How to recover a typosquatted .net domain

How to recover a typosquatted .net domain. UDRP and ccTLD domain recovery and defense across .net. Email the firm to assess your case. Transparent fees, respon…

A stranger registers a one-letter variation of your brand as a .net – a transposed character, a missing vowel, a doubled consonant – and the misdirected traffic begins. Customers land on a parking page, a pay-per-click farm, or something worse. You want the name transferred and the problem closed.

To recover a typosquatted .net domain, a complainant must satisfy all three elements of Paragraph 4(a) of the UDRP: confusing similarity to a mark the complainant holds, no rights or legitimate interests in the registrant, and registration and use in bad faith. The UDRP applies to .net because VeriSign, the .net registry, requires UDRP compliance from all accredited registrars. A standard case at WIPO runs approximately two months from filing to a transfer order, with a filing fee starting at USD 1,500 for a single-member panel on one to five domains.

This page covers the test, the evidence that decides it, the forum choice, the cost structure, and the next step for a brand owner ready to act.

Why .net typosquatting is actionable under the UDRP

The .net registry mandate is straightforward: every .net registrar must include UDRP compliance in its registration agreement, which means a brand owner with trademark rights can bring a UDRP complaint without first obtaining a court order or establishing jurisdiction over the registrant. Typosquatting – the deliberate registration of a misspelled variant of a known mark – is among the most consistently sanctioned forms of cybersquatting under the Policy. Panels have held for more than two decades that a domain that differs from a complainant's mark by a single character is confusingly similar, that the registrant of such a domain has no plausible innocent explanation, and that pointing the domain at a parking page or a pay-per-click directory satisfies the bad-faith use prong.

What makes .net particularly significant for brand owners? It carries global recognition second only to .com in user trust. A .net typosquat can intercept a meaningful volume of traffic from users who know your brand, mistype the URL, and arrive somewhere you did not build.

In our practice, .net typosquatting complaints tend to resolve cleanly when the evidence record is properly assembled. The registrant's conduct – parking revenue, a confusingly similar meta-description, or a redirect to a competitor – supplies the bad-faith use evidence that the panel needs. We regularly advise brand owners who initially doubt whether the misspelling is "close enough." The consistent panel view is that a variant that sounds, looks, or is typed identically to the mark is close enough.

What are the three UDRP elements and how does typosquatting satisfy them?

Paragraph 4(a) of the UDRP requires the complainant to prove all three elements; failure on any one is fatal to the claim. Here is how each applies in a typical .net typosquat situation.

Element 1 – Confusing similarity. The panel compares the domain (minus the .net suffix) to the mark. A typosquatted variant is, by definition, designed to resemble the mark. Transpositions ("yourbradn" instead of "yourbrand"), additions ("yourbrandd"), omissions ("yourbrad"), and adjacent-key substitutions ("yourbrans") all fall well within the confusingly similar standard. Proof of the mark – a registered trademark certificate or, in appropriate cases, unregistered rights established by use and recognition – is the foundation of the first element.

Element 2 – No rights or legitimate interests. The complainant need only make a prima facie showing; the burden then shifts to the registrant to produce evidence of a Paragraph 4(c) safe harbor: a bona fide offering of goods or services before notice of the dispute, a common association with the name, or legitimate noncommercial or fair use. A registrant holding a one-letter variation of a well-known mark on a parking page will not typically be able to invoke any safe harbor. We have yet to see a genuine bona fide offering of goods advanced in a case where the domain is a classic typosquat.

Element 3 – Registered and used in bad faith. Both limbs must be satisfied. Registration in bad faith follows naturally from the typosquatter's evident awareness of the mark; panels infer that someone who registers "yourbraand.net" knows exactly whose brand they are mimicking. Use in bad faith can be established by: pointing the domain at pay-per-click links that trade on the mark's goodwill; a passive holding that prevents the mark owner from reflecting the mark in the domain; a redirect to a competitor; or an offer to sell at a price exceeding out-of-pocket registration costs. Paragraph 4(b) of the Policy sets out four non-exhaustive bad-faith circumstances, and typosquatting will generally engage at least one of them.

For a read on whether the three UDRP elements are met in your .net matter, reach us at info@cognomenlaw.com.

How does the UDRP process work for a .net typosquat – step by step?

The UDRP follows five defined stages, and the timeline is set by the Rules rather than by the parties.

