Summary. This checklist turns the choice among domain name dispute procedures into a sequence of concrete questions and tasks. It starts with emergency triage for phishing and fraud, then fixes the facts that decide every forum: the top-level domain and its governing policy, the dates of the mark and the registration, the remedy the client actually needs, and who and where the registrant is. Separate fit tests cover the UDRP, the Uniform Rapid Suspension System, the major country-code policies, the in personam and in rem actions under the ACPA, and buying the name. A registrant's section covers responding, requesting a reverse domain name hijacking finding, and suing within the UDRP's ten-business-day window. The checklist closes with sequencing rules for combining procedures, a cost and timing table, a decision record, common mistakes, an FAQ, and practical takeaways.

A payments company's general counsel forwards three screenshots on a Monday morning: quillfin.shop is harvesting customer passwords, quillfin.co.uk is parked with links to competitors, and quillfin.com, which the company never owned, has just been listed for sale at a price with two commas in it. Each name lives under a different rulebook, and the order in which you act matters as much as the forum you pick. This checklist is the sequence of questions we work through before anyone files anything, written so that the brand owner, the registrant, and the lawyer advising either one can use it.

How to use this checklist

The short answer

Seven questions pick the forum in most cases.

  1. Is someone being defrauded right now? Abuse reports go out today, and in a new generic top-level domain a URS complaint goes out with them.
  2. What space is the name in? A .com, a .shop, and a .co.uk name have different menus, and some country codes have no administrative procedure at all.
  3. Who was first? If the domain was registered before your trademark rights existed, no cybersquatting procedure fits, and the realistic options are purchase, coexistence, or a different name.
  4. What does the client need? Suspension stops harm, transfer delivers the name, and only a lawsuit delivers money, an injunction, or a judgment against a person.
  5. Can a U.S. court reach the registrant, and is there anything to collect? If yes and the conduct is egregious, sue in personam. If the registrant cannot be reached or found, sue the domain itself in rem where its registry or registrar sits.
  6. How clean is the case? Clean cases go to the URS or the UDRP, arguable ones to the UDRP or a court, and weak ones nowhere, because a weak complaint invites a reverse domain name hijacking finding.
  7. Are you the registrant? After a UDRP transfer decision you have ten business days to sue in the right court and stop the transfer.

Part 1: Triage for active harm (the first day)

  • Classify the use. Decide whether the domain is being used for phishing, malware, fake invoices or payment redirection, impersonation of your staff, counterfeit sales, or only parking and resale.
    • Phishing, malware, botnets, pharming, and spam used to deliver them are "DNS abuse" under amendments to ICANN's registrar and registry agreements that took effect in April 2024. Registrars and registry operators must take prompt mitigation action when they receive actionable evidence. A parked page with competitor links is not DNS abuse; it belongs in a dispute procedure.
  • Preserve before you report. Capture the page with the full URL, date, and time, the page source, email headers from any phishing messages, the registration data record, DNS and hosting data, and any payment details, using a method a witness can later describe.
  • Report to every intermediary at once. Send a documented abuse report to the registrar's published abuse contact, the registry operator, the hosting provider, any content delivery network, and the email provider used to send the phishing messages.
    • One report with evidence attached beats five without. Include the trademark registration, the impersonated page, the phishing URL, and a plain statement of the harm.
  • Report phishing URLs to the major browser blocklists and warn customers. Blocklisting can neutralize a phishing page within hours even when a registrar is slow.
  • If the name is in a new gTLD or .org, start the URS draft the same day. Once the provider finds the complaint compliant, the registry must lock the domain within 24 hours of the provider's notice, which stops any transfer or change while the case runs (URS Procedure ¶ 4.1).
  • Reserve emergency court relief for facts that justify it. A temporary restraining order under Fed. R. Civ. P. 65 against an identified or Doe registrant, with an order directed to the registrar or registry, is available when the harm is serious and a court has jurisdiction. In an in rem case, delivering a file-stamped complaint to the registrar freezes the registration by statute, 15 U.S.C. § 1125(d)(2)(D)(i), although the site keeps resolving.
  • Do not contact the registrant first in a fraud case. A fraudster who is warned moves the name, changes registrars, or registers the next variant.
  • Refer serious fraud to law enforcement. A felony committed using a domain name registered with knowingly false information carries an enhanced maximum sentence under 18 U.S.C. § 3559(g).

