Two Instruments, Not Two Names for One Thing
A company facing a domain name that trades on its brand has two established routes. The Uniform Domain Name Dispute Resolution Policy is a contractual administrative proceeding, run by dispute-resolution providers under a policy every gTLD registrant agreed to at the point of registration. The Anticybersquatting Consumer Protection Act, at 15 U.S.C. 1125(d), is a federal cause of action decided by a court.
They are genuinely different instruments. Different elements have to be proved, they reach different conduct, and they award different things. Choosing between them on the basis of which one sounds faster, without reading what each requires, is how companies end up with an outcome they cannot use.
Two structural points are worth stating at the outset. The UDRP is not litigation and produces no judgment; a decision under it can be displaced by a court proceeding. And neither instrument is a general forum for arguing about who ought to have a name — both are trademark instruments, and a company with no rights in a mark has nothing to bring.
Where These Registrations Come From
The recognisable fact patterns are few:
- Typosquatting. A transposed letter, a doubled character, a missing hyphen, the same name at a different extension. Cheap to register at volume and monetised by traffic that was meant for somewhere else.
- Registrations made during a live dispute. A former distributor, franchisee or supplier registers a name incorporating the company's mark while a commercial argument is running, as a position to trade from.
- Registrations following a departure or a layoff. A former employee registers a complaint site, or a close variant of the corporate name, sometimes with working mail configured on it — which is a materially more serious problem than a parked page.
- Lapsed names caught at the drop. A defensive registration nobody renewed, picked up within seconds of release by a service that monitors expiring names.
- Names left behind by the company's own acquisitions, never consolidated, and eventually allowed to expire out of an account nobody was watching.
What matters legally is narrower than the story: what the registrant knew and intended at the time of registration, and what the name has been used for since. Both instruments turn on those two facts, in different ways.
The UDRP: What Has to Be Proved
Under Policy paragraph 4(a), a complainant has to prove all three of the following. That the domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights. That the registrant has no rights or legitimate interests in respect of the domain name. And that the domain name has been registered and is being used in bad faith.
Paragraph 4(b) sets out four non-exclusive circumstances evidencing bad faith registration and use: registration primarily to sell or transfer the name to the mark owner or a competitor for valuable consideration in excess of documented out-of-pocket costs; registration to prevent the mark owner from reflecting the mark in a corresponding domain, where there is a pattern of such conduct; registration primarily to disrupt the business of a competitor; and use to intentionally attract users by creating a likelihood of confusion with the complainant's mark as to source, sponsorship, affiliation or endorsement.
Paragraph 4(c) is the other side of the argument. A registrant can demonstrate rights or legitimate interests through bona fide use, or demonstrable preparations to use, the name in connection with a bona fide offering of goods or services before notice of the dispute; by being commonly known by the domain name even without trademark rights; or through legitimate non-commercial or fair use without intent for commercial gain.
The conjunction in the third element is what most complainants miss. Paragraph 4(a)(iii) requires bad faith registration and bad faith use — both. A name registered innocently years ago and later put to a bad-faith use does not fit the element as written. That is materially narrower than the ACPA. And paragraph 4(i) limits remedies to cancellation of the name or transfer of it to the complainant. There are no damages, and no relief that reaches anything beyond the domain name itself.
The ACPA: Bad Faith Intent to Profit
15 U.S.C. 1125(d)(1)(A) creates civil liability where a person has a bad faith intent to profit from a mark and registers, traffics in, or uses a domain name that is identical or confusingly similar to a distinctive mark, or identical, confusingly similar to, or dilutive of a famous mark. The list of conduct is disjunctive — registration, trafficking, or use, any one of which will do — which is the central structural difference from the UDRP.
