Someone Is Squatting on Your Brand's Domain. Can You Force Them to Hand It Over?

Is it actually cybersquatting, or is the domain just taken?

This is the question that decides everything, and most founders get it wrong because 'squatting' feels like the right word for anyone holding a name they're not using. Legally, it isn't. Cybersquatting means registering a domain that matches someone else's trademark in bad faith — specifically to profit from that mark, by reselling it to the trademark owner at a markup, diverting their traffic, or trading on their reputation. The key word is trademark. If you don't have rights in the name, nobody is squatting on you; they just own a domain you want.

The uncomfortable truth is that the vast majority of 'squatted' domains aren't squatting at all. A generic or descriptive word, a common surname, a two-word combination someone registered years before your startup existed — holding those and selling them for a profit is a legitimate business, not an offense. Domain investing is legal. You only have a claim when the registrant targeted a mark that was already yours, and 'I thought of this name last month and someone already had it' almost never clears that bar.

• You may have a real claim if: the domain is identical or confusingly similar to a trademark you already own, the holder has no legitimate connection to that name, and they registered it to profit from your mark specifically.
• You almost certainly don't if: the name is a generic or dictionary word, they registered it before your brand or trademark existed, or they're using it for a genuine unrelated purpose.

What do you actually need before you can fight for a name?

Trademark rights. Not a company registration, not a 'we've been calling ourselves this for a while' — enforceable rights in the name itself. In the US and many jurisdictions those rights can come from actual use in commerce, but a registered trademark is dramatically stronger evidence and makes every recovery route easier. If you're a brand-new startup whose name isn't yet a trademark anywhere and isn't in commercial use, you have essentially nothing to enforce, and no process will hand you a domain just because you wish you'd registered it first.

So step one is an honest audit of your own position. Do you own a trademark, or applied for one? Have you been using the name publicly and commercially long enough to have unregistered ('common law') rights? Is the domain genuinely confusable with your mark, or just adjacent? If the answers are weak, skip the legal fantasy entirely and treat this as a purchase negotiation — that's where you were headed anyway, and pretending otherwise just costs you time and leverage.

How does the UDRP process actually work?

The UDRP — the Uniform Domain-Name Dispute-Resolution Policy — is ICANN's built-in arbitration system, and it's the main tool for reclaiming a squatted domain without going to court. Every registrar contractually agrees to it, so you don't need the holder's cooperation: you file a complaint with an approved provider (WIPO and the Forum are the big two), a panelist reviews it, and if you win, the registrar is ordered to transfer the name to you. No lawsuit, no courtroom, and it typically resolves in roughly two months.

To win, you have to prove all three of these, and losing any one loses the case: first, the domain is identical or confusingly similar to a trademark you have rights in; second, the current holder has no rights or legitimate interest in the name; and third — the one that trips people up — the domain was both registered and used in bad faith. That third element is why a domain someone bought years before your brand existed is nearly unwinnable: they couldn't have registered it in bad faith toward a mark that didn't yet exist. The UDRP is a scalpel for clear-cut abuse, not a general-purpose way to pry loose any name you'd like to have.

What does a UDRP case cost, and what do you actually get?

Less than a lawsuit, but not nothing. A standard single-domain UDRP complaint decided by one panelist runs around $1,500 in provider fees at WIPO, before any lawyer you hire to write it. Opt for a three-member panel and that climbs to roughly $4,000. You can file it yourself, but the complaint has to hit all three elements cleanly with evidence, and a sloppy filing loses — for a name that matters, a trademark attorney who's done UDRP work is usually money well spent.

Here's the part that reshapes the whole calculation: the only remedies are transfer of the domain to you or cancellation of it. You get the name. You do not get money, you do not get damages, and you don't recover your filing fees. So if the holder would sell you the domain for less than the cost of filing — which for many parked names they will — the UDRP is the more expensive option, not the cheaper one. It's the right tool when the holder is demanding an outrageous ransom on a name you clearly own, and the wrong one when a quiet offer would settle it for a few hundred dollars.

