Summary. Two systems for taking a domain name away, and when each works.

Why domain names broke trademark law

Trademark law was built for a world of markets and channels. Two companies could both be Delta — one an airline, one a faucet manufacturer — because consumers encountering an airplane and a bathroom fixture are not confused. Rights were divided by goods, by services, and by geography.

Domain names have none of that structure. There is exactly one delta.com. The first party to register it holds it, regardless of whether it makes airplanes, faucets, or nothing at all. The domain name system is first-come, first-served and globally unique, which is precisely what trademark law is not.

In the late 1990s this mismatch produced an industry. Individuals registered thousands of names corresponding to established brands and offered to sell them back at prices calibrated to be cheaper than litigation. Courts stretched existing doctrine to reach the conduct — infringement, dilution — with mixed results, because a registrant who merely parked a name was not obviously "using it in commerce" on any goods.

Two responses arrived in 1999, within months of each other, and both are still in force.

The Anticybersquatting Consumer Protection Act, codified at 15 U.S.C. § 1125(d), created a federal cause of action aimed specifically at bad-faith registration of domain names corresponding to marks.

The Uniform Domain-Name Dispute-Resolution Policy, adopted by the Internet Corporation for Assigned Names and Numbers, created a contractual arbitration system binding every registrant of a generic top-level domain through their registration agreement.

They coexist. Neither preempts the other. Choosing between them is the first strategic decision in any domain dispute.

The ACPA

The elements

A plaintiff must show:

  1. A mark that was distinctive or famous at the time the domain name was registered;
  2. A domain name that is identical or confusingly similar to that mark (or, for famous marks, dilutive of it); and
  3. A bad faith intent to profit from the mark.

The third element carries the weight. Registration of a confusingly similar domain is not itself unlawful — the statute targets the intent, and Congress supplied a nine-factor list to guide the inquiry:

  1. The registrant's own trademark or other intellectual property rights in the name
  2. Whether the name is the registrant's legal name or a common identifier
  3. The registrant's prior use of the name in connection with the bona fide offering of goods or services
  4. Bona fide noncommercial or fair use of the mark in a site accessible under the domain
  5. Intent to divert consumers in a way that could harm the mark's goodwill, for commercial gain or to tarnish
  6. Offers to sell the domain without having used it, or a pattern of such conduct
  7. Provision of material and misleading false contact information when applying to register
  8. Registration of multiple domain names known to be identical or confusingly similar to others' marks
  9. The extent to which the mark is distinctive or famous

The statute also contains an express safe harbor: bad faith shall not be found where the court determines the registrant believed and had reasonable grounds to believe the use was fair or otherwise lawful.

Factors six, seven, and eight are the ones that most often decide cases. A registrant who registered fifty names corresponding to well-known brands, hid behind false WHOIS data, and offered to sell them is a straightforward defendant. A registrant with a plausible independent reason for the name usually is not.

In rem jurisdiction

The ACPA's most unusual feature addresses a practical problem: many cybersquatters are anonymous, foreign, or both. Section 1125(d)(2) permits an in rem action against the domain name itself, filed in the judicial district where the domain name registrar, registry, or other domain name authority is located.

The action is available where the owner cannot obtain personal jurisdiction over the registrant, or cannot find the registrant after due diligence — which requires sending notice to the postal and email addresses in the WHOIS record and publishing notice as the court directs.

The remedy is limited. In an in rem action, the only relief available is forfeiture, cancellation, or transfer of the domain name. No damages. No fees. That limitation makes in rem a tool for recovering names, not for punishing registrants.

Because a substantial share of gTLD registries are located in Virginia, the Eastern District of Virginia has developed particular expertise in these actions.

