Guide
Domain squatting: what it is and how to deal with it
By Josh Pigford, founder of Knockoff
Domain squatting is registering a domain with someone else's brand in it to profit from that brand. Look at what's on the domain before you spend anything. If it's selling copies of your store, report the store and skip the $1,500 filing. If it's parked, pay to get it only if you want that name.
What is domain squatting?
A domain squatter makes money three ways: selling the name to you, running ads on your customers' typos, or pointing it at a store that sells copies of your products. Cybersquatting is the same thing under its legal name. Typosquatting is the kind built on a misspelling. The names come in three shapes.
- Typos. yuorbrand.example, with letters swapped, dropped or doubled.
- Added words. yourbrand-outlet.example, or the same name with official or sale on the end.
- Other endings. Your exact name on .shop, .store or .online.
Knockoff's lookalike domain scanner lists 84 of these for a made-up 5-letter brand, 111 for 8 letters and 155 for 12. Registering every one at Porkbun's regular prices would run about $1,140 to $1,980 a year. That still wouldn't finish the job: it covers 15 endings out of 1,436 that exist, and squatters won't run out of words to add.
So buy your exact name on .com, .shop and .store, about $87 a year at the same prices, plus the misspelling your customers actually type. Then watch the rest.
Lookalikes the scanner lists for one brand name
5-letter name
8-letter name
12-letter name
Knockoff's lookalike scanner run on three made-up brand names, November 2, 2026. It's a count of what someone could register, not of names squatters hold.
How to deal with domain squatting
A report goes after the store. A filing, called a UDRP complaint, goes after the name. The store is what's costing you sales today, and you don't have to win the name to go after it. A registrar won't hand over a name just because you complain about a trademark. It needs the owner's say-so, a court order or a UDRP decision. So keep the trademark argument for the filing.
Two lookups tell you what you've got. Open the domain in a private window, see what comes up, and screenshot it with the date showing. Then run the name through ICANN's lookup for its registrar and the date it was registered. A name registered before your brand existed usually isn't squatting at all.
| What's on the domain | What to do | Cost | What you end up with |
|---|---|---|---|
| A live store selling copies | What to doReport the store to its platform or host: Shopify, Cloudflare or GoDaddy. | Cost$0 | What you end up withThe copied pages gone, if the platform or host agrees. The name stays theirs. |
| A page taking logins or card details | What to doReport it to the registrar as phishing, and to the host. | Cost$0 | What you end up withThe registrar has to act on real evidence of phishing. How it acts is its call. |
| A Shopify store showing as frozen | What to doSave the evidence and watch it. | Cost$0 | What you end up withNothing yet. A frozen store can come back on the same name. |
| The store came back on the same name | What to doFile a UDRP complaint. | Cost$1,330 to $1,500, about two months | What you end up withThe name, if you win. |
| Parked ads or a for-sale page | What to doAct only if you want the name. Buy it or file. | CostThe asking price, or $1,330 to $1,500 | What you end up withThe name. |
| Registered, no site | What to doWatch it. | Cost$0 | What you end up withNothing yet. A held name can turn into a store in an afternoon. |
| Anything, on a name older than your brand | What to doDon't file. Buy it or pick another name. | CostThe asking price | What you end up withThe name, if they'll sell. |
Reports don't always land. One founder whose Shopify store was cloned wrote that the registrar's "report page is broken and they haven't replied to any of my emails." What moved it was Cloudflare, which "eventually told me the actual host and also flagged it as suspected phishing." When a host goes quiet, here's where to take your report next. When the store returns under the same name, that's a relist, and it's your best case for filing: the UDRP lists using a name to pull in customers by confusion as an example of bad faith.
Is domain squatting illegal?
Yes, in the US, when it's done in bad faith. The Anticybersquatting Consumer Protection Act lets a trademark owner sue someone with "a bad faith intent to profit" who registers, trades in or uses a name confusingly similar to a mark that was distinctive when the name was registered. A court can award $1,000 to $100,000 per domain. When you can't reach the owner, you can sue the name itself, and then all you can get is the name forfeited, cancelled or transferred.