When is a lawsuit (the ACPA) worth it instead?

In the US there's a heavier weapon: the Anticybersquatting Consumer Protection Act. Unlike the UDRP, an ACPA lawsuit can win you actual money — statutory damages that run from $1,000 to $100,000 per domain — on top of forcing a transfer. That matters when a squatter has genuinely harmed you, is running a phishing or scam site under your brand, or is a repeat offender you want to deter rather than merely displace.

But it's federal litigation, with the cost, timeline, and uncertainty that implies: legal bills that dwarf a UDRP fee, months to years instead of weeks, and the need to establish jurisdiction over a holder who may be anonymous or overseas. For the ordinary case of a parked name sitting on your mark, the ACPA is overkill — the UDRP gets you the domain far faster and cheaper. Reserve litigation for real, damaging bad-faith use where getting the name back isn't enough and you want to make the squatter pay for it.

Should you just buy it instead of fighting?

Usually, yes — and there's no shame in it. If your legal position is anything short of airtight, or the holder's asking price is lower than a UDRP filing fee, buying the domain is faster, cheaper, and certain in a way that arbitration never is. Even when you'd probably win a UDRP, a clean purchase avoids two months of process and the small but real chance a panelist sees the facts differently than you do. Founders routinely spend more emotionally fighting a $1,200 name than the name is worth.

If you go this route, don't negotiate from your company email against a domain you obviously need — that's how a $300 name becomes a $8,000 one. Reach out anonymously or through a domain broker so the seller can't price to your desperation, and decide your walk-away number before you start. And keep the two tracks separate in your head: the moment you make an offer, you've implicitly conceded the name has value to its holder, which can weaken a bad-faith argument later. Pick one strategy — buy or fight — based on your actual trademark position, and commit to it.

What if you have no case and can't afford it — is the name gone?

No — it just means you should stop chasing this particular string and let a good tool do the work you were about to do by hand. The founders who get stuck are the ones who fall in love with one exact name and treat every alternative as a defeat. In reality, a slightly different construction — a coined spelling, a two-word pairing, a different but equally brandable root — is almost always available on a clean .com, and nobody but you will ever know it wasn't your literal first choice.

This is exactly the problem ZeroTaken is built to solve: describe the idea and it generates brandable names and checks in real time which ones are genuinely free to register, so instead of grinding against one taken name you get a shortlist of ones you can actually own today. Fighting a squatter is worth it when you have the trademark rights and the name is core to a brand you've already built — but if you're at the naming stage, moving on to an available name is nearly always the faster path to launch.

How do you make sure this never happens to your brand?

Prevention is embarrassingly cheap compared to recovery, and it comes down to a few habits. Register your domain the moment you're serious about a name — the window between 'we've decided' and 'we've registered' is exactly when a name leaks and gets grabbed. Lock down the .com plus the one or two extensions your audience might type by mistake, so a squatter can't set up shop next door on the version people guess. And if the name is going to carry a real business, file for a trademark — it's the single thing that turns 'someone took my domain' from a helpless situation into an enforceable one.

The through-line of every recovery story is the same: the founder who has trademark rights and moved early has options, and the one who fell for a name after someone else already owned it mostly has a checkbook. You can't control who registered a name before you existed, but you can control whether your own brand is defensible and whether you register fast enough to never need any of this. Do the cheap prevention now, and the expensive recovery is a chapter you get to skip.

• Register your primary .com the day you commit to a name — before the pitch deck, before the press, before the leak.
• Grab the obvious lookalike extensions and common misspellings so there's no open door beside your front one.
• File for a trademark on any name your business will actually run on; it's what makes recovery possible if it ever comes to that.
• If you're still choosing, pick a name that's genuinely available now rather than one you'll have to litigate or buy back later.