Choosing the Right Domain Name Dispute Procedure: A Practical Guide

Summary. This guide walks brand owners, registrants, and their lawyers through the choice among the procedures available in a domain name dispute, in the order the decisions actually arise. It starts with triage of active fraud, then shows how to identify the registry and the governing policy, line up the three dates that decide most cases, find the registrant, and test whether a U.S. court can reach it. It then matches objectives and facts to the UDRP, the Uniform Rapid Suspension System, country-code policies, an in personam or in rem action under the Anticybersquatting Consumer Protection Act, and a negotiated purchase, with timelines, fees, filing requirements, and the sequencing patterns that combine them. A separate part takes the registrant's side: calendaring the response, building the record, asking for a reverse domain name hijacking finding, and suing within the ten-business-day window under 15 U.S.C. § 1114(2)(D)(v) when a transfer order is wrong. A worked example follows a medical device company through five problem domains in five different forums, and the guide closes with common mistakes, an FAQ, and practical takeaways.

The brand-protection report arrives on a Monday with five rows highlighted in red. A lookalike .com is emailing invoices with payment links to customers; a .shop storefront is selling counterfeits; a .us name is parked by someone on another continent; a .cn name was registered four years ago by a company that collects brands; and a .de name, held by a former distributor, now forwards to a competitor. Someone in the meeting says, "Just file UDRPs." Only two of the five can go to a UDRP panel at all, and neither should start there.

Choosing the procedure is the first legal decision in a domain name dispute, and it often decides the outcome. Pick a forum whose standard you cannot meet and you lose. Pick one that cannot give you the remedy you need and you win nothing useful. Pick one without asking what the other side can do next and the win unravels. This guide walks through the choice in the order the decisions actually arise, first for the brand owner (Part one) and then for the registrant on the receiving end (Part two). The doctrine behind each option is explained in the companion article, Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking, and the UDRP and ACPA basics are in Domain Name Disputes: Cybersquatting, the ACPA, and the UDRP. We return to the Monday report in the worked example.

The short answer

Answer six questions, in order. Each answer removes options.

1. Is the name being used for fraud right now? Phishing and credential-harvesting pages, malware, and the spam that delivers them are "DNS abuse," which registrars and registries must act on under their ICANN contracts. Preserve the evidence, report the abuse to the registrar, the registry, and the host the same day, and keep a temporary restraining order in reserve. A procedure that takes weeks is the second move, not the first.
2. Which top-level domain is it in? The extension fixes the menu. For .com and .net, the choices are the UDRP, a lawsuit, or a purchase. For the new generic domains (.app, .shop, .xyz, and hundreds more) and for .org, add the URS. For a country code, the national registry's own policy governs, and some (.de is the famous example) have no administrative policy at all.
3. Who came first? Put the date your trademark rights began next to the date the domain was registered and the date the current holder acquired it. If the domain is older than your rights and nothing has changed hands since, most claims fail, and pressing one invites a finding of reverse domain name hijacking.
4. Can a U.S. court reach the registrant, and is there anything to collect? If yes, an in personam case under the Anticybersquatting Consumer Protection Act (ACPA) can deliver statutory damages, an injunction, and sometimes attorney's fees. If no, the in rem action under 15 U.S.C. § 1125(d)(2) recovers the name itself in the district where the registrar or registry sits; the registries for .com, .net, and .org are in the Eastern District of Virginia.
5. What do you actually need? To stop harm fast: the abuse desks and the URS. To own the name: the UDRP or the country-code policy. Money or deterrence: in personam litigation. A final judgment: litigation of either kind. Certainty at a known price: a purchase.
6. What can the other side do next? A registrant who loses a UDRP can freeze the transfer by suing within ten business days; a registrant who loses a URS by default can reopen it for up to a year; and a trademark owner who loses an administrative case can still sue. Choose the procedure whose result you can defend, not just the one you can win.

If you are the registrant, the clock runs the other way. Calendar the response deadline the day the notice arrives (20 days for a UDRP, plus four more on request; 14 days for a URS). Preserve the evidence of when and why you registered the name. Decide whether to respond, settle, or sell. And if a panel orders a transfer you believe is wrong, file suit under 15 U.S.C. § 1114(2)(D)(v) in a court the complainant agreed to, then get the file-stamped complaint to the registrar inside the ten-business-day window.

Who does what in a domain name dispute

Domain disputes involve more parties than the two who are fighting, and the right forum often turns on where the others sit. The Lanham Act defines a domain name as "any alphanumeric designation which is registered with or assigned by any domain name registrar, domain name registry, or other domain name registration authority as part of an electronic address on the Internet" (15 U.S.C. § 1127). The players:

For a primer on how generic and country-code spaces are organized, see Top-Level Domain Names: An Overview.

The legal framework in one place

Domain dispute procedures come from two different kinds of law. The administrative procedures are contracts: every registrant of a generic domain agrees, in its registration agreement, to submit to the Uniform Domain-Name Dispute-Resolution Policy (UDRP) and, in the new generic domains, to the Uniform Rapid Suspension System (URS), and country-code registries impose their own policies the same way. The court procedures are statutes: the ACPA, codified in the Lanham Act at 15 U.S.C. § 1125(d), the registrant protections in 15 U.S.C. § 1114(2)(D), and the personal-name provision in 15 U.S.C. § 8131. Federal courts hear these claims under 28 U.S.C. § 1338 and 15 U.S.C. § 1121, regardless of the amount in controversy.

Three secondary sources do most of the interpretive work, and you will cite all three. The WIPO Jurisprudential Overview 3.0 summarizes UDRP panel consensus by section and appears in nearly every decision. Chapter 25A of 5 J. Thomas McCarthy, McCarthy on Trademarks and Unfair Competition (5th ed.), covers the ACPA and court challenges to UDRP decisions (§ 25A:37 on the latter). And Elizabeth D. Lauzon, Annotation, Validity, Construction, and Application of Anticybersquatting Consumer Protection Act, 177 A.L.R. Fed. 1 (2002), collects ACPA decisions by issue, including in rem venue (§ 5), the bar on combining in rem and in personam claims (§ 6), proving that personal jurisdiction is lacking (§ 7), and whether publication can be excused (§ 8).

