This guide is for brand owners whose domain has been registered, hijacked, or used in bad faith. If the domain was stolen from your registrar account, start with the registrar recovery section. If a third party registered a lookalike domain, start with the route comparison. If you need damages, read the court section.
Quick answer: how to recover a cybersquatted domain
There is no single recovery route. The right route depends on what happened, which extension the domain is in, and what remedy you need. If the domain was stolen from your registrar account, the fastest route is usually the registrar and the Transfer Dispute Resolution Policy (TDRP). If a third party registered a domain that matches your trademark, the UDRP is the standard route for gTLDs, with URS available for clear-cut cases in new gTLDs and ccTLD policies for country-code extensions. If you need damages or an injunction, court proceedings — including an ACPA in rem action in the United States — may be the right route. The common thread is evidence: trademark rights, bad-faith registration or use, and a documented record.
Key facts at a glance
| Route | Scope | Remedy | Typical cost | Typical timeline |
|---|---|---|---|---|
| Registrar / TDRP | Unauthorized transfer | Return of domain | Low | Days to weeks |
| UDRP | gTLDs and selected ccTLDs | Transfer or cancellation | US$1,300–1,500+ | About two months |
| URS | New gTLDs | Suspension only | From ~US$360 | Weeks |
| ccTLD policies | .uk, .au, .ca, .eu, .in, .cn, .br, .us | Transfer or cancellation | Varies | 2–3 months |
| Court (ACPA) | US nexus; in rem or in personam | Transfer, damages, injunction | High | Months |
| Court (local) | Any jurisdiction | Damages, injunction, transfer | High | Months |
What counts as cybersquatting?
Typosquatting
Typosquatting is the registration of a domain that is a misspelling or slight variant of a trademark. Examples include arcelormittlal.com (missing “a”), michelinz.com (extra “z”), and lmagination.com (lowercase “L” replaced by “l”). Typosquatting is often combined with pay-per-click monetisation or phishing.
In Michelin, the panel found michelinz.com was a typosquatting attempt and represented a phishing risk through active MX records, resulting in a transfer order.
Phishing and impersonation
Phishing domains mimic a brand’s website, login page, or email to steal credentials or distribute malware. They often use:
- Lookalike characters (e.g., “rn” for “m”).
- Hyphenated brand names.
- Fake login pages.
- Active MX records to send deceptive emails.
In Thales-Raytheon, WIPO transferred thalesraytheons.com due to phishing risks. In Equifax, a UDRP complaint was filed against reportsequifax.info, which was used for a credential-harvesting scheme.
Parked and for-sale domains
A parked domain may display pay-per-click links, often to the complainant’s competitors. A “for sale” domain may be held for a ransom price. In HCL.ai, the respondent acquired the domain through an expired domain auction and offered it for sale; the panel found the respondent had no legitimate interest and ordered transfer.
Competitor blocking
A competitor may register a domain to block the brand owner or disrupt its business. Paragraph 4(b)(ii) and 4(b)(iii) of the UDRP address patterns of blocking and disruption. Evidence of a competitor relationship and a pattern of registrations supports the claim.
AI-generated lookalikes
In 2025, WIPO recorded the highest number of domain disputes in its history, crossing 6,000+ cases, and observed early signs of automation and AI being used to generate high-quality lookalike domains and content. AI-generated lookalikes can be harder to detect because they may use plausible variants and polished content. Monitoring and technical evidence are increasingly important.
Someone holds your brand domain? We assess the route, the evidence, and the remedy before you file. Start a recovery assessment →
The recovery routes: an overview
Registrar and TDRP
If the domain was stolen or transferred without authorization, the fastest route is usually through the registrars. ICANN’s Transfer Policy requires every registrar to maintain a Transfer Emergency Action Contact for urgent transfer problems, and a human must respond within four hours of an initial request. The losing registrar can contact the gaining registrar with evidence that the transfer was unauthorized. If the gaining registrar agrees, it can return the domain without any formal proceeding.