Part 2: Identify the space and its rulebook

  • Classify the top-level domain as one of five types: legacy generic (.com, .net, .org, .info, .biz); new generic, delegated since 2013 (.shop, .app, .xyz, .bank); a country code that applies the UDRP (.co, .ai); a country code with its own policy (.us, .uk, .ca, .eu, .cn, .au, .io); or a country code with no administrative procedure (.de).
  • Pull the registration data record and note the registrar of record, its IANA identifier, its abuse contact, the creation and expiry dates, the status codes, and the nameservers.
    • The Registration Data Access Protocol (RDAP) replaced WHOIS as the authoritative source for gTLD registration data in January 2025. Country codes vary.
  • Locate the registry operator and the registrar, with the city and state or country of each. That location decides where an in rem action can be filed.
  • Confirm whether the URS applies. It applies in every new gTLD and in the legacy spaces that took it on when their registry agreements were renewed, including .org. It does not apply to .com or .net.
  • For a country code, download the current policy, the procedural rules, and the provider's supplemental rules, and note each version date. Country-code policies change more often than the UDRP, and secondary sources lag behind them.
    • WIPO maintains a database of the policies country-code registries have adopted. Check it, then confirm on the registry's own site.
  • Note the language of the registration agreement. It sets the default language of a UDRP proceeding (UDRP Rules ¶ 11(a)) and of most country-code proceedings, and translation adds cost and delay.
  • Check eligibility rules that limit who may hold the name after a win. Transfer may require a U.S. nexus (.us), a Canadian presence (.ca), EU or EEA eligibility (.eu), or an Australian presence (.au). A complainant that cannot hold the name may get only cancellation.
  • Read the registrar's registration agreement for its choice-of-court clause. The courts of the registrar's principal office qualify as a UDRP "mutual jurisdiction" only if the registrant submitted to them in that agreement (UDRP Rules ¶ 1).

Part 3: Fix the dates and the rights

  • Build a date line with five entries: first use of the mark; the filing and registration dates of each relevant trademark; the creation date of the domain; the date the current holder acquired it; and the dates of any later transfers, registrar changes, or registrant changes.
    • Use historical WHOIS, archived captures, registrar transfer records, and marketplace sales data. The last entry is the one people forget, and it can decide an ACPA case.
  • If the domain predates your rights, stop and reassess. Panels do not find bad-faith registration of a name registered before the complainant had rights, unless the registrant targeted nascent rights it knew about, such as a leaked merger or an announced product launch. WIPO Jurisprudential Overview 3.0 § 3.8.
    • Filing anyway is the classic route to a reverse domain name hijacking finding. WIPO Overview 3.0 § 4.16.
  • Decide which date counts as the "registration" in each forum.
  • Confirm the type of mark. The URS accepts only word marks (registered and in current use, validated by a court, or protected by statute or treaty), so a logo or design registration will not carry a URS complaint. The UDRP accepts unregistered marks with proof of secondary meaning. WIPO Overview 3.0 § 1.3.
  • Check the Trademark Clearinghouse record. A Clearinghouse entry with validated proof of use satisfies the URS current-use requirement and powers sunrise and claims notices in new gTLDs. If the mark is not recorded, prepare a declaration and one specimen of current use.
  • Map the rights each country code recognizes. Nominet accepts rights enforceable under English law or otherwise, including unregistered goodwill. The .au policy counts company, business, and personal names. The .eu policy counts any right recognized or established by national or EU law. CIRA requires Canadian presence or a Canadian trademark registration for the word in the domain.
  • Confirm the mark qualifies for an in rem action. It must be registered in the USPTO or protected under 15 U.S.C. § 1125(a) or (c). A foreign registration with no U.S. use will not do.
  • For a personal name that is not a trademark, expect the UDRP to fail unless the name functions as a mark (WIPO Overview 3.0 § 1.5). The federal claim under 15 U.S.C. § 8131 requires a specific intent to profit by selling the name, and it offers injunctive relief and fees but no damages.