The cases that decide which forum works

Most domain cases turn on their facts, but a short list of decisions sets the procedural rules that make one forum better than another. The companion article discusses them in depth; this table shows what each one means when you are choosing.

Part one: the brand owner's path, step by step

Step 1: Triage active abuse in the first hours

Start by sorting the problem into one of two bins, because they run on different clocks. DNS abuse is the narrow category that registrars and registries have contractually agreed to police: malware, botnets, phishing, pharming, and spam used to deliver them. Since amendments to ICANN's registrar and registry agreements took effect in April 2024, a registrar that receives actionable evidence of DNS abuse must take prompt mitigation action, which in practice usually means suspending the domain. Everything else (a parked page with pay-per-click ads, an offer to sell, a redirect to a competitor, a gripe site) is a trademark dispute, and no registrar will act on it without a decision or a court order.

If you have DNS abuse, the first hours look like this:

1. Capture the evidence before anyone touches the site. Use a forensic capture tool or a vendor that produces a hash-verified record showing the URL, date, and time, and save the phishing email with full headers. Once the registrar acts, the page disappears. A capture that a witness can authenticate under Fed. R. Evid. 901, or that qualifies for certification under Fed. R. Evid. 902(13) or (14), will matter later; see Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court.
2. Report to the registrar's abuse contact. Every accredited registrar must publish one and investigate what it receives. Make the report easy to act on: the domain, the exact URL, screenshots, the email headers, a short statement of who you are and why the content is fraudulent, and your trademark registration number.
3. Report to the registry, the host, and the email provider at the same time. Registries have their own abuse obligations, and a host can pull content even when the registrar is slow.
4. Report to the browser blocklists and, if customers are being defrauded, to law enforcement. A browser warning protects users within hours even while the domain stays up.
5. Prepare, but do not yet file, emergency papers. If the registrar ignores a well-documented report and customers are losing money, a temporary restraining order under Fed. R. Civ. P. 65 can direct the registrar or registry to disable the name. Since 2020, a trademark plaintiff who shows likely success gets a rebuttable presumption of irreparable harm under 15 U.S.C. § 1116(a). For the ex parte showing, see Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court, and for the domain-disabling orders common in counterfeiting cases, see Counterfeiting, Seizure Orders, and Schedule A Litigation: Fighting Fakes in Federal Court.

If the name is in a new generic domain or .org, file a URS in parallel. It costs a few hundred dollars, and the registry must lock the name within 24 hours of the provider's notice. An abuse suspension is the registrar's call and can be quietly reversed; a URS determination is a published decision with a defined term.

Decision point. If the use is DNS abuse, the abuse desks come first and a legal procedure second. If it is not, move to Step 2 and expect nothing from the abuse desks.

Step 2: Identify the registry, the registrar, and the governing policy

Pull the current registration data through ICANN's lookup tool, which since January 2025 draws on the Registration Data Access Protocol (RDAP) rather than the old WHOIS service. Record the registrar and its country, the creation and expiration dates, the status codes (a "clientTransferProhibited" lock is routine; "serverHold" means the registry has already acted), and the name servers. For a country code, the IANA root zone database names the national manager, whose website posts the dispute policy in force, and WIPO maintains a database of the country-code registries that use its services. Then sort the name into one of these rows:

The elements and fees of each country-code policy are in the companion article. Two cautions apply to all of them. Policies change more often than the UDRP, so read the version in force on the day you file. And eligibility rules cut both ways: CIRA's presence requirement, the .eu residence rules, and auDA's licensing rules can keep a foreign brand owner from filing or from receiving the name, which is the best argument for registering the mark in each market before you need it.

Decision point. The table produces a short list. Strike every option that does not apply to this extension before you think about strategy.

Step 3: Put the three dates on one page

Three dates decide most domain disputes, and you should know all three before you choose anything:

1. When your rights began. The registration date and the first-use date of your mark, and for unregistered rights, the date the mark became distinctive. A U.S. registration is prima facie evidence of validity and ownership under 15 U.S.C. § 1057(b) and 15 U.S.C. § 1115(a), and once the registration issues, the application's filing date counts as nationwide constructive use under § 1057(c).
2. When the domain was first registered. The creation date in the registration data.
3. When the current holder acquired it. The creation date does not change when a name is sold, so you need historical registration records, archived versions of the site, and sometimes the registrar's own records to learn when the current holder took over.

The dates work differently in each forum:

• UDRP. A domain registered before the complainant had trademark rights generally cannot have been registered in bad faith, unless the registrant was targeting nascent rights, such as a name grabbed the day after a leaked product launch (WIPO Overview 3.0 §§ 3.8.1, 3.8.2). A transfer to a new, unrelated holder counts as a new registration, so bad faith is measured at that later date (§ 3.9).
• Disjunctive country-code policies. Where bad-faith registration or use is enough (the usDRP, Nominet's DRS, the .io policy, the CNDRP, the auDRP, and .eu), a name registered innocently but later used to target you is still within reach.
• ACPA. The mark must have been distinctive (or famous) "at the time of registration of the domain name." Whether a later transfer counts as a registration depends on the circuit: no in the Ninth (GoPets); yes in the Third, Fourth, and Eleventh (Schmidheiny, Prudential, Jysk). Because in rem cases over .com names go to the Eastern District of Virginia, Fourth Circuit law usually governs them.
• CNDRP. The three-year bar runs from registration, so a .cn name registered in year one and discovered in year four is outside the administrative system.

Decision point. If the domain predates your rights, nothing has changed hands since, and nothing suggests the registrant anticipated your brand, stop: the honest options are buying the name (Step 7) or living without it. Filing anyway is the most common route to a reverse domain name hijacking finding.

