. v. Kremer, 403 F.3d 672 (9th Cir. 2005), affirmed judgment for a critic on the infringement and dilution claims but reversed on the ACPA claim and remanded it. The critic loses when the "criticism" is a vehicle for money or leverage, as in People for the Ethical Treatment of Animals v. Doughney, 263 F.3d 359 (4th Cir. 2001), where the registrant of peta.org ("People Eating Tasty Animals") invited the organization to make him an offer, and Coca-Cola Co. v. Purdy, 382 F.3d 774 (8th Cir. 2004), where an activist used famous brands' names to divert users to fundraising pages. For the fair use doctrine generally, see Trademark Fair Use: Descriptive Use, Nominative Use, and Expressive Works After Jack Daniel's.

Personal names, registrars, and secondary liability

A living person whose name is not a trademark has a narrower claim under 15 U.S.C. § 8131: liability attaches only to someone who registers the person's name without consent "with the specific intent to profit from such name by selling the domain name for financial gain." There is a safe harbor for good-faith registrations tied to a copyrighted work, the remedies are injunctive (forfeiture, cancellation, or transfer) plus discretionary fees and costs, and there are no damages. The statute applies to names registered on or after November 29, 1999; Schmidheiny involved this provision and held that a later re-registration counted. For a public figure whose name functions as a mark, § 1125(d) is the better vehicle; see Trademarking Your Own Name and 2 J. Thomas McCarthy & Roger E. Schechter, The Rights of Publicity and Privacy § 7:32 (2d ed.).

Intermediaries are mostly out of reach. Registrars are not liable for registering names on others' behalf absent bad faith, 15 U.S.C. § 1114(2)(D)(iii); Lockheed Martin Corp. v. Network Solutions, Inc., 141 F. Supp. 2d 648 (N.D. Tex. 2001); and the Ninth Circuit held in Petroliam Nasional Berhad v. GoDaddy.com, Inc., 737 F.3d 546 (9th Cir. 2013), that the ACPA creates no claim for contributory cybersquatting. Platforms and marketplaces raise different questions under ordinary contributory infringement law, covered in Trademark Liability Online: Keyword Advertising, Marketplaces, and Contributory Infringement After Tiffany v. eBay.

Reverse domain name hijacking: the registrant's side of the ledger

Every tool described so far belongs to the trademark owner. The registrant has two of its own, and a lawyer advising either side needs to know both.

The UDRP finding

The UDRP Rules define reverse domain name hijacking (RDNH) as "using the Policy in bad faith to attempt to deprive a registered domain-name holder of a domain name." Under Rule 15(e), if the panel finds that a complaint was brought in bad faith, for example in an attempt at RDNH or primarily to harass the registrant, it must say so in its decision. Section 4.16 of the WIPO Jurisprudential Overview 3.0 collects the circumstances panels rely on: a complainant that knew or clearly should have known it could not prove one of the elements (most often because the domain was registered before the complainant had any trademark rights); a "Plan B" complaint filed after failing to buy the name; unsupported claims of rights; the omission of material facts that the respondent then supplies; and complaints resting on the barest allegations. Panels hold represented complainants to a higher standard, and losing alone is not enough.

The finding carries no fine, no fee award, and no bar. It is published, attached to the complainant's name forever, and quoted back at it in the next dispute, which for a public company or a law firm is not nothing. Other policies have more teeth: the URS bars abusive complainants for a year or permanently, the CDRP lets a panel award a registrant up to CAD $5,000, and Nominet's experts can find a complaint was brought in bad faith. For a deeper treatment of the doctrine and the respondent's strategy, see Catherine A. Shultz & Courtney A. Hofflander, Reverse Domain Name Hijacking and the Uniform Domain Name Dispute Resolution Policy: Systematic Weaknesses, Strategies for the Respondent, and Proposed Policy Reforms, 4 Cybaris Intell. Prop. L. Rev. 218 (2013).

