AI company names and the new wave of cybersquatting

As of October 2026, a recognizable pattern has taken hold in the domain dispute record: speculative registrants are acquiring names that match emerging AI companies, model names, and product brands – often within days of a public launch announcement or a funding round appearing in the press. The registrations arrive before the company controls its own namespace, and the demands that follow are invariably steep.

AI company name cybersquatting describes the practice of registering domains that correspond to the names of artificial intelligence ventures, models, or products in anticipation of – or immediately after – a public announcement, with the intent to sell at a premium or profit from user confusion. The governing legal test remains the three-element UDRP under Paragraph 4(a): confusing similarity to a mark, absence of legitimate registrant interest, and registration and use in bad faith. Owning a trademark does not transfer the domain automatically – a formal complaint or negotiation is required.

This page explains what changed, who is affected, and what an AI company or brand owner should do now.

What changed, and why AI names are being targeted now

The pace of AI product launches has created an unusual gap between name announcement and trademark registration. A venture announces a model name, a product line, or a company rebrand. Within hours, opportunistic registrants sweep available gTLDs – .com, .ai, .io, and new-gTLD variants – before the company has secured them. The .ai zone is administratively the country-code zone for Anguilla, and panels apply the same UDRP analysis to it as to other zones that have adopted the Policy, so the standard three-element test still governs.

What makes AI-sector cybersquatting distinctive is speed and scale. Registrants are not waiting for a company to build brand recognition over years. They are monitoring press releases, Product Hunt launches, funding announcements, and public GitHub repositories to identify a name the moment it surfaces. A company with a trademark application filed on Monday may find the exact .com and a cluster of typosquats registered by Tuesday. The five-figure buy-back demand often follows within a week.

The secondary consequence is confusion-based harm. Parking pages on squatted AI names frequently carry links to competitor tools or, in some cases, fake download pages. Users looking for a newly announced AI product type the name, land on a squatted domain, and either leave or – in a more serious scenario – install something they did not intend to. That user-confusion nexus matters to a UDRP panel assessing the bad-faith element under Paragraph 4(b).

Does a trademark filing establish rights before registration?

Under the UDRP, rights in a mark can pre-date formal registration in some circumstances, and this question is central to AI disputes. A company that announced a product name publicly – with documented press coverage, user signups, investor communications, or app-store listings – may be able to argue common-law or unregistered trademark rights in that name. Panels have consistently recognized unregistered rights where evidence shows the mark was used as a source identifier and had acquired distinctiveness, even if a trademark application is still pending.

The strength of that argument depends heavily on what the evidence shows. A single tweet announcing a name is weaker than a product page, a waitlist, press coverage across multiple outlets, and investor decks using the name as the product identifier. The practical lesson: document everything from day one. Screenshots of announcements with timestamps, contemporaneous press coverage, and user-facing materials all feed the rights analysis.

There is a common myth worth addressing directly. Many AI founders assume that the moment a trademark registration issues, the domain automatically transfers. It does not. A registration is evidence of rights, not a self-executing transfer mechanism. The transfer happens only after a UDRP complaint succeeds – or after negotiated purchase, escrow, and assignment. Understanding that distinction early prevents a company from waiting months for a trademark certificate before taking action when a complaint could be filed sooner.

For a read on whether the three UDRP elements are met for your AI brand, reach us at info@cognomenlaw.com.

How does a UDRP panel evaluate bad faith in AI name cases?

Bad faith registration under Paragraph 4(b) is the element that most frequently turns on the specific facts of an AI dispute. The timing of the registration relative to any public announcement is the most powerful indicator. Where a registrant acquired a domain the same week a funding round or launch was publicized, and the registrant has no independent connection to that string, a panel applying the Paragraph 4(b) factors will typically scrutinize whether the acquisition was opportunistic.

Parking the domain with pay-per-click links – particularly links to competing AI tools or to the mark owner's own competitors – satisfies the "commercial gain through confusion" basis in Paragraph 4(b). A registrant who has done nothing with the domain other than list it for sale at a price well above registration cost invokes the "sell to the mark owner at a premium" basis. Both patterns appear frequently in AI-sector cases.

