Categories
Free Speech Law Legal Analysis

Domain Squatting and Cyber Security ?

Domain Squatting and Cyber Security

Domain squatting, commonly referred to as cybersquatting, is the act of registering, trafficking or using an internet domain name with the intent to profit from the goodwill associated with a trademark, brand, or name belonging to another entity.

In the UK, where businesses, organisations, government departments and individuals increasingly depend on their online presence, domain squatting poses significant legal, ethical, and commercial challenges. It can undermine brand integrity, confuses consumers, and threatens the trustworthiness of the digital marketplace.

Addressing this issue requires a robust combination of legal frameworks, industry mechanisms, and proactive strategies, including guidance from authoritative sources such as the National Cyber Security Centre (NCSC).

The National Cyber Security Centre, a part of GCHQ, helps businesses, the public sector and individuals protect the online services and devices that we all depend on.

National Cyber Security Centre

How Domain Squatting Works

The mechanics of domain squatting are deceptively simple yet highly damaging. Squatters target well-known brands, public figures, or trending terms, registering domain names that closely resemble or incorporate these names. For example, a squatter might secure “brandnameuk.com” or a misspelled variant like “bradnname.com” before the legitimate owner can claim it.

Their objectives typically include selling the domain to the rightful owner at an exorbitant price, redirecting traffic to competing websites, or hosting misleading content to generate advertising revenue.

A related tactic, typosquatting, exploits common typing errors to divert users from their intended destinations, further eroding trust in online navigation. These practices not only harm brand owners but also create confusion and potential financial loss for consumers who may encounter fraudulent or misleading websites.

Legal and Industry Mechanisms in the UK

In the UK, domain squatting is addressed through a combination of legal and industry mechanisms designed to protect brand owners.

For .uk domains, the Nominet Dispute Resolution Service (DRS) offers a specialized, efficient process tailored to the .uk namespace. The DRS allows brand owners to resolve disputes by proving abusive registration or bad-faith use, making it a cornerstone of domain protection in the UK. Beyond these mechanisms, UK law provides additional recourse.

The Trade Marks Act 1994 enables trademark holders to pursue legal action against domains that infringe on their registered marks. The tort of “passing off” can also apply when a squatter’s actions mislead consumers into believing the domain is associated with the legitimate brand, causing reputational or financial harm. High-profile cases, such as those involving major brands like Marks & Spencer or Premier League football clubs, illustrate the courts’ commitment to protecting brand owners from cybersquatting.

The Uniform Domain Name Dispute Resolution Policy (UDRP), established by the Internet Corporation for Assigned Names and Numbers (ICANN), provides a global framework for trademark owners to challenge bad-faith domain registrations. To succeed under the UDRP, complainants must demonstrate that the domain is identical or confusingly similar to their trademark, that the registrant has no legitimate interest in the domain, and that it was registered or used in bad faith.

Government Guidance on Defensive Domain Registration

The Ministry of Justice (MoJ) security guidance on Defensive domain registrations emphasises defensive domain registration as a proactive strategy to combat cybersquatting. This approach involves registering multiple domain variations, including common misspellings, alternative extensions (e.g., .co.uk, .uk), and related terms, to prevent squatters from acquiring them.

The guidance advises securing domains early in the branding process, particularly for organisations with valuable intellectual property or high public visibility. It also recommends ongoing monitoring of domain registrations to detect suspicious activity, enabling swift action through Nominet’s DRS or legal channels. This proactive stance is critical for businesses seeking to safeguard their online presence and avoid costly disputes.

Some domain registrars have methods to detect malicious registrations of overtly government-associated domains through the use of misspellings and so on.

Unless there are strong justifications as to why misspellings must be covered, organisations should only defensively register .uk and .co.uk top-level domain variants and visual manipulations.

For example, the removal of one dot from justice.gov.uk leads to justicegov.uk which could be a registerable domain and one that looks a lot like justice.gov.uk during a casual inspection.

Defensive domain registrations – Ministry of Justice Security Guidance

The National Cyber Security Centre (NCSC) publishes Protecting your public domain name – NCSC.GOV.UK and many other articles on cyber security.

Ethical and Practical Implications

The ethical debate surrounding domain squatting is complex. Squatters often argue they are engaging in legitimate entrepreneurial activity by securing available digital assets in an open market.

However, their actions frequently exploit brand goodwill, mislead consumers, and undermine trust in the online ecosystem. Small businesses, in particular, are vulnerable, as they may lack the resources to pursue expensive legal battles or pay exorbitant fees to reclaim domains.

The financial and reputational damage caused by squatters can be significant, particularly when consumers encounter fraudulent websites or lose trust in a brand’s online presence.

Proactive Prevention and Solutions

Preventing domain squatting requires a multifaceted approach. Defensive domain registration, as recommended by cyber security professionals, is a critical first step. Businesses should also leverage monitoring services to track new registrations that may infringe on their brand.

Nominet’s DRS and other registry tools facilitate rapid detection and resolution of disputes, while legal action can reclaim hijacked domains when necessary.

However, prevention remains the most effective strategy. Public awareness, robust enforcement by Nominet, and adherence to government guidance play vital roles in mitigating the risks of cybersquatting.

