A business discovers that its brand name is registered as a domain by someone else — sometimes a competitor, sometimes a squatter waiting to sell it, and remarkably often a former web developer or employee who registered it in their own name years ago.
The last of these is the most common in Pakistan, and the most avoidable.
First: who actually owns your domains?
Check, today, for every domain your business uses:
- Whose name is in the registrant field?
- Which email address controls the account, and does a current employee have it?
- When does it expire, and is auto-renewal on with a valid payment method?
- Who has the registrar login?
The classic failures: the domain is registered to the developer's personal account; the registrant email is an ex-employee's; or nobody knows the login and the domain lapses. A lapsed domain is bought within hours by services that monitor expiries, and then sold back to you at a price.
Fix this before you need to. Transfer registrant details to the company, use a role-based email the company controls, enable auto-renewal and registrar lock, and keep the credentials with the company rather than with an individual.
Recovering a .com or other gTLD: the UDRP
For .com, .net, .org and most generic domains, the Uniform Domain-Name Dispute-Resolution Policy (UDRP) applies, administered by providers such as WIPO. It is an administrative process, decided on documents, and it is usually faster and cheaper than litigation.
You must establish three things, all of them:
- The domain is identical or confusingly similar to a trade mark in which you have rights
- The registrant has no rights or legitimate interests in it
- The domain was registered and is being used in bad faith
Bad faith indicators: acquiring it primarily to sell to you at a profit, a pattern of such registrations, disrupting a competitor's business, or using it to attract traffic by creating confusion.
Remedies are transfer or cancellation — no damages. If you want compensation, that is a court claim.
Two practical points. Registered trade mark rights make this far easier, which is another reason to register the mark before you build the brand. And a domain registered before your rights existed is generally not registered in bad faith.
.pk domains
Country-code domains are administered under their own registry's policies rather than the UDRP, and the .pk registry operates its own rules and dispute mechanism. The practical route usually combines:
- A complaint to the registry under its policy
- A legal notice to the registrant, where identifiable. See legal notices — how and when
- Court proceedings for passing off or trade mark infringement, with an injunction restraining use and requiring transfer. See stay orders and injunctions
Where the domain is being used for fraud or impersonation rather than merely held, the criminal route under PECA is available and is often faster than any of the above. See online blackmail, fake accounts and takedowns.
When it is a former developer or employee
The most common scenario we see, and it is contractual as much as it is IP.
If they registered it while engaged by you, and you paid for it, the arrangement is generally one where they held it for you — but proving that depends on what is in writing. Assemble the invoices, the emails instructing the registration, and the payment records.
Then: a written demand for transfer, and if refused, proceedings. Holding a client's domain hostage over a fee dispute is not a lien anyone should expect a court to endorse, but the underlying fee dispute has to be dealt with too.
Prevent it next time by putting domain and account ownership in the development contract. See software development and SaaS agreements, protecting your business when an employee leaves and when your agent binds you.
When it is a competitor or a fraudster
Typosquatting — a domain one keystroke from yours, used to intercept traffic or, worse, email. Business email compromise frequently runs through a lookalike domain that nobody noticed. See responding to a data breach and card and account fraud.
Cloned sites taking orders and payments in your name. Here the priority is takedown and warning your customers, not a domain dispute — report to the host, the registrar, the payment processor and the FIA, in parallel. See reporting online fraud and cybercrime and counterfeits and brand enforcement.
Parked domains with your brand, monetised by advertising. UDRP territory.
Should you just buy it?
Frequently, yes. Where the registrant has some legitimate connection, or your rights are weak because the mark is descriptive or unregistered, buying is faster and cheaper than a dispute you may lose.
Do it through an intermediary where possible — a request from the trade mark owner raises the price — and take the transfer against payment, ideally through an escrow arrangement. See escrow arrangements.
Be clear-eyed about the alternative: a UDRP takes weeks and a court case takes considerably longer.
Prevention, briefly
- Register the trade mark before launching the brand
- Register the domains at the same time — the .com and the .pk at minimum, plus obvious variants and common misspellings if the brand matters
- Register in the company's name, with a role-based contact email
- Auto-renew, registrar lock, and two-factor authentication on the account
- Keep a register of every domain, account and social handle the business owns, with who controls it
- Secure the social handles at the same time, and verify the accounts
See starting an online store and setting up a software house.
How the firm can help
We file and defend UDRP complaints, pursue .pk registry complaints and court proceedings for injunctions and transfer, handle negotiated acquisitions of domains including through escrow, deal with impersonating and cloned sites through takedown and criminal complaints, and put domain and account ownership on a proper footing before it becomes a dispute.
See intellectual property, or contact the firm.