Remedies

In a standard in personam action, the ACPA offers:

  • Injunctive relief, including transfer or cancellation of the domain, under 15 U.S.C. § 1116
  • Actual damages and the defendant's profits under 15 U.S.C. § 1117
  • Statutory damages of $1,000 to $100,000 per domain name, at the plaintiff's election — a provision that makes small cases viable and drives settlement
  • Attorney fees in exceptional cases

Statutory damages are the ACPA's teeth. A defendant holding twenty infringing domains faces theoretical exposure of $2 million without any proof of harm.

Registrar protection

Registrars occupy an awkward position: they hold the contractual relationship but have no ability to adjudicate rights. 15 U.S.C. § 1114(2)(D) protects them, providing that a registrar is not liable for damages for refusing to register, removing, transferring, or disabling a domain name in compliance with a court order or a reasonable policy prohibiting cybersquatting.

The same provision creates a cause of action running the other way: a registrant whose domain was suspended or transferred based on a knowing and material misrepresentation that the name was infringing may sue for injunctive relief and damages. This is the statutory hook for reverse domain name hijacking claims.

The UDRP

The UDRP is not law. It is a contract term. Every registrant of a domain in a generic top-level domain agrees, as a condition of registration, to submit to a mandatory administrative proceeding if a third party makes the required complaint.

The elements

A complainant must prove all three:

  1. The domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights;
  2. The registrant has no rights or legitimate interests in the domain name; and
  3. The domain name has been registered and is being used in bad faith.

The conjunctive third element is important and frequently misunderstood: both registration and use must be in bad faith. A name registered innocently and later used badly generally falls outside the UDRP, though panels have developed nuanced approaches to renewal and to changes in ownership.

The policy supplies non-exclusive examples of bad faith (acquisition primarily to sell to the mark owner; a pattern of blocking registrations; disruption of a competitor's business; attracting users for commercial gain by creating confusion) and of legitimate interests (bona fide offering of goods or services before notice of the dispute; being commonly known by the name; legitimate noncommercial or fair use without intent for commercial gain).

How the procedure works

  • Filing with an approved provider — the World Intellectual Property Organization Arbitration and Mediation Center and the Forum are the principal ones.
  • The registrar locks the domain upon notification, preventing transfer during the proceeding.
  • Response due within twenty days.
  • A panel of one or three neutrals is appointed.
  • Decision typically within about sixty days of filing.
  • Implementation: if transfer is ordered, the registrar waits ten business days; if the registrant files suit in a court of mutual jurisdiction in that window, implementation is stayed.

The remedy is transfer or cancellation. That is all. No damages, no fees, no injunction against future conduct.

Why anyone uses it

Cost and speed. A single-member UDRP proceeding costs on the order of a low four-figure filing fee plus preparation, and concludes in about two months. An ACPA case costs vastly more and takes years.

No jurisdictional problem. The registrant agreed to the process by registering. Anonymity and foreign residence are not obstacles.

Enforcement is automatic. The registrar implements the decision. There is no judgment to enforce.

The trade-off: no money, no precedent, and no finality — the losing registrant can go to court.

Choosing between them

Consideration UDRP ACPA
Cost Low four figures plus fees Six figures and up
Time ~60 days 1–3 years
Remedy Transfer or cancellation Transfer, damages, statutory damages, fees
Registrant anonymity Not an obstacle Requires in rem, which forfeits damages
Foreign registrant Not an obstacle Jurisdiction problem
Evidence Documents only; no discovery Full discovery
Finality Registrant may sue de novo Judgment
Precedent None; panels are persuasive only Binding

The practical rule: use the UDRP for straightforward cybersquatting where you want the name and nothing else. Use the ACPA where you want money, where the registrant is a serial offender worth deterring, where the facts are complex enough to need discovery, or where a UDRP loss needs to be undone.

A UDRP loss is not fatal. A complainant that loses may still sue under the ACPA, and the panel decision is not binding on the court.

What is not cybersquatting

A great many domain disputes are not cybersquatting at all, and treating them as such produces expensive failures.

Legitimate coexistence. Two businesses with the same name in different fields both have rights. Neither is squatting on the other.

