Filing a UDRP Domain-Name Complaint: A Step-by-Step Checklist

By Casey Scott McKay · 2026-06-28

A practitioner-grade, phase-by-phase checklist for clawing a hijacked domain name back from a cybersquatter through ICANN's Uniform Domain-Name Dispute-Resolution Policy. It moves from the threshold decision of whether the UDRP is even your tool, through locking down your trademark rights, investigating the registrant, and proving all three elements—identical or confusingly similar, no rights or legitimate interests, and bad-faith registration and use—with dated evidence and the WIPO Overview 3.0. It walks choosing a provider (WIPO, FORUM, and the rest), electing a one- or three-member panel, drafting the complaint to UDRP Rule 3, the mutual-jurisdiction statement, the registrar lock, and the response-default-decision sequence. A dedicated phase audits your draft against the boomerang of reverse domain name hijacking, and a closing phase explains the ten-business-day window and when to escalate to federal court under the Anticybersquatting Consumer Protection Act. Every item carries a Why note, a Trap warning where it earns one, and the controlling authority, with a fictional cookware brand threading the whole process. Built for brand owners, in-house teams, and the attorneys who file these. Not legal advice.

Intellectual Property -> Domains | Published 28 June 2026 | rightsy.io

What this checklist is for

Someone has registered a web address built out of your brand. Maybe it loads a wall of pay-per-click ads pointing at your competitors. Maybe it sits dark and parked, with a "make offer" button. Maybe an email just arrived offering to sell it to you for a number with a lot of zeroes. You want the name, and you do not want a years-long federal lawsuit to get it.

This is the checklist for that job. It walks you, in order, through filing a complaint under ICANN's Uniform Domain-Name Dispute-Resolution Policy (the UDRP)—the private, global, paper-only proceeding that resolves most domain hijackings in roughly six to eight weeks for a few thousand dollars. It is the operational companion to our narrative deep-dive, Reclaiming a Hijacked Domain: The UDRP Complaint, Step by Step, and it sits inside the broader program mapped in our strategic playbook for guarding your brand on the open internet. Read those for the why; use this for the how, in the order you actually do it.

Who should use it. Brand owners and founders deciding whether to file; in-house brand-protection teams running enforcement at scale; and attorneys who want a pre-flight checklist before they sign the certification. No prior UDRP experience is assumed—every term is defined the first time it appears.

What you'll need before you start. Your trademark registration certificate (or, for an unregistered mark, your common-law evidence); a current WHOIS lookup for the domain; dated screenshots of whatever the domain resolves to; any correspondence from the registrant; the chosen provider's fee (roughly $1,300–$1,500 for a single-member panel); and a couple of focused hours. A blank annex folder, numbered as you go, will save you a scramble later.

How it is organized. Twelve phases, each a set of checkbox items. Every item has a Why (what it accomplishes), most have a Trap (the rookie error that sinks the item), and the controlling authority—Policy paragraph, UDRP Rule, statute, or case—rides alongside. A running example threads the whole thing:

Our running example — Kestrelware. Kestrelware is a fictional maker of enameled cast-iron cookware that has sold Dutch ovens and skillets under the federally registered word mark KESTRELWARE for nine years, online at kestrelware.com. One morning a customer asks why kestrelware-outlet.com—a domain Kestrelware never registered—shows a page of ads for rival cookware brands. A week later, an unsigned email offers the domain "and the matching typo" for $25,000. We will build Kestrelware's complaint from nothing, item by item. (Kestrelware is entirely invented; any resemblance to a real company is coincidental. None of this is legal advice.)

A one-paragraph orientation before the boxes, because almost every rookie mistake flows from getting the nature of the thing wrong. The UDRP is not a lawsuit and not quite arbitration. It is an administrative process grafted onto a contract: ICANN requires every accredited registrar to fold the UDRP into the registration agreement, so the moment anyone registers a domain in a generic top-level domain (.com, .shop, .app, and the rest) they consent in advance to resolve certain disputes this way. There is no summons to serve, no discovery, and—in the ordinary case—exactly one round of papers: your complaint, the respondent's response, the panel's decision. That spartan design is the UDRP's superpower and its ceiling. It is fast and cheap precisely because it refuses to develop facts, which makes it the wrong instrument for a genuinely murky dispute and the right one for clean cybersquatting. Authority for the whole framework lives in the Policy (the substantive standard, ICANN, eff. Jan. 1, 2000) and the Rules for UDRP (the procedure), supplemented by each provider's own Supplemental Rules.

Phase 1 — Decide whether the UDRP is even your tool

Spend the first hour deciding not to waste the next twenty. The UDRP is superb at one job and incapable of several others. Confirm fit before you draft a sentence.

• [ ] Confirm your goal is the domain itself, not money. Why. The only remedies a UDRP panel can order are transfer of the domain to you or cancellation of it—nothing more. No damages, no disgorged profits, no attorney's fees, no injunction against future conduct. Policy ¶ 4(i). Trap. If what you actually need is a payout, a deterrent against a serial squatter, or relief beyond the single name, the UDRP is structurally incapable of delivering it, and you are in the wrong forum. That is the federal road under the Anticybersquatting Consumer Protection Act—covered at Phase 12 and in depth in our piece on remedies and damages for trademark infringement.

• [ ] Confirm the disputed TLD is actually governed by the UDRP. Why. The UDRP binds every generic top-level domain (gTLD)—the legacy .com, .net, .org, .biz, .info and the 1,200-plus newer extensions like .shop, .store, and .app. Many country-code TLDs (ccTLDs, the two-letter national suffixes) have adopted the UDRP or a near-cousin, but a stubborn minority run their own regimes. Trap. Filing a UDRP complaint over a domain in a ccTLD that never adopted it is a wasted fee. The .uk space, for instance, is run by Nominet under its own Dispute Resolution Service, with an "abusive registration" test and a built-in mediation stage; .eu, .us, .ca, and .de each have their own policies. Confirm which policy governs the specific TLD before anything else.