The federal cause of action: § 1114(2)(D)(iv) and (v)

The ACPA gave registrants real remedies. Under 15 U.S.C. § 1114(2)(D)(iv), a person whose knowing and material misrepresentation that a domain infringes causes a registrar to suspend, transfer, or disable it is liable for the registrant's damages, including costs and attorney's fees, and the court may order the name reactivated or returned. Under § 1114(2)(D)(v), a registrant whose name was suspended, disabled, or transferred under a policy like the UDRP may, on notice to the mark owner, sue "to establish that the registration or use of the domain name by such registrant is not unlawful" under the Lanham Act, and the court may order the name reactivated or transferred back.

Four circuits shaped the action.

• Sallen v. Corinthians Licenciamentos LTDA, 273 F.3d 14 (1st Cir. 2001): a registrant who lost corinthians.com in a WIPO proceeding could sue under § 1114(2)(D)(v), and the Brazilian soccer club's disclaimer of any intent to sue him did not eliminate the case or controversy, because the transfer itself created one.
• Barcelona.com, Inc. v. Excelentisimo Ayuntamiento de Barcelona, 330 F.3d 617 (4th Cir. 2003): the court must apply U.S. law, not foreign law, and owes the UDRP panel no deference. Because the city of Barcelona held no enforceable U.S. rights in its geographic name, the registration was not unlawful under the Lanham Act, and the court ordered barcelona.com returned.
• Hawes v. Network Solutions, Inc., 337 F.3d 377 (4th Cir. 2003): the registrant of lorealcomplaints.com, whose name was transferred to L'Oréal after the registrar deposited control with a French court, could still pursue a § 1114(2)(D)(v) claim against L'Oréal in the United States, although his claim against the registrar failed.
• Dluhos v. Strasberg, 321 F.3d 365 (3d Cir. 2003), and Parisi v. Netlearning, Inc., 139 F. Supp. 2d 745 (E.D. Va. 2001): UDRP proceedings are not arbitrations under the Federal Arbitration Act, so the deferential FAA standards do not apply and the court decides the dispute afresh.

The Second Circuit added the most quotable line in Storey v. Cello Holdings, L.L.C., 347 F.3d 370 (2d Cir. 2003): unlike binding arbitration, "UDRP proceedings are structured specifically to permit the domain-name registrant two bites at the apple." Courts have not agreed on how much of the Lanham Act the registrant must clear; some, including Ricks v. BMEzine.com, LLC, 727 F. Supp. 2d 936 (D. Nev. 2010), read "not unlawful" to mean not unlawful under the cybersquatting provision, while others look to the whole statute. See 5 J. Thomas McCarthy, McCarthy on Trademarks and Unfair Competition § 25A:37 (5th ed.).

The ten-business-day window

Timing is everything. UDRP paragraph 4(k) tells the registrant that the registrar will wait ten business days (measured where the registrar has its principal office) after the provider notifies it of a transfer decision, and then implement the decision unless, within that period, the registrar receives official documentation, such as a file-stamped complaint, showing that the registrant has sued the complainant in a jurisdiction to which the complainant submitted. Under Rule 3(b)(xiii), every UDRP complainant must submit to at least one mutual jurisdiction, chosen from two options: the courts where the registrar has its principal office, or the courts at the registrant's address as shown in the registrar's records when the complaint was filed.

Three practical consequences follow. First, the window is about two calendar weeks, and the clock starts when the registrar hears from the provider, not when the registrant reads the decision, so a registrant must be ready to file the day the decision arrives. Second, the suit must be filed in a mutual-jurisdiction court that the complainant designated to stop the transfer; Storey holds that a registrant may sue elsewhere, but only a suit in the agreed forum freezes the name. Third, the forum is also a choice of circuit law, which matters a great deal after the registration split described above. A complainant choosing its mutual jurisdiction, and a registrant choosing among the designated options, should both read the local circuit's cases first. Plead the claim under § 1114(2)(D)(v), add a declaratory judgment count under 28 U.S.C. § 2201, and expect the trademark owner to counterclaim under § 1125(d). For declaratory practice generally, see Declaratory Judgment Actions: Jurisdiction, Discretion, and the Race to the Courthouse.

