Domain protection for crypto and Web3 companies

A stranger registers the domain that carries your exchange's name, points it at a pixel-perfect phishing clone, and drains wallets before your security team gets an alert. That is not a hypothetical. It is the defining domain threat for crypto and Web3 companies – and the legal tools to stop it exist, though they require speed and precision to work.

Crypto web3 domain protection means using the Uniform Domain-Name Dispute-Resolution Policy (UDRP), the Uniform Rapid Suspension system (URS), and where necessary, court action to recover or suspend domains that imitate an exchange, wallet, protocol, or token brand. The UDRP filing fee at WIPO starts at USD 1,500 for a single-member panel; a standard case resolves in roughly two months. Blockchain-based naming systems such as ENS sit entirely outside ICANN's contracts, and the UDRP does not reach them.

This page covers the specific threats the sector faces, why crypto and Web3 brands are targeted disproportionately, the procedures that fit each situation, and what enforcement realistically costs and takes.

What domain threats does the crypto and Web3 sector face?

Phishing is the dominant threat. A bad actor registers a domain confusingly similar to a well-known exchange or wallet – adding a hyphen, swapping a letter, appending "io" or "pro" or the protocol's token ticker – and deploys a clone site that solicits seed phrases or initiates fraudulent transactions. The harm is immediate and often irreversible: cryptocurrency moves in minutes, and users rarely recover stolen funds.

Beyond phishing clones, in our practice we see four recurring patterns in this sector. First, typosquatting: dozens or hundreds of character-level variants of a brand name registered at once, typically by a single actor, exploiting the speed at which retail users navigate to exchange interfaces. Second, parked monetization: a registrant holds a domain similar to a token or protocol name and earns pay-per-click revenue from the resulting confusion. Third, ransom demands – a stranger holds the domain that matches your brand exactly and is demanding a five-figure payout. Fourth, competitor interference: a registrant who is or has ties to a competing project holds the mark, drives confusion, and makes the original brand's user acquisition harder.

What distinguishes crypto and Web3 from most other sectors is the combination of high per-user financial exposure and the absence of any central custodian who can freeze a transaction after the fact. The urgency of a domain enforcement action here is not reputational. It is financial.

Why is this sector targeted more heavily than others?

The economics of domain abuse are straightforward. A phishing page that captures a single set of wallet credentials on a busy exchange can yield far more than the same page on a retail or media brand. Registration of a confusingly similar domain costs less than USD 15 and takes under a minute. The asymmetry between cost and potential yield is extreme – more extreme in crypto than almost anywhere else.

New token launches and protocol updates create recurring windows of opportunity. Every time a project publishes a new domain or rebrands, the gap between announcement and UDRP-level enforcement can run to weeks. Sophisticated actors monitor project GitHub repositories, roadmap disclosures, and token-listing announcements, and register variants within hours. By the time a brand owner discovers a clone site, it may already have served phishing content to thousands of users.

The global, pseudonymous nature of the sector also complicates enforcement. Registrants use privacy or proxy services that redact WHOIS/RDAP data, route sites through bulletproof hosting, and change DNS records rapidly. Since 28 January 2025 ICANN no longer requires registrars to maintain a WHOIS service – RDAP is the standard – and registration data for individuals is redacted by default under applicable data-protection rules. Identifying a registrant now routinely requires an RDAP lookup followed by a formal disclosure request through ICANN's Registration Data Request Service, with no guaranteed timeline for the registrar's response. Speed matters enormously here, and the identification stage alone can consume critical days.

Which procedures fit crypto and Web3 domain disputes?

The right procedure depends on the zone, the remedy needed, and whether urgency or completeness is the priority. There is no single answer – and choosing wrong loses time that, in this sector, costs money.

For a .com, .net, .org, or new-gTLD domain – the overwhelming majority of phishing-clone registrations target these zones – the UDRP is the primary tool. The complainant must satisfy all three elements of Paragraph 4(a): the domain is identical or confusingly similar to a mark in which the complainant has rights; the registrant has no rights or legitimate interests; and the domain was registered and is being used in bad faith. All three must be proved. A standard WIPO case runs roughly two months; the expedited option introduced on 9 March 2026 delivers a decision in about one month for single-panel cases covering up to five domains, at a WIPO fee of USD 4,000. Where a campaign involves a single registrant holding many variant domains, a consolidated complaint covering all of them in one filing is available under the UDRP – but only if the registrant is the same holder across all domains.

Where the need is suspension rather than transfer, and the domain is on a new gTLD, URS is faster and cheaper. The remedy is suspension for the registration term – the domain does not transfer to the complainant – and the evidentiary standard is higher ("clear and convincing"). Legal fees run from USD 1,200 to USD 2,000 in our practice, with forum fees starting from USD 375. URS is best used when the phishing site is live and the brand needs it taken down immediately, pending a fuller UDRP proceeding if transfer is later sought.