• [ ] Choose among the UDRP, the URS, and an ACPA lawsuit. Why. They are different tools for different goals. The UDRP transfers the name. The Uniform Rapid Suspension System (URS)—available in the new gTLDs—is faster and cheaper (roughly three weeks, ~$375–$500) but demands a higher burden (clear and convincing evidence) and only suspends the domain for the rest of its term; it never transfers it. The ACPA (15 U.S.C. § 1125(d)) is a federal lawsuit that can deliver money and reach hidden registrants in rem. Trap. Reaching for the URS when you want to own the name. The URS stops an emergency (a live phishing site impersonating your bank); it does not give you the domain. For acquisition, you want the UDRP.

• [ ] Decide—deliberately—whether to send a demand letter first. Why. A measured demand sometimes recovers the domain for the cost of an email, and a registrant's reaction can sharpen your read of the case. Our art of the cease-and-desist letter and the companion drafting checklist cover tone and content. Trap. Tipping off a sophisticated squatter invites cyberflight—the registrant transfers the domain to a confederate or a new alias the moment it smells a complaint, forcing you to start over against a moving target. Against an anonymous parker who looks like a pro, many practitioners skip the letter and let the registrar lock (Phase 10) do the freezing. Calibrate to the target.

• [ ] Sanity-check that you hold a winner on all three elements. Why. You must prove all three elements of Policy ¶ 4(a); two out of three loses. The published ~85% complainant win rate reflects selection bias (the obvious squats are the ones that get filed), not panel generosity. Run a clean clearance pass on your own mark through Rightsy's trademark and logo search so you know exactly what you own before you accuse anyone. Trap. Talking yourself into a close case. If the domain predates your rights, the term is an ordinary dictionary word, or the registrant has a colorable legitimate use, stop and run the reverse-hijacking audit at Phase 7 now, before you spend the fee.

Kestrelware, Phase 1. Goal: own kestrelware-outlet.com (and the typo). .com is a core gTLD—UDRP applies. Kestrelware wants the name, not damages from an anonymous parker with no obvious assets, so the UDRP beats both the URS (which would only suspend) and an ACPA suit (slower, costlier, aimed at money). Because the registrant is hiding behind a privacy service and looks like a professional, Kestrelware skips the demand letter to avoid cyberflight and lets the registrar lock do the work.

Phase 2 — Lock down your own trademark rights

Element one has two halves: you must hold rights in a mark, and the domain must be confusingly similar to it. This phase nails the first half. Do it before you look at the squatter, because if your own house is not in order the rest is moot.

• [ ] Pull your registration certificate and a current status printout. Why. A federal registration on the Principal Register is prima facie evidence of the validity of the mark, of your ownership, and of your exclusive right to use it—exactly the leverage catalogued in what federal registration actually buys you. 15 U.S.C. § 1057(b). State and foreign registrations count too. Print the current status and title from the USPTO's Trademark Search system (which replaced the retired TESS database) so the panel sees a live, owned registration. Trap. Attaching a decade-old certificate without a current status page. A registration that has lapsed for missed maintenance filings is worth little; confirm it is alive first.

• [ ] Reconstruct and verify the chain of title. Why. The complainant in the caption must match the owner on the certificate. If your rights came by assignment, the panel will want the recorded chain. Pull it from Rightsy's trademark assignment records and attach it so there is no daylight between certificate and complainant. The mechanics of validating that chain live in our assignment due-diligence checklist. Trap. A broken or unrecorded assignment is a gift to the respondent's lawyer—an easy attack on your standing that has nothing to do with the merits.

• [ ] If the mark is unregistered, assemble the common-law / secondary-meaning package. Why. The UDRP recognizes unregistered, common-law rights, but only if you show the mark has become a distinctive identifier of your goods or services—what lawyers call secondary meaning. That means sales volumes, advertising spend, length and exclusivity of use, unsolicited media, and sometimes a survey. Our explainer on how marks move from descriptive to distinctive, the Section 2(f) secondary-meaning evidence checklist, and the common-law rights and geographic-scope toolkit tell you what to gather. The foundations are in common-law trademark rights. Trap. "We've used it for years" carries nothing. Bald assertion is not evidence; bare conclusory claims of common-law rights fail this element routinely. WIPO Overview 3.0, § 1.3.

• [ ] Confirm rights exist as of the filing date—and note the timing trap for element three. Why. For element one only, your mark does not need to predate the domain registration; what matters is that you hold rights when you file. WIPO Overview 3.0, § 1.1.3. Trap. Do not relax. The sequence of mark-versus-domain comes roaring back under element three, where bad-faith registration usually requires that your rights predate the domain. Rights you acquired last month satisfy element one and can doom element three. The whole logic of who-came-first is mapped in the time machine of trademark priority.

Kestrelware, Phase 2. Nine-year-old Principal Register registration for KESTRELWARE, current and owned outright (no assignments), with a fresh status printout. Element one's first half is a formality—and because the registration is nine years old and the domain was created last quarter, the timing also lines up for element three.

Phase 3 — Investigate the domain and the registrant

This is where cases are quietly won or lost, because the UDRP gives you one shot and no discovery. Capture everything now; the page you saw on Monday may be gone by Friday.

• [ ] Capture the live website with dated, full-URL screenshots. Why. Whatever the domain resolves to is your core proof on elements two and three—the parked ads, the impersonation page, the "for sale" lander. Screenshot it with the full URL and a visible date. Trap. Parking pages rotate their ads on a timer and registrants "tidy up" overnight once they sense a complaint. The recurring rookie disaster is failing to preserve the evidence before it evaporates. Capture the day your investigation begins, not the week you file.

• [ ] Pull and preserve the WHOIS record. Why. WHOIS shows the registrant (or a privacy placeholder), the registrar, and the creation date—each load-bearing later. Save a dated copy. Trap. Since the EU's GDPR took effect in 2018, WHOIS frequently redacts the registrant behind "Redacted for Privacy." This does not defeat your complaint. Under ICANN's Temporary Specification, you file against the redacted placeholder; once you file, the registrar discloses the underlying data to the provider, who relays it so you can amend (Phase 10). Redaction merely delays the unmasking—it does not prevent recovery.