When fighting back backfires

The registrant's suit puts the registrant's own conduct on trial, and the trademark owner's counterclaim can carry statutory damages. In Lahoti v. VeriCheck, Inc., 586 F.3d 1190 (9th Cir. 2009), a registrant who lost vericheck.com in a UDRP sued to get it back and instead was held liable for cybersquatting, the court relying in part on his request for as much as $72,500 for a name in which he had no legitimate interest and on his history of registering others' marks. In Web-adviso v. Trump, 927 F. Supp. 2d 32 (E.D.N.Y. 2013), a self-described "domainer" holding about 200 names, many containing famous brands, sought a declaration that trumpabudhabi.com and similar names were lawful; the court granted summary judgment to the trademark owner on its ACPA counterclaim. The registrants who win, like the city-name holder in Barcelona.com, have clean facts: a registration that predates the mark, a dictionary or geographic term, and no history of selling brands back to their owners.

The practical layer: finding the registrant, using abuse desks, locking names, and buying

Most domain disputes are decided before anyone files anything, by what the parties can find out and how quickly they act.

WHOIS after the GDPR

Since the EU General Data Protection Regulation took effect in May 2018, the public WHOIS record for most generic domains shows a privacy service, a redacted entry, or a web form rather than the registrant's name and address. ICANN first addressed the problem with a Temporary Specification, then with a permanent Registration Data Policy that took effect for registrars and registries in August 2025. The lookup protocol has changed as well: since January 2025, the Registration Data Access Protocol (RDAP) has been the authoritative source for gTLD registration data in place of the old WHOIS service.

Getting the hidden data takes one of four routes.

1. File first and let the process unmask the registrant. In a UDRP, the provider asks the registrar to confirm the registrant's identity, and complainants routinely amend once the real name appears. That is often the cheapest way to learn who you are dealing with.
2. Ask through ICANN's Registration Data Request Service (RDRS). Launched in November 2023 as a free, centralized request system for nonpublic gTLD registration data, it was extended by the ICANN Board in 2025 while the community works out a permanent policy. Participation by registrars is voluntary, and disclosure decisions remain the registrar's, so expect refusals as often as answers.
3. Use European law where it applies. Article 28 of the NIS2 Directive requires EU registries and registrars to keep accurate registration data and to answer lawful, substantiated access requests without undue delay and within 72 hours. EURid's disclosure policy for .eu follows that timetable.
4. Use the subpoena power. A U.S. lawsuit, including a Doe suit, supports discovery from registrars and privacy services under Fed. R. Civ. P. 45, usually after a motion for expedited discovery under Fed. R. Civ. P. 26(d). For the standards courts apply before unmasking an online actor, see Identifying an Anonymous Defendant Online: A Practical Guide and Unmasking Anonymous Online Speakers: John Doe Subpoenas, the Dendrite and Cahill Tests, and the First Amendment.

Historical WHOIS services, reverse-WHOIS searches on an email address, hosting records, analytics and advertising identifiers in the page source, and payment trails often identify the person faster than any formal request. Capture everything you find in a form a court will accept; see Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court and Fed. R. Evid. 901.

Registrar and registry abuse desks

ICANN's 2013 Registrar Accreditation Agreement requires every accredited registrar to maintain an abuse contact and to investigate and respond to abuse reports, and amendments effective in April 2024 require registrars and registry operators to take prompt, appropriate mitigation action when they receive actionable evidence of DNS abuse, defined as malware, botnets, phishing, pharming, and spam used to deliver them. A domain impersonating your login page is DNS abuse, and a well-documented report (screenshots, the phishing URL, headers from the phishing email, and a statement of your rights) can get it suspended within hours or days. A parked page with pay-per-click links to your competitors is not DNS abuse; for that you need the UDRP, the URS, or a court. Report to the registrar and the registry at once, and to the hosting provider as well. For the platform side of online enforcement, see Enforcing Trademarks Against Online Sellers and Platforms: A Practical Guide.

Locks, for offense and defense

Three kinds of lock matter. A UDRP lock, which the registrar must apply within two business days of the provider's request, freezes the registrant and registrar data so the name cannot be moved during the case. A URS lock is applied by the registry within 24 hours and leaves the site resolving. And a registry lock is a paid service many registries offer that sets server-level status codes requiring out-of-band verification before the name can be updated, transferred, or deleted. Every company should registry-lock its core domains. The sex.com saga in Kremen began when a fraudster talked the registrar into transferring the name with a forged letter, and modern domain hijackings work the same way through compromised registrar accounts. Two-factor authentication, a registrar account in the company's name rather than a former employee's, and a registry lock prevent most of them.