Cyber Security Failure of MI5 and SIS (MI6) ?

For reasons unknown, MI5 – The Security Service (mi5.gov.uk) didn’t register the domain mi5gov.uk. CI5/MOI registered it to protect MI5 from domain squatting and other cyber attacks.

For reasons unknown, MI6 (sis.gov.uk) didn’t register the domain sisgov.uk. CI5 / MOI registered it to protect MI6 from domain squatting and other cyber attacks.

The mi5gov.uk domain registration did not trigger the expected domain suspension whereas the sisgov.uk domain registration did.

Thank you for registering the domain name sisgov.uk. We are writing to let you know that this domain has been temporarily deactivated and what you can do to reactivate it. You should be able to find all the information you need below but if you need any help, please contact our Customer Support team on 0330 236 9477.

The domain sisgov.uk has triggered a score that requires us to verify some additional information. This domain is still registered in your name – simply follow the steps below to reactivate it.

To reactivate your domain, we need the following details:

• Tell us what this domain will be used for.
• You will need to verify your identity, we use Mitek an identity verification service to complete this. This will involve taking a live picture, similar to a passport photo, via your device and uploading your identification documents for photo ID and proof of address.

Nominet Customer Support– 9:17am

Nominet publishes Terms And Conditions of Domain Name Registration. Specifically 6.1.5 states that you will not use the domain name for any unlawful purpose.

Hi,

Thank you for your email and completing the Mitek verification.

I can confirm the domain name is now active.

Thank you again.

Kind regards,

Nominet UK
Registry Compliance Advisor

Nominet Registry Compliance Advisor – 10:39am

As with all the MOI domains, these domains will continue to be used for a lawful purpose.

Check out our related articles on Domain Names and Freedom of Expression, Free Speech Union, Rule of Law, Open Justice, Is the Law Black and White ?, What Does Lady Justice Symbolise ?, Can a Judge Direct a Jury to Find a Defendant Not Guilty ?, Law Society, Law Commission, Solicitors, Solicitors Regulation Authority, Barristers, Bar Council of England and Wales, Bar Standards Board, Contra Mundum, R v Sussex Justices, Police Impartiality and the highly questionable Sussex Family Justice Board.

The Ministry of Injustice is not the Ministry of Justice nor is it affiliated in any way with the justice system, legal profession, police or any other law enforcement agencies.

Latest Articles ↓

Most Popular ↓

You should always seek formal legal advice from a qualified and reputable lawyer (solicitor or barrister).

There are a number of links to Free and Paid For Legal Resources and Legal Organisations on the Free Legal Advice , Legal Aid and Pro Bono pages.

[post_title] was last updated on the 23rd June 2026

By Dom Watts

Dom Watts founded the Ministry of Injustice in July 2021. Dom is an IT Professional with 30+ years experience in Tier 1 Banking, Government, Defence, Healthcare and Global Blue Chips. Dom has no legal training and is not a lawyer but has previously consulted for a Magic Circle Law Firm. You can find Dom on X or Google.

Dom Watts publishes the Ministry of Injustice as a citizen journalist. The journalism exemption is detailed in the Data protection and journalism code of practice published by the ICO and Section 124 of the Data Protection Act 2018.

Section 2 of the Defamation Act 2013 sets out the defence of truth. Section 3 of the Defamation Act 2013 sets out the defence of honest opinion. Section 4 of the Defamation Act 2013 sets out the defence of public interest. Section 8 of the Defamation Act 2013 sets out the single publication rule.

Section 4a of The Limitation Act 1980 defines the time limit for actions for defamation or malicious falsehood as one year from the date on which the cause of action accrued.

Article 10 of the Human Rights Act 1998 gives the right to freedom of expression. "This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers."

"Free speech encompasses the right to offend, and indeed to abuse another." - Para 43 Scottow v CPS [2020] EWHC 3421 (Admin)

"Free speech is a fundamental common law right" - Para 21 R v Shayler [2002] UKHL 11 [2003] 1 AC 247 per Lord Bingham and Para 42 Phillips -v- Secretary of State for Foreign, Commonwealth and Development Affairs [2024] EWHC 32 (Admin)

Dom is a member of The Free Speech Union

“A key issue here is the need to distinguish between conduct which, however objectionable, does not justify invoking the criminal law and conduct which crosses the line and results in criminal liability" - Para 31 R v O’Neill [2016] EWCA Crim 92 [2016]

“Harassment is generally understood to involve improper oppressive and unreasonable conduct that is targeted at an individual and calculated to produce alarm and distress” - Para 38 R v O’Neill [2016] EWCA Crim 92 [2016]

"The behaviour said to amount to harassment must reach a level of seriousness passing beyond irritations, annoyances....The gravity of the misconduct must be of an order which would sustain criminal liability" - Paras [40-44] Hayden v Dickenson [2020] EWHC 3291 (QB)

"If you tell the truth, you don't have to remember anything"

In 2002 Dom Watts was an unlikely consumer champion. The dad of three from Croydon took on the power and might of Kodak – and won...Dom on BBC Working Lunch

Rule of Law - Open Justice - Policing By Consent