What Is Cybersquatting? Examples, Laws & How to Protect Your Domain

Cybersquatting can turn a familiar brand name into a confusing web address that sends customers somewhere else. The risk matters because online impersonation can be costly.

In June 2026, the U.S. Federal Trade Commission reported that consumers had reported $3.5 billion in losses to imposter scams during 2025, and nearly one in three fraud reports involved impersonation. That figure covers impersonation scams broadly, not cybersquatting alone, but it shows why businesses should protect names used online. This guide explains what cybersquatting is, when U.S. law may apply, how it differs from typosquatting, and practical ways to protect domain and trademark rights.

What Is Cybersquatting?

Cybersquatting, also called domain squatting or domain name squatting, generally involves registering, trafficking in, or using a domain in a way that targets another party’s protected mark in bad faith. Under the U.S. Anti-Cybersquatting Consumer Protection Act (ACPA), bad-faith intent to profit is a central issue.

A cybersquatter may use a confusing domain to divert visitors, impersonate a business, earn revenue, or try to sell the domain to the mark owner. No single fact proves a claim.

For example, imagine a fictional business owns trademark rights in LumaNest. A third party registers lumanest-support.com, copies the brand’s appearance, and offers to sell the domain to the company. Taken together, those facts may raise a stronger concern than simply owning a similar unused domain.

WIPO reported a record 6,282 domain-name cases in 2025, up 1.8% from 2024, showing that trademark-based domain disputes remain active globally.

Does a Domain Name Give You Trademark Rights?

No. The USPTO explains that registering a domain name with a registrar does not give you trademark rights by itself. A domain works mainly as an internet address, while a trademark identifies the source of goods or services.

Buying yourbrand.com and protecting YOUR BRAND as a trademark are therefore separate steps.

A Famous Cybersquatting Case

The Madonna.com dispute is a well-known early UDRP example. A WIPO panel found that the domain was identical or confusingly similar to protected trademark rights, that the respondent lacked rights or legitimate interests, and that the domain had been registered and used in bad faith. The panel ordered the domain transferred.

The case shows why domain disputes depend on trademark rights, legitimate interests, use, and evidence of bad faith—not merely who registered the web address first.

Is Cybersquatting Illegal in the United States?

Certain forms of cybersquatting can create civil liability in the United States. The main federal provision is the ACPA, found in 15 U.S.C. §1125(d).

How the ACPA Works

A mark owner may have a claim when another person has a bad-faith intent to profit and registers, traffics in, or uses a domain that meets the law’s trademark-related requirements.

A mark owner may have a claim when another person has a bad-faith intent to profit and registers, traffics in, or uses a domain that meets the law’s trademark-related requirements.

Courts may consider whether the domain holder:

• Has intellectual property rights in the name
• Is commonly known by the name
• Used the domain for a bona fide business or fair use
• Intended to divert customers for commercial gain
• Offered to sell the domain without genuine business use
• Registered a pattern of domains tied to protected marks

The statute also provides that bad-faith intent should not be found when a person reasonably believed the domain use was fair or otherwise lawful.

In a qualifying ACPA case, a plaintiff may elect statutory damages of $1,000 to $100,000 per domain name, as the court considers just, instead of actual damages and profits.

How the UDRP Works

The Uniform Domain Name Dispute Resolution Policy (UDRP) is different. It is an administrative process for covered trademark-based domain disputes, not another U.S. statute or lawsuit.

Under ICANN’s policy, a complainant must establish all three elements:

1. The domain is identical or confusingly similar to a trademark or service mark in which the complainant has rights.
2. The domain holder has no rights or legitimate interests in the domain.
3. The domain was registered and is being used in bad faith.

ACPA vs. UDRP

What Are the Main Types of Cybersquatting?

Common patterns include typo domains, added words, different extensions, look-alike characters, and some expired-domain registrations. These patterns can raise concerns, but none automatically proves unlawful conduct.