Step 4: Find the registrant and test whether a court can reach it

Identification comes first, and the routes run roughly from cheapest to most expensive:

1. Read what is already public. The site's terms, privacy policy, checkout pages, and page source (analytics and advertising identifiers often repeat across a registrant's other sites), plus historical registration records and reverse lookups on any email address that ever appeared.
2. Ask the registrar. ICANN's permanent Registration Data Policy, which took effect on August 21, 2025, keeps personal data out of public records and leaves disclosure decisions to the registrar. ICANN's Registration Data Request Service, launched in November 2023, routes requests for free to the registrars that participate. Expect refusals as often as answers, and remember that some registrars forward the request to the registrant, which can trigger a quick transfer to a new holder.
3. Use European law for European names. Article 28 of the EU's NIS2 Directive requires registries and registrars in member states to answer lawful, substantiated access requests within 72 hours.
4. File a UDRP. The registrar must confirm the registrant's identity to the provider within two business days, and providers pass registrar-confirmed data to complainants so they can amend. That is how Prudential learned who owned pru.com before it changed course and sued in Virginia.
5. Sue a Doe defendant. A complaint plus a motion for expedited discovery under Fed. R. Civ. P. 26(d) supports subpoenas to the registrar, the privacy service, and the payment processors under Fed. R. Civ. P. 45. See Identifying an Anonymous Defendant Online: A Practical Guide and, for the motion papers, John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash.

Then ask whether a U.S. court can reach the person you found. Specific jurisdiction over an online actor turns on targeting, not mere accessibility. Zippo Manufacturing Co. v. Zippo Dot Com, Inc., 952 F. Supp. 1119 (W.D. Pa. 1997), introduced the sliding scale of website interactivity; the Fourth Circuit, whose law governs most in rem cases, asks whether the defendant directed electronic activity into the state with the manifested intent of doing business there, in ALS Scan, Inc. v. Digital Service Consultants, Inc., 293 F.3d 707 (4th Cir. 2002); and Toys "R" Us requires deliberate targeting of the forum. A squatter's scheme aimed at a company in the forum can be enough under the effects test of Calder v. Jones, 465 U.S. 783 (1984), as the Ninth Circuit held in Panavision International, L.P. v. Toeppen, 141 F.3d 1316 (9th Cir. 1998). A foreign registrant that is not subject to jurisdiction in any single state, but has enough contacts with the United States as a whole, can be sued under Fed. R. Civ. P. 4(k)(2), as in Graduate Management Admission Council v. Raju, 241 F. Supp. 2d 589 (E.D. Va. 2003). Service abroad runs through the Hague Convention where it applies or through court-ordered alternatives under Rule 4(f)(3), including email (Rio Properties), and venue is rarely a problem because a defendant not resident in the United States may be sued in any district under 28 U.S.C. § 1391(c)(3). The full analysis is in Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor and Service of Process: Domestic and International Methods That Work.

Last, ask what a judgment would be worth. Look for U.S. assets, advertising revenue, payment accounts, and the registrant's other domains: a domain portfolio is itself property a judgment creditor can reach, and in Office Depot, Inc. v. Zuccarini, 596 F.3d 696 (9th Cir. 2010), a creditor used Fed. R. Civ. P. 69 and a receiver under Fed. R. Civ. P. 66 to seize and auction a typosquatter's names, the court holding that domain names are located where the registry is for that purpose. See Collecting a Judgment: Discovery in Aid of Execution, Liens, Levies, and Garnishment.

Decision point. Reachable, collectible, and egregious: price an in personam case. Unreachable or unknown after diligence: in rem or an administrative proceeding. Reachable but not worth suing: an administrative proceeding, because in rem is closed to you. The statute allows in rem only when personal jurisdiction is unavailable, Alitalia treats the two tracks as mutually exclusive, and Prudential measures the question on the filing date. If you cannot tell, a UDRP filing or limited jurisdictional discovery will usually answer the question cheaply.

Step 5: Define the objective, then match the facts to a standard you can meet

Write down what the client actually needs before anyone drafts anything. The answer narrows the list again:

Then test the facts against each surviving forum's standard, because the forums do not measure the same things:

• Obvious abuse, a registered word mark, a new generic domain. The URS fits: clear and convincing evidence, with no genuine issue of material fact. Any plausible story from the registrant (a reseller, a dictionary meaning, a fan or criticism site) defeats it, and the URS Procedure tells examiners to deny such complaints. Use the URS only when you could win it in 500 words.
• Bad faith at registration and in use, and you want the name. The UDRP, on a preponderance standard.
• An innocent registration followed by bad-faith use. The UDRP's conjunctive test is the wrong tool. A disjunctive country-code policy works where available, and so does the ACPA, which reaches anyone who "registers, traffics in, or uses" a name with bad-faith intent; bad faith that arrives later counts, as in Virtual Works, Inc. v. Volkswagen of America, Inc., 238 F.3d 264 (4th Cir. 2001), and DSPT International, Inc. v. Nahum, 624 F.3d 1213 (9th Cir. 2010).
• Good-faith registration, infringing use. A foreign business with the same name that now sells into the United States may not be a cybersquatter at all. An infringement theory, available in rem under Harrods, can still work, but Abitron Austria GmbH v. Hetronic International, Inc., 600 U.S. 412 (2023), confines the infringement provisions to domestic use in commerce, so build the record of U.S.-directed use.
• Criticism, fan, and reseller sites. Most forums fail. Noncommercial criticism defeated the ACPA claim in Lamparello v. Falwell, 420 F.3d 309 (4th Cir. 2005); an injunction barring a broker from using LEXUS in any domain name was vacated as overbroad, because names like buy-a-lexus.com can be nominative fair use, in Toyota Motor Sales, U.S.A., Inc. v. Tabari, 610 F.3d 1171 (9th Cir. 2010); and UDRP panels have parallel rules for criticism sites and resellers (WIPO Overview 3.0 §§ 2.6, 2.8). The line is crossed when the "criticism" is leverage for money, as in People for the Ethical Treatment of Animals v. Doughney, 263 F.3d 359 (4th Cir. 2001). See Asserting or Defeating a Trademark Fair Use Defense: A Practical Guide.
• A personal name that is not a trademark. 15 U.S.C. § 8131 applies only to a registrant with the specific intent to profit by selling the name, and it awards no damages. The UDRP works only if the name functions as a mark.
• A dictionary word or a "generic.com" brand. After U.S. Patent & Trademark Office v. Booking.com B.V., 591 U.S. 549 (2020), a generic.com term can be a registrable mark if consumers see it as a brand (examiners treat domain-name marks under TMEP § 1215), but its protection is narrow, because consumers are slow to attribute similar names to a single source. UDRP panels likewise give registrants of dictionary words wide latitude (WIPO Overview 3.0 § 2.10). See Genericness, Genericide, and Acquired Distinctiveness: Where Trademark Protection Begins and Ends.