Section 1125(d)(1)(B)(i) gives a court nine non-exclusive bad-faith factors to consider: the defendant's own trademark or other intellectual property rights in the name; whether the name is the defendant's legal name or a name otherwise commonly used to identify it; prior use of the name in connection with a bona fide offering of goods or services; bona fide non-commercial or fair use of the mark on a site accessible at the name; intent to divert consumers from the mark owner's online location in a way that could harm the goodwill represented by the mark; an offer to sell or transfer the name for financial gain without having used or intended to use it in a bona fide offering; provision of material and misleading false contact information when applying for the registration, or failure to maintain accurate contact information; registration or acquisition of multiple domain names known to be identical or confusingly similar to others' marks; and the extent to which the mark is or is not distinctive and famous.
Section 1125(d)(2) additionally provides an in rem action against the domain name itself where the registrant cannot be found or is beyond personal jurisdiction — a capability the UDRP does not need and an ordinary trademark action does not have. Its venue and notice requirements are detailed, and are a question to put to counsel rather than to assume.
On remedies, a successful plaintiff can obtain injunctive relief, and under 15 U.S.C. 1117(d) may elect statutory damages instead of actual damages and profits, of not less than 1,000 dollars and not more than 100,000 dollars per domain name, as the court considers just.
How Companies Choose Between Them
| UDRP | ACPA | |
|---|---|---|
| Nature | Contractual administrative proceeding on written submissions | Federal litigation, with pleadings, discovery and motion practice |
| Conduct reached | Registration and use in bad faith, conjunctively | Registration, trafficking in, or use, with bad faith intent to profit |
| Registrant unfindable | Provider obtains registrant data from the registrar on filing | In rem action against the name under 1125(d)(2) |
| Remedies | Cancellation or transfer only | Injunction, actual or statutory damages, and fees in appropriate cases |
| Outcome | Administrative decision, displaceable by a court | Judgment |
The trade is speed and cost against damages and precedent. The UDRP is decided on documents, without discovery or live testimony, and reaches any gTLD registrar in the world through the registration agreement. Where the only goal is to hold the name and the facts are clean, it is usually the proportionate instrument.
The ACPA is worth the expense in a narrower set of situations: where the registrant is a serial actor holding a portfolio of variants, where damages are genuinely worth pursuing, where the registrant cannot be found or served, where relief is needed against conduct that goes beyond the domain name, or where a documented court outcome has deterrent value against the next registrant. Where the facts are complicated — a registrant with an arguable interest, a name with an independent meaning, a history of negotiation — the UDRP is frequently the wrong first move, for the reason set out next.
Reverse Domain Name Hijacking, and the Cost of a Weak Complaint
A UDRP panel can find that a complaint was brought in bad faith to attempt to deprive a registrant of a domain name it is entitled to hold. That finding is reverse domain name hijacking, and it is a real outcome that a complainant can suffer, not a theoretical one.
It carries no monetary penalty. What it carries is publication. The decision is issued under the company's own name, it stays available, it is indexed, and it describes the company's conduct in those terms to anyone who searches the brand or the domain afterwards. For a company whose complaint was about protecting a reputation, that is a poor trade.
The recognisable circumstances are consistent: a complaint against a generic or descriptive name registered years before the company's rights in the mark arose; a complaint against a registrant with an obvious legitimate interest, such as a business commonly known by the name; or a complaint filed after an attempt to buy the name failed, where the filing reads as a substitute for the price. A weak complaint is worse than none, because it converts a private irritation into a published record, tells the registrant precisely how much the company wants the name, and hardens a position that might have been settled commercially. The decision to file is worth making on registration dates and use history, not on how annoying the registration feels.
What the Evidence Actually Is
These cases are decided on a small set of technical facts, and companies consistently underestimate how much of the outcome is fixed before anything is drafted.
- Registration and creation dates. Whether the domain was registered before or after the company's rights in the mark arose is the single most decisive fact in either instrument. A name registered first is very hard to characterise as registered in bad faith.
- Historical registration data. Who the registrant was at each point, and when it changed. Because current data is redacted, the archive is frequently the only route to identity and to a change of hands.
