Reverse domain hijacking: protect your domain from legal abuse
Reverse domain name hijacking is when a trademark owner abuses the official domain dispute process to try to take a domain name away from someone who registered it legitimately. It is a legal tactic, not a hacking technique, and it is quite different from someone breaking into your account and stealing your domain. This article explains what reverse domain name hijacking actually is, how to spot a bad-faith complaint, what to do if you receive one, and how it differs from the unrelated (but more common) problem of a domain being hacked or hijacked by a criminal.
What is reverse domain name hijacking?
Reverse domain name hijacking (often shortened to RDNH) is defined under the Uniform Domain-Name Dispute-Resolution Policy (UDRP), the official process that ICANN-accredited registrars use to resolve disputes over domain names. Paragraph 15(e) of the UDRP rules describes it as “using the UDRP in bad faith to attempt to deprive a registered domain-name holder of a domain name.”
In plain terms: a company or individual who owns a trademark files a formal complaint claiming that your domain infringes their trademark, hoping a panel will order it transferred to them, even though they have no real case. It is sometimes called “reverse cybersquatting”, because it is the mirror image of cybersquatting. Cybersquatting is registering a domain that contains someone else’s brand name to profit from it. Reverse domain name hijacking is a trademark owner trying to take a domain from its rightful, legitimate owner using unjustified legal claims.
This is a legal and administrative problem, decided by independent panellists under UDRP rules. It has nothing to do with someone hacking your hosting account, your registrar login or your DNS settings. Some online glossaries blur the two, but they are separate issues with separate causes and separate fixes, which is why this article deals with them one at a time.
How a UDRP complaint actually proceeds
If you are on the receiving end of a trademark complaint about your domain, it helps to know roughly what happens and when, so you do not panic or miss a deadline.
- The complainant files an electronic complaint with an ICANN-approved dispute provider, such as WIPO (the World Intellectual Property Organization) or the Forum (formerly the National Arbitration Forum).
- The provider checks the complaint meets its formal requirements, then asks your registrar to confirm your contact details and to lock the domain. This lock simply stops the domain being sold or moved while the case is open. It is a standard procedural step, not a sign anything has been hacked.
- You, as the registrant (called the “respondent”), have 20 days from the start of proceedings to file a response. A four-day extension can be requested automatically; anything beyond that needs a good reason.
- Once a response is filed, or the deadline passes, one or three panellists are appointed and usually decide the case within 14 days.
- If you do not respond at all, the panel will normally decide in the complainant’s favour, provided the complaint itself meets the UDRP’s three requirements. Staying silent is not a safe option.
- If you lose, the domain is only transferred if you have not filed a lawsuit in a relevant court by the deadline given in the decision. Losing a UDRP case is not necessarily the end of the road if you have a genuine claim to the name.
Complaints are usually decided within 45 to 60 days, without the need for a court case. Filing a complaint costs the complainant roughly $1,500 to $4,000 at the time of writing, which is one reason most complaints involve well-resourced trademark holders rather than individuals.
Signs a complaint against you may be made in bad faith
UDRP panels have identified several situations where a complaint is found to be an abuse of the process. These are useful checks if you have received a complaint and want to gauge whether it looks like genuine infringement or an opportunistic attempt to take your domain:
- Your domain predates their trademark. If you registered the domain before the complainant had any trademark rights in the name, they cannot reasonably claim you registered it in bad faith to target them.
- No evidence of bad faith. The complaint provides no real evidence that you registered or used the domain to target their brand specifically.
- It follows failed negotiations. The complainant previously tried to buy the domain from you, the deal fell through, and the UDRP complaint looks like a “Plan B” to get it anyway.
- Misleading the panel. The complainant withholds relevant facts, misrepresents the history of the domain, or does not mention an earlier complaint that was already rejected.
- No fair reading supports bad faith. Your use of the domain, looked at reasonably, could not be considered bad faith under any interpretation.
If several of these apply to a complaint you have received, it is worth raising them explicitly in your response, ideally with the help of a lawyer who has handled domain disputes before.
What happens if a panel agrees it was reverse domain name hijacking?
It is worth being realistic about what a finding of reverse domain name hijacking actually achieves. If a panel agrees the complaint was filed in bad faith, you keep your domain and the decision is published with a formal note that the complainant abused the process.
That public record is the main consequence. UDRP panels do not currently have the power to fine the complainant or award you compensation through the UDRP process itself. For most large complainants, a reverse domain name hijacking finding is a reputational knock rather than a financial penalty. If you want to pursue damages, such as for wasted legal costs, that generally has to happen separately, through the courts, outside the UDRP.