Step 6: Price each option, including the other side's next move

Price the whole path, not the first filing. A UDRP that ends with the registrant suing within ten business days becomes a federal case. A URS won by default can be reopened for six months, and six more on request. A default judgment in rem is usually the end of the matter, but an in personam judgment against a squatter with no reachable assets is a framed certificate. The fees and timelines for each option are collected in the tables below.

Fee-shifting runs both ways and belongs in the price. A prevailing party in an "exceptional" Lanham Act case may recover attorney's fees under 15 U.S.C. § 1117(a), judged by the totality of the circumstances under Octane Fitness, LLC v. ICON Health & Fitness, Inc., 572 U.S. 545 (2014); see Lanham Act Attorney's Fees Under 15 U.S.C. § 1117(a): A Practical Guide. A trademark owner whose knowing and material misrepresentation causes a registrar to suspend or transfer a name owes the registrant damages, costs, and fees under 15 U.S.C. § 1114(2)(D)(iv). The CDRP lets a panel award a registrant up to CAD $5,000 against a complainant that acted without colour of right, and two abusive URS complaints bar a complainant from the URS for a year.

Step 7: Decide whether to write first, buy, or file

Three choices, each with a cost:

• File first when bad faith is plain, when the registrant is likely to move the name, or when there is fraud. Filing freezes the name: a UDRP lock must be in place within two business days of the provider's request, the Policy bars transfers to a new holder while the case is pending and for 15 business days after it ends (Policy ¶ 8), and an in rem filing obliges the registrar or registry to deposit control of the name with the court and leave it alone under 15 U.S.C. § 1125(d)(2)(D)(i). A demand letter does none of that, and its main effect on a professional squatter is a quick transfer of the domain to a new holder in another country, which domain lawyers call cyberflight.
• Write first when the registrant may be legitimate, when the name predates your rights, when there is a prior relationship (a former distributor, agency, or employee), or when you would rather buy. See Trademark Cease-and-Desist Letters: Sending and Responding: A Practical Guide.
• Buy when the holder had the name first, when the price is below the cost of the cheapest procedure you would win, or when speed matters more than principle. Approach through an anonymous broker, set a walk-away price before the first offer, close through domain escrow, and paper the deal: the seller's warranty that it is the registrant and has not sold or licensed the name, transfer mechanics and deadlines, a release, and a covenant not to register variants. See Escrow Agreement Review Checklist and Drafting a Settlement Agreement and Release: A Practical Guide.

Two evidence points shape this choice. Whatever the registrant says about price becomes evidence: a demand far above out-of-pocket costs is a listed bad-faith circumstance under Policy ¶ 4(b)(i) and one of the ACPA's nine factors, and in Prudential the registrant's claim to an anonymous broker that it had a six-figure offer helped prove bad faith. Fed. R. Evid. 408 bars using an offer to compromise a disputed claim to prove or disprove that claim in court, but a price quoted to a stranger before any claim exists is ordinarily not such an offer, and UDRP panels are not bound by the rule. In the other direction, a brand owner that tries to buy, fails, and then files a weak complaint presents the "Plan B" pattern that panels cite when finding reverse domain name hijacking (WIPO Overview 3.0 § 4.16). If you might end up filing, make sure your outreach would read well as an exhibit.

Step 8: Sequence and combine procedures

The procedures are not mutually exclusive, and the best results usually come from running them in a deliberate order:

1. Abuse report, then URS, then UDRP. For a new-gTLD name you eventually want to own, the abuse report or the URS stops the harm in days. A URS determination does not prejudice either side in a later UDRP (URS Procedure ¶ 13), and a suspended name stays frozen in the current registrant's hands for the rest of its term, so it cannot be moved to a new holder while you prepare the UDRP. File before the registration expires, or the name drops back into the pool.
2. UDRP first, ACPA in reserve. If the registrant sues within the ten-day window, counterclaim under § 1125(d) for transfer and statutory damages. A registrant who has just filed suit in the mutual jurisdiction is in a poor position to dispute that court's power over a counterclaim arising from the same dispute.
3. UDRP as an investigative step, then court. In Prudential, the UDRP filing revealed who held pru.com. Prudential offered $50,000, was refused, sued the holder and the domain in the Eastern District of Virginia, and then withdrew the UDRP; the court dismissed the individual defendant for lack of personal jurisdiction and let the case proceed in rem, where Fourth Circuit law treated the 2017 purchase as a new registration. Watch for the reverse effect, though: if the unmasked registrant turns out to be reachable, the in rem door closes.
4. Court first. When you need damages, an injunction against future registrations, discovery, or relief against a serial squatter's whole portfolio, start in court. Under UDRP Rule 18, a panel may suspend, terminate, or decide a case when litigation is pending, so a parallel UDRP is usually money spent twice.
5. One evidence pack, several filings. A brand squatted across extensions needs a separate proceeding under each policy (a .io complaint and an .ai complaint go separately even at the same provider), but one shared exhibit set. Within the UDRP, one complaint can cover several names held by the same registrant (Rule 3(c)), and panels allow consolidation against nominally different registrants under common control (WIPO Overview 3.0 § 4.11.2).
6. The German sequence. DISPUTE entry first, then a warning letter, then a preliminary injunction if needed, then a deletion order that delivers the name to you through the entry.
7. Doe suit, then name the defendant or change tracks. Start in personam against a Doe, subpoena the registrar, and amend under Fed. R. Civ. P. 15 once the registrant is known. If the registrant proves unreachable, the in rem claim belongs in the registry's or registrar's district; a court can sometimes transfer a case filed in the wrong venue under 28 U.S.C. § 1406(a), but do not plan on it.

