The UDRP recovers a hijacked domain from a cybersquatter in roughly six weeks for a few thousand dollars, with no service of process and no jurisdictional fight. But it works only on clean cases: you must prove all three elements, and overreaching can earn you a published finding of reverse domain name hijacking. This checklist takes you from investigation to transfer. For the full doctrinal treatment, see How to File a UDRP Complaint for Domain Name Disputes; for the namespace itself, Top-Level Domain Names; and for the broader program, Brand Protection Online.

Phase 1 — Confirm the UDRP is the right tool

  • Confirm the disputed domain sits in a gTLD (or a ccTLD that has adopted the UDRP); check the governing policy for the specific TLD.
  • Confirm your goal is recovery of the domain (transfer or cancellation), not damages, discovery, or precedent.
  • Assess whether the facts are clear-cut cybersquatting with no plausible legitimate use; muddy, genuinely contested cases belong in court.
  • Decide whether ACPA litigation (15 U.S.C. § 1125(d)) is the better route — when you need money, discovery, in rem jurisdiction over the domain, or binding precedent.
  • Decide whether the lighter URS is enough — it suspends (does not transfer) a domain fast and cheaply, useful to stop an active phishing/fraud site.
  • Screen for reverse-domain-name-hijacking risk: does your mark predate the domain registration, is the term generic, or does the registrant have a colorable legitimate use?

WHY / traps. The UDRP is a sorting machine for obvious squatting; its ~85% complainant win rate reflects selection, not rubber-stamping. The fatal mismatch is filing where your trademark rights postdate the domain registration—bad-faith registration is then logically impossible, and you risk an RDNH finding. Remember the third element requires bad faith in both registration and use; a domain registered in good faith but later misused does not satisfy the UDRP (though it may satisfy the ACPA).

Phase 2 — Investigate and capture evidence by element

  • Pull and save the current WHOIS record (expect "Redacted for Privacy" under GDPR; you can still file).
  • Screenshot the live resolving page, dated and with the URL visible, before the registrant "cleans it up."
  • Pull Wayback Machine archives showing historical use or non-use.
  • Capture any offer to sell, ransom demand, or correspondence from the registrant.
  • Confirm the registration date of the domain and compare it to your mark's rights timeline.
  • Search the registrant's name across prior UDRP decisions to surface a pattern of squatting.
  • Element-one evidence (rights): registration certificate(s) and current status from USPTO Trademark Search; for common-law marks, secondary-meaning proof (sales, advertising, media).
  • Element-two evidence (no legitimate interest): WHOIS, page screenshots, proof the registrant is not commonly known by the name and was never licensed.
  • Element-three evidence (bad faith): dated screenshots of PPC/impersonation content, the sale offer, prior decisions, other trademark-matching registrations, false/proxy WHOIS data.

WHY / traps. Evidence is ephemeral—parked pages rotate ads and registrants tidy up when they sense a complaint. Capture everything the day you start, dated and with URLs visible. Organizing proof by element now makes drafting fast and complete later.

Phase 3 — Choose the provider and read the rules

  • Select a provider: WIPO (deepest jurisprudence; complex/high-value/international cases) or FORUM (efficient domestic squats), or another accredited center as appropriate.
  • Read the UDRP itself, the Rules of Procedure, and the provider's Supplemental Rules (word vs. page limits differ) before drafting a word.
  • Decide single- vs. three-member panel (three members buys insulation against an outlier decision in a serious, well-resourced case).
  • Confirm the current fee schedule with the provider.

WHY / traps. The substantive policy is uniform, but a complaint that ignores a provider's formatting or length rules can be bounced on administrative-compliance grounds before a panel ever reads it.

