When a lookalike domain is causing real harm, abuse reports to the host and registrar can get the content taken down. But the domain stays with its owner, who can point it at a new host next week. If you want the domain itself, the standard route is the Uniform Domain-Name Dispute-Resolution Policy — the UDRP.
It's faster and much cheaper than a lawsuit, and it's a paper process: no hearings, no discovery. It's also narrower than people expect. This article covers what it can do, what you have to prove, and how to decide whether a given domain is worth it.
This is an overview of how the process works, not legal advice. Most complainants use a trademark lawyer, and for good reason.
What the UDRP is
Every registrar accredited by ICANN for generic top-level domains — .com,
.net, .org, and the newer extensions like .shop and .store — must agree
to the UDRP, and every person registering a domain through them agrees to it as
part of the registration contract. That's what gives it teeth: the registrar is
bound to carry out the decision.
Many country-code domains have adopted the UDRP too, but some run their own
policies — .uk, for example, has Nominet's own dispute resolution service.
Check which policy applies to the extension before you start.
Complaints are filed with an approved dispute-resolution provider. WIPO's Arbitration and Mediation Center handles the most cases; the Forum is the other large one, and there are a few regional providers.
What it can and can't do
The only remedies are transfer of the domain to you, or cancellation. No damages, no costs awarded against the other side, no order covering future registrations. If the same person registers a different lookalike tomorrow, that's a new complaint.
The three things you have to prove
The complainant must establish all three. Missing any one loses the case.
- The domain is identical or confusingly similar to a trademark in which you have rights. A registered mark is the cleanest basis. Unregistered (common-law) rights can qualify, but you'll need evidence the name has acquired distinctiveness, which is more work. The comparison is usually just the domain's text against the mark; adding a generic word such as "outlet" or "shop" generally doesn't avoid confusing similarity.
- The registrant has no rights or legitimate interests in the domain. You make a prima facie case — they're not known by that name, you never licensed them, they're not making a legitimate non-commercial or fair use — and the burden shifts to them to show otherwise.
- The domain was registered and is being used in bad faith. The policy gives examples: registering mainly to sell the domain to you or a competitor, registering to block you from using it, registering to disrupt a competitor's business, or using it to attract users for commercial gain by creating confusion with your mark.
The third element is where most complaints are won or lost, and where evidence matters most. A domain running a counterfeit store with your product photos is a strong case. A domain that's been parked for years without content is harder, though not impossible: panels have found passive holding to be in bad faith in some circumstances, such as when the mark is well known and there's no plausible good-faith use.
Timing matters too. If the domain was registered before you had any trademark rights, it's hard to argue it was registered in bad faith against you.
What it costs
At WIPO, the provider fee for a complaint covering one to five domains decided by a single panelist is $1,500; a three-member panel costs more. Other providers' fees are in a similar range. Check the provider's current fee schedule before filing.
Legal fees come on top. A clear-cut case with good evidence is not much drafting work for a specialist; a contested one with a responding party and counsel is more.
How long it takes
Roughly two months from filing to decision is typical when the respondent doesn't engage, which is common. The broad sequence:
- You file the complaint; the provider checks it for compliance and the registrar locks the domain.
- The respondent is notified and has 20 days to respond.
- A panel is appointed and issues a decision.
- If you win, the registrar implements the transfer after a short waiting period (10 business days), unless the respondent shows they've started court proceedings.
Is this domain worth it? A practical test
Before spending $1,500 plus fees, ask:
- Is it doing harm now? A live counterfeit store, a phishing page or a fake support site is worth acting on. A parked typo with no traffic usually isn't — monitor it instead. See Lookalike domains for how to tell them apart.
- Would removing the content be enough? If the operator is likely to move on once the site is down, a registrar or host abuse report may solve the problem for free. UDRP makes sense when the domain is the asset — it's highly confusing, it keeps getting reused, or customers have already learned it.
- Can you prove all three elements? Particularly bad faith. If your only evidence is that the domain exists, wait until it's used, and capture that use when it happens. The evidence file explains what to keep.
- Is URS an option? For many newer extensions, the Uniform Rapid Suspension System is quicker and cheaper. It only suspends the domain for the rest of its registration rather than transferring it, and it needs a clearer case, but for an obvious abuse site that may be all you need.
- Is the registration older than your mark? If so, get advice before filing.
What to have ready
If you do decide to file, your lawyer — or you — will need:
- Trademark registration certificates, with dates, for every jurisdiction you rely on.
- The domain's registration date and registrar, from WHOIS or RDAP.
- Dated captures of what the domain has shown: full-page screenshots, saved copies, archive links.
- Any evidence of confusion: customer emails, support tickets, orders placed on the wrong site.
- Any contact you've had with the registrant, including offers to sell.
Collecting this as you go is much easier than reconstructing it later.
Don't overreach
Panels can find that a complaint was brought in bad faith — "reverse domain name hijacking" — when a complainant tries to use the UDRP to take a domain it has no real claim to, for example from someone using a common word legitimately. The finding has no financial penalty, but it's published with your name on it. File when the three elements are clearly there, not to pressure someone into a sale.
Know which domains are live
Most lookalike domains you'll ever find are parked and harmless. Defenex checks each one, fetches what it's actually doing, and reports only those with content it can quote — so you know which are worth a complaint and which are worth watching. Scan your brand: free, no account, about 90 seconds.