Step 9: Prepare the filing for the procedure you chose

Each forum has its own paperwork, and the mistakes are predictable. Templates for all of them are in Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses.

• URS. The Forum handles most cases. The online form asks for the parties, the domain names, the word mark with its registration and proof of current use (a Trademark Clearinghouse record with proof of use, or a declaration and specimen), a statement of no more than 500 words, attachments such as screenshots and the registration certificate, and an attestation that the complaint is not filed for an improper purpose. The Forum's fee is $375 for up to 14 names. Draft it as the only complaint you will get, because the URS was built around a single, final pleading.
• UDRP. Rule 3(b) lists the contents: the parties, the registrar, the domain names, the marks, argument and evidence on each element of Policy ¶ 4(a), the remedy, the panel size, a submission to at least one mutual jurisdiction (the registrar's principal office or the registrant's address in the registration data), any related legal proceedings, and the required certification. Under Rule 11, the proceeding runs in the language of the registration agreement unless the parties agree or the panel decides otherwise, which matters with registrars in China, Korea, and Japan. The mechanics are in How to File a UDRP Complaint for Domain Name Disputes and Filing a UDRP Domain Name Complaint: A Practical Checklist.
• Country-code policies. Use the registry's own form and designated provider, prove eligibility where transfer depends on it, budget for translation when the proceeding runs in the language of the registration agreement, and compute any time bar from the registration date. For .de, the DISPUTE entry application needs evidence of your right to the name.
• In rem. Send the statutory notice of the alleged violation and of your intent to proceed in rem to the registrant's postal and email addresses (§ 1125(d)(2)(A)(ii)(II)(aa)), then wait comfortably longer than the eight days rejected in Lucent. File a verified complaint naming the domain as the defendant, pleading the trademark claims and the facts that make in rem jurisdiction available, with a declaration of the notice and diligence steps under 28 U.S.C. § 1746; the civil filing fee is $405. Send a file-stamped copy to the registrar or registry the day you file, which obliges it to deposit the registrar certificate and freeze the name. Move promptly for an order directing publication. Judges in the same district have disagreed about whether publication can be excused when the registrant actually received notice: Banco Inverlat, S.A. v. www.inverlat.com, 112 F. Supp. 2d 521 (E.D. Va. 2000), said yes, and Shri Ram Chandra Mission v. Sahajmarg.org, 139 F. Supp. 2d 721 (E.D. Va. 2001), said publication is mandatory. Publish anyway. Then request entry of default and move for default judgment under Fed. R. Civ. P. 55, with a proposed order directing the transfer.
• In personam. Plead the ACPA claim against the nine bad-faith factors, add any infringement, dilution, or § 8131 claims, allege the jurisdictional facts that show targeting, include a service plan, and add TRO papers if the harm is ongoing. The election of statutory damages can wait until any time before final judgment under § 1117(d).
• Registrant's suit. See Part two, Step 7.

Step 10: After the decision: implement, secure, and watch

If you won, finish the job:

• UDRP. The registrar implements the decision ten business days after the provider notifies it, unless it receives a file-stamped complaint in time. The name usually lands in an account at the registrar of record; move it to your corporate registrar once any transfer lock lapses, renew it for several years, and put it under a registry lock.
• URS. The suspension runs to the end of the registration term, plus one optional year at commercial rates. Calendar the expiry and either backorder the name or file a UDRP before it lapses.
• Court judgment. Serve the order on both the registrar and the registry. If a foreign registrar refuses to comply, ask the court to direct the registry, as in GlobalSantaFe and America Online, Inc. v. AOL.org, 259 F. Supp. 2d 449 (E.D. Va. 2003), and remember that Fed. R. Civ. P. 70 lets the court appoint someone else to perform an act the judgment requires.
• Prevention. Record the mark in the Trademark Clearinghouse, subscribe to a watch service, register the core country codes before the next launch, and keep registrar accounts in the company's name with two-factor authentication. For a broader program, see Brand Protection Online: A Strategic Guide for Businesses.

If you lost, check the exits before choosing one. A UDRP complainant can refile only in narrow circumstances, such as material new evidence that was reasonably unavailable the first time (WIPO Overview 3.0 § 4.18), but a court remains open and owes the panel no deference. A URS complainant can appeal within 14 days or file a UDRP. Nominet's DRS allows an appeal to a three-expert panel on notice within ten working days. A party that loses in federal court has 30 days to appeal under Fed. R. App. P. 4.

Part two: the registrant's path, step by step

A complaint against your domain is an accusation, not a verdict. People hold names for legitimate reasons (a surname, a dictionary word, a business older than the complainant's, an investment portfolio), and the procedures give them real defenses and sometimes real remedies. The same procedures are unforgiving to registrants who targeted a brand, so the first job is an honest read of your own facts.

Step 1: Read the notice and calendar every deadline today

• UDRP. The response is due 20 days after the proceeding formally commences (Rule 5(a)). Ask for the automatic four-day extension under Rule 5(b) if you need it; anything longer requires the complainant's agreement or exceptional circumstances.
• URS. You have 14 days, extendable by up to seven on a good-faith request, and the response is limited to 2,500 words. There is no response fee unless the complaint names 15 or more domains.
• Country-code policies. Each sets its own clock; Nominet's DRS, for example, allows 15 working days.
• In rem. The court's publication order sets the date by which you must appear, and the registrar has already frozen the name.
• In personam. You have 21 days after service to answer or move under Fed. R. Civ. P. 12, longer if you waived service.

While you are calendaring, note which provider and which mutual jurisdiction the complainant chose. The mutual jurisdiction is where you will have to sue to stop a transfer, and it decides which circuit's law applies if you do.

Step 2: Freeze your own conduct

Do not sell the name, transfer it, or move it to another registrar; Policy ¶ 8 forbids it, and the lock prevents it anyway. Do not change the registration details or restructure who owns the name: in Prudential, the registrant's two changes to its contact data after the UDRP was filed counted toward bad faith. Do capture your current site and parking page before you change anything, and then switch off any pay-per-click categories that track the complainant's business, because panels treat automatically generated links as the registrant's responsibility (WIPO Overview 3.0 § 3.5). And do not answer the complaint with a price; if you are willing to sell, say so through counsel in a settlement framework.