The registrant's own name. A person named Marcus Delta registering delta.net has a factor-two defense.

Descriptive and generic terms. A domain consisting of ordinary words used descriptively is not a trademark violation. Owners of marks that are also common words have a persistently weak position outside their field.

Criticism sites. A site at brandnamesucks.com criticizing the brand is generally protected noncommercial expression. The analysis is harder where the domain is identical to the mark without a modifier, and panels and courts split.

Fan sites. Noncommercial fan use is often a legitimate interest, though monetization changes the picture.

Resellers and distributors. A reseller using the mark in a domain may have a legitimate interest if it actually sells the goods, uses the site to sell only those goods, and accurately discloses its relationship — the framework panels apply to authorized and unauthorized resellers alike.

Domain investing. Registering dictionary words, short strings, and generic terms for resale is a legitimate business. It becomes cybersquatting when the registrant targets specific marks.

Reverse domain name hijacking

The mirror-image abuse: a trademark owner using the dispute process to take a domain from a registrant with a legitimate claim to it.

Under the UDRP, a panel may make an express finding of reverse domain name hijacking where the complaint was brought in bad faith — for example, where the complainant knew the registrant had legitimate interests, where the mark postdates the domain registration, or where the complainant misrepresented facts. The finding carries no penalty beyond publication, but panel decisions are public and the finding follows the complainant.

Under the ACPA, 15 U.S.C. § 1114(2)(D)(v) gives a registrant whose domain was suspended or transferred a cause of action to establish that the registration is not unlawful, with injunctive relief including reactivation or transfer back.

The recurring fact pattern: a company adopts a brand in 2021, discovers the matching domain was registered in 2009, and files a UDRP complaint. It loses, because the domain could not have been registered in bad faith against a mark that did not exist — and may draw a hijacking finding for having filed at all.

Three disputes, three outcomes

The serial registrant

Halcyon Bakeware sells enameled cast iron under the mark HALCYON, registered since 2011. In 2025 its marketing team discovers eleven domains: halcyonbakeware.net, halcyon-bakeware.com, halcyonbakware.com, halycon-bakeware.com, and eight variants. All resolve to parked pages displaying advertisements for competing cookware. All are registered to a privacy service.

The analysis. This is the paradigm case. The mark is distinctive and predates the registrations. The names are confusingly similar, including deliberate misspellings — typosquatting. The parking pages divert consumers for commercial gain. The registrant holds eleven names targeting one mark, which is bad faith factor eight. The contact information is concealed.

The choice. Halcyon's counsel, Odalys Ferreira-Nunn, evaluates both routes.

A UDRP would take about sixty days and cost roughly $4,000 in fees for a consolidated single-panel complaint covering all eleven names, plus preparation. It would deliver the names.

An ACPA action would take two years and cost several hundred thousand dollars. It would deliver the names plus statutory damages — up to $1.1 million at $100,000 per name — but only if the registrant can be identified and served, and only if the registrant has assets.

What she does. Files the UDRP, wins in nine weeks, gets all eleven names. She also instructs the registrar to place the recovered names in Halcyon's defensive portfolio rather than letting them lapse.

Why not the ACPA. The registrant, once disclosed, turns out to be an individual in a jurisdiction where a United States judgment would be difficult to enforce. Statutory damages that cannot be collected are not worth two years and six figures. Odalys makes this recommendation in writing, which matters because the client's instinct was to "make an example" of the squatter.

The prior registrant

Vantablack Advisory LLC is a financial consultancy formed in 2023. It applies to register VANTABLACK ADVISORY as a mark and discovers that vantablack.com was registered in 2007 by a photographer who has used it for a portfolio site continuously since.

The analysis. Vantablack Advisory has no case, and filing one would be a mistake.

Under the UDRP, the third element requires that the domain have been registered and used in bad faith. A 2007 registration cannot have been made in bad faith against a mark first used in 2023. The complaint fails on its face, and a panel would likely enter a finding of reverse domain name hijacking, which is published and permanent.