• [ ] Archive historical use through the Wayback Machine. Why. Past versions of the site can show prior infringing use, prior parking, or a suspicious gap—evidence the live page alone will not give you. Pull the snapshots and save them as annexes. Trap. Waiting until filing day. Archive on day one of the investigation, because a registrant cannot scrub the Internet Archive but can change the live page.

• [ ] Nail down the domain's creation/registration date. Why. This single date is the hinge of element three. Set it against the date your mark became known. A domain registered the week after your product launch, your merger announcement, or a news event that made your term valuable is a powerful inference of knowledge and bad faith. Trap. Confusing the creation date with a later renewal or transfer date. For bad-faith-registration purposes, the relevant date is generally the original registration—or a transfer to a new holder, which most panels treat as a fresh registration. WIPO Overview 3.0, § 3.9.

• [ ] Identify the registrar and the registration agreement's language. Why. The registrar's location helps define the mutual jurisdiction (Phase 9), and the language of the registration agreement is the default language of the proceeding under Rule 11(a). Trap. Assuming the proceeding runs in English. If the registration agreement is in, say, Turkish, you may have to file in Turkish or formally request that the panel proceed in English—an avoidable surprise if you check first.

• [ ] Run the registrant through prior UDRP decisions and reverse-WHOIS. Why. A documented pattern of abusive registrations is independent evidence of bad faith under Policy ¶ 4(b)(ii), and a serial squatter is a panel's favorite kind of respondent to rule against. Search the registrant's name and email across WIPO and FORUM decision databases, and look for its other trademark-matching domains. Trap. Skipping this because the single case looks strong enough. Pattern evidence is cheap, powerful, and often the difference in a contested matter.

• [ ] Preserve every offer-to-sell or ransom communication. Why. An unsolicited demand for a sum exceeding documented out-of-pocket costs is Policy ¶ 4(b)(i) in its purest form—often the single most damning exhibit you will file. Trap. Negotiating by phone or letting the email thread scroll away. Keep it in writing, keep the full headers, and do not delete anything.

Kestrelware, Phase 3. Kestrelware screenshots the rival-cookware ad page (full URL, dated), saves the WHOIS (registrant redacted behind a privacy service; registrar identified; domain created last quarter—six years after the registration matured to incontestable), archives two Wayback snapshots, preserves the $25,000 email with headers, and finds the same privacy-shielded email tied to four other "-outlet.com" domains matching well-known brands. Pattern, established.

Phase 4 — Build element one: identical or confusingly similar

With rights proven (Phase 2), the comparison itself is refreshingly mechanical. Keep this section tight and confident; denials almost never turn on element one.

• [ ] Drop the TLD and run the recognizability test. Why. Panels disregard the TLD suffix (.com, .shop) as a technical necessity of the addressing system, then ask whether your mark is recognizable within what remains. WIPO Overview 3.0, §§ 1.7, 1.11. If the mark is plainly present, the element is satisfied. Trap. Over-arguing a point reality already concedes. A paragraph or two is plenty; save your word budget for element three.

• [ ] Address added or altered terms and typos head-on. Why. The squatter's costume tricks all fail here: adding generic or descriptive words (kestrelware-outlet, buy-kestrelware), geographic or corporate add-ons (kestrelware-usa, kestrelwareinc), and deliberate misspellings (typosquatting: kestrelwear, kestralware) leave the mark recognizable and stay confusingly similar. WIPO Overview 3.0, § 1.8. The deeper consumer-confusion analysis—relevant well beyond domains—is mapped in our likelihood-of-confusion field map and the multifactor toolkit across the circuits. Trap. Conceding that an added word like "outlet" dispels confusion. It does the opposite—a descriptive add-on that names your own channel or product tends to deepen the association.

• [ ] Attach the rights evidence as a clean annex. Why. The registration certificate plus current status (or the secondary-meaning package) is the proof behind your one or two sentences of argument. Label it and move on.

Kestrelware, Phase 4. Strip .com: "kestrelware-outlet." The registered mark KESTRELWARE sits in plain view, trailed by a word that merely names a sales channel. Confusing similarity is obvious. Two sentences and the certificate; done.

Phase 5 — Build element two: no rights or legitimate interests

Now you must prove a negative—that the registrant has no legitimate basis for holding the name. Because that evidence lives inside the registrant's own files, panels use a burden-shifting framework: make a prima facie case and the burden of production shifts to the registrant to show a real stake. WIPO Overview 3.0, § 2.1.

• [ ] State the prima facie case—the four negatives—in plain words. Why. Affirmatively assert what you can prove from the outside: the registrant (i) is not commonly known by the name (cite the WHOIS), (ii) owns no trademark of its own in the term, (iii) was never licensed or authorized by you, and (iv) is making no bona fide or fair use. That quartet, supported, shifts the burden. Trap. Leaving any of the four implicit. State each one and attach its proof; a panel will not infer the negatives for you.

• [ ] Pre-empt each Policy ¶ 4(c) safe harbor before the response can raise it. Why. Paragraph 4(c) hands the registrant three ways to show legitimacy, and you should foreclose each:

  • 4(c)(i) — bona fide offering before notice. Use of, or demonstrable preparations to use, the domain for a genuine offering before notice of the dispute. Show the page is a parking lot, not a business.
  • 4(c)(ii) — commonly known by the name. Someone genuinely named or trading as the term has an interest in it. Show the registrant is not.
  • 4(c)(iii) — legitimate noncommercial or fair use. Genuine criticism, commentary, fan, or parody use can qualify—if it is real. The descriptive and nominative fair-use defenses are unpacked in our forthcoming piece on fair use in trademark law. Trap. A registrant cannot manufacture legitimacy by throwing up a storefront the morning after your cease-and-desist arrives—the offering must predate notice. And a site that pretends to criticize while quietly banking pay-per-click revenue is not fair use; it is cybersquatting in a Halloween costume. Say so.