Passive holding is also in play. Where a registrant does nothing with a domain but holds it, panels have found bad faith in circumstances where no plausible legitimate use of the name exists – particularly when the string is a coined or invented brand name rather than a common dictionary word. AI model names tend to be invented strings ("invented names are not independently descriptive and therefore unlikely to have been chosen independently," as panels often reason), and that fact strengthens the targeting argument.

The harder question arises when a registrant claims to have registered the domain for an unrelated AI project before the complainant's name was publicized. That defense requires credible evidence: development records, earlier communications, working code, or a business record predating the complainant's announcement. Bare assertions do not hold up. In a recent matter – a .ai typosquat targeting a newly launched language model, spring 2026 – we assessed a complainant's evidence package and identified that the registration postdated the product launch by four days; the timeline alone was compelling on the bad-faith element.

Who is affected, and across which zones?

The primary targets are AI startups and established companies launching AI products under a new brand. Both face the same exposure: a name selected and announced publicly before domain registration is secured is a name at risk. Established technology companies are affected too – when a corporate AI division launches under a sub-brand, the sub-brand name is as vulnerable as any startup's primary name.

The zone picture is multi-layered. The .com is the highest-priority target for squatters because it carries the highest resale premium. The .ai zone follows closely, because the association with "artificial intelligence" makes it commercially resonant for this sector – even though, legally, it is a Anguillan ccTLD and UDRP analysis applies on the same terms. New-gTLD strings like .tech, .io (technically a British Indian Ocean Territory ccTLD that many AI companies use), and brand-extension strings are also registered speculatively. A comprehensive response should address all live squats, not only the .com.

Where the squatted domain is being used in a phishing campaign – sending emails that appear to come from the AI company or distributing fake software – the matter gains urgency beyond the standard cybersquatting framing. DNS abuse obligations that took effect on 5 April 2024 require registrars to act on well-evidenced phishing; however, those obligations address the abuse vector, not ownership. A DNS-abuse report to a registrar is not a substitute for a UDRP where the goal is transfer of the domain.

What should an AI company or brand owner do now?

The first step is to document the current state of each squatted domain: a full RDAP lookup, screenshots of any content, any parked-page links, and any communications received from the registrant. Since 28 January 2025, WHOIS has been replaced by RDAP as the standard source of registration data, and registrant identity is frequently redacted. If the registrant's identity matters to establishing a pattern of conduct, a disclosure request through ICANN's Registration Data Request Service (RDRS) – extended beyond its original two-year pilot as of November 2025 while next steps are decided – is the channel, though registrar responses are not guaranteed. For guidance on running that process, see Identifying a registrant when the WHOIS record is redacted.

The second step is to assess the complaint. A UDRP complaint at WIPO costs USD 1,500 for a single-member panel covering one to five domains, with a standard timeline of about two months. If multiple domains across different registrants are involved, each group sharing a common holder can be addressed in one complaint; separate registrants require separate filings. Where speed is critical – a product launch approaching and a squatted domain in the way – WIPO's expedited option (available since 9 March 2026) delivers a decision in about one month for single-panel cases covering up to five domains, at a fee of USD 4,000.

Third, consider the broader portfolio. A company that secures the .com through a UDRP but leaves the .ai, the .tech, and a cluster of typosquats live has solved one problem and left the others open. A coordinated filing covering multiple domains against the same registrant is the more efficient path where the same holder controls multiple squats.

To assess a UDRP complaint for an AI company name, or to plan a portfolio-level response, email info@cognomenlaw.com.

About COGNOMEN

COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. COGNOMEN focuses only on domain-name disputes: recovery, defense, and transactions. To discuss a domain, contact info@cognomenlaw.com.

Related at COGNOMEN

• udrp recovery – file a UDRP complaint to transfer a cybersquatted domain
• Identifying a registrant when the WHOIS record is redacted – how to pursue disclosure through RDAP and RDRS
• recover phishing domain it – steps to reclaim a domain used in a phishing attack

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.