Recover a .us domain from a serial cybersquatter: what panels actuall…

Recover a .us domain from a serial cybersquatter: what panels actuall. UDRP and ccTLD domain recovery and defense across .us. Email the firm to assess your cas…

A brand owner discovers that a .us domain matching its registered trademark has been registered by someone who holds dozens of similar names across multiple zones – each parked, each priced for resale, and each pointing at pay-per-click advertising. The registrant has been on the wrong side of prior dispute decisions. The question is not whether this looks like cybersquatting. The question is what a panel will require in order to transfer the domain, and where the evidence has to come from.

To recover a .us domain from a serial cybersquatter, a complainant must satisfy all three elements of the usDRP – the .us domain dispute policy administered under ICANN's framework – which mirrors the three elements of Paragraph 4(a) of the UDRP: confusing similarity to a mark the complainant holds, absence of any legitimate interest in the registrant, and registration plus use in bad faith. A standard case runs approximately two months from filing to decision. The only remedies are transfer or cancellation. Prior adverse decisions against the same registrant are admissible and, in practice, carry significant weight.

This analysis examines the usDRP test element by element, then turns to the evidence patterns that separate strong cases from weak ones, the role of serial-cybersquatter history, the cross-zone considerations when the same registrant holds the .com and the .us, and the realistic options when a panel finds against the complainant.

What is the usDRP and how does it govern .us domain disputes?

The usDRP is the dispute-resolution policy that applies to all .us domain names. It was modeled on the UDRP but operates under the authority of the .us registry and applies specifically to the .us ccTLD. The procedural architecture is close to the UDRP: a complainant files before an approved dispute-resolution provider, the registrant receives notice and has a defined window to respond, a panel is appointed, and the panel issues a written decision.

The critical structural point is that the usDRP requires the complainant to satisfy the same three cumulative elements as the UDRP under Paragraph 4(a): confusing similarity, no rights or legitimate interests in the registrant, and registration plus bad-faith use. Panels deciding usDRP cases regularly draw on UDRP precedent, particularly WIPO jurisprudence, because the policy language tracks so closely. This means that the substantial body of UDRP decisions – on what constitutes a bona fide offering, on passive holding as bad faith, on the significance of prior adverse decisions – is directly relevant to .us proceedings, even though the two policies are formally distinct.

One practical difference: .us is a ccTLD, and earlier eligibility rules required a US nexus for registration (US citizenship, residence, or organizational presence). Panels have noted this requirement, though its significance at the dispute stage is secondary to the three-element test itself. The forum most frequently used for usDRP proceedings is the same provider pool that handles UDRP cases, with timelines and administrative procedures substantially parallel to those described for WIPO and the Forum under the UDRP.

For a complainant who holds an active US trademark registration, the similarity element is usually the easiest to satisfy. The harder work is assembling proof of the registrant's lack of legitimate interest and of bad faith – and that is where the serial-cybersquatter history becomes strategically significant.

To assess whether the usDRP three-element test is met for your .us domain, contact info@cognomenlaw.com.

Does the three-element test under the usDRP work the same way as the UDRP?

For practical purposes, yes – panels decide usDRP cases using the same analytical structure as UDRP panels, and the same doctrine applies at each step. Confusing similarity is assessed by comparing the domain with the complainant's mark; the top-level domain designation (.us) is typically disregarded. A domain that is identical or nearly identical to a registered mark, perhaps with a generic word added or a single letter changed, satisfies the first element in the overwhelming majority of decisions.

The second element – no rights or legitimate interests – turns on whether the registrant can invoke any of the recognized safe harbors. Under the UDRP's Paragraph 4(c), and its usDRP equivalent, a registrant may rebut the complainant's showing by demonstrating a bona fide offering of goods or services in connection with the domain before any notice of the dispute, a circumstance that the registrant is commonly known by the domain name, or a legitimate noncommercial or fair use. A serial cybersquatter – one who has registered multiple names corresponding to third-party marks and offers them for sale – will typically fail to invoke any of these. Parking pages loaded with advertising links, or a simple "for sale" notice, do not amount to a bona fide offering. Panels have consistently held that monetizing a domain that trades on a trademark does not create legitimate interest.