Step 3: Build the record of when, why, and how you use the name

Collect the registration or purchase receipt and every date that matters; the business plan, emails, and invoices showing use or demonstrable preparations to use the name before notice of the dispute (Policy ¶ 4(c)(i)); evidence that you are commonly known by the name (¶ 4(c)(ii)); proof of noncommercial or fair use (¶ 4(c)(iii)); dictionary and third-party uses of the term; and a clean profile of your other registrations. Put the facts in a declaration that complies with 28 U.S.C. § 1746, so the same document works in a later lawsuit. A domain investor should be ready to summarize the portfolio, because the first thing a panel or court asks is whether it is full of other people's brands; in court, a summary of voluminous records comes in under Fed. R. Evid. 1006.

Step 4: Choose among responding, settling, selling, and defaulting

Defaulting is cheap and usually fatal in a UDRP, because the panel decides on the complaint alone and may draw inferences from silence. In a URS, a default can be undone: you may file a response for de novo review up to six months after the notice of default, extendable by six more, and filing it restores the name's resolution while the lock stays on. Settling is common: providers routinely suspend a UDRP at the parties' joint request so they can negotiate, Rule 17 governs how a settlement ends the case, and a sale should come with a full release, including of ACPA damages, and no admission. Responding costs real money (a few thousand dollars for a simple UDRP response, more for a contested record), and if the case turns on judgment calls, consider electing a three-member panel under Rule 5, in which case you pay half the fee for the three-member panel.

Step 5: Respond to the standard the forum actually applies

• UDRP. The complainant must prove all three elements, so one clean defense is enough. The strongest are a registration that predates the complainant's rights (WIPO Overview 3.0 § 3.8), a legitimate interest under Policy ¶ 4(c), and the conjunctive requirement that the name was both registered and used in bad faith.
• URS. You do not have to win; you only need to show a genuine issue of material fact. The URS Procedure lists defenses that include fair use of a generic or descriptive term and tribute or criticism sites, and it states that trading in domain names, holding a large portfolio, and parking a name with pay-per-click links are not, by themselves, evidence of bad faith. Suppose Fernhill, a bakery in Ohio, receives a URS complaint over fernhill.shop from a software company called Fernhill: three paragraphs, a photo of the storefront, and the 2021 registration receipt should end the case.
• Country-code policies. Read the policy's own defenses. Nominet's DRS, for instance, expressly recognizes that trading in domain names and holding large portfolios are lawful activities in themselves, and the CDRP places the burden of proving a legitimate interest on the registrant only after the complainant has offered some evidence that it lacks one.
• Court. Answer or move as you would in any federal case; see Drafting an Answer and Affirmative Defenses: A Practical Guide.

Step 6: Ask for a reverse domain name hijacking finding when the facts support it

Under UDRP Rule 15(e), a panel that finds a complaint was brought in bad faith, for example as an attempt at reverse domain name hijacking, must say so. The circumstances panels rely on include a complainant that knew or should have known it could not prove an element (most often because the domain predates its mark), a "Plan B" complaint filed after a failed purchase attempt, omission of material facts, and a represented complainant that should have known better (WIPO Overview 3.0 § 4.16). Ask for the finding expressly and support it with dates. Under the UDRP, it brings no fee award, only a published rebuke; the CDRP can add a costs award, and abusive URS complainants can lose access to the URS.

Step 7: If you lose, sue within ten business days, or use the URS exits

The UDRP gives you ten business days after the provider notifies the registrar of the decision. Within that window, the registrar must receive official documentation, such as a file-stamped complaint, showing that you have sued the complainant in a jurisdiction to which it submitted under Rule 3(b)(xiii); otherwise the transfer happens (Policy ¶ 4(k)). Work the window like a deadline in a trial:

1. Day of the decision. Confirm the mutual jurisdiction the complainant designated, retain local counsel there, and pull your Step 3 record into a complaint.
2. Plead the right claims. Sue under 15 U.S.C. § 1114(2)(D)(v), which requires notice to the mark owner, for a declaration that your registration and use are not unlawful and an order keeping or returning the name; add a declaratory judgment count under 28 U.S.C. § 2201 and Fed. R. Civ. P. 57; and consider a § 1114(2)(D)(iv) claim if a knowing, material misrepresentation led the registrar to act against the name.
3. File, then deliver. Send the file-stamped complaint to the registrar's legal contact the same day and get written confirmation that implementation is on hold. Storey holds that you may sue elsewhere, but only a suit in the agreed forum stops the registrar.

The law behind the suit is favorable to registrants with clean facts. A transfer order creates a live controversy even if the trademark owner disclaims any intent to sue, Sallen v. Corinthians Licenciamentos LTDA, 273 F.3d 14 (1st Cir. 2001); the court applies U.S. law and owes the panel no deference (Barcelona.com); UDRP decisions get none of the deference given to arbitral awards, Dluhos v. Strasberg, 321 F.3d 365 (3d Cir. 2003); and a registrant whose name was moved through a foreign court can still sue the mark owner here, Hawes v. Network Solutions, Inc., 337 F.3d 377 (4th Cir. 2003). Registrants who have received only a demand letter can sometimes sue first for a declaratory judgment if the dispute is concrete and immediate under MedImmune, Inc. v. Genentech, Inc., 549 U.S. 118 (2007); see Filing or Defending a Declaratory Judgment Action: A Practical Guide.

For a URS, appeal within 14 days to a de novo appeal panel (new evidence is limited and costs extra), or, if you defaulted, file a response within the review window. For the .io policy, the court that can stop a transfer is in England, not the United States.

Step 8: Weigh the counterclaim before you file

A registrant's suit invites an ACPA counterclaim with statutory damages of up to $100,000 per name, and a losing registrant can face a fee award. In Lahoti, the registrant who sued to recover vericheck.com was held liable for cybersquatting, and in Web-adviso v. Trump, 927 F. Supp. 2d 32 (E.D.N.Y. 2013), a domainer seeking a declaration about Trump-formative names lost on the counterclaim. Before filing, score yourself honestly on the nine statutory factors in § 1125(d)(1)(B)(i), and remember that the safe harbor for a registrant who reasonably believed its use was lawful does not protect one who acted even partly in bad faith (Virtual Works). The registrants who win, like the city-name holder in Barcelona.com, have a registration that predates the mark, a generic or geographic term, and no history of selling brands back to their owners.