1. Complaint drafting and filing. The complaint must identify the disputed domain, establish the complainant's mark rights, address all three elements of Paragraph 4(a), and select a forum – WIPO, the Forum, CAC, or ADNDRC. Filing initiates the formal clock. WIPO's online filing system is the most widely used for .net disputes.
2. Formal review and commencement. The chosen provider reviews the complaint for procedural compliance and, once satisfied, formally commences the case. The registrar is notified and places the domain in a registrar lock, preventing transfer while the case is pending.
3. Response period. The registrant has 20 days from commencement to file a response. If no response is filed, the case proceeds on the complaint alone. In our experience, a significant proportion of .net typosquat respondents default – they have no defense to offer.
4. Panel appointment. A single panelist is appointed unless a party requests a three-member panel. The complainant selects single or three-member at filing; the respondent may also request three members. If only one side requests three members, the parties generally split the higher fee.
5. Decision and implementation. The panel issues a written decision. If the decision is transfer, the registrar implements it after a short waiting period, during which the registrant may seek a court stay. The only remedies available are transfer or cancellation; the UDRP does not award damages, costs, or injunctions.

End to end, a standard .net typosquat case at WIPO typically concludes within about two months. Where the complainant needs a faster resolution, WIPO offers an expedited option delivering a decision within about one month, available for single-panel cases covering up to five domains.

Which forum should you use to recover a typosquatted .net domain?

WIPO and the Forum together handle approximately 97% of all UDRP proceedings, and both accept .net complaints. Choosing between them – or considering CAC as a lower-cost alternative – depends on budget, timeline preference, and the nature of the record.

WIPO is the default choice for most international brand owners. Its published fees are clear: USD 1,500 for a single-member panel on one to five domains, and USD 4,000 for a three-member panel on the same number. The WIPO panelist pool is large, its decisions are publicly indexed, and its processes are well-documented. For a .net typosquat with an international registrant, WIPO is familiar territory.

The Forum begins at around USD 1,300 for one to two domains on a single-member panel. It is a credible alternative and the dominant provider for US-centric disputes. Both forums produce well-reasoned decisions on typosquatting; the substantive outcome should not depend materially on the forum selection for a strong fact pattern.

The Czech Arbitration Court (CAC) offers the lowest entry-level filing cost – typically in the USD 500–800 range – and is a reasonable option for budget-sensitive complaints involving a single domain and a clear record. CAC is the least-used of the four accredited providers, but it is a fully accredited ICANN provider, and its decisions carry the same legal weight.

What if the typosquat covers both a .net and a corresponding .com? That situation is common. A single complaint can cover multiple domains only where all are held by the same registrant. If the .com and .net are registered to the same entity, a single filing at WIPO is efficient. If different registrants hold them, two separate complaints are required. And if the typosquat also extends to a national ccTLD – a .de, .uk, or .eu variant – a parallel ccTLD procedure may be needed, since the UDRP cannot reach a ccTLD that has not adopted it.

To weigh UDRP against a court action for your .net matter, email info@cognomenlaw.com.

What evidence decides the outcome of a .net UDRP typosquatting complaint?

A well-assembled evidence record is what separates a complaint that transfers the domain from one that is denied – or, worse, draws a finding of Reverse Domain Name Hijacking (RDNH) if the case was overreached. Here is what panels look for and what typically decides close cases.

Proof of mark rights. A registered trademark certificate is the strongest starting point. Panels accept both national and international registrations. If the complainant relies on unregistered rights, the evidence burden is heavier: the complainant must demonstrate continuous use, commercial recognition, and the geographic scope of that recognition. A pending application with no registration is generally insufficient on its own.

The domain itself. Screenshots of the domain's current and historical content are critical. A WHOIS/RDDS printout showing the registration date relative to the mark's priority date establishes the temporal sequence. Archive captures – from a web archival service – show how the domain was used over time: parking pages, pay-per-click links, redirect destinations, or offered-for-sale notices. The more precisely the captured content ties to the complainant's mark or industry, the stronger the bad-faith use argument.

Pattern evidence. Where the registrant holds multiple typosquats of multiple brand owners' marks, that pattern is one of the Paragraph 4(b) bad-faith factors. Establishing a pattern requires checking registrar records for the registrant's other domains, which WHOIS/RDDS data can sometimes reveal. Panels have consistently held that a demonstrated pattern of abusive registrations is independent ground for a bad-faith finding.