Reverse domain name hijacking vs account takeover and DNS hijacking
It is easy to confuse reverse domain name hijacking with ordinary domain hijacking, but they are different problems with different warning signs and different fixes. The table below sets out the distinction clearly.
| Reverse domain name hijacking | Domain hijacking (account takeover) | |
|---|---|---|
| What it is | Abuse of the UDRP legal process by a trademark claimant | Someone changes your domain’s registration or settings without your permission |
| Who does it | A trademark owner or their lawyer | A criminal or attacker |
| How it happens | Filing a bad-faith complaint with a UDRP provider such as WIPO or the Forum | Breaking into your registrar account, tricking you via phishing, or taking over the email address linked to your domain and resetting the password |
| First sign | A formal written complaint or notice from a UDRP provider | Your site suddenly goes offline, your DNS records change unexpectedly, you are locked out of your registrar account, or you receive a password-reset email you did not request |
| What to do | File a timely, well-evidenced response within the UDRP process | Contact your registrar immediately, recover your account, and check your DNS and nameserver records |
Two related terms are also worth knowing. DNS hijacking is when an attacker alters a domain’s DNS settings so visitors are sent to a different server, often a fake one, without changing who owns the domain. URL hijacking (sometimes called typosquatting) is registering a domain with a spelling similar to a well-known one, then building a site designed to look like the original in order to deceive visitors. Neither of these involves the UDRP process described above.
If you think your domain has actually been hacked rather than disputed legally, speed matters far more than it does in a UDRP case. Check with your registrar straight away, confirm your account recovery email is secure, and review your DNS records for anything you do not recognise. If your site is already unreachable, our guide on what to do when your website is down covers the first checks to run.
How to protect yourself against both types of problem
Because reverse domain name hijacking and account-based domain hijacking are different threats, the protective steps are different too.
If you are worried about a bad-faith trademark complaint
- Keep your WHOIS or registrar contact details accurate and up to date, so there is a clear, verifiable record of who has held the domain and since when.
- Keep dated evidence of your use of the domain: old invoices, website archives, marketing material, or anything that shows when you started using the name and for what.
- If a company offers to buy your domain and you decline, keep a record of the correspondence. It can help show a later UDRP complaint is really a “Plan B” after a failed purchase attempt.
- Take any UDRP notice seriously and respond within the deadline. Missing the 20-day window makes it far more likely the panel will rule against you by default.
- Get advice from a lawyer experienced in domain name disputes if the complaint looks weak or opportunistic. The checklist above can help you brief them quickly.
If you want to reduce the risk of your domain actually being hijacked
- Use a strong, unique password for your registrar account and turn on two-factor authentication.
- Make sure the email address linked to your domain account is itself well secured, since resetting that email’s password is a common way in for attackers.
- Turn on registry/registrar locks that prevent your domain from being transferred without extra verification.
- Renew your domain in good time rather than letting it lapse. Our guide on how to avoid letting your domain name expire covers this in more detail.
- Check your domain’s DNS and nameserver records periodically so you notice quickly if something changes.
- Review the steps in what to do after buying a domain name to make sure the basics, like registration details and renewal settings, are correctly set up from the start.
FAQ
Is reverse domain name hijacking the same as having your domain hacked?
No. Reverse domain name hijacking is a legal process: a trademark owner files a complaint through the UDRP trying to get a panel to transfer your domain to them. Having your domain hacked means a criminal has gained unauthorised access to your registrar account or email and changed the registration or DNS settings directly. The warning signs and the fixes are different for each.
What should I do if I receive a UDRP complaint about my domain?
Read it carefully, note the response deadline (normally 20 days from the start of proceedings), and gather evidence of when and why you registered and used the domain. Consider getting advice from a lawyer who handles domain disputes, especially if the complaint looks weak or opportunistic. Do not ignore it: if you do not respond, the panel is likely to rule against you by default.
Can I get compensation if a panel finds a complaint was reverse domain name hijacking?
Not usually through the UDRP itself. A finding of reverse domain name hijacking means you keep your domain and the decision is published noting the complainant’s bad faith, but UDRP panels have no power to award damages or fines. Pursuing financial compensation for wasted costs would generally need separate legal action through the courts.
How long does a UDRP case take?
Most cases are decided within 45 to 60 days of being filed, without needing a court case. You get 20 days to respond once proceedings start, with a four-day extension available on request, and panellists usually decide within 14 days after that.