Timelines, fees, and evidence at a glance

How long each procedure takes.

What each procedure costs. Provider fees as of mid-2025; confirm them before quoting a number.

What goes in the exhibit pack.

Worked example: five domains, five forums

Corvane Medical, Inc., a Minnesota maker of insulin-pump accessories, owns a U.S. registration for the word mark CORVANE (2019), a European Union trade mark (2020), and a Chinese registration (2021). On a Monday in March 2025, its brand team brings counsel the five domains from the opening of this guide, plus one more.

corvane-billing.com: fraud first. Registered three weeks earlier through a registrar in Southeast Asia behind a privacy service, the name is sending invoices with payment links to patients. Step 1 controls. Counsel captures the page and three phishing emails with full headers, reports to the registrar, the host, and the email provider, flags the page to the browser blocklists, and drafts a Doe complaint with a TRO motion asking the court to direct the registry to disable the name. The registrar suspends the domain on day two after a second report attaching the headers, and the TRO papers stay in the file. Because a suspension can be reversed, Corvane then files a UDRP at WIPO. An in rem action in the Eastern District of Virginia was available against an anonymous foreign registrant, but the UDRP cost a fraction as much and the registrant was unlikely to appear anywhere. It defaults, and the name transfers about eight weeks after filing.

corvane.shop: counterfeits. A storefront selling fake infusion-set clips in a new generic domain. Corvane does not want the name, only the store gone. The URS fits exactly: a registered word mark, an identical name, and use no examiner could excuse. The $375 fee and 500 words produce a suspension in about three weeks. Counsel calendars the expiration date and places a backorder.

corvane.us: parked abroad. Held by an individual in Romania and parked with pay-per-click links to diabetes supplies. The .us nexus rules require a U.S. presence this registrant lacks, so a nexus complaint is the cheapest route, but its likely result is cancellation, which returns the name to the open market. Corvane wants the name, so it files under the usDRP, where bad-faith registration or use is enough, and the parking page aimed at its field does the work.

corvane.cn: too old for the policy. Registered in 2021 by a Shenzhen company that holds hundreds of brand-name domains. The CNDRP's three-year bar has run, so the administrative route is closed; the choices are a Chinese lawsuit on Corvane's Chinese registration or a purchase. Corvane's distributor in China needs the name this year, a Chinese action would take longer and cost more, and after an anonymous broker's counteroffer the price lands well below that cost. Corvane buys through escrow, with a covenant against registering variants. Paying a squatter is distasteful; paying one less than it would cost to beat it is sometimes just arithmetic.

corvane.de: the former distributor. Registered by Corvane's former German distributor during the relationship and now forwarding to a competitor. There is no .de policy to invoke. Counsel applies for a DENIC DISPUTE entry based on the EU trade mark, sends a warning letter citing the mark and the distribution agreement's post-termination clause, and prepares a preliminary injunction application. The distributor releases the name within a month, and the DISPUTE entry makes Corvane the next holder automatically.

corvane.net: the case they did not file. Marketing also wanted a UDRP against corvane.net. Step 3 stopped it: the name was registered in 2008, eleven years before the mark, by a retired engineer whose family name is Corvane and who uses it for family email. Every forum would have denied the complaint, and a UDRP panel could have added a reverse domain name hijacking finding. Corvane made one polite offer, was declined, and moved on.

Six names, five different routes, and one decision not to file. Total provider fees and purchase costs came in under the cost of a single contested ACPA case, which is the point of choosing deliberately.

Common mistakes

Brand owners

• Starting a UDRP against a phishing domain instead of calling the abuse desks, and losing the week that mattered.
• Filing a URS against a .com or .net name, on a logo registration, or against a registrant with any plausible story.
• Skipping the three dates and filing against a name that predates the mark, which is the fastest route to a reverse domain name hijacking finding.
• Sending a demand letter to a professional squatter and watching the name move to a new holder before anything is locked.
• Trying to buy, failing, and then filing a weak complaint (the "Plan B" pattern).
• Choosing in rem when the registrant is reachable (Alitalia), filing it in the wrong district (Mattel), or filing too soon after the notice (Lucent).
• Treating a UDRP win as final before the ten business days have run, or letting a URS suspension lapse without a plan for the name.

Registrants

• Missing the 20-day UDRP or 14-day URS response deadline.
• Changing contact data, moving the name, or restructuring ownership after notice (Prudential).
• Answering the complaint with a price, or leaving pay-per-click links aimed at the complainant's industry.
• Suing outside the mutual jurisdiction, so the name transfers while the case is pending (Storey).
• Suing at all with a portfolio full of other companies' brands (Lahoti, Web-adviso).

Frequently asked questions

Can I file a UDRP and a lawsuit at the same time? You can, but under UDRP Rule 18 the panel may suspend or terminate the administrative case once litigation is pending, so the UDRP fee is usually wasted. Choose: the UDRP when you want the name cheaply, a court when you need money, an injunction, or discovery.

Is a URS worth filing if I want the domain? Only as a first step. The URS suspends but never transfers. If you want the name, follow the URS with a UDRP before the registration expires, or go straight to the UDRP.

Should I file with WIPO or the Forum? Both are experienced and fast. Compare their current fees, word limits in the supplemental rules, panelist lists, and language capacity. Some scholars argue that provider choice affects outcomes; see Daniel Klerman, Forum Selling and Domain-Name Disputes, 48 Loy. U. Chi. L.J. 561 (2016). A three-member panel costs more but dilutes the risk of one panelist's idiosyncratic view in a close case.

The registrant is in China and the domain is a .com. What are my options? A UDRP, possibly in Chinese if that is the language of the registration agreement, unless the panel orders otherwise; an in rem action in the Eastern District of Virginia, where the .com registry sits (CNN, Prudential); or an in personam case if the registrant targeted the United States, with service abroad that can take many months. See Serving Defendants in China: Methods and Strategy Under the Hague Service Convention.

