A squatter has registered a domain that copies your brand — maybe to run a phishing page, maybe to sit on it. You have two main administrative tools to deal with it: the UDRP (Uniform Domain-Name Dispute-Resolution Policy) and the URS (Uniform Rapid Suspension System). Both are run under ICANN and both let you act without going to court. They are not interchangeable.
The short version: use UDRP when you want to take ownership of the domain, when the case has any nuance, or when the domain is a legacy TLD like .com. Use URS when the abuse is blatant, the domain is a new gTLD, and you only need the site taken offline fast and cheaply. This guide walks through the differences so you can pick correctly the first time.
What the UDRP is
The UDRP is the long-standing, full administrative process for resolving domain disputes. It is administered by approved providers — in the US the main ones are WIPO and Forum (formerly NAF) — and it applies to virtually all generic top-level domains, including .com, .net, and .org.
To win, you must prove three things:
- The domain is identical or confusingly similar to a trademark in which you have rights.
- The registrant has no legitimate interest in the name.
- The domain was registered and is being used in bad faith.
A UDRP decision can order the domain transferred to you (or cancelled). That is the key payoff: you end up owning the name, so a squatter can't simply re-register it. Cases typically resolve in roughly two months and cost on the order of a few thousand dollars in provider fees for a single-member panel, before any counsel time.
What the URS is
The URS is the fast, lightweight cousin of the UDRP. It was designed for the new gTLDs launched after 2013 — names like .app, .shop, .finance — and for clear-cut, indefensible cases of infringement.
The bar is deliberately higher and the scope narrower. You must meet the same three-part test as UDRP, but to a higher evidentiary standard ("clear and convincing evidence"), and the case must be obvious on its face. The filing fee is lower than UDRP — typically a few hundred dollars — and the timeline is measured in weeks, not months.
The catch is the remedy. A URS win suspends the domain for the rest of its registration term: the site goes dark and resolves to a notice page. You do not get the domain. When it eventually expires, it can fall back into circulation.
Pick based on the outcome you need: UDRP gets you ownership of the domain; URS only takes the site offline. If you want to keep a squatter from coming back, URS alone won't do it.
The key differences
- Outcome. UDRP transfers (or cancels) the domain. URS only suspends it.
- Scope. UDRP covers nearly all gTLDs including
.com. URS covers new gTLDs (post-2013) and a handful of registries that adopted it — not legacy TLDs. - Cost. URS filing fees are a few hundred dollars; UDRP runs into the low thousands per case before counsel.
- Speed. URS resolves in weeks; UDRP in roughly two months.
- Evidentiary bar. URS demands clear and convincing evidence of a clear-cut case. UDRP uses the standard preponderance approach and can handle nuance and contested facts.
- Defensibility. A registrant can respond in both, but URS is built to bounce any case with a genuine dispute back toward UDRP or court.
Which should you use
Work through it in this order:
- Do you need to own the domain? If yes — for example, to retire a confusingly similar name permanently or fold it into your portfolio — file UDRP. URS can't transfer.
- **Is it a legacy TLD (
.com,.net,.org)? If yes, UDRP** is your only administrative option; URS doesn't apply. - Is the case airtight and the domain a new gTLD? A live phishing page on
yourbrand-login.appis the textbook URS scenario: obvious bad faith, no legitimate use, fast suspension. File URS to pull the site down quickly and cheaply. - Is there any real dispute? If the registrant might have a colorable claim, or the facts are messy, choose UDRP — URS isn't designed to adjudicate close calls.
A common pattern in fraud response: file URS first to stop an active phishing site within days, then follow with UDRP if you decide you need permanent ownership.
What you need before filing
Either process rests on the same foundations, so assemble these first:
- Trademark rights. A registered trademark is the cleanest basis and is effectively required for URS. UDRP can lean on common-law rights, but a registration is far easier to prove — and it strengthens your standing in both forums.
- Evidence of bad faith. Screenshots of the infringing page, the phishing or payment-capture behavior, WHOIS/registration records, certificate-transparency entries showing when the lookalike came online, and any prior contact with the registrant.
- A clean timeline. Capture and timestamp evidence early. Squatters take pages down once a complaint lands, and a dead page is harder to prove than a live one.
This is general information, not legal advice; for a specific dispute, confirm the right forum and the current fees with qualified counsel.
How this fits a takedown workflow
A domain dispute is the escalation, not the first move. The faster, cheaper path is often a registrar or hosting abuse report, which can disable an actively malicious site within hours — useful while a URS or UDRP runs in parallel. Escalate to URS for rapid suspension on a new gTLD, and to UDRP when you need transfer or the case has nuance.
The work that makes any of these succeed happens before you file: catching the lookalike early and documenting it cleanly. Brandfence watches certificate-transparency logs, DNS, and new registrations to surface impersonating domains as they appear — detection is passive, so you see the threat without scanning anyone's infrastructure — and assembles the evidence package each route needs.
Protect your brand
Choosing UDRP versus URS is straightforward once you know whether you need ownership or just a takedown, and whether the domain is a legacy or new gTLD. The harder part is having the evidence ready and catching the abuse before it does damage.
Brandfence watches certificate-transparency logs, DNS, and new registrations for domains impersonating your brand, then packages the evidence for a registrar abuse report, UDRP, or URS filing — every notice human-reviewed before it's sent. Get a free brand exposure report.