• [ ] If the domain is an ordinary dictionary word, explain why the use targets your mark. Why. A registrant may legitimately hold a common word for its everyday meaning (the owner of apple-orchard-supply.com who sells apple trees is not squatting on a computer company). You must show the registrant's actual use trades on your brand, not the word's ordinary sense. Trap. Ignoring this where your mark is descriptive or dictionary-derived. That gap is exactly where a legitimate-interest defense—and a reverse-hijacking finding—lives. Re-run Phase 7.

• [ ] Anchor everything with dated screenshots and the WHOIS. Why. Your prima facie case is only as good as its annexes. The parked page, the WHOIS, and any correspondence are the proof that the four negatives are true.

Kestrelware, Phase 5. The registrant is "Redacted for Privacy" (not "Kestrelware" anything), owns no KESTRELWARE mark, has never had any relationship with the company, and merely auto-parks the domain on machine-generated rival-cookware ads. None of the 4(c) safe harbors fits—the parking predates nothing, the registrant is known by no such name, and ad-revenue parking is not fair use. Prima facie case made; a parking-page squatter has nothing to shift back.

Phase 6 — Build element three: bad-faith registration AND use

This is where you spend most of your effort. Element three demands bad faith in both the registration and the use—two separate findings joined by the single most consequential word in the Policy: and. A domain registered in good faith but later exploited does not satisfy the UDRP (though it may satisfy the ACPA—the reason the two regimes are not interchangeable). Policy ¶ 4(a)(iii).

• [ ] Lay out the chronology and reach for the inference of knowledge. Why. Put your mark's timeline beside the domain's creation date. Knowledge of your mark at registration is the heart of bad-faith registration, and you prove it by inference: the fame or distinctiveness of the mark, a near-exact typo, registration suspiciously soon after a launch or announcement. Where your brand sits on the spectrum from generic to fanciful drives how strong that inference is—see the Abercrombie spectrum and the distinctiveness and protectability toolkit. Trap. A domain that predates your rights usually makes bad-faith registration logically impossible. If the creation date is older than your mark, this is likely a losing complaint—reconsider before filing. WIPO Overview 3.0, § 3.8.

• [ ] Map your facts onto the four Policy ¶ 4(b) circumstances. Why. Any one of these establishes bad-faith registration and use:

  • 4(b)(i) — registered primarily to sell to the mark owner or a competitor for more than out-of-pocket cost (the ransom demand; a portfolio held for resale).
  • 4(b)(ii) — registered to block the owner from a corresponding domain, where the registrant shows a pattern.
  • 4(b)(iii) — registered primarily to disrupt a competitor's business.
  • 4(b)(iv) — using the domain to attract users for commercial gain by confusion as to source or sponsorship (pay-per-click parking, impersonation, phishing). Trap. Treating the list as exhaustive—or as a single finding. It is non-exclusive, and you still need both registration and use. Name the subsection(s) you rely on and tie each to an exhibit.

• [ ] Marshal the wider bad-faith indicators. Why. Panels routinely look past the four enumerated circumstances to a wider constellation: hiding behind a privacy/proxy service, false or incomplete WHOIS data, ignoring the complaint, and—most powerfully—opportunistic bad faith, where the mark is so well known that no innocent explanation is plausible. WIPO Overview 3.0, §§ 3.1.4, 3.6. The more famous and distinctive your mark, the heavier that inference lands. Trap. Leaving the privacy shield or the false WHOIS unmentioned. These are not neutral facts; flag them as the bad-faith indicators they are.

• [ ] If the domain is dark or parked-and-blank, run the Telstra passive-holding analysis. Why. A domain that is registered but never actively used can still satisfy "use in bad faith." The landmark is Telstra Corp. Ltd. v. Nuclear Marshmallows, WIPO Case No. D2000-0003, now folded into WIPO Overview 3.0, § 3.3. The factors ask whether bad faith is the only sensible inference: the distinctiveness/reputation of your mark, the registrant's failure to respond, concealment behind privacy or false WHOIS, and the implausibility of any good-faith use. Trap. Assuming an inactive domain cannot infringe and giving up. March through the Telstra factors by name; passive holding by an anonymous registrant of a well-known mark is bad faith wearing a still mask.

• [ ] Confirm—explicitly—that BOTH registration and use are bad faith. Why. This is the bouncer-conjunction. Make the panel's job easy by separately stating why the registration was in bad faith (knowledge + intent at acquisition) and why the use is in bad faith (the parking, the sale offer, the impersonation, or passive holding). Trap. Proving only ongoing bad use while assuming registration bad faith follows automatically. It does not. If you can only show later bad faith after an innocent registration, the UDRP may not reach it—and the ACPA (Phase 12) becomes your real tool.

Kestrelware, Phase 6. Two independent hooks, either of which would carry the day. 4(b)(i): the unsolicited $25,000 demand dwarfs any registration cost. 4(b)(iv): the pay-per-click page monetizes confusion with KESTRELWARE for commercial gain. Knowledge is plain—the mark is nine years old and distinctive, the domain brand-new, and four sibling "-outlet" squats establish a 4(b)(ii) pattern. Registration and use, both bad faith, each tied to a dated exhibit.

Phase 7 — Self-audit against reverse domain name hijacking

Before you sign the certification, turn the lens on yourself. The UDRP cuts both ways, and overreaching complainants get cut. Under Rule 15(e), a panel may declare Reverse Domain Name Hijacking (RDNH)—that you brought the complaint in bad faith—where you knew or should have known you could not prove an element and filed anyway. WIPO Overview 3.0, § 4.16. The finding is published, names you as an abuser of the process, and follows you into later disputes. Treat this phase as a hard gate, not a formality.

• [ ] Re-check the dates: do your rights predate the domain? Why. If the domain was registered before your trademark rights existed, bad-faith registration is logically impossible, and filing anyway—especially while glossing over the dates—is a fast track to RDNH. Trap. The classic disaster: a two-year-old startup that just coined a brand files to seize a domain a supplier has quietly held since 1998. Do not be that complainant.