Buying the domain

Purchase is often the right answer, and not only for the brand owner. A legitimate holder of a dictionary term or a pre-existing name may have every right to it, and paying is cheaper and faster than losing a dispute. If you buy, buy carefully.

• Decide before you approach. An anonymous inquiry through a broker is standard, but whatever the registrant says in response becomes evidence. In Prudential, the registrant's reply to an anonymous broker that it had received a six-figure offer helped establish bad faith. Conversely, a brand owner that tries to buy, fails, and then files a UDRP it cannot win invites a reverse hijacking finding under the "Plan B" line of decisions.
• Use escrow. A domain escrow service holds the money until the registrar confirms the transfer. Never wire funds against a promise to push the name later. See Escrow Agreement Review Checklist.
• Paper it. The purchase agreement should identify the seller as the actual registrant, warrant title and the absence of prior sales, licenses, or liens, set the transfer mechanics (authorization code or same-registrar push) and deadlines, assign any associated goodwill and content, and release claims. Many registrars impose a transfer lock after a change of registrant, so build that into the timeline.
• Keep the record clean. Do not misstate your trademark rights in negotiations; a knowing and material misrepresentation that leads to a transfer is actionable under § 1114(2)(D)(iv).

A decision matrix

The six options compared on the five dimensions that matter:

Read the matrix as a sequence of questions. Is there active fraud (phishing, malware, impersonation)? Go to the abuse desks and, in a new gTLD, the URS, today. Which space is the name in? That narrows the menu to the policies that apply. Do you need the name, or just need the harm to stop? Suspension may be enough. Can you reach the registrant in a U.S. court, and is there anything to collect? If yes and the conduct is egregious, in personam litigation with statutory damages may be worth its cost; if no, in rem or an administrative proceeding. Finally, is the registrant actually doing anything wrong? If the honest answer is "they had it first," buy it or pick another name. The step-by-step version of this analysis is in Choosing the Right Domain Name Dispute Procedure: A Practical Guide.

Worked example 1: Ledgerline's .io, .ai, and .co.uk problem

Return to Ledgerline, the payments startup from the opening. Its facts: a U.S. registration for the word mark LEDGERLINE covering payment software, issued in 2023; customers in the United Kingdom since 2024 and a pending UK application; ledgerline.com in hand. The day after the Series A announcement, ledgerline.io, ledgerline.ai, and ledgerline.co.uk were registered through privacy services and parked on pages showing pay-per-click links to rival payment apps and a "for serious inquiries" banner. Two weeks later, ledgerline-login.app appeared, hosting a copy of Ledgerline's sign-in page.

Hour one: the phishing domain. The .app name is a live fraud and gets handled first. Counsel preserves the page with a forensic capture, sends a documented phishing report to the registrar and to the .app registry under their DNS-abuse obligations, reports the host, and drafts a URS complaint in parallel. The URS fits perfectly: a new gTLD, a registered word mark, an identical mark plus a descriptive word, and an impersonation page no examiner will excuse. The abuse report suspends the site within two days; the URS, filed anyway for a few hundred dollars, locks it for the rest of its term, and Ledgerline adds .app to its watch list.

Weeks one to eight: the three ccTLD names. None of the three is reachable by a cheap, fast suspension, and Ledgerline wants the names, so the administrative policies do the work.

• ledgerline.ai goes to WIPO under the UDRP. Registration the day after a publicized funding round, parking with competitive links, and an offer to sell satisfy registration and use in bad faith comfortably.
• ledgerline.io goes to WIPO under the .IO policy, where Ledgerline need only show bad faith in registration or use. Because the policies differ, the .io and .ai names are filed as separate complaints even though the evidence is the same, and counsel notes that a losing registrant would have to sue in the English courts to stop the transfer.
• ledgerline.co.uk goes to Nominet's DRS. Ledgerline's U.S. registration and its UK goodwill both count as Rights, and an offer to sell plus confusing parked use is a textbook Abusive Registration. If the registrant does not respond, Ledgerline requests a £200 summary decision; if it does respond, Nominet's free mediation may produce a cheap transfer.