The TDRP is ICANN’s formal procedure for disputes about transfers between registrars that allegedly broke the Transfer Policy. Only a registrar can file a TDRP complaint; a registrant cannot. The complaint must be filed within twelve months of the alleged violation.
UDRP
The Uniform Domain Name Dispute Resolution Policy is the standard route for gTLDs and selected ccTLDs. It requires the complainant to prove three elements: confusing similarity, no legitimate interest, and bad-faith registration and use. The remedy is transfer or cancellation. There are no damages. The filing fee at WIPO starts at US$1,500 for a single panelist and up to five domains; Forum starts at about US$1,300. The process takes about two months from filing to decision.
URS
The Uniform Rapid Suspension system is a fast-track procedure for new gTLDs. It requires clear and convincing evidence of the three elements, with no genuine issue of material fact. The remedy is suspension only, not transfer. Filing fees start at about US$360–375 at Forum and ADNDRC, and €175 at MFSD. The process can be resolved in weeks.
ccTLD policies
Each country-code extension has its own policy:
- Nominet DRS for
.uk. - auDRP for
.au. - CDRP for
.ca. - .eu ADR for
.eu. - INDRP for
.in. - CNDRP for
.cn. - SACI-Adm for
.br. - usDRP for
.us.
The elements, deadlines, fees, and remedies vary. A UDRP win does not transfer a ccTLD domain; a separate ccTLD proceeding is required.
Court proceedings
Court proceedings are the route when you need damages, an injunction, or a remedy the administrative procedures cannot provide. In the United States, the Anticybersquatting Consumer Protection Act (ACPA) allows:
- In personam actions against the cybersquatter.
- In rem actions against the domain name itself where the registrant cannot be found or is outside the US.
- Statutory damages of US$1,000 to US$100,000 per domain name.
- Actual damages and profits.
- Attorney’s fees in exceptional cases.
In in rem cases, monetary damages are not available; the remedy is forfeiture, cancellation, or transfer of the domain.
Comparison table
| Route | Best for | Remedy | Speed | Cost |
|---|---|---|---|---|
| Registrar / TDRP | Stolen domains | Return of domain | Fastest | Low |
| UDRP | gTLDs, clear cases | Transfer or cancellation | ~2 months | US$1,300–1,500+ |
| URS | New gTLDs, clear-cut cases | Suspension | Weeks | ~US$360–375 |
| ccTLD | Country-code extensions | Transfer or cancellation | 2–3 months | Varies |
| Court (ACPA) | Damages, injunctions, in rem | Transfer, damages, injunction | Months | High |
| Court (local) | Any jurisdiction | Damages, injunction | Months | High |
The right route depends on the extension, the evidence, and the remedy you need. We map the options before you commit. Ask us which fits →
Route 1: Registrar recovery and TDRP
When the domain is still at the gaining registrar
The best chance of recovery is before the domain moves again. If the domain is still at the gaining registrar, the losing registrar can contact the gaining registrar with evidence that the transfer was unauthorized. If the gaining registrar agrees, it can return the domain without a formal proceeding.
What to do immediately:
- Secure the email account that controls the registrar login. Most hijackings start with a compromised inbox. Change the password, sign out of all sessions, enable two-factor authentication, and check for forwarding rules.
- Contact the registrar’s abuse or security team in writing. State that the transfer was unauthorized, give the date, and ask them to lock the domain and seek reversal.
- Ask the registrar to use the Transfer Emergency Action Contact. ICANN requires a human response within four hours.
- Gather proof of ownership: invoices, renewal receipts, account history, registrar emails, historical WHOIS, DNS and hosting records, archived website captures, and business records.
- Change every password and enable two-factor authentication on the registrar, email, DNS, and hosting accounts.
- Report the theft to law enforcement where the value is significant. In the US, file with the FBI’s IC3.
- Do not pay a ransom without advice.
