How to Get Back a Domain Name Taken by a Cybersquatter

Three ways to resolve a domain name dispute

Most domain name dispute cases are decided outside court. When the domain was registered under ICANN's system, which covers .com, .net, .org and most other generic extensions, every registrant has agreed to the Uniform Domain Name Dispute Resolution Policy (UDRP). A trademark owner can file a UDRP complaint with an approved provider such as the WIPO Arbitration and Mediation Center, and an independent panel decides on documents alone.

For .in domains, the National Internet Exchange of India (NIXI), which runs the .IN Registry, has its own .IN Domain Name Dispute Resolution Policy, called the INDRP. A complaint goes to the .IN Registry, which appoints a sole arbitrator from its panel. The arbitrator decides under the INDRP and its Rules of Procedure, and the proceeding is an arbitration under Indian law.

The third route is a civil suit for trademark infringement or passing off, filed in the Delhi High Court if the suit is valued above Rs 2 crore, or in a district commercial court below that. The pecuniary limit is Rs 2 crore at present; a proposal to raise it is pending, so check the current limit. A suit takes longer and costs more, but it gives remedies the other two cannot: damages, an injunction against future registrations, orders against registrars and banks, and disclosure of the people behind the domain. The firm's page on domain name disputes sets out how we handle all three routes.

What cybersquatting looks like in practice

Cybersquatting means registering a domain that matches someone else's trademark in order to profit from it. The classic case is the person who registers a brand's name as a domain and then offers to sell it to the brand owner for many times the registration cost. Others park the domain with pay-per-click advertisements, often for the brand's competitors, and earn money from confused visitors.

Typosquatting is the same thing with a misspelling: a letter dropped, doubled or swapped, so that people typing quickly land on the squatter's page. Drop-catching is the practice of grabbing domains the moment they lapse, which catches many Indian businesses whose domain was registered by a developer years ago and never renewed.

The most harmful form today is fraud. Websites on lookalike domains offer dealerships, franchises, distributorships or jobs in a well known brand's name, take registration fees and security deposits, and vanish. Victims then blame the brand. In a batch of cases led by Dabur India, the Delhi High Court has dealt with this kind of fraud and directed domain name registrars to lock and suspend such domains and share registrant details. For these cases, a court suit is often the only effective route.

Before you file: should you just buy it back?

Sometimes the cheapest answer is to buy the domain. If the asking price is modest and you need the domain quickly, a purchase through an escrow service can cost less than a complaint, and it is final. Many businesses do this for domains that are not central to their brand.

Before you make any offer, though, decide whether you might fight. If the holder demands a large sum, his demand is itself strong evidence of bad faith, and you want that on record in writing. If you open with an offer of your own, the holder can later present the discussion as an ordinary negotiation started by you. Use a neutral enquiry, or have the enquiry made by someone else, and save every message.

Check the basics first. Look up the WHOIS record, which may show the registrant or only a privacy service. Check whether the domain is in the redemption period after expiry, in which case the original registrant may still be able to renew it through the registrar. If the domain was registered by your own employee or developer, look at his contract and your payment records, because that is often a contract dispute rather than cybersquatting.

The UDRP complaint for .com and other generic domains

A UDRP complaint is filed online with an approved provider. Under paragraph 4(a) of the UDRP, the complainant must prove three things: the domain is identical or confusingly similar to a trademark or service mark in which the complainant has rights; the registrant has no rights or legitimate interests in the domain; and the domain has been registered and is being used in bad faith. Both registration and use in bad faith are needed under the UDRP, though panels treat passive holding of a domain matching a well known mark as bad faith use in suitable cases.

Paragraph 4(b) gives examples of bad faith: buying the domain mainly to sell it to the trademark owner for more than the cost, registering it to prevent the owner from using it where there is a pattern of such conduct, registering it mainly to disrupt a competitor, and using it to attract users for commercial gain by creating confusion. Paragraph 4(c) gives the respondent's defences, such as genuine use before notice of the dispute, being commonly known by the name, or legitimate non-commercial use.

After the complaint is checked and served, the respondent gets 20 days to reply. A panel of one or three members is appointed and normally decides within a couple of weeks. The whole process often finishes in about two months. At WIPO, the fee for one to five domains decided by a single panelist has for some years been USD 1,500, more for three panelists; check the current schedule before filing. If the panel orders transfer, the registrar implements it after ten business days unless the respondent shows that he has started court proceedings in the agreed jurisdiction.