• [ ] Re-check for a generic or dictionary term you do not exclusively own. Why. Trying to capture an ordinary word the registrant uses for its ordinary meaning is a paradigm RDNH fact pattern. Trap. Confusing "I want this domain" with "I have exclusive rights in this word." The distance between them is where RDNH findings live.

• [ ] Re-check for a colorable legitimate use or a good-faith business under a similar name. Why. A legitimate business operating in good faith under a similar name in a different field has an interest you cannot extinguish with the UDRP. (Imagine a "Kestrel Web Design" studio that has traded for years at kestrel.dev—wholly unrelated to cookware.) Trap. Pattern-matching on the name alone and ignoring a genuinely different field or a real operating business.

• [ ] Disclose the inconvenient facts; do not hide them. Why. Candor about adverse dates or a plausible competing use lets you address them head-on and signals good faith. Hiding them and hoping the panel will not check is itself a recognized aggravator of RDNH. Trap. The instinct to bury the bad date. Panels check. Concealment converts a losing complaint into a branded one.

Kestrelware, Phase 7. Audit passes cleanly: KESTRELWARE is a distinctive coined term Kestrelware has used for nine years; the domain is brand-new; "kestrelware-outlet" has no ordinary-language meaning; and the registrant is an anonymous parker with no competing business. No RDNH exposure. Sign with confidence.

Phase 8 — Choose your provider and panel

The substantive Policy is identical across providers (it is, after all, uniform). What differs is each provider's Supplemental Rules, roster, fees, and feel.

• [ ] Pick the provider. Why. ICANN accredits a small set. In Western practice two dominate: WIPO (Geneva)—the largest caseload, the deepest published jurisprudence, the author of the Overview 3.0, and the reflexive default for complex, high-value, or internationally tangled disputes—and FORUM (formerly the National Arbitration Forum, "NAF," Minneapolis)—the second-largest center, popular with U.S. complainants for efficiency and competitive pricing. Others include the ADNDRC (Asia), the Czech Arbitration Court, the ACDR (Amman), and the CIIDRC (Canada). Trap. Choosing on price alone. Fees run roughly $1,300–$1,500 (single panelist) and $2,600–$4,000 (three), but they change without much warning—confirm the current schedule before filing.

• [ ] Elect a one- or three-member panel. Why. A single member is faster and cheaper and is plenty for a default-bound, clean squat. A three-member panel costs more but buys insulation against an outlier single-panelist decision when you expect a serious, well-resourced response. Trap. Defaulting to one member in a genuinely contested, high-value case to save a few thousand dollars. For a fight worth fighting, the extra panelists are cheap insurance. If you elect three, you must name three candidates from the provider's published list. Rules 3(b)(iv), 6.

• [ ] Read the provider's Supplemental Rules, the Policy, and the UDRP Rules—before drafting. Why. The Supplemental Rules govern format, length limits, and filing mechanics, and they differ: WIPO imposes a word limit on the substantive argument (commonly cited around 5,000 words), while FORUM works from a page-based cap. Trap. A complaint that flunks the provider's formatting can be bounced on administrative-compliance grounds before any panelist reads your argument. Read first; draft second.

Kestrelware, Phase 8. Clean, likely-default domestic squat. Kestrelware picks FORUM for cost and speed, elects a single panelist, and reads FORUM's Supplemental Rules and page limits before drafting a word.

Phase 9 — Draft the complaint to UDRP Rule 3

The complaint is your case. There is no hearing to rescue a thin filing, no deposition to develop what you left out, and in the ordinary proceeding no reply brief. One document for you, one for the respondent, then the decision. Treat it as the only shot it is.

• [ ] Assemble every Rule 3(b) required content. Why. A complete complaint includes: a request to decide under the UDRP; your (and any representative's) contact details and communication preferences; the panel election; the respondent's information matched as closely as possible to the WHOIS (carry over placeholders like "Redacted for Privacy"); the disputed domain(s) and registrar(s); the trademark(s) relied on and the goods/services they cover; the factual and legal grounds organized around the three elements; the remedy sought (transfer or cancellation); a statement of any other pending or decided proceedings on the domain; the mutual-jurisdiction statement; the certification; and the annexes. Rule 3(b). Trap. Omitting the "other proceedings" statement or the goods/services description. Small gaps trigger a compliance deficiency notice and cost you days.

• [ ] Draft the mutual-jurisdiction statement. Why. You must agree to submit to the courts of at least one mutual jurisdiction—generally the registrar's principal office or the registrant's WHOIS address—for the limited purpose of any challenge to a transfer order. Rules 1, 3(b)(xiii). This is the hinge that lets a losing respondent run to court within ten business days (Phase 12). Trap. Forgetting that, by filing, you are agreeing in advance to be suable in that forum. It surprises people, but it is the price of the system's speed.

• [ ] Include the prescribed certifications. Why. You must certify that the information is complete and accurate, and that your claims and remedies concerning the domain run solely against the registrant—waiving claims against the provider, panelists, registrar, and registry (deliberate wrongdoing aside). Rule 3(b)(xiii)–(xiv). Trap. Signing the completeness certification while concealing an adverse date (see Phase 7). The certification is exactly what an RDNH finding turns against you.

• [ ] Respect the word or page limit. Why. WIPO's word cap and FORUM's page cap are real constraints. Allocate the budget where the case is contested—element three—and keep element one to a paragraph. Trap. Burning half your word count over-arguing confusing similarity, then running out of room for the bad-faith chronology that actually decides the case.

• [ ] Organize and label the annexes by element. Why. Panels read fast. A numbered annex set—registration certificate and status; chain of title; WHOIS; dated site screenshots; Wayback captures; the sale-offer email; prior UDRP decisions against the registrant—lets the panel verify each assertion at a glance. Trap. A shapeless evidence dump. If the panel cannot find the proof, it does not exist.

Kestrelware, Phase 9. FORUM model complaint: three elements, transfer requested, mutual jurisdiction set to the registrar's location, certifications signed, eight numbered annexes (certificate + status, WHOIS, two dated screenshots, two Wayback captures, the $25,000 email, a table of the four sibling squats with their decisions). Within the page cap, with room to spare on element three.