Part 4: Decide what the client actually needs

  • Rank the goals in writing: stop the harm now, recover the name, collect money, deter a repeat squatter, identify the person, or build a public record of abuse. Most clients want two of these, and the ranking picks the forum.
  • If stopping the harm is enough, prefer the abuse desks and, where it applies, the URS (or the usRS for .us). A URS suspension lasts for the rest of the registration term, and the complainant can extend it by one year.
  • If the client wants the name, the candidates are the UDRP, a country-code policy, an in rem action, an in personam action, and a purchase. The URS never transfers.
  • If the client wants money, only an in personam ACPA action will do. The plaintiff may elect statutory damages of $1,000 to $100,000 per domain name at any time before final judgment, 15 U.S.C. § 1117(d).
  • If the client wants the person's identity, remember that a UDRP filing often reveals it (the provider asks the registrar to confirm the registrant) and that a Doe lawsuit supports early subpoenas (Part 5).
  • Decide whether the client will actually use the name. A name you will not use still has to be renewed, secured, and watched; for a typo variant, cancellation or suspension may beat transfer.
  • Set the budget and the time tolerance, and get the client's approval before choosing. A five-figure in rem case is the wrong answer to a $1,500 problem, and a $375 URS is the wrong answer to a serial squatter with fifty names and a U.S. bank account.

Part 5: Find and locate the registrant

  • Record exactly what the public record shows, including any privacy or proxy service, and save it with the date.
  • Run the open-source investigation: historical WHOIS, reverse-WHOIS on email addresses and names, hosting and IP history, shared analytics and advertising identifiers, certificate transparency logs, payment and checkout trails, and marketplace listings.
  • Request the nonpublic data through ICANN's Registration Data Request Service (RDRS). ICANN launched it in November 2023 as a free, central place to ask for redacted gTLD registration data. Registrar participation is voluntary, and the disclosure decision stays with the registrar.
  • For EU registries and registrars, make a substantiated access request under Article 28 of the NIS2 Directive, which requires an answer to lawful, duly justified requests without undue delay and within 72 hours.
  • Decide whether filing will unmask the registrant for you. In a UDRP, the registrar's verification response names the underlying registrant, and the complainant may amend. The URS is less forgiving, so finish the investigation before filing one.
  • If you will sue, plan the subpoenas. A Doe complaint supports a motion for early discovery under Fed. R. Civ. P. 26(d) and subpoenas to registrars, privacy services, hosts, and payment processors under Fed. R. Civ. P. 45.
  • Place the registrant on a map. The country decides personal jurisdiction, service, collectability, and whether the in rem action is available. A registrant beyond the reach of any U.S. court is the reason the in rem action exists.
  • Search prior decisions against the registrant and its email address. Earlier UDRP and URS losses and a portfolio of other brands' names are pattern evidence under every policy and under the ACPA's bad-faith factors, 15 U.S.C. § 1125(d)(1)(B)(i)(VI) and (VIII).
  • Treat false contact data as evidence, not only an obstacle. It is itself a bad-faith factor, § 1125(d)(1)(B)(i)(VII), and it triggers the presumption of willfulness in § 1117(e).

Part 6: UDRP fit test

  • The space applies the UDRP: every gTLD, plus the country codes that adopted it, such as .co and .ai.
  • All three elements are provable on a preponderance: the domain is identical or confusingly similar to a mark in which the complainant has rights; the registrant has no rights or legitimate interests; and the domain was registered and is being used in bad faith.
  • Bad faith existed at registration, not only in the later use. The conjunctive test defeats complainants whose problem began after an innocent registration. The ACPA reaches that later conduct through its "uses" and "traffics in" language, Virtual Works, Inc. v. Volkswagen of America, Inc., 238 F.3d 264 (4th Cir. 2001); DSPT International, Inc. v. Nahum, 624 F.3d 1213 (9th Cir. 2010), and so do the disjunctive country-code tests.
  • Choose the provider deliberately (WIPO, the Forum, the Czech Arbitration Court, the Asian Domain Name Dispute Resolution Centre, CIIDRC, or the Arab Center for Dispute Resolution), comparing fees, language capacity, and the panelists each draws on. Provider fees run from roughly $1,300 to $5,000, depending on panel size and the number of names.
  • Choose the mutual jurisdiction as if you will litigate there, because the registrant can. Under UDRP Rules ¶ 3(b)(xiii), the complainant submits to the courts of the registrar's principal office or of the registrant's address in the registrar's records. The choice also selects the circuit law on re-registration (Part 3).
  • Consolidate where the rules allow it: several names against one registrant, or names held by nominally different registrants under common control.
  • Check for pending litigation. If a court case about the name is pending, the panel may suspend, terminate, or decide (UDRP Rules ¶ 18(a)).
  • Accept the limits. The UDRP gives no money and no injunction, and a court reviewing the dispute later owes the panel no deference, Barcelona.com, Inc. v. Excelentisimo Ayuntamiento de Barcelona, 330 F.3d 617 (4th Cir. 2003); Dluhos v. Strasberg, 321 F.3d 365 (3d Cir. 2003).