Under the ACPA, the mark must have been distinctive at the time the domain name was registered. It was not.

What the company should do instead. Negotiate a purchase at arm's length, or select a different domain. The photographer holds a legitimate asset and is entitled to be paid for it if he chooses to sell.

The general lesson: the first question in every domain dispute is which came first. Counsel who skip it generate hijacking findings.

The former distributor

Kestrel Marine Systems appointed Tidewater Nautical as its exclusive Gulf Coast distributor in 2016. Tidewater registered kestrelmarinegulf.com with Kestrel's knowledge and used it for eight years. The distribution agreement terminated in 2024. Tidewater kept the domain and now redirects it to its own site selling a competing brand.

The analysis. This looks like cybersquatting and is not, exactly.

Bad faith at registration is missing. Tidewater registered the name with authorization, for a legitimate purpose, at a time when it was Kestrel's distributor. Under the UDRP's conjunctive test, the failure of the registration prong is usually fatal, though some panels have found bad faith where a registrant's use changes fundamentally after a relationship ends and the registration is renewed.

The better claims are contractual. The distribution agreement almost certainly addressed use of Kestrel's marks and what happens on termination. If it required assignment of domains incorporating the marks — as well-drafted distribution agreements do — this is a breach of contract case with specific performance as the remedy, and it is far stronger than a cybersquatting theory.

The trademark claims that do work. Redirecting a domain containing Kestrel's mark to a site selling a competitor's products is a straightforward infringement and false designation claim under 15 U.S.C. § 1114 and 15 U.S.C. § 1125(a). Post-termination use of a former principal's mark is one of the clearest infringement fact patterns there is.

The lesson for drafting: every distribution, franchise, reseller, agency, and development agreement should require that domains, social handles, app store listings, and advertising accounts incorporating the principal's marks be assigned on termination, with a power of attorney to effect the transfer if the counterparty will not cooperate.

Building the record before you file

Domain disputes are decided on documents. Both systems reward preparation and punish assertion.

Evidence the complainant needs:

  • Registration certificates and evidence of first use, establishing that the mark predates the domain registration.
  • Archived screenshots of the disputed site over time. The Internet Archive is the standard source, and panels accept it. Capture before you file — pages change the moment a complaint arrives.
  • WHOIS history, showing registration date, transfers, and any changes in registrant identity. Historical WHOIS services matter because a transfer can reset the relevant date.
  • Evidence of the registrant's other holdings, establishing a pattern under bad faith factor eight. Reverse-WHOIS searches identify portfolios held by the same registrant, email address, or nameserver.
  • Correspondence, including any offer to sell. An unsolicited offer at a price far above out-of-pocket cost is the single most useful document in a cybersquatting case.
  • Evidence of actual confusion, if any — misdirected customer emails are common and persuasive.
  • The registrar's identity and location, which determines the forum for an in rem action.

Evidence the registrant needs:

  • Prior use of the name in a bona fide offering, dated.
  • Independent derivation — why this name, from a source unrelated to the complainant.
  • Personal or business identity matching the name.
  • The complainant's mark timeline, if the mark postdates the registration.
  • Communications showing the complainant initiated contact, which undercuts a "registered to sell" theory.
  • Noncommercial character of any criticism or fan use.

A caution about pre-filing contact. A cease-and-desist letter tips the registrant, who may transfer the domain to a new registrant in a new jurisdiction — "cyberflight." Where the facts are clear and the registrant looks like a serial squatter, many practitioners file first and negotiate after the registrar lock is in place. Where the registrant may be legitimate, contact first, because filing against a legitimate holder is how hijacking findings happen.

Managing a domain portfolio

Most domain problems are prevented rather than litigated, and the prevention is administrative rather than legal.

Registration hygiene. The single most common corporate domain disaster is not cybersquatting — it is a lapsed renewal. A domain that expires enters a redemption period, then drops, and is often registered within seconds by a service monitoring expirations. Recovering it then costs far more than the renewal did.

