Cybersquatting

Cybersquatting is the bad-faith registration, holding or use of a domain name that is identical or confusingly similar to someone else's trademark. The squatter may want to sell the domain to the brand, earn money from advertising traffic, divert customers to a competitor, or use the domain for fraud. It is a legal concept as much as a technical one, and the main remedies are dispute procedures and the courts.

How it works

Squatters register brand names in new generic top-level domains and country-code domains, shortly before or after a product launch, or as soon as a brand lets a domain expire. They also use typosquatting and combosquatting. Many cybersquatted domains sit parked with ads or a "for sale" notice; others are pointed at phishing pages when it suits the holder. For generic top-level domains such as .com, ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP) lets a trademark owner ask for transfer or cancellation if the domain is identical or confusingly similar to the mark, the holder has no legitimate interest in it, and it was registered and is being used in bad faith. Many country-code registries run their own dispute schemes, and in the United States the Anticybersquatting Consumer Protection Act allows court action.

Example

An illustrative case: shortly after a fictional software company announces a product called ExampleCloud, someone registers examplecloud[.]app and examplecloud-login[.]com. The first shows a "domain for sale" page with a high asking price. The second later hosts a copy of the company's login page and is used in phishing emails.

How to spot it

• A domain contains your trademark and was registered by an unrelated party.
• Parked pages show ads for competitors or an offer to sell the domain.
• The registration date lines up with your announcements or a lapsed renewal.
• Owner details are hidden and contact is only possible through a broker.

What brands can do

• Register your core marks in the main top-level domains and in the country-code domains of your key markets, and keep renewals on auto-pay.
• Monitor new registrations that contain your marks.
• Separate the cases: a domain hosting phishing needs a takedown through host and registrar; a passive domain that infringes your mark is a matter for UDRP or a national dispute process.
• Be cautious about buying domains back, which can encourage further squatting.

Phishvoid handles the abusive side, verifying and taking down cybersquatted domains used for phishing or fraud; contact the team for more. Background on domain tricks is in Typosquatting and homoglyph domains explained.

Read more: Typosquatting and Homoglyph Domains Explained