Part 7: URS fit test

  • The domain is in a space that offers the URS (Part 2).
  • The mark is a qualifying word mark: a valid national or regional registration in current use, a mark validated in court proceedings, or a mark protected by statute or treaty (URS Procedure ¶ 1.2.6.1).
  • The domain is identical or confusingly similar to that mark.
  • The abuse is obvious enough to survive clear-and-convincing review with no genuine issue of material fact. If the registrant could tell any plausible story (a reseller, a fan site, a descriptive use, criticism), the examiner must deny the complaint (URS Procedure ¶ 8).
  • The bad-faith facts fit the URS list: an offer to sell to the complainant or a competitor for more than out-of-pocket costs, a pattern of blocking registrations, disruption of a competitor's business, or confusion for commercial gain (URS Procedure ¶ 1.2.6.3). Phishing and impersonation pages are the clearest cases of all.
  • The case fits in 500 words. The free-text explanation is capped (URS Procedure ¶ 1.2.7). If you need more room, you need the UDRP.
  • Suspension is an acceptable result. The registry suspends the name for the balance of the term, the complainant may extend for one year at commercial rates, and the name then returns to the pool. If you want to own it, plan a UDRP after the suspension.
  • Budget the fee. At the Forum, a complaint costs $375 for 1 to 14 names, $400 for 15 to 30, and $500 for 31 to 50. The registrant pays a response fee only when 15 or more names are listed, refundable to the prevailing party.
  • Treat a default win as provisional. A registrant that defaulted may seek de novo review by filing a response within six months of the notice of default, extendable by six more months on request (URS Procedure ¶ 6.4).
  • Know the appeal route and its price. Either side may appeal within 14 days for de novo review (URS Procedure ¶ 12.4). At the Forum, an appeal costs $300 for one examiner or $950 for three, or $450 and $1,300 if the appellant adds new evidence, which must predate the complaint.
  • Sign the certification as if it matters, because it does. Two abusive complaints, or one deliberate material falsehood, bar a complainant from the URS for a year; two findings of deliberate material falsehood bar it permanently (URS Procedure ¶ 11).
  • For a .us name, consider the usRS, which uses the same short form and suspension remedy but requires bad faith in registration or use, not both.

Part 8: Country-code fit tests

.us

  • Check the registrant's nexus. A registrant that is not a U.S. citizen or resident, a U.S. organization, or a foreign entity with a bona fide U.S. presence can lose the name through a nexus complaint to the registry, with no trademark analysis at all.
  • Compare the usDRP with the usRS. Both ask for bad faith in registration or use, not both. The usDRP transfers or cancels; the usRS suspends, on clear and convincing evidence.
  • Keep the ACPA in view. A .us registrant usually has U.S. contacts, so an in personam case is more realistic than for most country codes.

.uk

  • Frame the complaint around Rights and an Abusive Registration. Registration or use that took unfair advantage of, or was unfairly detrimental to, the complainant's Rights is enough; there is no conjunctive trap.
  • File new cases with WIPO. Since 7 July 2026, the WIPO Arbitration and Mediation Center has administered newly filed Dispute Resolution Service cases. The DRS Policy, the expert panel, Nominet-facilitated mediation, and the fee schedule did not change, and cases filed before that date stay with Nominet until they finish.
  • Plan for mediation. If the registrant responds, a free mediation stage comes first, and many cases settle there.
  • Budget the fees: £200 for a summary decision when the registrant does not respond, £750 for a full expert decision, and £3,000 for an appeal to three experts, with VAT where chargeable.
  • Go to court for damages or an injunction against future registrations. British Telecommunications plc v. One in a Million Ltd. [1999] 1 WLR 903 (C.A.) remains the leading English authority.
  • Remember the deterrent. DRS experts can find that a complaint was brought in bad faith, so the weak-complaint warnings in Part 3 apply here too.