Phase 10 — File, pay, and the registrar lock

You file with the provider; you do not serve the respondent. The provider drives notice and the lock. Rule 2.

• [ ] File the complaint with the provider and pay the fee. Why. Filing and payment start the clock. The provider will not act until the fee clears. Trap. Filing without the fee and assuming the case is pending. It is not commenced until paid.

• [ ] Expect the provider's administrative-compliance review. Why. Within three calendar days of receiving the fee, the provider checks the complaint for formal compliance with the Policy, Rules, and its Supplemental Rules. Rule 4(a)–(b). Trap. If the provider flags a deficiency, you have five calendar days to cure or the complaint is deemed withdrawn (you can refile). Watch your inbox; do not let a curable defect kill the filing.

• [ ] Understand the registrar verification and the lock. Why. The provider asks the registrar to verify the registration and to lock the domain—freezing transfers and changes so the squatter cannot shuffle the name to a confederate or let it lapse mid-case. Under ICANN's lock policy the registrar must apply the lock within two business days of the request, before notifying the registrant. Rule 4; ICANN registrar lock requirement. Trap. Expecting instant public confirmation. The lock is administrative and may not show in public WHOIS immediately; trust the sequence (lock first, notify second)—that ordering is a quiet structural advantage over a lawsuit, where a nimble defendant can move a domain in the gap before an injunction.

• [ ] Amend after the registrar discloses the underlying WHOIS. Why. Where the registrant was redacted, the registrar's verification reveals the true holder to the provider, who relays it to you. Amend the complaint to name the real respondent and add any newly relevant facts. Trap. Treating the privacy placeholder as the final respondent. Once unmasked, conform the caption and explore whether the real identity opens settlement or strengthens the pattern.

• [ ] Note the commencement date—the clock that runs the case. Why. Once the complaint is compliant and forwarded, the provider formally commences the proceeding and notifies the respondent. Commencement starts the response period. Rule 4(c). Trap. Miscounting from your filing date rather than the commencement date. The respondent's clock runs from commencement, not from when you hit "submit."

Kestrelware, Phase 10. Kestrelware files and pays at FORUM. Within two business days the registrar locks kestrelware-outlet.com and discloses the registrant—an individual in another country behind the privacy service, the same name on the four sibling squats. Kestrelware amends to name him and strengthens the pattern paragraph. The proceeding commences.

Phase 11 — The response window, settlement, and the decision

Now you wait, watch the calendar, and stay ready to settle or reply.

• [ ] Calendar the respondent's 20-day response deadline. Why. The respondent has 20 days from commencement to respond. Rule 5(a). A short extension is available—four days as of right on request under Rule 5(b), and more in exceptional circumstances under Rule 5(d). Trap. Assuming silence equals an instant win the day after the deadline. The panel still has to be appointed and rule.

• [ ] Evaluate any settlement overture on its merits. Why. Respondents sometimes offer to transfer the domain voluntarily once the lock makes flight impossible. A consented transfer can resolve the matter faster and cheaper; the provider can suspend the proceeding to document it. Rule 17. Trap. Paying ransom dressed up as settlement. If your case is strong, a voluntary transfer should cost you little or nothing beyond what you have already spent—do not reward the squat.

• [ ] Remember that a default is not an automatic win. Why. If the respondent says nothing, the panel must still find all three elements proven on the record. Rule 14(b) lets the panel draw inferences from default, but a paper-thin complaint can lose unopposed. Trap. Relaxing because the respondent went quiet. Draft as if the panel will scrutinize you—because it will.

• [ ] Track panel appointment and the decision timeline. Why. After the response (or the response deadline passes), the provider appoints the panel within five calendar days (Rule 6), and the panel forwards its decision to the provider within 14 days of appointment (Rule 15(b)); the provider communicates it to the parties within three business days (Rule 16(a)). Trap. Expecting a hearing or a chance to supplement. There is neither, absent a panel request. Your complaint is your case.

• [ ] Read the decision carefully when it issues. Why. The decision states whether each element was met and orders transfer, cancellation, or denial—and whether the panel made any RDNH finding. It tells you what happens next and on what timeline. Trap. Filing the win and ignoring the mechanics. The transfer is not instant; see Phase 12.

Kestrelware, Phase 11. The respondent—true to type for a serial parker—defaults. FORUM appoints a single panelist, who nonetheless works through all three elements on Kestrelware's unrebutted record, credits the $25,000 demand and the rival-ad parking, notes the four-domain pattern, and orders transfer. No RDNH (none was remotely warranted).

Phase 12 — After the gavel: transfer, stay, and escalation

Winning is not quite the end. One built-in pause stands between the decision and the domain.

• [ ] Mark the ten-business-day window. Why. The registrar implements a transfer only after waiting ten business days to see whether the losing respondent files court proceedings in a mutual jurisdiction to challenge it. Policy ¶ 4(k). That window is the UDRP's pressure valve and the reason its decisions are not, strictly, final. Trap. Telling the world you own the name on decision day. You do not control it until the window closes and the registrar acts.

• [ ] Implement the transfer and update your portfolio. Why. If no court action lands inside the window, the registrar transfers the domain. Take control, set it to auto-renew, point it where you want, and fold it into your watch program so it never lapses into a squatter's hands again. Standing surveillance is the subject of our watch-and-policing program checklist and the broader online brand-protection and anti-counterfeiting toolkit. Trap. Recovering the one name and ignoring the obvious variants and typos. Defensive registration of the predictable squats—covered in the brand-launch IP clearance checklist—is far cheaper than the next proceeding.

• [ ] If a losing respondent files suit to stay the transfer, prepare for de novo court review. Why. A respondent who sues in a mutual jurisdiction within the window can stay the transfer while a court takes a fresh, de novo look. Court challenges are rare—most UDRP losers are squatters without the resources or defenses to bankroll litigation—but they happen. A respondent who believes the transfer was an unjust seizure may also strike first; see declaratory-judgment actions in trademark disputes. Trap. Assuming the UDRP decision binds the court. It does not; the court starts over.