Can I recover my legal fees? Not in a UDRP or URS. In court, fees are available in exceptional cases under § 1117(a), and statutory damages under § 1117(d) often matter more. In rem cases ordinarily produce no fee award, although one court awarded fees against a serial cybersquatter in Agri-Supply Co. v. Agrisupply.com, 457 F. Supp. 2d 660 (E.D. Va. 2006).

Can I use U.S. discovery to unmask a registrant for a proceeding abroad? For a foreign court case, such as a German suit over a .de name, 28 U.S.C. § 1782 can compel a U.S. registrar or privacy service to produce documents. After ZF Automotive US, Inc. v. Luxshare, Ltd., 596 U.S. 619 (2022), it does not reach private adjudicative bodies, which almost certainly includes UDRP panels. See Seeking or Opposing Section 1782 Discovery: A Practical Guide.

I lost a UDRP as the registrant. How fast must I act, and where? Within ten business days of the registrar's notice of the decision, file suit in a mutual-jurisdiction court the complainant designated, and deliver the file-stamped complaint to the registrar. Filing elsewhere is allowed (Storey) but will not stop the transfer.

What if a foreign registrar ignores a U.S. court order? Ask the court to direct the registry, which can disable the name (GlobalSantaFe), transfer it (AOL.org), or move it to a registrar the plaintiff selects (Agri-Supply). That works only when the registry is within the court's reach, which is why in rem is far stronger for .com, .net, and .org than for most country codes. For competing foreign orders, see Anti-Suit Injunctions and Parallel Proceedings: Racing to Judgment Across Borders.

Practical takeaways

• Triage first: DNS abuse goes to the abuse desks today; everything else waits for a deliberate choice.
• Let the extension set the menu, the three dates set the merits, and the registrant's reachability set the court options.
• Match the remedy to the need: suspension (URS), transfer (UDRP, country-code policy, in rem), money and injunctions (in personam), certainty (purchase).
• Price the whole path, including the other side's next move and fee-shifting in both directions.
• File first against squatters; write first, or buy, when the holder may be legitimate.
• Registrants: calendar the deadline, freeze your conduct, build the record, and if a transfer order is wrong, sue in the mutual jurisdiction within ten business days.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking: the doctrine behind every procedure in this guide.
• Domain Name Disputes: Cybersquatting, the ACPA, and the UDRP: the core framework for cybersquatting claims.
• How to File a UDRP Complaint for Domain Name Disputes: elements, evidence, and drafting for the UDRP.
• Top-Level Domain Names: An Overview: how generic and country-code spaces are organized.
• Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor: the analysis that decides between in personam and in rem.
• Unmasking Anonymous Online Speakers: John Doe Subpoenas, the Dendrite and Cahill Tests, and the First Amendment: the First Amendment tests a court applies before it orders a registrar to reveal who is behind a name.
• Trademark Liability Online: Keyword Advertising, Marketplaces, and Contributory Infringement After Tiffany v. eBay: intermediary liability beyond registrars.
• Genericness, Genericide, and Acquired Distinctiveness: Where Trademark Protection Begins and Ends: why dictionary-word domains are hard to take.
• Lanham Act Attorney's Fees Under 15 U.S.C. § 1117(a): A Practical Guide: fee-shifting for both sides.
• Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court: emergency orders against fraudulent domains.
• Counterfeiting, Seizure Orders, and Schedule A Litigation: Fighting Fakes in Federal Court: domain-disabling relief in counterfeiting cases.
• Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court: preserving the evidence before the site disappears.
• Collecting a Judgment: Discovery in Aid of Execution, Liens, Levies, and Garnishment: turning an ACPA judgment, or a squatter's portfolio, into money.
• Forum Selection, Transfer, and Parallel Proceedings: Choosing and Keeping the Court You Want: venue and transfer rules when the domain case is in the wrong court.
• Trademark Cease-and-Desist Letters: Sending and Responding: A Practical Guide: when to write before you file.

Related Guides

• Recovering a Domain Name: A Practical Guide: lapsed registrations, hijacked accounts, and former insiders.
• Identifying an Anonymous Defendant Online: A Practical Guide: expedited discovery and subpoenas to find the registrant.
• Enforcing Trademarks Against Online Sellers and Platforms: A Practical Guide: takedowns when the problem is a marketplace, not a domain.
• Asserting or Defeating a Trademark Fair Use Defense: A Practical Guide: the defenses behind reseller and criticism domains.
• Filing or Defending a Declaratory Judgment Action: A Practical Guide: the registrant's affirmative suit.
• Service of Process: Domestic and International Methods That Work: serving a foreign registrant.
• Drafting an Answer and Affirmative Defenses: A Practical Guide: responding to an ACPA complaint or counterclaim.
• Drafting a Settlement Agreement and Release: A Practical Guide: papering a domain sale or settlement.
• Seeking or Opposing Section 1782 Discovery: A Practical Guide: U.S. evidence for foreign domain litigation.

Related Checklists

• Domain Name Dispute Forum Selection Checklist: A Practical Checklist: this guide's decisions as a sequence of items to check.
• Domain Name Dispute Checklist: A Practical Checklist: the general dispute workflow.
• Filing a UDRP Domain Name Complaint: A Practical Checklist: UDRP filing mechanics.
• Serving a Foreign Defendant Under the Hague Convention: A Practical Checklist: service abroad in an in personam case.
• Escrow Agreement Review Checklist: reviewing escrow terms when you buy a name.

Related Toolkits

• Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses: templates for the filings described in Step 9.
• Domain Name Toolkit: UDRP Complaints, ACPA Pleadings, and Portfolio Management: core UDRP and ACPA templates.
• John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash: papers for unmasking an anonymous registrant.
• Online Trademark Enforcement Toolkit: Platform Notices, Test Purchase Records, and Contributory Liability Demands: notices and records for platform enforcement.
• Online Brand Protection Toolkit: A Strategic Roadmap and Resource Library: monitoring and prevention programs.