The Transfer Emergency Action Contact
The Transfer Emergency Action Contact is a registrar-to-registrar channel. It is not available to registrants directly, but registrants can ask their registrar to use it. The four-hour response requirement makes it the fastest escalation route.
The TDRP
The TDRP is the formal procedure for disputes about transfers between registrars. Only a registrar can file a TDRP complaint. The complaint must be filed within twelve months of the alleged violation, and the fees can be substantial. In practice, the TDRP is used when registrars cannot agree informally.
Limits of registrar recovery
Registrar recovery works best when:
- The domain has not moved again.
- The documentation is clear.
- The registrant acts within days, not weeks.
If the domain has moved to a new registrar or been sold to a buyer who claims good faith, registrar recovery may fail, and a UDRP or court route may be necessary.
Route 2: UDRP
When to use it
The UDRP is the standard route when:
- The domain is in a gTLD (
.com,.net,.org,.shop, etc.). - The complainant has trademark rights.
- The respondent has no legitimate interest.
- The domain was registered and used in bad faith.
The three elements
- Confusing similarity: The domain is identical or confusingly similar to the mark.
- No legitimate interest: The respondent has no rights or legitimate interests.
- Bad faith: The domain was registered and is being used in bad faith.
Evidence
The evidence should include:
- Trademark registration certificates.
- WHOIS/RDDS records.
- Website screenshots with dates and URL bars.
- Wayback captures.
- Offer-to-sell correspondence.
- Evidence of a pattern.
- Technical evidence of phishing or impersonation.
Costs and timeline
WIPO: US$1,500 for a single panelist and up to five domains; US$4,000 for three panelists. Forum: about US$1,300 for a single panelist. The process takes about two months from filing to decision.
Enforcement
After a transfer decision, the registrar waits 10 business days before implementing it, unless the respondent files a court action. If the respondent does nothing, the transfer is implemented.
UDRP transfers the domain; URS suspends it; court can award damages. We match the remedy to the harm. Start a recovery assessment →
Route 3: URS
When to use it
The URS is suitable when:
- The domain is in a new gTLD.
- The case is clear-cut.
- Suspension is enough — you do not need ownership.
Suspension, not transfer
The URS remedy is suspension of the domain for the remainder of its registration term. It does not transfer ownership. If you need the domain, the UDRP is the right route.
Costs and timeline
Filing fees start at about US$360–375 at Forum and ADNDRC, and €175 at MFSD. The process can be resolved in weeks, sometimes as little as ten days.
Route 4: ccTLD policies
Each ccTLD has its own policy, deadline, fee, and remedy. The key differences:
| Extension | Policy | Response deadline | Remedy | Key feature |
|---|---|---|---|---|
| .uk | Nominet DRS | 15 working days | Transfer, suspension, cancellation | Free mediation; 2,000-word limit |
| .au | auDRP | 20 calendar days | Transfer or cancellation | 10-page limit; “registered or used” |
| .ca | CDRP | 20 days | Transfer or cancellation | Canadian Presence Requirement; RDNH costs |
| .eu | .eu ADR | 30 working days | Transfer or revocation | EUR 700 discounted fee |
| .in | INDRP | Set by arbitrator | Transfer or cancellation | Arbitration; 5,000-word limit; INR 30,000 |
| .cn | CNDRP | 20 calendar days | Transfer or cancellation | Three-year limit; Chinese language |
| .br | SACI-Adm | 15 days | Transfer or cancellation | Stricter bad-faith standard |
| .us | usDRP | 20 days | Transfer or cancellation | Nexus requirement; disjunctive bad faith |
A UDRP win does not transfer a ccTLD domain. A separate proceeding is required for each extension.
Route 5: Court proceedings
ACPA in rem
An in rem action is against the domain name itself, not the registrant. It is available where the registrant cannot be found or is outside the US, and the plaintiff has satisfied the due diligence requirement. The remedy in an in rem case is forfeiture, cancellation, or transfer; no monetary damages are available.
ACPA in personam
An in personam action is against the cybersquatter. It allows the court to award:
- Actual damages and profits.