The third element – registration and use in bad faith – requires both limbs to be satisfied cumulatively. This is the point where serial conduct becomes most valuable to the complainant. Paragraph 4(b) of the UDRP sets out a non-exhaustive list of bad-faith circumstances. Among them: registration primarily to sell the domain to the mark owner at a price exceeding out-of-pocket costs; registration to disrupt a competitor; and registration to attract users for commercial gain by creating a likelihood of confusion with the complainant's mark as to source. A registrant who has been the subject of prior adverse UDRP or usDRP decisions sits squarely within the Paragraph 4(b)(ii) pattern of abusive registrations – something panels treat as a powerful bad-faith indicator, not merely background color.

How does a history of prior adverse decisions change the analysis?

Prior adverse decisions are among the most practically significant factors a complainant can document. Panels across UDRP and usDRP proceedings have treated a demonstrated pattern of abusive registrations as independently establishing bad faith, even where other evidence is thinner. The reason is structural: once a panel has found that a registrant registered a domain corresponding to a third-party mark in bad faith, a subsequent registration by the same party of another third-party mark is difficult to characterize as coincidence.

The evidentiary approach is straightforward. The complainant identifies prior decisions – publicly available through the WIPO and Forum decision databases – in which the registrant was the losing respondent. The submission explains the pattern: same conduct (parking, pay-per-click, sale demand), different marks, different complainants, consistent outcome. Panels regularly note that a registrant whose name appears repeatedly in adverse decisions cannot credibly claim that each new registration was made without knowledge of the underlying mark.

There is a minority position worth acknowledging. Some panels have held that prior decisions against a registrant do not automatically establish bad faith for a new domain; they require the complainant to connect the prior conduct to the present registration through evidence specific to the domain at issue – the date of registration relative to the mark's prominence, the content of the resolving page, and any correspondence involving a sale demand. In our practice, we address this by layering the prior-decision record onto direct evidence of the disputed domain's use, so the case does not rest on pattern evidence alone.

The practical implication is that a .us case against a serial cybersquatter is often stronger – on element three – than an equivalent case against a first-time registrant. The complainant walks in with a dossier. The panel has seen the registrant's name before. The burden on the respondent to explain the registration is correspondingly heavier.

What evidence actually decides a .us cybersquatting case?

Evidence drives outcomes. The analytical framework is fixed; what the panel weighs is the documentary record the parties build. For the complainant targeting a serial cybersquatter in a .us case, the core evidence package typically contains the following categories.

First, trademark registration and priority: a copy of the registered mark, the registration number, the date of first use and registration date, and the scope of goods and services. USPTO registration certificates are ideal. The date matters because the registration must predate, or at least meaningfully predate, the domain registration for the third element to hold.

Second, domain registration data: the WHOIS or RDDS record showing the registrant's name, registration date, and – where available through historical lookups – registrant history. If the domain was registered on the day after the complainant's product launch or press announcement, that timing is itself a bad-faith indicator panels have relied on.

Third, evidence of the registrant's use of the domain: screenshots of the resolving page, with metadata and timestamp. A pay-per-click parking page that displays links related to the complainant's goods or services is a textbook Paragraph 4(b)(iv) scenario. A "domain for sale" landing page, particularly one with an above-cost price, supports the Paragraph 4(b)(i) inference.

Fourth, prior decision records: a curated list of prior adverse UDRP or usDRP decisions in which the same registrant was ordered to transfer or cancel a domain. Each entry should show the case provider (WIPO, the Forum), the approximate date, the domain type, and the outcome. A registrant with five or ten prior losses carries that record into every subsequent case.