The roads not taken. An ACPA suit for statutory damages would require personal jurisdiction over a registrant who appears to be abroad, perhaps under Rule 4(k)(2) if the squatter targeted U.S. users, and then a collection effort with little prospect of success. An in rem action is possible only if a registrar or registry in the chain sits in the United States; counsel checks, finds that the .io name was registered through a U.S. registrar, and keeps an in rem filing in that registrar's district in reserve if the .IO proceeding stalls. Buying was considered and rejected, because paying a squatter who registered the day after a press release finances the next one.

Result and budget. The phishing domain was dark within days. All three ccTLD names transferred within roughly two months, for total provider fees in the low thousands and counsel fees in the low five figures. The prevention lessons were cheaper still: register the core country codes before the press release, record the mark in the Trademark Clearinghouse so new-gTLD sunrise periods and claims notices work for you, and register the mark in each market where the company will sell (Canada's CDRP, for example, is closed to a complainant without a Canadian presence or registration).

Worked example 2: a domain investor fights back

Halcyon Names LLC is a small domain investment firm in Oregon that holds about 4,000 two-word .com names. In 2014 it bought brightloom.com from its original 2009 registrant; the name has been parked ever since and listed for sale at $28,000. BrightLoom, Inc., a project-management software startup, adopted BRIGHTLOOM in 2021 and registered it in 2022. In 2025 BrightLoom's broker made an anonymous $2,500 offer; Halcyon pointed to its listed price. Three weeks later BrightLoom filed a UDRP complaint, designating as the mutual jurisdiction the federal courts in Arizona, where Halcyon's registrar is based. A single panelist ordered the transfer, reasoning that Halcyon's parking page had recently displayed links to project-management software and that its price was excessive.

Day one. The registrar will implement the decision ten business days after the provider notifies it. Halcyon's counsel drafts a complaint for the District of Arizona under § 1114(2)(D)(v) and the Declaratory Judgment Act, files it within a week, and delivers the file-stamped copy to the registrar, which freezes the transfer. Counsel considers adding a § 1114(2)(D)(iv) claim, because the UDRP complaint described Halcyon as having registered the name "after BrightLoom's launch," which the record shows was untrue.

The merits. The court owes the panel no deference (Barcelona.com, Dluhos). The threshold ACPA question is whether BRIGHTLOOM was distinctive "at the time of registration." Under GoPets, the Ninth Circuit rule that governs in Arizona, the relevant registration is the 2009 original, twelve years before the mark existed, and Halcyon's 2014 purchase does not restart the clock. Even under Prudential, the purchase predates the mark by seven years. The vulnerability is narrower: Halcyon moved the name to a new registrar in 2024, after the mark was registered, and in the Third, Fourth, and Eleventh Circuits a re-registration can count, which would put Halcyon's 2024 intent and its parking page squarely at issue. The mutual-jurisdiction choice, made by the trademark owner, quietly decided which rule applied.

The registrant's own house. Before filing, Halcyon's counsel did what every investor-plaintiff should do: reviewed the portfolio for names that combine other companies' marks (there were a handful, which Halcyon dropped), turned off pay-per-click categories that track BrightLoom's field (UDRP panels treat automatically generated links as the registrant's responsibility), and preserved the purchase records from 2014. A registrant whose portfolio looks like the one in Web-adviso, or whose history looks like Lahoti's, should expect the declaratory action to end with a cybersquatting judgment against it.

Resolution. Facing a weak counterclaim, an exceptional-case fee argument built on a "Plan B" complaint and a misstatement about the registration date, and an adverse forum, BrightLoom settled by buying the name for a five-figure sum close to Halcyon's listed price, and the case was dismissed. The lesson runs both ways: the trademark owner would have spent less by paying the asking price at the start, and the investor won because its record was clean before the dispute began.