  • Register in the company's name, never an employee's or an agency's.
  • Use a corporate registrar account with role-based access, not an individual's login.
  • Set auto-renew and keep a valid payment method; expired cards cause lapses.
  • Enable registrar lock and, for critical names, registry lock, which requires out-of-band verification for any change.
  • Maintain accurate contact records with a monitored role address, not a departed employee's mailbox.
  • Keep DNSSEC and registrar security features enabled where supported.

Defensive registration, sensibly scoped. Registering every conceivable variant is not economical. A workable scope:

  • The primary mark in .com and the relevant ccTLDs for markets where the company operates
  • Common typographical variants of the primary mark (transposition, omission, adjacent-key substitution)
  • Hyphenated and unhyphenated forms
  • The mark plus obvious modifiers used in the industry
  • Names matching product brands with real commercial significance

Beyond that, monitoring is cheaper than registration.

Monitoring. Commercial watch services alert on new registrations containing the mark or close variants across gTLDs and ccTLDs. Pair the alert with a triage rule so that clear abuse gets a UDRP and everything else gets a look before anyone writes a letter.

The Trademark Clearinghouse. For new gTLDs, recording a mark in the Clearinghouse provides sunrise registration rights and a notice service that alerts the mark owner when someone registers a matching name. It is inexpensive relative to a single dispute.

Handling recovered names. Names obtained through a dispute should be moved into the corporate portfolio and renewed, not allowed to lapse. A recovered name that drops will be re-registered by someone, and the second proceeding is not cheaper than the first.

Social handles and app listings. The same discipline applies to platform identifiers, which have no UDRP equivalent and are governed entirely by each platform's policies. Register them early; recovering them depends on platform goodwill rather than on law.

Beyond the .com: other domain spaces

Country-code domains. Each ccTLD registry sets its own policy. Some have adopted the UDRP directly. Some have adopted variants — for example, policies requiring only that registration or use be abusive, which is easier for complainants than the UDRP's conjunctive test. Some have local presence requirements that themselves prevent squatting. Others have no dispute procedure at all, leaving national courts as the only route. Determine the applicable policy before assuming any process exists.

New generic top-level domains. The expansion beyond the original handful created hundreds of new spaces. Practical consequences:

  • The URS is available in these spaces, offering rapid suspension at low cost with a clear-and-convincing standard.
  • Sunrise periods give Clearinghouse-recorded mark owners a window to register before general availability.
  • Some registries impose restrictions — professional credentials, geographic connection, community membership — that can be enforced through separate eligibility challenges.
  • Volume is unmanageable defensively. No company can register its mark in every space, which is why monitoring replaced blanket defensive registration.

Brand top-level domains. Some companies operate their own top-level domain. This eliminates squatting within that space entirely, at substantial cost and administrative burden, and is economical only for very large brands.

The practical implication: a global brand should decide, deliberately, which spaces it will defend and which it will only monitor. Attempting to defend all of them is how domain budgets are consumed without reducing risk.

Litigating an ACPA case

When money or deterrence matters enough to justify federal litigation, the case has a recognizable shape.

Pleading. A complaint typically pleads cybersquatting under 15 U.S.C. § 1125(d) alongside infringement under 15 U.S.C. § 1114 and false designation under § 1125(a), and dilution under § 1125(c) where the mark is famous. Pleading in the alternative matters: cybersquatting requires bad faith intent to profit, which infringement does not, and a defendant who defeats the bad faith element may still be liable for infringing use.

The in rem decision. If the registrant cannot be identified or served, the in rem route under § 1125(d)(2) is available — but it forfeits damages entirely. Before choosing it, exhaust identification: registrar disclosure, historical WHOIS, reverse-WHOIS on the email address, payment processor records, and the content of the site itself, which frequently reveals more than the registrant intends.