Country-code zones (.uk, .eu, .de, and others) follow their own procedures. A .uk phishing clone goes to the Nominet DRS – administered by WIPO since 7 July 2026 – under a test of "abusive registration," which reads "registered or used" abusively, a lower bar than the UDRP's cumulative "registered and used in bad faith." A .eu clone proceeds through the ADR.eu platform. A .de registration has no UDRP analogue at all; that dispute belongs in the German courts, with a DENIC DISPUTE entry to block transfer during litigation. For any ccTLD not listed here, the governing national procedure applies, and the rules should be confirmed with counsel before filing.

Court action – US anticybersquatting litigation and its equivalents in other jurisdictions – is available where arbitration is unavailable or the complainant also wants monetary damages. In our practice, court action is the route of last resort for large-scale campaigns where multiple actors may have coordinated abuse, or where the registrant has re-registered the same domain after a UDRP transfer order.

To assess the three UDRP elements on a specific domain – including selecting the fastest forum and assembling the bad-faith evidence – contact info@cognomenlaw.com.

What evidence decides a crypto or Web3 UDRP complaint?

Trademark rights are the starting point. A registered trademark is the cleanest evidence of rights under Paragraph 4(a)(i), but panels have consistently recognized unregistered or common-law marks where the complainant can show acquired distinctiveness – sustained use, market recognition, and evidence that users associate the name with the source. For a token or protocol name, that might be press coverage, listed trading volume records, developer community documentation, and user-facing brand identifiers, none of which depend on registration.

On the second element – no legitimate interest – the practical work is eliminating the Paragraph 4(c) safe harbors. The registrant was not commonly known by the domain before the dispute, made no bona fide offering under the name, and used the domain neither for legitimate noncommercial purposes nor for genuine fair comment. A phishing clone fails every safe harbor. A parked page monetizing a mark also fails. The harder cases involve registrants who claim the name is a common dictionary word or a generic crypto term – "defi," "swap," "yield" – and the complainant's mark is too descriptive to block that use.

Bad faith is where the crypto sector's specific facts do the most work. Paragraph 4(b) lists non-exhaustive bad-faith circumstances, including registration to sell to the mark owner at a price exceeding out-of-pocket costs, registration to disrupt a competitor, and intentional attraction of users for commercial gain by creating a likelihood of confusion with the complainant's mark. A phishing clone hits the third squarely. A ransom demand for five figures hits the first. Pattern-of-conduct evidence – the same registrant holding a dozen typosquats of different crypto brands – is admissible and persuasive.

Documentation matters enormously in fast-moving cases. Screenshots of the clone site, captured with a tool that records date and URL metadata, are the core exhibit. DNS records showing the domain pointed at the phishing server. Any communication in which the registrant demanded payment. Evidence of actual user confusion – support tickets, social media posts misidentifying the clone as the official site. Panels in phishing cases have consistently drawn adverse inferences from a registrant's failure to respond. Default is common in this sector, but the complainant must still prove its case on the record.

In a recent matter – a .com phishing clone, early 2026, targeting a protocol's governance interface – we assembled a complaint based on a combination of common-law mark evidence, live screenshots of a credential-harvesting page, and DNS records linking the registrant to earlier abusive registrations of other crypto brand variants. The panel transferred the domain in approximately eight weeks, without a response from the registrant.

What are the hard limits of UDRP enforcement for Web3 companies?

The single most important boundary is this: the UDRP applies only to domains in the ICANN system. Blockchain-based naming services – ENS/.eth, Unstoppable Domains, and similar systems – are entirely outside ICANN's contracts. There is no UDRP procedure, no URS, no transfer mechanism, and no equivalent arbitral route for names registered on those platforms. Remedies, if any exist, lie in general law, and no established procedure yet delivers the equivalent of a UDRP transfer order for a blockchain name. Brands that built identity around on-chain names should understand this clearly: enforcement of those names is a materially different legal problem from enforcement of a .com.

A second limit is the bad-faith test itself. Many assume that owning the trademark guarantees the domain transfers automatically. It does not. The UDRP requires all three elements; the bad-faith element requires proof that the domain was registered and used in bad faith. Where a registrant registered a domain years before your brand acquired distinctiveness, the registration-date analysis becomes unfavorable. Where a token name is also a common word or abbreviation used in other contexts, the complainant's distinctiveness case is harder to make. The Policy offers no damages, no cost awards, and no injunctive relief against future registrations – only transfer or cancellation of the specific domain at issue.