The INDRP for .in domains

The INDRP covers every domain ending in .in, including second level domains such as .co.in and .net.in. The complaint is filed with the .IN Registry with the prescribed fee. The Registry checks it for compliance and appoints a sole arbitrator from its panel, who issues notice to the registrant. Under the INDRP Rules of Procedure, the arbitrator is expected to pass an award within 60 days of the start of the proceeding, extendable by up to 30 days in exceptional cases. The proceeding is in English, and documents in other languages need translations.

The grounds are close to the UDRP. The complainant must show that the domain is identical or confusingly similar to a name, trademark or service mark in which it has rights, that the registrant has no rights or legitimate interests in the domain, and that the domain was registered and/or used in bad faith. The INDRP wording on bad faith is wider than the UDRP, because bad faith registration or bad faith use can be enough.

The fee is fixed by the .IN Registry and covers an administration fee and the arbitrator's fee. At the time of writing it was about Rs 30,000 plus GST for a single domain decided on papers, with extra charges for any personal hearing; check the current schedule. Because the INDRP proceeding is an arbitration, the award can be challenged in court under Section 34 of the Arbitration and Conciliation Act 1996. The guide on challenging an arbitral award under Section 34 explains that route and its strict time limit.

The rules that decide domain disputes

UDRP, INDRP or a court suit: how they compare

When a court suit is the better route

A suit makes sense when the domain is only one part of a bigger problem. If the squatter is running a fake website that takes money from the public, you need an injunction that takes the site down, orders to the registrar to lock the domain and disclose who registered it, and sometimes orders to banks and payment platforms to freeze the accounts receiving the money. A UDRP panel cannot do any of that.

A suit also suits cases with many domains, repeat registrations by the same people, unknown registrants hiding behind privacy services, or a real claim for damages. The Delhi High Court has granted orders requiring registrars to suspend lookalike domains and to stop offering for sale new domains containing a well known mark, and it can make those orders dynamic so that new registrations by the same network are covered. The guide on dynamic injunctions against piracy websites explains how that dynamic mechanism works.

The suit is usually framed as infringement of a registered trademark, passing off, or both. If your brand is not registered, you can still sue for passing off, as the guide on passing off and how it differs from infringement explains. Where the dispute is with a former partner, employee or developer, a court is often the only forum, because UDRP panels decline cases that are really business or contract disputes.

Fake dealership and franchise websites

If a lookalike domain is being used to collect money from the public, treat it as both a civil and a criminal matter. File a complaint on the national cyber crime portal or through the 1930 helpline at once, so that the receiving bank accounts can be flagged. Report the domain to the registrar's abuse contact, with screenshots. Then prepare a suit to take the site down and disclose the people behind it.

Put a notice on your own website and social media warning customers that you do not sell dealerships through any other site and listing your official domains. This protects customers and also creates evidence of the date you learnt of the fraud and acted. Keep complaints from victims who contact you, with their consent, because they show the confusion the court looks for.

The criminal side, including cheating under Section 318 of the Bharatiya Nyaya Sanhita (old Section 420 IPC) and offences under the Information Technology Act, is covered on our page on cyber crime matters in the Delhi High Court. The civil suit and the police complaint run side by side; neither has to wait for the other.

Which forum hears your dispute, and why

A UDRP case is decided by a panel on documents submitted online. There is no hearing and no Indian court involvement, unless the losing respondent files a suit. In every UDRP complaint the complainant must agree to the jurisdiction of the courts either at the registrar's principal office or at the registrant's address, so that a respondent who wants to challenge a transfer knows where to sue. Choose this mutual jurisdiction carefully, because it decides where any court fight will happen.

An INDRP proceeding is an arbitration under Indian law, and a challenge under Section 34 goes to the court with jurisdiction over the seat. In practice many INDRP challenges have been heard by the Delhi High Court as commercial arbitration petitions. Check the award for the seat it records.

A court suit goes to the Delhi High Court's original side, where the Intellectual Property Division hears trademark and domain cases, if the suit is valued above Rs 2 crore, and to the district commercial courts below that. Territorial jurisdiction follows Section 134(2) of the Trade Marks Act for infringement of a registered mark, and Section 20 CPC for passing off. A website targeted at Delhi users, or a fraud that took money from people in Delhi, usually gives the Delhi courts jurisdiction. The guide on the Intellectual Property Division explains how those cases are listed and heard.

Step by step: recovering a domain through UDRP or INDRP

These are the usual stages for a straightforward cybersquatting case. A court suit follows the trademark suit stages instead.

1. Capture the evidence

   Take dated screenshots of the website, any parked page with advertisements, the WHOIS record and any sale listing on a domain marketplace. Use an online archive tool as well, because the squatter may change the page once he hears from you.