.ca

  • Confirm the complainant meets CIRA's Canadian Presence Requirements, or owns a Canadian trademark registration for the word in the domain. Without one, the CDRP is closed, which is a reason to register in Canada before you need to.
  • Prove bad-faith registration for one of the purposes the CDRP lists, and offer some evidence that the registrant lacks a legitimate interest; the registrant then bears the burden of proving one.
  • Price the downside. A panel that finds the complaint was brought unfairly and without colour of right can order the complainant to pay up to CAD $5,000 toward the registrant's costs.

.eu

  • Confirm eligibility for transfer: residence or establishment in the EU or EEA, or EU citizenship. Without it, the remedy is revocation.
  • Use the disjunctive test: a right recognized by national or EU law, plus either no rights or legitimate interest in the registrant or registration or use in bad faith (Regulation (EU) 2019/517).
  • Pick the provider and plan the language. The Czech Arbitration Court and WIPO both administer .eu ADR, and the case generally runs in the language of the registration agreement. The standard fee is EUR 1,300, and EURid has been discounting it through 2026.

.cn

  • Check the time bar first. CNDRP providers will not accept a complaint against a name registered more than three years earlier (two years before a 2019 revision).
  • Plan for a Chinese-language proceeding before CIETAC or the Hong Kong International Arbitration Centre, with translation in the budget.
  • For older registrations, plan Chinese litigation with local counsel.

.au

  • Use the broader rights definition (trademarks plus company, business, and personal names) and the test of registration or subsequent use in bad faith.
  • Confirm eligibility for transfer under auDA's licensing rules, and check names registered directly under .au (available since 2022) as well as .com.au.

.de

  • Place a DISPUTE entry with DENIC first. It blocks transfer to anyone else and makes you the next holder if the name is released. It lasts a year and can be extended.
  • Then send a demand or seek a preliminary injunction in a German court under trademark law or the name right in § 12 of the German Civil Code. Expect an order to release (delete) the name, which the DISPUTE entry turns into a transfer to you.

.io, .co, and .ai

  • For .io, use the .IO policy, a modified UDRP administered by WIPO that asks for bad faith in registration or use. A losing registrant who wants to block the transfer must sue in the courts of England. Because the United Kingdom has agreed to transfer sovereignty over the Chagos Archipelago to Mauritius, the long-term future of the IO code is uncertain, and no company should rely on a .io name as its only domain.
  • For .co and .ai, use the UDRP through WIPO, and check for typosquatting variants of the matching .com.
  • For all three, check whether the registrar sits in the United States, which opens an in rem option in the registrar's district.

Every other country code

  • Look up the policy in WIPO's database and on the registry's site. France, the Netherlands, Switzerland, India, Brazil, and Japan each run their own procedures, and some countries offer only their courts.
  • Retain local counsel wherever the only route is a national court.

Part 9: ACPA in personam fit test

Part 10: ACPA in rem fit test

Part 11: Purchase and negotiated outcomes

  • Set the ceiling before the first approach, and approach anonymously through a broker. Every reply is evidence. In Prudential, the registrant's claim to an anonymous buyer that it had received a six-figure offer helped establish bad faith.
  • Use escrow and a written agreement: a warranty that the seller is the registrant, no prior sales, licenses, or liens, transfer mechanics and deadlines, an assignment of any goodwill, and a release of claims. See Escrow Agreement Review Checklist.
  • Build registrar transfer locks into the timeline. Many registrars block transfers for a period after a change of registrant.
  • Do not follow a failed purchase with a weak complaint. A "Plan B" complaint without a plausible legal basis is a recognized ground for a reverse domain name hijacking finding (WIPO Overview 3.0 § 4.16).
  • Do not overstate your rights while negotiating. A knowing and material misrepresentation that causes a registrar to suspend or transfer a name is actionable under 15 U.S.C. § 1114(2)(D)(iv).
  • Consider coexistence or a different name when the holder is legitimate and the price is not.

