Is Cybersquatting Legal? (2026 Updated)

If you've ever searched for your business name online and found a suspicious domain sitting there - unused, parked with ads, or pointing to a competitor - it can feel like someone's holding your brand hostage.

Cybersquatting is one of those issues that looks simple on the surface (?they registered my name!?), but the legal answer depends on what the domain is, how it's being used, and what rights you can prove.

Below, we'll break down what cybersquatting is, whether it's actually illegal in the UK, and the practical steps you can take (either to stop it, or to avoid being accused of it).

What Is Cybersquatting (And What Counts In The UK)?

Cybersquatting is usually used to describe registering, using, or dealing in a domain name that takes advantage of someone else's brand or reputation.

In plain English: it's when someone grabs a domain connected to your name (or something close to it) for an unfair advantage - often to sell it back to you, divert your customers, or piggyback on your goodwill.

Common Cybersquatting Examples

• Exact brand domain hoarding: registering yourbrand.co.uk (or yourbrand.com) and offering to sell it to you for a high price.
• Typosquatting: registering misspellings like yoourbrand.co.uk to catch people who mistype.
• "Sucks" domains or gripe sites: registering yourbrand-scam.co.uk or similar (these can be legally complex).
• Competitor diversion: pointing the domain to a competing product or service page.
• Fake support or phishing domains: using a lookalike domain to trick customers into handing over payment details or logins.

Cybersquatting vs Legitimate Domain Investing

Not every "someone else owns a domain I want" situation is cybersquatting.

There's a legitimate industry around buying and selling generic domains (for example, bestplumberslondon.co.uk). That's usually fine - the issue is when a domain is tied to someone else's identifiable brand and is registered/used in a way that looks unfair or abusive.

So, Is Cybersquatting Illegal In The UK?

Cybersquatting isn't a single named offence in the UK with one neat definition and one neat punishment.

Instead, it can be unlawful (and sometimes criminal) depending on what's happening in the background - particularly if the domain is being used to mislead, impersonate, or extract money unfairly.

In practice, most cybersquatting disputes are handled through:

• Domain dispute procedures (rather than court), and/or
• Civil legal claims (for example, trade mark infringement or passing off).

When Cybersquatting Can Be Unlawful (Civil Claims)

Cybersquatting commonly overlaps with these legal areas:

• Trade mark infringement under the Trade Marks Act 1994 (where you have a registered trade mark and the domain use falls within infringement rules).
• Passing off (where you don't have a registered trade mark, but you can prove goodwill/reputation, misrepresentation, and damage).
• Misrepresentation and unfair competition-type conduct (fact-specific, often tied into how the domain is used).

If your brand is important to your business (and for most businesses, it is), getting your rights secured early through Trade mark registration can make enforcement far more straightforward later on.

When Cybersquatting Can Cross Into Criminal Territory

Some domain behaviour goes beyond "sharp practice" and into potential criminal issues - particularly where there's fraud, impersonation, or hacking.

For example, if a domain is being used for phishing emails pretending to be your finance team ("please pay this invoice urgently"), or collecting card details on a fake checkout page, you may be looking at fraud-related offences.

That said, for a typical "they registered my domain and want money" situation, the route is usually a dispute process or civil enforcement, rather than criminal prosecution.

What Laws And Rights Help You Fight Cybersquatting?

If you're dealing with a cybersquatter, your best option depends on two things:

• What rights you have (registered trade marks, company name, trading name, reputation), and
• What the domain is doing (parked, redirecting, impersonating, selling counterfeit goods, etc.).

Registered Trade Marks (Often The Strongest Tool)

A registered UK trade mark can be a powerful foundation for stopping brand misuse, including domain-based misuse.

If you're weighing up whether registration is worth it, it helps to understand trademark registration costs early, so you can plan the sensible (and scalable) option for your business.

Passing Off (If You Don't Have A Registered Trade Mark)

If you don't have a registered trade mark, you may still be able to act, but you'll usually need to prove:

• Goodwill in the name/brand (customers associate it with you),
• Misrepresentation (the domain use misleads people into thinking it's you), and
• Damage (lost sales, reputation harm, customer confusion, etc.).

Passing off can be effective, but it's typically more evidence-heavy (and more arguable) than a straightforward registered trade mark position.

Consumer Protection And Misleading Conduct

If the domain is being used to mislead consumers (for example, a fake "official" site), you may also be looking at consumer protection issues and regulatory concerns - especially if customers are being tricked into purchases or handing over data.

Copyright, Website Copy, And Content Scraping

Cybersquatters often don't stop at domains - they might copy your logos, product images, website text, or even your terms.

Having clear ownership signals (and consistent branding) can help, including using a proper Copyright notice where appropriate. It won't solve a domain dispute on its own, but it can strengthen the overall "this is our brand/content" story when you're gathering evidence.

How Domain Disputes Work In Practice (Nominet, UDRP, And Beyond)

Most businesses want a result that's quick, cost-effective, and actually gets the domain moved into their control.

In many cases, domain dispute resolution is the practical path - especially if the domain is clearly abusive.

.UK Domains: Nominet Dispute Resolution Service (DRS)

If the domain ends in .uk or .co.uk, the relevant registry is typically Nominet, and disputes are commonly handled through Nominet's Dispute Resolution Service (DRS).