• [ ] If you lost a winnable case, weigh re-filing versus escalating to the ACPA. Why. A losing complainant can re-file a fresh UDRP (cheaper) or sue under the ACPA, 15 U.S.C. § 1125(d)—the vehicle for the cases the UDRP cannot reach. The ACPA folds the "no legitimate interest" inquiry into a nine-factor bad-faith-intent-to-profit test (15 U.S.C. § 1125(d)(1)(B)(i)) and, crucially, has no "registered and used" bouncer—bad faith can arise after a lawful registration, reaching the employee or contractor who registers a domain legitimately and later weaponizes it. See DSPT Int'l v. Nahum, 624 F.3d 1213 (9th Cir. 2010); the litigation mechanics are in our federal-court infringement complaint checklist and the infringement litigation toolkit. Trap. Re-litigating reflexively. If the UDRP loss reflected a real defect (your rights postdate the domain), the ACPA will not cure it.

• [ ] If you won the domain but need money or a deterrent, file the ACPA suit. Why. The ACPA pays where the UDRP cannot: actual damages and profits, or—at your election any time before final judgment—statutory damages of $1,000 to $100,000 per domain (15 U.S.C. § 1117(d)), plus attorney's fees in "exceptional" cases (15 U.S.C. § 1117(a)) and an in rem action against the domain itself where the registrant is hidden or beyond reach (15 U.S.C. § 1125(d)(2)). False contact data creates a rebuttable presumption of willfulness (15 U.S.C. § 1117(e)). How those dollars get measured and split is the subject of dividing the spoils, the remedies and monetary-recovery toolkit, willful infringement and enhanced recovery, and who pays the lawyers. Trap. Expecting the UDRP to deter a serial squatter. It transfers one name; the squatter registers another tomorrow. Only money and an injunction—ACPA territory—change that math.

Kestrelware, Phase 12. Ten business days pass with no court filing; the registrar transfers kestrelware-outlet.com. Kestrelware auto-renews it, grabs the matching typo defensively, and stands up a watch on "kestrelware" across the new gTLDs. Because the respondent is a four-domain serial parker who profited from confusion, Kestrelware's counsel weighs an ACPA suit for statutory damages to deter the next round—exactly the calculus the UDRP cannot perform.

A compact worked example, start to finish

To see the machine run end to end, here is Kestrelware's path compressed into a single arc.

A customer flags kestrelware-outlet.com loading rival-cookware ads; days later, an anonymous email offers it (and "the matching typo") for $25,000. Kestrelware confirms the UDRP is the right tool—it wants the name, the TLD is .com, and a demand letter risks cyberflight against a pro (Phase 1). It pulls its nine-year-old KESTRELWARE registration, current and owned outright, with a fresh status printout (Phase 2). It screenshots the ad page with a visible date and URL, saves the redacted WHOIS, archives two Wayback snapshots, fixes the last-quarter creation date, identifies the registrar, preserves the ransom email with headers, and finds four sibling "-outlet" squats tied to the same shielded email (Phase 3).

The case builds itself. Element one: strip .com, and KESTRELWARE sits in plain view before a descriptive add-on—two sentences and the certificate (Phase 4). Element two: the registrant is not known by the name, owns no such mark, was never licensed, and only auto-parks for ad revenue—prima facie case made, no 4(c) safe harbor in reach (Phase 5). Element three: the $25,000 demand (4(b)(i)) and the rival-ad parking (4(b)(iv)) each independently prove bad faith; the nine-year-old distinctive mark against a brand-new domain proves knowledge; the four-domain pattern (4(b)(ii)) seals it—registration and use, both bad faith (Phase 6). The RDNH self-audit passes cleanly: distinctive coined mark, brand-new domain, no dictionary meaning, no competing business (Phase 7).

Kestrelware picks FORUM, elects a single panelist, and reads the Supplemental Rules (Phase 8). It drafts a model complaint to Rule 3, sets the mutual jurisdiction to the registrar's location, signs the certifications, and labels eight annexes (Phase 9). It files and pays; within two business days the registrar locks the domain and discloses the registrant, whom Kestrelware names by amendment (Phase 10). The respondent defaults; the panelist nonetheless works the full record and orders transfer (Phase 11). Ten business days later, with no court challenge, the registrar hands over the domain; Kestrelware auto-renews it, grabs the typo, sets a watch, and weighs an ACPA suit against the serial parker for statutory damages (Phase 12).

Filing fee aside, the whole thing ran about seven weeks, never touched a courtroom, and brought the name home.

Common mistakes

• Reaching for the UDRP when you actually want money or a deterrent. The panel can only transfer or cancel. If the point is damages or stopping a serial squatter, that is the ACPA. Policy ¶ 4(i); 15 U.S.C. § 1117(d).
• Filing where the domain predates your trademark rights. Bad-faith registration is usually impossible if the name existed before your mark. This is both a losing complaint and a leading cause of RDNH findings. WIPO Overview 3.0, §§ 3.8, 4.16.
• Confusing the UDRP's "registered and used" standard with the ACPA's. The conjunction is a bouncer: later bad faith after an innocent registration fails the UDRP but can win under the ACPA. Plan the forum around that single word.
• Not capturing evidence before it evaporates. Parking pages rotate ads and registrants tidy up overnight. Screenshot (dated, full URL) and pull Wayback captures on day one, not filing day.
• Treating a privacy-redacted WHOIS as a dead end. You file against the placeholder; the registrar discloses after filing; you amend. Redaction delays, it does not defeat. ICANN Temporary Specification.
• Conceding that an added word cures confusion. "Outlet," "shop," "store," "USA," "inc"—these keep the mark recognizable and often deepen the association. WIPO Overview 3.0, § 1.8.
• Leaving the prima facie negatives implicit on element two. State all four—not known by the name, owns no mark, never licensed, no bona fide/fair use—and attach proof for each. WIPO Overview 3.0, § 2.1.
• Giving up on a dark, parked-and-blank domain. Passive holding can be bad-faith use. Invoke Telstra and march through its factors. WIPO Case No. D2000-0003; WIPO Overview 3.0, § 3.3.
• Treating a default as an automatic win. The panel still must find all three elements proven. Draft to be scrutinized. Rule 14(b).
• Ignoring the provider's Supplemental Rules. A complaint that blows the word or page limit can be bounced on compliance before any panelist reads it. Read the Rules first.
• Forgetting the mutual-jurisdiction consequence. By filing, you agree to be suable in that forum if the respondent challenges the transfer. Rules 1, 3(b)(xiii).
• Announcing victory on decision day. The registrar waits ten business days for a court challenge before transferring. Policy ¶ 4(k).
• Overreaching. The through-line of the entire process. The UDRP rewards the clear cybersquatting case and publishes the names of those who abuse it. Know which case you actually have before you sign.