Part 12: The registrant's side

  • Docket the response deadline the day notice arrives. UDRP: 20 days from commencement (UDRP Rules ¶ 5(a)), plus four calendar days granted automatically on request (¶ 5(b)). URS: 14 days, with up to seven more for good cause. Nominet DRS: 15 working days.
  • Do not sell, move, or change the name or its content after notice. The UDRP and URS locks prevent most changes anyway, and a change made to look legitimate after the fact persuades no one.
  • Assemble the registration story: original registration or purchase records, prior use and business plans, the reason the name was chosen, and every communication with the complainant.
  • Test the defenses: registration before the complainant's rights existed (WIPO Overview 3.0 § 3.8); a dictionary or descriptive term used for its ordinary meaning; a genuine business; genuine criticism (§ 2.6); and the absence of any targeting of the complainant.
  • Fix what you can before the panel looks. Turn off pay-per-click categories in the complainant's field, because panels hold registrants responsible for automatically generated links (§ 3.5), and stop any price talk that mentions the complainant.
  • Consider a three-member panel. A respondent may elect one even if the complainant chose a single panelist, and then shares the panel fee.
  • Ask for a reverse domain name hijacking finding when the facts fit (UDRP Rules ¶ 15(e); WIPO Overview 3.0 § 4.16): rights that postdate the registration, a Plan B complaint, omitted material facts, or false evidence. Panels hold represented complainants to a higher standard.
  • In a URS, respond within 14 days, ask for a finding that the complaint was abusive, and calendar both the 14-day appeal period and the default-review window.
  • In a CDRP case, ask for costs of up to CAD $5,000 if the complaint was brought without colour of right.
  • If you lose a UDRP and want to keep the name, sue within ten business days of the registrar's notice of the decision, in a mutual-jurisdiction court the complainant designated, and deliver the file-stamped complaint to the registrar (UDRP Policy ¶ 4(k)).
  • Read the circuit law of the mutual jurisdiction before filing. The registration-date rule in Part 3 may decide the case.
  • Audit your own record before suing. The trademark owner will counterclaim, likely as a compulsory counterclaim under Fed. R. Civ. P. 13(a), and registrants with poor records lose: Lahoti v. VeriCheck, Inc., 586 F.3d 1190 (9th Cir. 2009); Web-adviso v. Trump, 927 F. Supp. 2d 32 (E.D.N.Y. 2013).
  • If you discover an in rem default judgment against your name, move promptly under Fed. R. Civ. P. 60(b), or under Rule 55(c) before judgment, with a meritorious defense and an account of why notice failed.
  • When a demand letter arrives before any filing, answer it with the same care as a complaint, because it will be an exhibit. See Responding to a Trademark Cease-and-Desist Letter Checklist: A Practical Checklist.

Part 13: Sequencing and combining procedures

  • Run abuse reports and the URS in parallel. Neither waits for the other.
  • Use the URS first and the UDRP second when you need speed now and the name later. A URS determination has no preclusive effect on a later UDRP, and a suspended name cannot be moved while the UDRP runs.
  • Treat every administrative win as reviewable. Either party may go to court before, during, or after a UDRP (UDRP Policy ¶ 4(k)), and the court decides afresh, Parisi v. Netlearning, Inc., 139 F. Supp. 2d 745 (E.D. Va. 2001). In the Second Circuit's phrase, the registrant gets "two bites at the apple" (Storey).
  • Avoid parallel UDRP and court proceedings over the same name unless you are prepared for the panel to suspend or terminate (UDRP Rules ¶ 18(a)).
  • Never run in rem and in personam claims together (Alitalia), and choose in rem only after documenting why in personam is unavailable.
  • File separately under each policy when the names span several spaces. A .io, a .ai, and a .co.uk name need three complaints, even with identical evidence.
  • Do not plan on refiling a lost UDRP. Panels accept a refiled complaint only in narrow circumstances, such as material new evidence that was not reasonably available the first time.
  • Pair a country-code procedure with local court action where the policy is thin: a .de DISPUTE entry plus a preliminary injunction, or Chinese litigation after the .cn time bar.
  • Calendar the court deadlines too. A notice of appeal in most federal civil cases is due 30 days after judgment under Fed. R. App. P. 4.

Part 14: Cost, timing, and the decision record

Option Out-of-pocket All-in with counsel Time to result Result Review
UDRP $1,300 to $5,000 in provider fees About $5,000 to $15,000 45 to 60 days Transfer or cancellation Court action within 10 business days stops the transfer
URS From $375 About $1,500 to $3,500 3 to 4 weeks Suspension for the term, plus an optional year De novo appeal within 14 days; default review for up to a year
Nominet DRS £200 (summary) or £750 (full) Low four figures and up 1 to 3 months Transfer, suspension, cancellation, or amendment Three-expert appeal (£3,000)
Other country-code policies Low four figures in most Varies 1 to 3 months for most Whatever the policy allows Per policy, plus national courts
ACPA in personam Filing fee and service costs Six figures if contested 1 to 2 years Transfer, injunction, damages, fees in exceptional cases Appeal as of right
ACPA in rem Filing fee and publication Low-to-mid five figures if uncontested 3 to 6 months Forfeiture, cancellation, or transfer Appeal as of right
Purchase The price, broker commission, and escrow fee Modest Days to weeks The name, with contractual warranties Not applicable

Fees change. Confirm them with the provider before quoting a number to a client.

