The reason goes deeper than "it's unfair." Here's the actual legal logic behind why holding domain names for ransom is a crime — and where the line between legal and illegal actually sits.
To understand why cybersquatting is illegal, you have to understand what a trademark actually is. A trademark isn't just a name or logo — it's a legally recognized indicator of the source of goods or services. When Nike puts a swoosh on a shoe, that mark tells consumers "this came from Nike." Trademarks have real commercial value, and the law protects that value from being exploited by third parties.
When someone registers "nike-outlet.com" specifically because Nike is a famous brand — with the intent of either diverting their customers or ransoming the domain back to them — they're using Nike's trademark-protected brand recognition as the basis for a commercial transaction. They didn't create that value. Nike did. That's the core of why it's illegal.
In the US, cybersquatting was formally made illegal by the Anticybersquatting Consumer Protection Act (ACPA) in 1999. Before that, trademark law existed but didn't specifically address domain names, which created a wild west period in the mid-1990s when people registered famous brand names as domains en masse and then attempted to sell them back to the brands for enormous sums.
The ACPA made it illegal to register, traffic in, or use a domain name that is identical or confusingly similar to a distinctive or famous trademark, with bad faith intent to profit from that trademark. Importantly, it also allowed trademark holders to sue in court to recover the domain and seek damages of $1,000 to $100,000 per domain.
In 1999, a man registered "eToys.com" before the toy company eToys launched their website and attempted to sell it for $650,000. The case helped establish early legal precedent for cybersquatting and demonstrated that courts would consistently rule in favor of established trademark holders in bad-faith domain disputes.
Not every domain registration involving a brand name is cybersquatting. The law requires bad faith intent to profit. Courts look at specific factors to determine whether bad faith is present — things like whether the registrant offered to sell the domain to the trademark holder for more than out-of-pocket registration costs, whether they registered multiple domains containing famous trademarks (a pattern), whether they provided false contact information during registration, and whether the domain was used to divert traffic from the trademark holder's site.
If you legitimately registered a domain that happened to match a trademark because you had your own legitimate interest in the name — and you weren't aware of or intending to profit from the trademark — that's a different situation. Courts and UDRP arbitrators weigh all the circumstances, not just the name similarity.
Registering "bestrunninggear.com" as a generic descriptive domain, then selling it to a running equipment store that approaches you. You registered it for its descriptive value, not to exploit a brand.
Registering "adidas-sale.com" immediately after Adidas launches a new product line, then emailing Adidas demanding $50,000 to transfer the domain. Classic bad faith, classic cybersquatting.
A fan registers "johnnycashfans.com" to run a genuine fan site about the musician. Fan sites with clear non-commercial intent typically survive UDRP challenges.
Registering a celebrity's full name as a domain with no content, then demanding payment from them or their management to transfer it. Clear bad faith, clear cybersquatting.
The ACPA is US law, but cybersquatting is addressed globally through ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP), which applies to all generic top-level domains (.com, .net, .org, etc.) regardless of where the registrant is located. Under UDRP, a trademark holder can file a complaint with an approved arbitration provider, and if the panel finds cybersquatting, the domain is transferred — without the trademark holder needing to file a lawsuit anywhere.
This makes the global enforcement of cybersquatting laws surprisingly effective. A company in Japan can file a UDRP complaint and recover a domain registered by someone in Belgium without going to court in either country, as long as the dispute falls under a generic TLD.
Read our guide on domain flipping — what's legal, what isn't, and how to invest safely.
Read: Is domain flipping legal? →