Phase 4 — Draft the complaint (element by element)

  • Include all Rule 3 required contents: request for UDRP decision; complainant/representative contact info; panel election; respondent info matched to WHOIS; the disputed domain(s) and registrar(s); the mark(s) and their goods/services; factual and legal grounds; remedy sought; other proceedings; mutual-jurisdiction statement; certification; and annexes.
  • Element one — attach the registration certificate (or secondary-meaning proof), do the side-by-side comparison, note the TLD is disregarded, and explain why added/typo'd terms fail to dispel confusion. Keep it tight.
  • Element two — state the prima facie case (not commonly known by the name, owns no marks, never licensed, no bona fide/fair use) with supporting annexes, and pre-rebut the registrant's likely legitimate-interest argument.
  • Element three — lay out the chronology, reach for the inference of knowledge (fame, recent launch, exact-mark typo), prove bad-faith use under ¶4(b), and—if the domain is inert—run the Telstra passive-holding analysis.
  • Cite the WIPO Overview 3.0 consensus views throughout.
  • Draft the mutual-jurisdiction statement (registrar's or registrant's location) and the certification waiving claims against the provider, panel, registrar, and registry except for deliberate wrongdoing.

WHY / traps. The complaint is your entire case—no hearing, no discovery, no reply in the ordinary proceeding. Match effort to where the fight is: do not pad element one when element three decides the case. The conjunctions matter: ¶4(a) is cumulative (fail one and you fail), and ¶4(b)(iii) says registered and used in bad faith.

Phase 5 — File, lock, and serve

  • File the complaint and annexes with the provider (not by serving the respondent — the provider serves).
  • Confirm the provider requests the registrar lock within two business days, before the registrant is notified, to prevent cyberflight.
  • Once the registrar discloses underlying WHOIS data behind a privacy shield, amend the complaint to name the actual respondent if needed.
  • Calendar the 20-day response window and watch for an automatic short extension request.

WHY / traps. Service and the lock are handled by the provider under the 2015 Rules—do not try to serve the respondent yourself. GDPR redaction only delays unmasking until after filing; it does not prevent recovery.

Phase 6 — After the decision

  • On a transfer order, note the registrar implements it after a ten-business-day window for the respondent to file court proceedings.
  • If the respondent sues in a mutual jurisdiction within the window, the transfer is stayed pending the court's review.
  • If no court action lands, confirm the transfer and that the domain has come home.
  • If you lose and still want the domain or damages, evaluate re-filing under the ACPA.

WHY / traps. A respondent default is not an automatic win—the panel must still find all three elements on the record. Conversely, most decisions stand because losing respondents rarely have the resources or defenses to fund a federal suit.

Common mistakes

  • Filing when your mark postdates the domain (no bad-faith registration possible) — invites an RDNH finding.
  • Trying to capture a "generic dictionary word" you do not exclusively own.
  • Failing to screenshot and archive evidence before the registrant alters the site.
  • Over-arguing element one while under-proving element three.
  • Ignoring the provider's Supplemental Rules and getting bounced on compliance.
  • Confusing the UDRP (transfer, no damages) with the ACPA (damages, discovery, in rem) or the URS (suspension only).

Primary authority

  • Policy and rules: Uniform Domain-Name Dispute-Resolution Policy (ICANN, eff. Jan. 1, 2000), ¶¶ 4(a)–(c); Rules for UDRP (Rules 2, 3, 4, 5, 15(e)); provider Supplemental Rules; URS; ICANN Temporary Specification for gTLD Registration Data.
  • Decisions/guidance: Telstra Corp. Ltd. v. Nuclear Marshmallows, WIPO Case No. D2000-0003 (passive holding); WIPO Jurisprudential Overview 3.0.
  • Statute (ACPA): 15 U.S.C. § 1125(d); remedies/damages, 15 U.S.C. § 1117(d)–(e); Sporty's Farm L.L.C. v. Sportsman's Market, Inc., 202 F.3d 489 (2d Cir. 2000).
  • Resources: WIPO Arbitration and Mediation Center (wipo.int); FORUM; USPTO Trademark Search (uspto.gov); Internet Archive Wayback Machine.

Provider fees, rosters, and rules change — confirm current figures before filing.

Related resources

This checklist is general information, not legal advice. Domain disputes turn on the governing policy for the specific TLD and on specific facts; consult qualified counsel before filing.