Cybersquatting Definition
Cybersquatting, also called domain squatting, is the practice of registering, trafficking in, or using an internet domain name with bad-faith intent to profit from the goodwill of a trademark belonging to someone else. The defining element is intent — registering a generic domain to resell is legitimate business, but registering a domain because it resembles an established brand is not.
Cybersquatters typically aim to sell the domain back to the trademark owner at an inflated price, capture misdirected traffic for advertising revenue, or damage the brand's reputation. Increasingly, though, squatted domains serve as attack infrastructure — convincing lookalike addresses used to host phishing pages, deliver malware, and enable business email compromise.
What are the different types of cybersquatting?
Cybersquatting is an umbrella term covering several distinct tactics. Typosquatting (or URL hijacking) registers common misspellings of a brand: gogle.com, amzon.com — to capture traffic from users who mistype an address. Combosquatting appends a legitimate-sounding word to a real brand name, creating domains like nikeoutlet.com or applesupport.net that look like official sub-brands. Homograph attacks substitute visually similar characters, such as a capital "I" for a lowercase "L" in paypaI.com. Name-jacking targets the personal names of celebrities and public figures. Domain expiration squatting waits for a company to let a registration lapse, then buys it immediately. Gripe sites register brand-adjacent domains to publish criticism or attack a company's reputation.
Is cybersquatting illegal?
Yes. In the United States, the Anti-Cybersquatting Consumer Protection Act (ACPA) of 1999 gives trademark owners a federal civil cause of action. To prevail, the owner must prove the mark was distinctive when the domain was registered, the domain is identical or confusingly similar to that mark, and the registrant had bad-faith intent to profit. Remedies include transfer or cancellation of the domain plus statutory damages of $1,000 to $100,000 per domain. Separately, ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP) provides a faster, cheaper arbitration route requiring the same three-part test — though it can only transfer or cancel a domain, not award damages. Importantly, registering generic or descriptive domains for resale is not cybersquatting; the violation requires targeting someone else's mark.
How can businesses prevent and stop cybersquatting?
Defense works in two directions: prevention and enforcement. Preventively, register your trademark early — it's the legal foundation for any dispute — and defensively register common misspellings, key variations, and important top-level domains before someone else does. Continuous domain monitoring is essential, since new lookalike domains appear constantly and the window between registration and a live phishing campaign can be hours. Solutions like the ones Fortra offers combine automated detection of newly registered lookalike domains with rapid takedown services, connecting external domain threats to broader brand protection. For enforcement, a UDRP complaint typically resolves in about 60 days at a fraction of litigation cost, with complainants winning roughly 85–90% of cases — while ACPA litigation remains the route when monetary damages are the goal.