Fifth, any direct communications: if the registrant solicited a sale, sent a price, or responded to an inquiry from the complainant's side, those communications are central. An unsolicited offer to sell a domain to the trademark owner at a five-figure price is the clearest Paragraph 4(b)(i) scenario in the policy.

In a recent matter involving a .us domain (autumn 2025), we assembled a complaint that combined a US trademark registration predating the domain by several years, a WHOIS record showing the registrant had registered approximately twenty domains matching third-party marks in the prior eighteen months, and a set of prior decisions from both WIPO and the Forum against the same registrant. The panel transferred the domain without extended analysis. The record answered every element before the registrant had a chance to construct a defense.

What are the weaknesses in a serial-cybersquatter case that panels actually probe?

Not every case against a serial cybersquatter is straightforward. Panels probe at least four recurring weak points.

The first is mark strength and fame at the time of registration. If the complainant's trademark was obscure or narrowly registered at the moment the domain was created, the panel may question whether the registrant actually knew of the mark. A generic or descriptive term that happens to be registered does not present the same inference as a well-known brand. Complainants sometimes overestimate how much work a prior adverse decision does when the mark at issue is relatively weak.

The second is the connection between the prior decisions and the present domain. Panels applying the minority view described above will ask: is this the same kind of mark, the same industry, the same registrant conduct? A serial cybersquatter of pharmaceutical marks registering a technology-sector .us does not automatically transfer the bad-faith inference from one industry to another, though many panels will still find the pattern persuasive.

The third is what the domain resolves to at the time of the complaint. A domain that has resolved to a blank page or a registrar default for years presents a passive-holding analysis. Panels have generally held that passive holding can constitute bad faith – particularly when the registrant has no apparent legitimate purpose and a prior adverse record – but the analysis is more demanding than in the active-use case. The complainant must explain why non-use, in this registrant's hands, with this domain, still amounts to bad faith.

The fourth is default. When a serial cybersquatter does not respond to a complaint – which happens regularly, since these registrants often have no colorable defense – the panel does not automatically find for the complainant. Default shifts the practical burden, but the complainant must still demonstrate each element to the required standard. Panels have occasionally denied transfer in default cases where the complaint relied solely on the prior-decision record without documenting domain-specific evidence.

If you have already assembled evidence or received no response from the registrant, email info@cognomenlaw.com for an assessment of the record before filing.

How does a .us dispute compare with a UDRP over the equivalent .com, and when does cross-zone strategy matter?

A serial cybersquatter rarely holds just one domain. In a significant number of the cases we advise on, the registrant has registered both the .com and the .us – and sometimes a further set of country-code or new-gTLD variants – each pointing at a similar parking page or sale notice. Cross-zone strategy then becomes as important as the single-domain analysis.

The routing decision follows the zone. If the .com is held by the same registrant, a UDRP complaint before WIPO or the Forum can address it directly. The filing fees at WIPO start at USD 1,500 for a single-member panel covering one to five domains, and the Forum's fees begin around USD 1,300. The usDRP runs on a comparable fee structure through the same approved providers. A combined or parallel strategy – filing UDRP over the .com and usDRP over the .us simultaneously – is procedurally available where the registrant is the same holder, since each policy allows a single complaint to cover multiple domains if the underlying registrant is common.

The practical advantage of consolidation is not just cost. A consolidated record establishes the pattern more powerfully than two separate filings. A panel deciding a combined complaint sees the full spread of registrations – the .com, the .us, perhaps the .net – and the prior adverse decisions apply to all of them simultaneously. In our experience, a consolidated filing against a serial cybersquatter is generally the stronger presentation where the zone policies permit it.

Where the zones split between UDRP and a procedure that does not follow the UDRP model – for example, where the registrant also holds a .de – the strategies must be sequenced rather than combined. The .de dispute belongs in the German courts, with a DENIC DISPUTE entry to block transfer during litigation. The .com and .us can proceed in parallel under their respective arbitral policies. A brand owner in that position needs to prioritize by commercial harm: which zone is driving the most traffic or damage, and which has the fastest and least expensive path to transfer.