- Statutory damages of US$1,000 to US$100,000 per domain name.
- Attorney’s fees in exceptional cases.
- Injunctive relief.
Statutory damages
The statutory damages range is US$1,000 to US$100,000 per domain name, in lieu of actual damages. The court has discretion to award an amount it considers just. Statutory damages are available in in personam cases, not in rem cases.
Local courts and injunctions
In other jurisdictions, local courts can grant injunctions, order transfer, and award damages under trademark, unfair competition, or passing-off laws. In Dabur India Ltd v. Ashok Kumar, the Delhi High Court addressed registrar liability and treated large-scale cybersquatting as a form of systemic cyber fraud. The case illustrates that courts can go beyond the administrative remedies.
When court is the right route
Court is the right route when:
- You need damages.
- You need an injunction against a wider fraud operation.
- The domain is in a ccTLD with a weak administrative remedy.
- The registrant is identifiable and within the jurisdiction.
- The administrative route has failed or is unavailable.
Choosing the right route
Remedy
- Transfer: UDRP, ccTLD policies, court.
- Suspension: URS.
- Damages: Court (ACPA in personam or local court).
- Injunction: Court.
Speed
- Fastest: Registrar recovery.
- Weeks: URS.
- About two months: UDRP.
- Months: Court.
Cost
- Lowest: Registrar recovery.
- Low: URS.
- Medium: UDRP, ccTLDs.
- High: Court.
Evidence
- Clear-cut: URS.
- Contested: UDRP or court.
- Damages: Court.
Jurisdiction
- gTLD: UDRP or URS.
- ccTLD: The relevant ccTLD policy.
- US nexus: ACPA.
- Other: Local court.
Decision matrix
| Situation | Recommended route |
|---|---|
| Stolen domain, still at gaining registrar | Registrar recovery / TDRP |
| gTLD, clear-cut, suspension enough | URS |
| gTLD, need transfer | UDRP |
| ccTLD, need transfer | Relevant ccTLD policy |
| Need damages or injunction | Court |
| Registrant anonymous, US nexus | ACPA in rem |
| Multiple extensions | Parallel UDRP + ccTLD filings |
One strategy, multiple extensions. We coordinate UDRP, URS, ccTLD, and court routes so the remedy matches the harm. Talk to counsel →
Evidence for recovery
Trademark rights
Registered or common-law rights, in force, connected to the goods or services.
Bad-faith evidence
Paragraph 4(b) evidence, technical evidence, prior conduct, and the absence of a legitimate explanation.
Technical evidence
MX records, SPF/DKIM/DMARC, SSL certificates, screenshots of fake login pages, and email headers.
Preservation
Preserve evidence immediately. Website content can change, and Wayback captures should be dated. Do not contact the respondent directly without advice.
Costs and timelines
UDRP
| Provider | Single panelist | Three panelists |
|---|---|---|
| WIPO | US$1,500 | US$4,000 |
| Forum | ~US$1,300 | ~US$2,600 |
URS
| Provider | Fee |
|---|---|
| Forum | US$375 |
| ADNDRC | US$360 |
| MFSD | €175 |
ccTLDs
Fees vary by policy and provider. Nominet DRS: £200 summary, £750 full, £3,000 appeal. auDRP: AUD $1,500 single, AUD $3,000 three-member. CDRP: CAD $1,500 filing, CAD $1,850 single panel, CAD $3,000 three-member. .eu ADR: EUR 700 discounted. INDRP: INR 30,000 + GST. CNDRP: CNY 8,000–16,000 at HKIAC. SACI-Adm: fixed by provider.
Court
Costs vary widely. ACPA statutory damages can be US$1,000–100,000 per domain, but litigation costs can exceed the recovery.
Enforcement after a decision
The 10-day wait
After a UDRP transfer decision, the registrar waits 10 business days before implementing it, unless the respondent files a court action.