  • Write a one-page forum memo: the date line, the space and its rulebook, the registrant's identity and location, the goals in rank order, each option considered with the reason for choosing or rejecting it, the budget, the timeline, the risks (a reverse hijacking finding, a counterclaim, fee exposure), and the client's approval.
  • Docket every deadline from the moment of filing or notice, including the registrant's ten-business-day window if you are the complainant; the registrant's suit can arrive on day nine.
  • Set triggers to revisit the choice: the registrant appears, the name moves, a decision issues, or new variants appear.
  • Close the gap that let it happen. Register core country codes and obvious new gTLD variants before announcements, record the mark in the Trademark Clearinghouse, put a registry lock on core domains, and run a watch service. See Online Brand Protection Toolkit: A Strategic Roadmap and Resource Library and Brand Protection Online: A Strategic Guide for Businesses.

Common mistakes this checklist is designed to catch

  • Filing a URS against a .com or .net name, or relying on a logo registration the URS will not accept.
  • Filing any complaint against a name registered before the complainant's rights existed.
  • Following a failed anonymous purchase offer with a weak complaint.
  • Choosing a mutual jurisdiction without reading that circuit's law on re-registration.
  • Filing an in rem case where the company is based instead of where the registrar or registry sits (Mattel), or a week after sending notice (Lucent).
  • Suing the registrant and the domain at the same time (Alitalia).
  • Missing country-code gates: the .cn time bar, CIRA's presence rule, and the eligibility rules for holding .eu, .us, and .au names.
  • Expecting money from any administrative procedure.
  • For registrants: missing the ten-business-day window, suing in a court the complainant never designated, or bringing a declaratory action with a portfolio full of other companies' brands.

Frequently asked questions

Which procedure is fastest? For obvious abuse in a new gTLD, the URS, which usually takes about three weeks; a well-documented phishing report to the registrar can be faster still. For a transfer, the UDRP or a country-code policy, which typically takes one to two months.

Can we use the URS against a .com name? No. The URS applies to new gTLDs and to the legacy spaces, including .org, that adopted it when their registry agreements were renewed. For .com and .net, the options are the UDRP, the ACPA, or a purchase.

What if we cannot find out who the registrant is? Either file a UDRP and let the registrar's verification reveal the registrant, or, for a .com, .net, or .org name, document your diligence, send the statutory notice, wait a reasonable time, and sue the domain in rem in the Eastern District of Virginia.

Is it worth suing for statutory damages? Only when a U.S. court can reach the registrant, the conduct is bad enough to justify a meaningful award, and there is something to collect. Otherwise the judgment is a framed piece of paper.

We lost a UDRP. Is it over? No. A losing registrant has ten business days to file in a mutual-jurisdiction court and stop the transfer, and can sue later even after the name moves. A losing complainant can sue under the ACPA. The court gives the panel's decision no deference either way.

Do we need a trademark registration in the country whose code is involved? Not always. Nominet accepts unregistered goodwill, and the .eu policy accepts national rights. But CIRA requires a Canadian presence or a Canadian registration, and the .us, .eu, and .au eligibility rules can block a transfer to a foreign complainant.

Should we just buy it? If the registrant had the name first, uses it legitimately, or holds a dictionary term, usually yes. If it registered the name the day after your launch announcement, paying finances the next squatter, and a complaint is the better answer.

Practical takeaways

  • Sort the dispute by space first; the top-level domain sets the menu.
  • Build the date line before anything else, and stop if the domain came first.
  • Match the forum to the goal: suspension, transfer, money, or identity.
  • Use the URS and the abuse desks for speed, the UDRP and country-code policies for transfers, the in rem action for anonymous registrants of .com, .net, and .org, and in personam litigation only when money or deterrence justifies it.
  • Choose the mutual jurisdiction as if you will litigate there, because you may.
  • Registrants: docket the ten business days on the day the decision issues, and clean up your own record before you sue.
  • Put the choice and its reasons in a one-page memo the client signs.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Companion documents in this series

Related Articles

Related Guides

Related Checklists

Related Toolkits