Communications. Any email or broker approach from the registrant offering to sell the domain for a sum exceeding out-of-pocket registration costs is direct evidence of Paragraph 4(b)(i) bad faith. Preserve every communication in original form.

In a recent matter – a .net typosquat (one transposed character from the complainant's registered word mark), spring 2025 – we assembled parking-page screenshots, archive captures showing a pay-per-click page drawing on the exact product category of the complainant, and registrant communications offering the domain at a five-figure price. The transfer order followed within approximately eight weeks of filing. No response was filed by the registrant.

When is a .net UDRP claim at risk of failing – or drawing an RDNH finding?

Not every .net dispute that looks like typosquatting is one. Understanding the failure modes before filing is essential – both to avoid an unsuccessful complaint and to avoid the reputational consequence of an RDNH finding.

An RDNH finding – Reverse Domain Name Hijacking – occurs when the panel concludes the complaint was brought in bad faith to deprive a legitimate registrant of a domain they held lawfully. RDNH carries no monetary penalty under the UDRP, but the finding is published and indexed, and it is visible to every panel in every future dispute that party brings. We also defend registrants facing overbroad or abusive complaints, and an RDNH finding is one of the most powerful outcomes a respondent can obtain.

A complaint is at risk in the following situations. First, where the registrant's domain predates the complainant's mark. If the .net variant was registered before the trademark priority date, the registration-in-bad-faith element fails on its face – there is nothing to infringe at the time of registration. Second, where the domain is a genuinely descriptive or generic term and the "typosquat" reading is a stretch. A three-letter variant of a descriptive word mark may not be confusingly similar at all. Third, where the registrant is commonly known by the disputed name, operates a legitimate business under it, or can point to a bona fide use predating the dispute notice. Fourth, where the complainant holds only a pending trademark application and no established unregistered rights.

In a recent matter (a .net dispute, autumn 2024), a brand owner approached us about a domain that appeared on its face to be a typosquat of the client's service mark. On reviewing the registrant's WHOIS/RDDS history and the evidence the client intended to submit, we identified that the registration predated the client's first trademark filing by more than three years. We recommended against filing. That advice was unwelcome initially, but it preserved the client's credibility for a parallel .com complaint – involving a registrant with no such defense – that resulted in a transfer order.

The decision matrix is straightforward. If the mark predates the domain: file, and the evidence record should be strong. If the domain predates the mark: assess unregistered rights carefully, or pursue a court action where monetary claims may offer a different route. If the registrant has any apparent legitimate use: consult before filing. If the registrant is a serial cybersquatter with a pattern of registrations: document the pattern and file, since panel discretion here runs strongly in the complainant's favor.

What does it cost to recover a typosquatted .net domain?

Costs have two distinct components that are frequently conflated: the forum filing fee and the legal fee. Combining them produces the total case budget.

The WIPO filing fee for a single-member panel on one to five .net domains is USD 1,500. A three-member panel on the same number costs USD 4,000. These are WIPO's published standard rates. If the case is withdrawn or terminated before panel appointment, WIPO typically refunds approximately USD 1,000 of a single-member USD 1,500 fee. The Forum's entry-level fee is approximately USD 1,300 for one to two domains; CAC begins lower, in the USD 500–800 range.

Legal fees for a straightforward UDRP complaint on a single .net domain typically fall in a market range of USD 3,000 to USD 7,000, separate from the forum fee. That range reflects drafting the complaint, assembling the evidence annex, selecting the forum, and managing the case through the decision. More complex matters – multiple domains, an unregistered-rights argument, a serial cybersquatter requiring pattern documentation, or a parallel ccTLD filing – sit at the upper end of or above that range.

COGNOMEN publishes its pricing ranges on its service pages. There are no hidden fees and no "price on application" for standard .net typosquatting complaints. The forum filing fee is a pass-through at cost; the legal fee is quoted as a flat range before any work commences.

Where a .net typosquat is one of a cluster of abusive registrations, filing a multi-domain complaint under a single case covers all domains held by the same registrant, which reduces the per-domain cost substantially at the forum-fee level. Identifying whether the typosquatter holds additional variants – through WHOIS/RDDS lookups and registrar data requests – is part of the pre-filing diligence we conduct for every client.

Related at COGNOMEN

• UDRP domain recovery – the full service across gTLDs and ccTLD zones
• How panels treat serial cybersquatters – analysis of the pattern-of-conduct doctrine
• Check ccTLD eligibility – for disputes extending beyond the .net zone