Registrar non-implementation
In some cases, a registrar may fail to implement a decision. In a .cloud case, a software brand won a clean UDRP transfer order, but the accredited registrar acknowledged the order and then failed to implement it for more than four weeks, while the phishing page remained live. The case illustrates that enforcement may require escalation to the registrar, ICANN compliance, or court.
Court challenges
A losing party can challenge the decision in court. A court is not bound by the UDRP decision.
Case studies
Thales-Raytheon
WIPO transferred thalesraytheons.com due to phishing risks. The case shows that technical evidence of impersonation supports a transfer order.
Michelin
The panel found michelinz.com was a typosquatting attempt and represented a phishing risk through active MX records, resulting in transfer. The MX records were decisive technical evidence.
L'Oréal and cancellation risk
L'Oréal filed a UDRP complaint against 705 domain names and opted for cancellation rather than transfer. The case sparked discussion about the risks of cancellation: domains released to the public can be re-registered by new squatters, and the brand loses control over future use. The case illustrates that the remedy choice matters beyond the immediate win.
.cloud registrar non-implementation
A software brand won a UDRP transfer order for a .cloud domain used for phishing, but the registrar failed to implement it for more than four weeks. The case shows that enforcement is not automatic and may require escalation.
Dabur and registrar liability
In Dabur India Ltd v. Ashok Kumar, the Delhi High Court addressed registrar liability and treated large-scale cybersquatting as a form of systemic cyber fraud. The case illustrates that courts can impose liability beyond the registrant, particularly where registrars facilitate abuse.
Preventing cybersquatting
Monitoring
Monitor for:
- Typosquatting variants.
- Lookalike characters.
- Hyphenated brand names.
- Domains combining the brand with common keywords.
- New registrations in key extensions.
Tools use Levenshtein algorithms and automated scanning to detect variants. Monitoring should cover gTLDs and key ccTLDs.
Defensive registration
Register key variants defensively, particularly in extensions where enforcement is slow or expensive. Defensive registration is not a substitute for enforcement, but it reduces the risk of a lookalike being used against your customers.
Trademark clearinghouse
Record marks in the Trademark Clearinghouse to support URS and other rights-protection mechanisms. The SMD record streamlines standing in URS complaints.
Enforcement policy
Adopt a consistent enforcement policy: monitor, prioritise, file, and follow up. A documented policy supports claims of bad faith and helps justify costs.
Recovery checklist
- Identify the route: registrar, UDRP, URS, ccTLD, or court.
- Preserve evidence: screenshots, Wayback, WHOIS, MX records, correspondence.
- Secure accounts: email, registrar, DNS, hosting; enable 2FA.
- Contact the registrar: abuse team, Transfer Emergency Action Contact.
- Assess trademark rights: registered or common-law.
- Assess bad faith: paragraph 4(b) evidence, technical evidence.
- Choose the provider: WIPO, Forum, or the relevant ccTLD provider.
- Prepare the annex file: numbered, indexed, dated.
- File within the deadline: response deadlines vary by policy.
- Enforce the decision: 10-day wait, registrar follow-up, court if needed.
- Monitor for re-registration: particularly after cancellation.
Ready to recover the domain? We assess the route, build the evidence file, and enforce the decision. Start a recovery assessment →
How counsel.domains can help
If your domain has been stolen, we act immediately on registrar recovery and TDRP.
If a third party holds your brand domain, we assess UDRP, URS, ccTLD, and court options and recommend the route that matches the remedy.
If you need damages or an injunction, we coordinate court proceedings and local counsel.
If the case spans multiple extensions, we run parallel filings on a single timeline.
counsel.domains Domain name disputes, worldwide. Start a recovery assessment → · [email protected]
Disclaimer: This website provides general information about domain name dispute resolution. It is not legal advice and does not create a professional relationship. Procedures and fees change; check the relevant policy and provider before acting. counsel.domains is not affiliated with WIPO, ICANN, Forum, Nominet, auDA, CIRA, NIXI, CNNIC, EURid, Registro.br, or any registry or dispute-resolution provider.