Common mistakes, on both sides

Brand owners

• Filing a URS against a .com or .net name, or relying on a logo or design registration the URS does not accept.
• Filing a UDRP against a name registered before the mark existed, which is the most common route to a reverse hijacking finding.
• Making an anonymous purchase offer, failing, and then filing a weak complaint (the "Plan B" pattern panels punish).
• Filing an in rem action in the district where the company is based rather than where the registrar or registry sits (Mattel, FleetBoston), or filing it a week after sending notice (Lucent).
• Suing the registrant in personam and the domain in rem at the same time (Alitalia).
• Treating a UDRP win as final. The registrant can still sue under § 1114(2)(D)(v), and the court will start from scratch.
• Missing ccTLD gatekeeping rules: the three-year .cn time bar, CIRA's Canadian presence requirement, and .eu eligibility for transfer.

Registrants and domain investors

• Missing the ten-business-day window, or filing in a court the complainant never designated, so the name transfers while the lawsuit is pending.
• Leaving pay-per-click categories pointed at the complainant's industry.
• Answering an anonymous inquiry with a price justified by the trademark owner's interest in the name (Prudential, Lahoti).
• Bringing a declaratory action with a portfolio full of other companies' brands (Web-adviso).
• Assuming that an old registration date protects a name that was later moved or transferred, without checking the governing circuit's rule on re-registration.

Further reading

The standard treatise treatment is 5 J. Thomas McCarthy, McCarthy on Trademarks and Unfair Competition ch. 25A (5th ed.), especially § 25A:37 on court challenges after a UDRP decision and §§ 25A:49 to 25A:66 on the ACPA. Ian C. Ballon, E-Commerce and Internet Law § 7.04[2], compares UDRP and ACPA strategy, and 6 Callmann on Unfair Competition, Trademarks and Monopolies § 22:40 (4th ed.) covers § 43(d). On in rem jurisdiction and its international reach, see Xuan-Thao N. Nguyen, The Digital Trademark Right: A Troubling New Extraterritorial Reach of United States Law, 81 N.C. L. Rev. 483 (2003), and Zohar Efroni, A Guidebook to Cybersquatting Litigation: The Practical Approach in a Post-Barcelona.com World, 2003 U. Ill. J.L. Tech. & Pol'y 457. On provider choice and its effect on outcomes, see Daniel Klerman, Forum Selling and Domain-Name Disputes, 48 Loy. U. Chi. L.J. 561 (2016). The annotation at 177 A.L.R. Fed. 1 collects ACPA decisions by issue.

Frequently asked questions

Can I use the URS against a .com domain? No. The URS applies to the new gTLDs and to the few legacy spaces (including .org) that adopted it in contract renewals. For .com and .net, the options are the UDRP, the ACPA, or a purchase.

How long does a registrant have to challenge a UDRP transfer in court? To stop the transfer, ten business days from the registrar's notice of the decision, with a suit filed in a mutual-jurisdiction court and file-stamped proof delivered to the registrar. A registrant can sue later, but the name will already have moved and the case becomes a suit to get it back.

Can I recover money without going to court? No. The UDRP, URS, and ccTLD policies award no damages. Money comes only from an in personam ACPA case, through actual damages, statutory damages of $1,000 to $100,000 per domain, and fees in exceptional cases. The only administrative money remedy of note runs the other way: the CDRP's cost award to registrants facing bad-faith complaints.

Why are so many in rem cases filed in Alexandria, Virginia? Because the in rem action must be filed where the registrar or registry is located, and the registries for .com, .net, and .org are in the Eastern District of Virginia. That district has decades of in rem experience and moves quickly.

What happens if a foreign registrar ignores a U.S. in rem judgment? The court can order the U.S. registry to act directly, by disabling the name in the zone file (GlobalSantaFe), transferring it (AOL.org), or changing the registrar of record (Agri-Supply). That works only where the registry is within the court's reach, which is why in rem is far stronger for .com than for most country codes.

I bought a domain years before the company that now wants it existed. Am I safe? Mostly, but check two things. First, your later conduct: the ACPA reaches bad-faith use and trafficking, not only registration (Virtual Works, DSPT). Second, the circuit: in the Third, Fourth, and Eleventh Circuits a later re-registration or transfer can restart the clock, while the Ninth Circuit looks to the initial registration (GoPets).