Typosquatting

Typosquatting uses likely typing or spelling errors. If the genuine fictional domain is brightnest.com, a confusing version might be brightnesst.com or brighntest.com.

Added-Word and Look-Alike Domains

A registrant may add words that make a domain seem official, such as:

• brightnest-support.com
• brightnest-login.com
• brightnest-store.com

Some deceptive domains also use characters that visually resemble ordinary letters, making the address look authentic at a glance.

Different Extensions and Expired Domains

A similar name under .net, .org, .co, or another extension is not automatically unlawful.

The same is true when someone buys an expired domain. Trademark rights, timing, use, and intent still matter.

What Is Cybersquatting vs. Typosquatting?

Cybersquatting is the broader trademark-related concept. Typosquatting is one technique based on spelling or typing variations. Domain flipping and domain hijacking are different again.

A parked domain, an expensive asking price, or a refusal to sell does not by itself establish cybersquatting.

When Is a Similar Domain Not Cybersquatting?

A similar domain may be lawful when the holder has a genuine right or legitimate interest in the name, or when the evidence does not show bad-faith targeting of another party’s mark.

A domain is not automatically cybersquatting because:

• It was registered before your trademark rights began.
• It is parked or unused.
• The owner asks a high sale price.
• Two businesses legitimately use the same word in different markets.
• The holder is genuinely known by the name.
• The site makes bona fide noncommercial or fair use.

WIPO’s updated 2026 UDRP guidance also explains that genuine criticism can qualify as fair activity when a website is not merely a pretext for improper cybersquatting or commercial gain.

Before treating a domain as cybersquatting, ask four questions:

1. Did your trademark rights exist when the domain was registered?
2. Is the domain identical or confusingly similar to your mark?
3. Does the holder have a legitimate right or interest?
4. What evidence points to bad faith?

How to Protect Your Domain Name From Cybersquatting

You cannot prevent every similar domain from being registered, but you can reduce risk with a focused protection plan.

1. Search Before Launch. Check federal trademark records and the wider market for exact and similar names.
2. Consider Federal Trademark Registration. Federal registration can provide broader rights and protections than unregistered rights when the USPTO registers the mark.
3. Register Important Domain Variations. Focus on realistic typos, extensions, and brand-plus-word combinations customers may use.
4. Protect Your Registrar Account. Use auto-renewal, multi-factor authentication, strong passwords, and registrar locks when available.
5. Monitor Your Brand. Watch for confusing domains, fake sites, redirects, and potentially conflicting trademark filings.

A domain-squatting protection platform or domain-monitoring tool may help identify look-alike web addresses. Trademark monitoring serves a different purpose because it focuses on trademark filings that may conflict with your mark.

For broader preventive steps, see Trademark Engine’s Brand Protection Guide and Trademark Monitoring resources.

What Should You Do If You Find a Suspicious Domain?

Preserve evidence first. Then compare the registration date, trademark rights, site use, and signs of bad faith before choosing a response.

1. Save dated screenshots, URLs, and redirects.
2. Keep emails, advertisements, messages, and sale offers.
3. Check the domain registration date and available registrar details.
4. Confirm when your trademark rights began.
5. Look for a genuine business, personal-name, or fair-use reason.
6. Consider whether the UDRP or legal advice about an ACPA claim fits the facts.

A domain dispute can turn on details that are easy to miss. A similar domain by itself does not necessarily mean you have a successful cybersquatting claim.

Conclusion

Cybersquatting concerns are strongest when a domain targets a protected mark, lacks a clear legitimate purpose, and shows evidence of bad faith. A similar or expensive domain alone is not enough. Protect your brand early by searching before launch, securing key domain variations, maintaining strong registrar security, retaining evidence of trademark use, and considering federal trademark registration when it aligns with your business goals.

Protect the Brand Behind Your Domain

A domain name alone does not create federal trademark rights. If a name, logo, or slogan is central to your business, search existing registrations through Trademark Engine to check for possible conflicts before investing further.