While each case turns on its facts, the general approach is to show:

• you have rights in the name (registered trade mark, unregistered rights/goodwill, etc.), and
• the registration/use is abusive (for example, intended to take unfair advantage of your rights).

DRS is often faster and cheaper than going straight to court - but you still need to prepare your evidence carefully.

.COM And Many Other Domains: UDRP

For many non-UK domains (like .com), the common framework is the Uniform Domain-Name Dispute-Resolution Policy (UDRP).

The UDRP test differs in wording, but it similarly focuses on trade mark rights, legitimate interests, and bad faith registration/use.

When Court Action Makes Sense

Court isn't always the first choice, but it can be appropriate where:

• there's serious reputational harm or significant financial loss,
• the domain forms part of a broader infringement/fraud campaign,
• you need urgent remedies (like injunction-style relief), or
• there are multiple parties and assets involved.

It's also worth remembering that even if you "win" a domain dispute, you still need a longer-term protection plan - so the problem doesn't reappear under another extension or spelling variation.

What Should You Do If Someone Is Cybersquatting Your Brand?

If you've discovered a suspicious domain, it's tempting to fire off an angry email immediately.

We get it - but taking a few careful steps first can protect your position and reduce the risk of accidentally strengthening theirs.

Step 1: Gather Evidence (Before Anything Changes)

Take screenshots and capture key details, including:

• the full URL and any redirects
• screenshots of every page (including checkout pages, contact pages, and "for sale" notices)
• the date/time you accessed the site
• any adverts, affiliate links, or competitor references
• any email headers if the domain is being used for impersonation/phishing

Step 2: Check Who Owns The Domain (Where Possible)

WHOIS data is often privacy-protected now, but you can still sometimes identify the registrar, hosting provider, and complaint channels. For .uk domains, Nominet records can be particularly relevant.

Step 3: Work Out What Rights You Can Prove

This is where businesses often get stuck. Helpful evidence might include:

• registered trade marks
• Companies House registration details (if your company name matches)
• proof of trading under the name (invoices, website history, marketing, press mentions)
• customer confusion evidence (emails from customers, misdirected enquiries)

Step 4: Choose The Right Enforcement Path

Depending on the facts, your options may include:

• sending a carefully drafted cease and desist / letter of demand
• filing a Nominet DRS complaint (for .uk domains)
• filing a UDRP complaint (for many other domains)
• reporting abuse to the registrar/host (especially for phishing/fraud)
• court action (in high-impact cases)

Step 5: Don't Pay Without Advice

Sometimes paying for a domain is a commercial decision - but it can create repeat risk (and in the worst cases, you may be funding further wrongdoing).

It's usually worth getting legal advice first so you understand:

• whether you have a strong claim to recover the domain without paying,
• whether the asking price itself could be evidence of abusive registration, and
• how to structure a purchase to minimise future risk (for example, making sure you get full control and proper transfer).

How Do You Avoid Being Accused Of Cybersquatting? (Yes, It Happens)

Not every dispute is "obvious cybersquatting". We sometimes see situations where a business registers a domain in good faith - and later receives a complaint from a trade mark owner, a larger overseas company, or a competitor.

Here's how to reduce that risk.

Do Basic Trade Mark And Name Checks First

Before you commit to a brand name (and buy ten domain variations), do some early checks. If you're planning to build a serious brand, registering it properly and early is usually cheaper than trying to fix a dispute later.

Be Careful With "Fan" Or "Review" Domains

Domains that include someone else's brand plus critical terms ("scam", "bad service", "fraud") can raise tricky issues. Depending on how the site is run, it may be defensible - or it may drift into misleading conduct, impersonation, or unfair commercial use.

If your site could be interpreted as "official", that's where legal risk increases quickly.

Don't Use Another Brand's Trade Mark In A Way That Suggests Endorsement

Using another company's mark in a domain can be risky if it implies sponsorship, affiliation, or an "official" relationship.

It's also worth being consistent in how you present your own trade mark symbols across your marketing; the rules around TM/? symbols are often misunderstood, and messy branding can complicate disputes when you're trying to show what your customers associate with you.

Get Your Website Legal Basics Right

In real-world disputes, cybersquatting complaints often come bundled with broader claims: misleading marketing, copied content, or dubious data collection.

If you're running online services, having properly drafted Website Terms and Conditions and a compliant Privacy Policy won't "fix" a domain dispute by itself - but it does help demonstrate you're operating transparently and legitimately (which matters when the other side is alleging bad faith).

Key Takeaways

• Cybersquatting isn't a single standalone "named" crime in the UK, but it can be unlawful through trade mark infringement, passing off, and (in serious cases) fraud-related behaviour.
• For .uk and .co.uk domains, Nominet's Dispute Resolution Service (DRS) is often a practical way to recover domains without going straight to court.
• Registered trade marks are one of the strongest tools for stopping abusive domain registrations and proving your rights quickly.
• If someone has registered a domain connected to your brand, gather evidence first (screenshots, redirects, "domain for sale" pages) before you contact them or file a complaint.
• Not every domain dispute is clear-cut - if you registered a domain in good faith, you can still face accusations, so early checks and careful branding decisions matter.
• Where a domain is used for impersonation, phishing, or taking payments, treat it as an urgent risk management issue, not just a brand annoyance.

If you'd like help responding to a cybersquatting issue (or locking down your brand protection strategy from day one), you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.