2. Collect your trademark rights

   Gather registration certificates in India and abroad, or proof of common law rights through sales, advertising and media coverage. A pending application alone is weak; proof of actual use and reputation is what panels look for.

3. Choose the forum

   Use the UDRP for generic domains, the INDRP for .in, and a court where there is fraud, many domains or a claim for money. Consider whether the respondent might sue to block a transfer, and where.

4. Draft and file the complaint

   The complaint sets out each element with evidence, identifies the domain and registrar, and states the remedy sought. For the UDRP, choose a single or three-member panel; for the INDRP, file with the .IN Registry and pay the fee.

5. Respond to the reply, if any

   Many squatters do not reply at all. If one does, the panel or arbitrator may allow a further short submission. Keep it focused on the respondent's claimed interest and the timing of his registration.

6. Implementation

   If transfer is ordered, the registrar moves the domain to your account. Under the UDRP the registrar waits ten business days for any court challenge. Once received, lock it and set it to renew automatically.

Typical time and cost in a domain name dispute

Documents and evidence to collect

A practical tip on proving bad faith

When Advocate B.K. Singh looks at a domain dispute, the first comparison he makes is between the date the disputed domain was registered and the date your brand became known. If the domain came after your brand was public, bad faith is much easier to show. If it came before your brand existed, the complaint will usually fail unless there is later evidence of targeting. Check also whether the domain has changed hands, because a transfer to a new holder is treated as a fresh registration, and a squatter who bought it recently may not be able to rely on the original date.

Panels respond to clear timelines. A one-page chronology at the front of the complaint, listing your trademark filings, launch, media coverage and the domain's registration date, often does more than pages of argument.

If you are accused of cybersquatting

Receiving a UDRP or INDRP complaint is not a finding against you. Many domains are registered honestly: a common word, a family name, a place name, a fan or criticism site, or a business you started before the complainant's brand existed. The respondent's defences under the UDRP include genuine use or preparations for use before notice of the dispute, being commonly known by the domain name, and legitimate non-commercial or fair use without intent to mislead.

Reply within the time given, with documents. A respondent who stays silent almost always loses. If the complainant has filed knowing it had no case, for example to bully a small business into giving up a domain it registered first, a UDRP panel can make a finding of reverse domain name hijacking against the complainant. That finding carries no money penalty but can matter in later litigation.

Advocate B.K. Singh's practical advice to respondents is to stop any sale offer or pay-per-click use of the domain the day the complaint arrives, and to gather proof of when and why the domain was registered before writing a word of reply. An honest explanation backed by an old business plan, invoice or email is worth far more than legal argument. If the panel orders transfer and you believe the decision is wrong, the remedy is a suit within the ten business day window, filed in the jurisdiction the complainant chose.

What usually goes wrong

• Letting domains lapse. Most recoveries could have been avoided by auto-renewal and a company email on the registrar account.
• Using the UDRP for a business quarrel. Disputes with former partners, employees or developers are often outside the policy, and panels decline them.
• Weak proof of rights. A complainant without a registered mark must prove common law rights with evidence of use and reputation. Bare claims fail.
• Opening the negotiation yourself. An offer from you can blur the bad faith picture. Let the squatter make the demand.
• Missing the deadline to challenge. A Section 34 petition against an INDRP award must be filed within three months, with at most 30 days more for sufficient cause.

Keeping your domains safe once you recover them

Register the domain in the company's name, using a company email address that more than one person can access. Turn on auto-renewal with a valid payment method and the registrar lock that prevents unauthorised transfers. Put the domain registrar login in the same safe place as your company's statutory records.

Register the main variants of your brand: .in and .com at least, common misspellings and the hyphenated version if your brand has two words. The cost is small compared with any dispute. Register your trademark too, as the guide on protecting a trademark before going to court explains, because every route to recover a domain is easier with a registration in hand.

Set a watch on new domain registrations containing your brand. Several services offer this, and early detection lets you act before a lookalike domain is used for fraud. A domain picked up last week with no content yet is far easier to recover than one that has been running a fake website for a year.

What to do this week

Capture the disputed website, the WHOIS record and any sale offer with dates. Pull out your trademark certificates, earliest invoices and the registration dates of your own domains. If the domain is being used to take money from the public, file a cyber crime complaint now and warn your customers on your own website. Then decide on the forum: UDRP, INDRP or a suit. Our page on domain name disputes in the Delhi High Court explains how the firm can help with each.

If you have been accused of cybersquatting, stop any sale offer, collect the documents showing why you registered the domain, and reply within the time given. For advice on your papers or updates on the law, contact Advocate B.K. Singh.