Third, the UDRP does not reach registrants who quickly shift a phishing campaign from one domain to another. A campaign using fifty rotating domains requires a different enforcement architecture – monitoring, rapid filing of serial complaints, coordination with hosting providers under the DNS abuse obligations that took effect 5 April 2024, and in persistent cases, a court action that can reach injunctive relief against a registrant across multiple domains. COGNOMEN handles both the arbitral and court-side coordination, with local litigation counsel in the relevant jurisdiction where court action runs abroad.

What does domain monitoring mean for a crypto or Web3 brand?

Reactive enforcement – filing a UDRP after a phishing site has already run – is the floor, not the ceiling. The economics of crypto-domain abuse make preventive monitoring worth the cost for any brand with meaningful user exposure. A brand-protection monitoring service watches for new registrations that are confusingly similar to a trademark across all gTLDs and participating ccTLDs, flags suspicious registrations within hours, and enables a decision on whether to file a UDRP, send a cease-and-desist, or acquire the domain by purchase before it is weaponized.

In our practice we advise crypto clients to treat monitoring as a standard cost of operation – alongside the Trademark Clearinghouse (TMCH) recordal process that is relevant for any new gTLD round. With the next round of new gTLDs now closed to applications as of 12 August 2026, a Sunrise period of at least 30 days precedes general availability for each delegated string, during which TMCH-recorded mark holders may register matching domains before the general public. A Claims period of 90 days follows, triggering notices to registrants whose registrations match a recorded mark. First delegations from the current round are not expected before 2028 – but the time to record marks with the TMCH is before the Sunrise window opens, not after.

Brand-protection retainer services at COGNOMEN are priced from USD 1,000 to USD 3,000 per month, depending on portfolio size and the volume of monitoring alerts requiring assessment. Pre-acquisition due diligence – checking the chain of title and prior dispute history of a domain before purchasing it – starts from USD 1,500 and is standard practice before any high-value acquisition in this sector.

In a separate matter – a .com and .io dual-zone phishing campaign, autumn 2025 – we identified the registrant's pattern of conduct across approximately a dozen variant domains, filed consolidated complaints at WIPO against a single holder's registrations where consolidation was available, and coordinated parallel hosting-provider notices for domains outside the UDRP's reach. The consolidated approach reduced total filing cost and resolved the campaign within a single proceeding window.

To weigh UDRP against a court action for your case, or to discuss a monitoring program for your exchange or protocol brand, email info@cognomenlaw.com.

What does enforcement cost at this scale?

Forum filing fees and legal fees are separate. For a single-domain UDRP complaint at WIPO – the most common route in this sector – the WIPO filing fee is USD 1,500 for a single-member panel. The Forum begins around USD 1,300. The Czech Arbitration Court starts lower still. COGNOMEN's indicative legal fee for a UDRP complaint is USD 2,500 to USD 4,000, set after a case assessment; the exact cost depends on complexity, number of domains, and whether expedited treatment is sought.

A three-member panel costs more: USD 4,000 at WIPO for a single-member expedited case (introduced March 2026), or USD 4,000 for a three-member panel on one to five domains at standard rates. Where a respondent requests a three-member panel after the complainant requested a single panelist, the parties typically split the higher fee. The choice of panel size turns on the value of the domain and the complexity of the legal argument – a straightforward phishing clone rarely needs three panelists.

URS suspension – where speed matters more than transfer – carries legal fees from USD 1,200 to USD 2,000, with forum fees starting from USD 375. Court action is hourly and substantially higher; it is the right choice when the UDRP cannot reach the registrant, when damages are sought, or when injunctive relief covering future registrations is the goal.

For a monitoring-plus-enforcement program covering a crypto brand at scale – dozens of alerts per month, serial filings, and coordinated hosting-provider notices – total annual cost depends on the volume of actionable registrations identified. We advise budgeting at both the monitoring retainer level and per-complaint, rather than treating enforcement as a one-time cost. The economics of abuse in this sector make it a recurring operational expense, not a litigation event.

All fees stated are indicative, not a binding offer, and are set after a case assessment. No outcome is guaranteed. Forum fees are the published rates as of the date of this page; confirm current rates before filing.

COGNOMEN and crypto and Web3 domain disputes

COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking cases. In the crypto and Web3 sector, we work with exchanges, protocol teams, token issuers, and wallet providers facing phishing-clone campaigns, ransom demands, and large-scale typosquatting. For an assessment of your domain dispute, contact info@cognomenlaw.com.

Related at COGNOMEN

• udrp recovery – how to file a UDRP complaint and recover a domain
• Domain protection for fintech and financial services – domain enforcement for regulated financial sector brands
• case recover after buyback mx – recovering a domain after a failed buy-back attempt

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.