Domain flipping, buying names to resell them, is legal. It isn't bad faith by itself. It crosses over when the name was picked because it reads like your brand.
Suing makes sense when one person holds a string of your names, or when the harm is big enough that you want a court to put a number on it. For one name, a UDRP complaint is the cheaper road.
UDRP complaint: what it costs and what sinks it
UDRP, the Uniform Domain-Name Dispute-Resolution Policy, is a rule every ICANN-accredited registrar has adopted. A complaint asks a private panel, not a court, to transfer or cancel a domain, and nobody pays you a cent. For one domain, you file at WIPO for $1,500 or Forum for $1,330, you don't need a lawyer, and WIPO says a case "normally should be completed within 2 months." You have to prove three things: the name is identical or confusingly similar to a mark you have rights in, the holder has no rights or legitimate interest in it, and it was registered and is being used in bad faith.
Most complaints that reach a decision win. WIPO's 2025 numbers list 4,899 transfers and 79 cancellations against 329 denials, about 94% for the complainant. That's every complainant, global brands included, so it isn't your odds. Three things sink a small brand:
- The domain is older than your rights. The owner of loyalsoldiers.com had held it since 2014. A UK business offered £100, got a $999 counteroffer the same day, and filed two days later on a mark registered in 2025. The panel denied it and found reverse domain name hijacking, meaning the complaint itself was brought in bad faith.
- Your name is one other people use. A bakery with a registered OVENLY mark filed against ovenly.com and lost. The panel found the word widely used by others, with no sign the owner had targeted the bakery.
- You have no registered trademark. You can still file, but you have to show customers associate the name with you, with evidence like sales, advertising and public recognition. Common law trademark rights covers what that takes.
On a newer ending like .shop, .store, .online or .site there's a cheaper option, Uniform Rapid Suspension (URS). It costs $375 at Forum, and the owner gets 14 days to respond. You need a registered trademark in current use and a clear-cut case, and a win only suspends the name for the rest of its registration. You never get the domain, so it's for a name you want shut off, not one you want to own. It doesn't cover .com or .net.
How to get a domain from a squatter
You buy it or you file, and the math is short. If you want the name and the price is under $1,330, paying costs less than the lowest filing fee, and a purchase can't lose.
The first price you hear isn't the price. A domain investor bought ovenly.com at auction for $709 in 2024. A GoDaddy broker told the bakery it would cost $9,999. The owner says that after the bakery filed, it offered the name at $709 and the bakery countered at $100. The bakery then lost the case and the name. It paid more to lose than it would have paid to buy.
One domain, four prices: ovenly.com
Broker's quote
Filing fee at Forum
Owner's price after the filing
Bakery's counteroffer
From the Forum decision in case FA2512002192462, January 12, 2026, and Forum's fee schedule.
Keep written quotes. An offer above what the owner can show they spent on the name can count as bad faith, but only when the owner has no legitimate interest in the name and is targeting you. A high price on a plain word is just a high price, so don't file because a quote annoyed you. That's close to what happened in the loyalsoldiers.com case above.
How to find lookalike domains
The free lookalike domain scanner lists the lookalikes of your domain and what's on each one. One scan tells you about today. New names keep turning up, and the one that turns into a store is usually the one you hear about from a customer.
Knockoff's paid plan, $799 a month, takes that off your list. We watch for new lookalikes every day. When a store poses as your brand, we file the reports as your authorized agent, under a Letter of Authorization you sign once: Shopify's fraud report for a Shopify store, which doesn't need a registered trademark, and registrar reports for everything else, plus Cloudflare reports when the store sits behind Cloudflare. Going after the name itself, by UDRP or in court, stays with you or your lawyer. Going after the store is our job.