Venue. In personam actions follow ordinary venue rules under 28 U.S.C. § 1391. In rem actions must be filed where the registrar, registry, or other domain authority is located, which concentrates a large share of these cases in a small number of districts.

Discovery targets. Registration and renewal records; payment records identifying the registrant; the registrant's other domain holdings; communications with the mark owner or intermediaries; traffic and revenue data from parking or advertising services; and evidence of the registrant's knowledge of the mark.

The bad faith fight. Defendants build a record on the statutory safe harbor: a reasonable belief that the use was lawful. Plaintiffs build a record on factors six through eight: offers to sell, false contact information, and a pattern of registrations. Reverse-WHOIS evidence showing a portfolio of brand-matching names is the most persuasive single exhibit available.

Statutory damages strategy. Because the range is $1,000 to $100,000 per name, the plaintiff's election is usually made late, after discovery establishes the number of names and the defendant's conduct. Courts consider willfulness, the number of names, the defendant's profits, and deterrence. Awards at the top of the range are reserved for egregious serial conduct.

Collectability. The persistent practical problem. Many defendants are individuals abroad with no reachable assets. A judgment that cannot be enforced is worth less than the transfer a UDRP would have delivered in sixty days. Assess this before filing, not after judgment.

Fees. Available in exceptional cases, applying the same standard used in patent cases under the Octane Fitness framework, which courts have imported into Lanham Act fee practice. Both prevailing plaintiffs and prevailing defendants recover, and a hijacking-flavored case brought against a legitimate registrant is a genuine fee risk.

Buying a domain from its holder

A large share of domain problems end in a purchase rather than a proceeding, and the purchase has its own hazards.

Value the name honestly. A domain matching a distinctive brand held by a squatter is worth the cost of a UDRP — roughly a low five-figure sum all in — because that is the alternative. A domain consisting of a valuable generic word held by a legitimate investor is worth what the market pays for such names, which can be far more. Confusing the two categories produces either an overpayment or a failed negotiation.

Do not reveal the buyer's identity early. A brand owner who approaches directly will be quoted a brand owner's price. Brokers exist for this reason, and using one is standard rather than devious.

Confirm the seller can actually convey. Check the WHOIS registrant against the party negotiating. Domains are frequently offered by people who do not control them, and by resellers who have merely listed someone else's name.

Use escrow. Domain escrow services hold funds until the transfer completes at the registrar. Direct payment against a promise to transfer is how people lose money.

Document the transfer mechanically. The agreement should specify the registrar transfer process, the authorization code, the deadline, who bears transfer fees, and what happens if the transfer fails. It should also include a representation that the seller has not granted any conflicting rights and an assignment of any goodwill and associated intellectual property.

Address the traffic. A name with existing traffic may carry email addresses in use, inbound links, and search history. Plan for redirects, and consider requesting a period of forwarding.

Watch for the tax and accounting treatment. A purchased domain is typically a capitalized intangible asset rather than a deductible expense, and the characterization matters for larger purchases.

Consider whether purchase moots your rights. Buying a name from a squatter is sometimes criticized as rewarding the conduct. It is also frequently the cheapest outcome. Where the registrant is a serial offender likely to reappear with variants, a proceeding that produces a transfer order and a public record may be the better investment even at higher cost.

Frequently asked questions

Can a domain name itself be a trademark? Yes, if it functions as a source identifier for goods or services rather than merely as an address. Registration is available where the mark is used in commerce for the goods or services identified, subject to the ordinary distinctiveness requirements of 15 U.S.C. § 1052. A generic term plus a top-level domain is generally not registrable, though the Supreme Court has held that a generic-plus-.com term may be registrable where consumers perceive it as a brand rather than as a class of goods.

What if the domain resolves to nothing at all? Passive holding can still be bad faith use under the UDRP where the mark is well known, the registrant concealed its identity, and no plausible good-faith use is conceivable. Under the ACPA, non-use does not defeat the claim — the statute targets registration and trafficking with bad faith intent, not use in commerce on goods.

