I detest doing WHOIS lookups at 2am. But every time I skip that step to save twenty minutes, I remember Q2 2026 numbers: UDRP case filings are up roughly 12% year-over-year, according to data tracked by Domain Name Wire and GigaLaw's ongoing UDRP monitoring. That number woke me up.

More cases mean more domain owners dragged into arbitration. A lot. Some of them did nothing wrong — they bought legitimately, built or parked legitimately, and still got served with a complaint. Cases follow. That's domain ownership in an era when every corporate legal team has a "domain enforcement" line item in their budget.

Why are UDRP filings spiking in 2026?

A few things happened at once, and none of them is going away soon — not one.

First, AI-branded startups are proliferating fast. Every company with "AI," "GPT," or a clever portmanteau in its name is now filing trademarks. Some of those marks have been around for a year or two. The company is now funded, they have counsel, and they've noticed someone parked a domain on the same string. Complaint filed.

Second, WIPO expanded its expedited arbitration lane in 2026. I covered that in more detail in the WIPO expedited UDRP piece — but the short version is: complaints that meet certain threshold criteria can now move in 45 days instead of 90. Easy to miss. That's faster than most domain owners realize a complaint has been served, especially if their contact info is stale.

Third — and this one bothers me most — some brand teams have figured out that UDRP is cheaper than negotiation for a certain category of targets: owners who won't respond, owners whose contact info bounced, or names with enough surface-level similarity to get a default judgment. A look at WIPO's case statistics shows default decisions (where the respondent simply didn't show up) running well above 20% of all outcomes. That's a meaningful chunk of "wins" that aren't really disputed at all.

All of which means: the risk environment for domain buyers is higher than it was 18 months ago. It doesn't mean you can't invest in domains. It means your pre-purchase diligence needs to be sharper. No shortcuts.

The buyer defense checklist I actually run

I'm not a lawyer. Nothing here is legal advice. But I've been doing this long enough to have a list that has kept me out of trouble. Here it is, with no corporate framework language:

1. WHOIS history — not just current registration

Current WHOIS tells you who owns it now. WHOIS history tells you what the name was doing for the last decade. Not automatic rejects. Domains that bounced through multiple owners in short windows, that were registered and dropped repeatedly, or that show a gap between brand-matching registration dates and existing trademark timelines. Those are yellow flags.

I use domain tools alongside DomainTools and SecurityTrails to pull historical records. If a name was clearly registered the same month a startup announced funding, and the registrant has no apparent connection to that industry, I want to know before I buy it as secondary inventory.

2. Trademark screening — USPTO and WIPO, not just Google

Google searches will miss registered marks, pending applications, and international registrations. A name can look pristine on a search engine and still carry a live trademark that a three-member panel will take seriously.

Free tools: the USPTO TESS search for US marks, and WIPO's Global Brand Database for international registrations. For anything I'm paying more than $5,000 for, I'll pay a trademark attorney for a quick opinion. That $300 search has saved me from two names I almost bought that had pending marks filed in the exact category I intended to use them. I nearly skipped it. My take? I was wrong.

3. The phishing pattern test — does this name impersonate anything?

This is the one buyers underestimate. A UDRP isn't just for obvious counterfeits. It also covers names that are "confusingly similar" — which panels have interpreted broadly in 2025 and 2026 as brand awareness has grown.

If a name adds a prefix or suffix to a major brand ("Get-[Brand].com", "[Brand]-AI.com", "[Brand]-Pro.app"), that's a phishing pattern regardless of your intent. I won't touch those names even at $50. Not worth it. The litigation exposure outweighs any arbitrage upside.

I look at whether a reasonable person — not a domain investor who knows the space — would assume the name is associated with a known company. If the answer is "maybe," that's enough for a UDRP panel. The threshold is lower than most buyers think. "Maybe" is enough.

4. Escrow for anything over $2,500

I've written about this separately in the domain escrow guide for larger purchases, but the principle is simple: escrow protects you from sellers who disappear post-payment, domains that are already under UDRP complaint at time of sale, and transfers that stall mid-process. Every legitimate high-value sale should clear through Escrow.com or a comparable service.

Seller resistance to escrow is itself a red flag. Legitimate sellers don't lose anything in an escrow transaction. If someone insists on direct transfer before payment "because it's faster," walk away. No debate.

5. Check for pending complaints — the step everyone skips

There's no public real-time registry of pending UDRP complaints before they're decided. But you can check the WIPO and NAF case lookup tools for a domain name to see if it's appeared in a prior complaint or is listed in an active case filing.

If WIPO shows a case number for the name you're buying, ask the seller directly and get a written explanation. A name that's already been through UDRP and survived may actually be a stronger buy — the prior panel already affirmed legitimate registration. A name mid-complaint is a different story entirely. Stay out.

6. Avoid registrations that match breaking-news brand announcements

This one sounds obvious until you're tempted by a fresh, catchy name you found 48 hours after a well-funded startup announced its rebrand or product launch. Panel intent analysis looks at registration dates relative to trademark use. "Three days after the TechCrunch article" is not a timeline that helps your case — panels read that timing as opportunistic.

There's a whole sub-niche of investors who speculate on freshly announced brand names. I understand the appeal. I also see a consistent thread of UDRP filings targeting exactly those registrations. Pattern holds. The ICANN UDRP policy makes "registration in bad faith" a standard that includes opportunistic timing.

What about reverse domain name hijacking?

I'd be telling you an incomplete story if I didn't mention that UDRP cuts both ways. The Glide UDRP reverse hijacking case is a vivid recent example: a company that offered over $100,000 for a domain, got turned down, filed UDRP, and got handed a Reverse Domain Name Hijacking (RDNH) finding instead of a transfer order.

RDNH happens when a panel decides the complainant filed knowing they had a weak case — often to pressure a seller after failed negotiations. It doesn't happen as often as it should, but when it does, the finding is public, permanent, and searchable. Stays forever. Some brand counsel who push aggressive UDRP strategies are starting to rethink that approach after a few RDNH entries on the company's public record.

For buyers: if you're ever served a complaint you believe is bad-faith, don't default. Respond. Show up. The cases where respondents fight RDNH and win are disproportionately cases where the respondent had clean registration, legitimate use, and didn't ghost the panel.

How the 12% spike changes what to buy right now

My buying posture has shifted in 2026. I'm more cautious about AI-adjacent names that closely mirror funded startups' brand vocabulary. I'm more careful about anything involving common words used heavily in trademark filings — "flow," "sync," "shift," "frame," "spark" — because even a legitimate hold can get challenged when a brand grows up and starts looking for an excuse.

What I'm more comfortable buying: established domain names with clean multi-year WHOIS history, strong secondary-use positioning that doesn't rely on any existing brand's goodwill, and names in curated marketplaces like our cybersecurity collection where listings have been pre-screened. A name like ExploitGym.app is a good example — it communicates a clear, original use case in cybersecurity training without borrowing from any existing trademark.

I also check the acquisition FAQ before closing anything new — it's a good reminder of the basic due-diligence steps that are easy to skip when you're excited about a name.

The domain market isn't getting more dangerous — it's getting more professionalized. That's actually good news if you do your homework. Bad news if you don't. The buyers who cut corners on WHOIS checks and trademark screens are the ones becoming WIPO case numbers.

Keep your acquisition process clean, stay current on the WIPO panel overview and DNJournal's ongoing coverage, and browse inventory that's already been curated with these checks in mind. That's the low-drama path in a 12%-spike environment.