- Archived page content. What the name resolved to over time — a parked advertising page, a competitor's site, a redirect to the complainant, a genuine business, or nothing at all.
- DNS and mail history. Where the name servers pointed, whether MX records were ever configured, and whether the name was used to send mail.
- The registrant's other holdings. Portfolio and reverse-lookup analysis goes directly to the pattern circumstance in paragraph 4(b) and to the multiple-registrations factor in 1125(d)(1)(B)(i).
- The correspondence. An offer to sell, and the sum asked, relative to documented out-of-pocket costs.
One caution worth keeping straight: redacted registration data is not false contact information. The ACPA factor concerns material and misleading false data supplied at registration, or a failure to keep contact data accurate — not compliance with a redaction policy that applies to every registrant.
What Counsel Ends Up Needing Proved
A UDRP is decided entirely on a written record, which makes the exhibits the case: dated captures of what the domain resolved to, registration and DNS history, portfolio analysis of the registrant's other names, and a documented account of how each item was obtained. In court the same material has to be authenticated, and the question shifts from what the capture shows to whether the process that produced it can be shown to produce an accurate result. Those are technical questions rather than legal ones, and they are what an expert is engaged to examine, document and explain.
Preserve early, because this evidence decays faster than most. Parked pages change, name servers move, registrants transfer names to third parties once a complaint lands, and archived captures of a low-traffic domain may be sparse or missing entirely. Capturing the site as it currently stands with the date and method recorded, and pulling registration and DNS history at the moment the problem is noticed, is worth considerably more than a reconstruction attempted after the page has been changed. The same applies to correspondence: an emailed offer to sell is evidence of a paragraph 4(b) circumstance and of an ACPA bad-faith factor, and it disappears from mailboxes on retention schedules like anything else.
Frequently Asked Questions
Someone registered a domain name using our company name. What can we do about it?
Two routes exist, and they are not interchangeable. The UDRP is an administrative proceeding under the policy every gTLD registrant agreed to, decided on written submissions, and it awards transfer or cancellation of the name and nothing else. The ACPA, at 15 U.S.C. 1125(d), is a federal lawsuit reaching registration, trafficking, or use with a bad faith intent to profit, and it can produce an injunction and damages.
Which one fits depends on the registration date, the registrant's identity and location, what the name has been used for, and whether damages are worth pursuing. Establish those facts before filing anything.
Can we get damages from a cybersquatter?
Not through the UDRP, which limits remedies to cancellation or transfer of the domain name under paragraph 4(i). There is no damages award available in that forum at all.
Under the ACPA, 15 U.S.C. 1117(d) allows a plaintiff to elect statutory damages instead of actual damages and profits, of not less than 1,000 dollars and not more than 100,000 dollars per domain name, as the court considers just. The election matters because actual loss from a squatted domain is often impossible to prove — but it also means the figure is a matter of judicial discretion informed by the bad-faith factors, not a calculation the company controls.
What is typosquatting, and can we do anything about it?
Typosquatting is the registration of misspellings and near-variants of a name — a transposed letter, a doubled character, a missing hyphen, the same name at a different extension — to capture traffic intended for the original.
It is a recognisable pattern under both instruments, and the evidence tends to be strong: the variant has no independent meaning, the registrant has no rights in it, and it usually resolves to advertising or to a competitor. Where one registrant holds many such variants, the pattern circumstance in the UDRP and the multiple-registrations factor in the ACPA are directly engaged. Defensive registration of the obvious variants remains cheaper than either proceeding.
Can our company lose a UDRP that we file?
Yes, and it can lose in a way that is worse than never having filed. A panel can find reverse domain name hijacking — that the complaint was brought in bad faith to attempt to deprive a registrant of a name it is entitled to hold — and that finding is published as part of the decision, under the company's name.
The recognisable pattern is a complaint against a generic or descriptive name registered before the company's rights arose, or one filed after a purchase negotiation failed. The decision to file is worth making on the registration dates and the use history rather than on irritation.