When only the .us is at issue and the .com is legitimately registered or not held by the cybersquatter, the usDRP is the correct route. It does not require US court intervention, and it is faster and less expensive than litigation. Court action becomes relevant in two specific circumstances: where the registrant's conduct involves damages the complainant wishes to recover (the usDRP, like the UDRP, provides no monetary remedy), or where the panel decision is challenged and a court proceeding is needed to enforce or review it.

What happens when a panel finds against the complainant – and how is reverse domain name hijacking raised in .us?

The RDNH doctrine – reverse domain name hijacking – is recognized in both the UDRP and the usDRP. A finding of RDNH means the panel has concluded that the complaint was brought in bad faith to deprive a legitimate registrant of a name to which the registrant had a genuine entitlement. RDNH has no monetary consequence, but the reputational and practical costs of such a finding can be significant for the complainant.

In practice, RDNH findings in .us cases involving serial cybersquatters are uncommon. The reason is structural: a registrant who has lost multiple prior decisions is not a sympathetic subject for an RDNH claim. Panels are unlikely to find that a complaint brought against a respondent with a documented history of abusive registrations was filed in bad faith, even if the complainant's evidence was imperfect.

Where RDNH is more plausible is when a brand owner files a usDRP complaint against a registrant who had a preexisting business or legitimate use for the name – a company that had been trading under the domain for years before the complainant sought trademark registration, for example – and the complaint ignores that history. In those circumstances, a respondent working with competent counsel can build an RDNH record by documenting the good-faith registration, the timeline of the mark relative to the domain, and any commercial activity conducted under the name.

We regularly advise registrants on this defensive posture. The same evidence standards apply in reverse: the respondent documents registration date, business use, lack of knowledge of the complainant's mark at the time of registration, and any communications from the complainant that suggest bad faith in the filing strategy.

What is the realistic next step for a brand owner facing a serial cybersquatter on .us?

The realistic next step is a structured assessment of the three elements before any filing decision is made. That assessment covers: whether the trademark registration predates the domain and is strong enough to satisfy element one without argument; what evidence exists of the registrant's use of the domain (active or passive); and how many prior adverse decisions the registrant has accumulated and in what circumstances.

Where all three elements are well supported, a usDRP complaint is generally the fastest and least expensive route to transfer. The timeline – approximately two months from filing to decision – is one of the clearest advantages of the arbitral route over litigation. The filing fees, which track the provider's published schedule, are a fraction of court costs. And the decision, if it orders transfer, is implemented directly by the registrar without requiring further legal proceedings.

Where element three is thinner – perhaps because the domain is passively held and the prior-decision record is less extensive – the complainant should expect the filing to require more detailed evidentiary support. A submission that relies on pattern evidence alone, without domain-specific proof of bad faith, creates a meaningful risk of denial.

In a recent matter (a .us cybersquatting complaint, spring 2025), we identified a registrant with a significant prior-decision record but a domain that had been resolving to a blank page for nearly two years. We supplemented the pattern evidence with WHOIS history showing the registration was made two days after the complainant's product launch, correspondence in which the registrant had quoted a five-figure purchase price in an unsolicited message, and a reverse WHOIS showing the registrant's portfolio of trademark-corresponding names. The panel transferred the domain. Passive holding alone would have been a harder case; the surrounding record made it straightforward.

For brand owners who also have a .com at risk from the same registrant, the consolidated or parallel filing strategy described above – UDRP for the .com, usDRP for the .us – is worth pricing out early. The incremental cost of adding a domain to an existing filing is generally far lower than two separate proceedings.

Related at COGNOMEN

• UDRP domain recovery service – how COGNOMEN prepares and files UDRP complaints across gTLDs
• Passive holding and the bad-faith element – FAQ on recovering domains held without active use
• Court action for cybersquatting – when arbitration is not the right route