Related Resources

• Reclaiming a Hijacked Domain: The UDRP Complaint, Step by Step — the narrative companion to this checklist.
• Guarding Your Brand on the Open Internet: A Strategic Playbook — where domain disputes fit in the larger program.
• Online Brand Protection and Anti-Counterfeiting Toolkit — the parent toolkit for internet enforcement.
• Setting Up a Trademark Watch and Policing Program: A Checklist — how to catch the next hijack early.
• Brand Launch IP Clearance Checklist: Vetting a New Name Before You Spend — defensive domain registration up front.
• What Federal Registration Actually Buys You: The Lanham Act Advantages, Decoded — the rights behind element one.
• From Descriptive to Distinctive: How Marks Acquire Secondary Meaning and Establishing Secondary Meaning: A Section 2(f) Evidence Checklist — proving common-law rights.
• Transferring a Trademark: The Assignment Recordation Checklist and Trademark Assignment Due-Diligence Checklist: Validating Chain of Title — fixing the chain of title.
• Likelihood of Confusion: A Brand Owner's Field Map and Likelihood of Confusion Toolkit — the confusion analysis.
• The Abercrombie Spectrum: From Generic to Fanciful and Trademark Distinctiveness and Protectability Toolkit — distinctiveness and the bad-faith inference.
• The Time Machine of Trademark Priority: Constructive Use Under Section 7(c) — why dates decide element three.
• Fair Use in Trademark Law: Descriptive and Nominative Defenses — the criticism and fair-use defenses a respondent may raise.
• Filing a Trademark Infringement Complaint in Federal Court: A Litigation Checklist and Trademark Infringement Litigation Toolkit — escalating to the ACPA.
• When You Win: Remedies and Damages for Trademark Infringement, Trademark Remedies and Monetary Recovery Toolkit, Dividing the Spoils: Apportioning Profits and Damages, and Who Pays the Lawyers? Attorney's Fees Under Section 35 — the money side the UDRP can't reach.
• Sending a DMCA Takedown Notice: A Compliance Checklist and DMCA Takedowns: How to Send One, How to Fight One — when the squat also steals your images or copy.
• Recording a Trademark with U.S. Customs: A Border Enforcement Checklist and Stopping Counterfeits at the Border — the parallel enforcement front.
• The Trademark Lifecycle Master Toolkit: Your Complete Research Roadmap — the big-picture map.

When the strategy gets genuinely close—UDRP or ACPA? one domain or a portfolio? transfer or damages?—Rightsy's virtual trademark attorneys can pressure-test the call before you commit a filing fee, and Rightsy's search tools let you confirm your rights, pull an opponent's assignment history, and stand a watch in one place.

Selected authorities

Policy and rules. Uniform Domain-Name Dispute-Resolution Policy (ICANN, eff. Jan. 1, 2000), ¶¶ 4(a), 4(b), 4(c), 4(i), 4(k); Rules for UDRP, Rules 1 (mutual jurisdiction), 2 (notice), 3 (complaint contents), 4 (compliance, lock, commencement), 5 (response), 6 (panel appointment), 11 (language), 14 (default), 15(b) & (e) (decision; RDNH), 16 (communication), 17 (settlement); provider Supplemental Rules (WIPO; FORUM); Uniform Rapid Suspension System (URS); ICANN Temporary Specification for gTLD Registration Data (2018) and registrar lock requirement.

UDRP decisions and guidance. Telstra Corp. Ltd. v. Nuclear Marshmallows, WIPO Case No. D2000-0003 (passive holding); WIPO Jurisprudential Overview of Panel Views on Selected UDRP Questions (3d ed.) ("WIPO Overview 3.0"), §§ 1.1.3, 1.3, 1.7, 1.8, 1.11, 2.1, 3.1.4, 3.3, 3.6, 3.8, 3.9, 4.16.

Statutes and federal cases (the ACPA road). Anticybersquatting Consumer Protection Act, 15 U.S.C. § 1125(d); remedies, 15 U.S.C. § 1117(a), (d)–(e); registration presumptions, 15 U.S.C. § 1057(b); Sporty's Farm L.L.C. v. Sportsman's Market, Inc., 202 F.3d 489 (2d Cir. 2000); DaimlerChrysler v. The Net Inc., 388 F.3d 201 (6th Cir. 2004); Lamparello v. Falwell, 420 F.3d 309 (4th Cir. 2005); DSPT Int'l v. Nahum, 624 F.3d 1213 (9th Cir. 2010); Newport News Holdings Corp. v. Virtual City Vision, 650 F.3d 423 (4th Cir. 2011); Panavision Int'l, L.P. v. Toeppen, 141 F.3d 1316 (9th Cir. 1998).

Secondary sources. 4 McCarthy on Trademarks and Unfair Competition ch. 25A (5th ed.) (cybersquatting and the ACPA); Restatement (Third) of Unfair Competition §§ 9, 20–21 (1995). Provider fees, rosters, and statistics change frequently; confirm current figures before relying on them.

This checklist is general information, not legal advice. Domain-name disputes turn on their specific facts and on the dispute policy that governs the particular TLD, and nothing here creates an attorney-client relationship. Consult qualified counsel before filing a complaint or a lawsuit.

Read this article on Rightsy