Do I need a registered trademark to file a UDRP? No. The policy requires "a trademark or service mark in which the complainant has rights," and panels accept unregistered common law rights supported by evidence of use and secondary meaning. A registration makes the first element trivial; without one, expect to prove the mark.

What happens if the registrant does not respond to a UDRP complaint? The panel decides on the complaint alone. Default is common and complainants usually win, but not automatically — the panel still requires that all three elements be established, and complaints that fail on the record are denied even against a silent registrant.

Can several domains be consolidated in one UDRP complaint? Yes, where they are held by the same registrant or by registrants shown to be under common control. Panels examine nameservers, contact details, site content, and registration patterns. Consolidation substantially reduces cost, so build the common-control record before filing.

Is a three-member panel worth the extra cost? Sometimes. A three-member panel costs several times a single-member panel and takes somewhat longer. It is worth considering where the case is genuinely contested, where the registrant has asserted legitimate interests, or where a respondent has elected three members and the complainant must share the cost regardless.

Can I get a domain if the registrant just parks it with ads? Often yes. Pay-per-click parking that displays advertisements for the mark owner's competitors is a classic bad faith use under both systems.

What if the WHOIS record is hidden behind a privacy service? Common and not an obstacle. Under the UDRP the registrar discloses the underlying registrant when a complaint is filed. Under the ACPA, hidden contact information supports the in rem route and is itself a bad-faith factor.

Does the ACPA reach country-code domains? Only in limited circumstances, since ccTLD registries are outside United States jurisdiction. Most ccTLDs have their own dispute policies, some modeled on the UDRP and some quite different.

What is the URS? The Uniform Rapid Suspension system, available in newer gTLDs, is a faster and cheaper procedure with a higher burden of proof. Its only remedy is suspension for the balance of the registration term — the name is not transferred. Useful for clear-cut abuse where you do not want the name.

How long does a UDRP take? About sixty days from filing to decision, plus ten business days before implementation.

Can I recover the domain and also sue for damages? Yes — win the UDRP for the name, then sue under the ACPA for money. The UDRP decision is not preclusive.

What if a former employee or contractor holds the domain? That is usually a contract and fiduciary problem rather than cybersquatting. The ACPA and UDRP both require bad faith targeting of a mark, which fits awkwardly where the registrant was authorized at the time. Breach of contract, conversion, and claims for unauthorized account access are usually stronger.

Where domain law is heading

Three pressures are reshaping practice, and none has settled.

WHOIS access after privacy regulation. Registration data that was once public is now largely redacted, and access for legitimate purposes runs through a request system rather than a lookup. The practical effect is a slower and more contested identification step: brand owners must request disclosure and may be refused, which pushes more disputes toward the UDRP, where the registrar discloses on filing, and toward in rem actions, where the identification problem is the predicate for jurisdiction rather than an obstacle to it.

Registrar and registry cooperation. Voluntary abuse-reporting mechanisms have expanded, and some registries now suspend names used for phishing, malware distribution, or clear-cut counterfeiting outside any formal dispute process. These are faster than the UDRP and free, and for security-driven abuse they are increasingly the first tool rather than the last. They do not transfer the name, and they depend entirely on registry discretion.

The volume problem in counterfeiting. Operations selling counterfeit goods rotate through hundreds of domains, registering new ones as fast as old ones are suspended. Neither the UDRP nor individual ACPA actions scale to that. The response has been consolidated federal litigation against large numbers of anonymous defendants with broad injunctive relief reaching registrars, registries, payment processors, and marketplaces — a procedure with its own substantial controversies about notice and due process, but one that reflects the mismatch between a per-name dispute system and an adversary operating at industrial scale.

What has not changed. The core analysis is stable and has been for twenty-five years: which came first, is there a legitimate interest, and was the registration aimed at the mark. A practitioner who answers those three questions accurately before filing will avoid nearly every serious mistake available in the field.

Related documents