Do courts defer to UDRP decisions? No. Courts decide afresh under U.S. law (Barcelona.com, Dluhos, Parisi), and a UDRP outcome does not bind either side in later litigation (Storey).

Is a criticism site that uses my company's name in its domain cybersquatting? Usually not, if it is genuinely noncommercial and the registrant is not trying to sell the name or extract leverage (Lamparello, Lucas Nursery, TMI). It becomes cybersquatting when the criticism is a pretext for profit (PETA, Purdy).

Practical takeaways

• Sort every dispute by space first: generic, new generic, country code, or courts-only.
• Use the URS and the abuse desks for speed, the UDRP and ccTLD policies for transfers, the in rem action for anonymous registrants of .com, .net, and .org, and in personam litigation only when money, deterrence, or an injunction justifies the cost.
• Before an in rem filing, document diligence, wait a reasonable time after notice, and file in the registrar's or registry's district.
• Before any complaint, compare the registration date with the date your rights arose; if the name came first, you probably need to buy it.
• Registrants who lose a UDRP have ten business days; prepare the complaint before the decision arrives.
• The forum you choose (or the mutual jurisdiction your opponent chose) decides whether a re-registration restarts the ACPA clock.
• Register core country codes and lock core domains before the launch announcement, not after.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Domain Name Disputes: Cybersquatting, the ACPA, and the UDRP: the core framework this article builds on.
• How to File a UDRP Complaint for Domain Name Disputes: elements, evidence, and drafting for the standard procedure.
• Top-Level Domain Names: An Overview: how generic and country-code spaces are organized and governed.
• Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor: the analysis that decides whether you can sue the registrant or must sue the domain.
• Trademark Liability Online: Keyword Advertising, Marketplaces, and Contributory Infringement After Tiffany v. eBay: secondary liability for platforms and intermediaries.
• Unmasking Anonymous Online Speakers: John Doe Subpoenas, the Dendrite and Cahill Tests, and the First Amendment: when courts let you identify a hidden registrant.
• Trademark Fair Use: Descriptive Use, Nominative Use, and Expressive Works After Jack Daniel's: the defenses behind gripe-site and reseller domains.
• Declaratory Judgment Actions: Jurisdiction, Discretion, and the Race to the Courthouse: the procedural vehicle for registrant suits.
• Anti-Suit Injunctions and Parallel Proceedings: Racing to Judgment Across Borders: what happens when a foreign court tries to block a U.S. domain judgment.
• Lanham Act Attorney's Fees Under 15 U.S.C. § 1117(a): A Practical Guide: the exceptional-case standard for both sides.
• Trademarking Your Own Name: when a personal name becomes a mark the ACPA protects.

Related Guides

• Choosing the Right Domain Name Dispute Procedure: A Practical Guide: the step-by-step companion to this article.
• Recovering a Domain Name: A Practical Guide: the full recovery workflow, from investigation to transfer.
• Identifying an Anonymous Defendant Online: A Practical Guide: subpoenas and expedited discovery to unmask registrants.
• Enforcing Trademarks Against Online Sellers and Platforms: A Practical Guide: takedown and platform strategy beyond domain names.
• Service of Process: Domestic and International Methods That Work: serving foreign registrants in an in personam case.

Related Checklists

• Domain Name Dispute Forum Selection Checklist: A Practical Checklist: the forum decision as a sequence of concrete questions.
• Domain Name Dispute Checklist: A Practical Checklist: the general dispute workflow.
• Filing a UDRP Domain Name Complaint: A Practical Checklist: filing mechanics for the UDRP itself.
• Escrow Agreement Review Checklist: reviewing the escrow terms when you buy a name.

Related Toolkits

• Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses: templates for every procedure discussed here.
• Domain Name Toolkit: UDRP Complaints, ACPA Pleadings, and Portfolio Management: core UDRP and ACPA templates.
• Online Brand Protection Toolkit: A Strategic Roadmap and Resource Library: monitoring and enforcement programs.
• Cross-Border IP Litigation and Service Toolkit: A Roadmap and Resource Library for International Disputes: litigating against foreign parties.