UDRP Domain Disputes Jump 41% in Q1 2026 on Two Mega-Filings

Two trademark filings did most of the damage. Domain names challenged under the world’s main cybersquatting playbook surged 41% in the first quarter of 2026, the steepest jump in six years of tracking, and almost all of that climb traces back to one cosmetics company and one American retirement-plan giant.

The figure comes from GigaLaw’s Q1 2026 Domain Dispute Digest, published in April. Panels under the Uniform Domain Name Dispute Resolution Policy handled 4,766 disputed domains between January and March. L’Oréal alone challenged 705 names. Empower targeted 537 in one filing tied to a retirement-plan phishing operation. Together, those two complaints made up more than a quarter of every domain in dispute that quarter.

Strip the two cases out and the numbers look ordinary. Keep them in and the quarter rewrites the record book.

Two Filings Did Most Of The Damage

UDRP decisions, the procedural count rather than the domain count, rose roughly 15% year over year. That tracks with the slow upward grind the system has shown for most of the past decade. The 41% spike in disputed names is the outlier, and it is concentrated in two complaints that almost never clear procedural review at this scale.

L’Oréal’s filing covered 705 domains in a single proceeding. Empower Annuity Insurance Company, the parent of the Empower retirement-services brand, filed against 537. No other Q1 case came within an order of magnitude of either.

Doug Isenberg, founder of GigaLaw and the report’s author, has spent two decades working UDRP files for trademark owners. He has been clear on how rare consolidation at this size is. He told Westlaw Today the L’Oréal cancellation request alone sits in territory chosen by roughly 1% of complainants.

Why Empower Grabbed The Domains And L’Oréal Killed Them

Both companies won. They took different exits. Empower secured transfers, meaning the disputed names now sit inside Empower’s own portfolio, locked away from any future bad-faith registrant. L’Oréal asked the panel to cancel the 705 domains, releasing them back into the registry pool.

Cancellation has a known weakness. A canceled domain can be re-registered the moment its hold lapses, sometimes by the same actor who lost it. Most trademark owners take transfers for that reason. Isenberg said he almost always advises clients to do exactly that, then explained why L’Oréal might still have chosen the harder route.

“Some companies have become very mindful of the sizes of their domain name portfolios, which require annual renewal fees paid to their registrars, so adding hundreds of domain names in a single batch could be seen as a considerable expense not worth incurring,” Isenberg said in comments published by Westlaw Today.

That math matters. Adding 705 names to a corporate portfolio at typical registrar renewal rates can run into six figures annually, in perpetuity, for assets the brand will never use. Isenberg has also pointed out that the UDRP does not currently allow what he calls a “true” cancellation, where a domain would be removed from circulation altogether. WIPO and the Internet Commerce Association have asked ICANN to consider that change in the next UDRP review.

The Privacy Wall That Usually Stops These Cases

UDRP rules require that all disputed domains in a single proceeding belong to one registrant, or be controlled by the same operator. That used to be straightforward to prove. Then privacy services and Europe’s GDPR redactions wiped most ownership data out of public WHOIS lookups.

Trademark counsel now has to build common-control arguments through indirect evidence: identical name servers, repeated registrar choices, shared hosting fingerprints, copy-pasted registrant patterns, and behavioral traces from the sites themselves. Panels reject many would-be mass complaints on exactly this point. Both Q1 mega-cases cleared it.

Inside The Phishing Scheme Behind The 537 Names

The Empower panel’s reasoning, captured in the published WIPO Administrative Panel Decision D2025-5176, leans heavily on the operational fingerprints of the underlying scam. The 537 domains were not random typos. They were engineered to read like Empower’s brand at a glance, especially in SMS messages where capital letters and small-caps sans-serif fonts collapse legibility.

Empower’s filing argued the registrants targeted retirement-plan participants in the United States, the demographic least likely to verify a sender domain in a text message and most likely to click through to a fake login. The panel agreed and granted consolidation across all 537 names.

The campaign’s structure looked industrial rather than opportunistic. Several details made consolidation defensible.

• 705 vs 537: the size of the L’Oréal and Empower complaints set the upper bound for what panels accepted in a single filing this quarter.
• 4,766 disputed domains: Q1 2026 total, with a quarter of that volume coming from two complainants.
• 15%: the year-over-year rise in UDRP decisions, the procedural baseline that excludes the domain-count surge.
• 1%: Isenberg’s estimate of the share of UDRP complainants who request cancellation rather than transfer.

Trademark lawyers tracking phishing infrastructure have argued for years that mass-typo domains targeting financial brands tend to share back-end signatures. The Empower decision is now a usable citation for that argument. Future filings against retirement, brokerage, and 401(k) phishing operations can lean on its consolidation reasoning.

That precedent is the most consequential thing in the Q1 numbers, and the part the headline percentage buries. The 41% rise gets the press. The new template for chasing organized phishing through a single UDRP proceeding is the durable change.

Where UDRP Sits After Its 25th Year

WIPO’s 2025 record-breaking year announcement reported more than 6,200 proceedings administered under the UDRP and related country-code mechanisms last year, the highest activity since the policy launched in 1999. The 25th anniversary brought more than 800 panelists, brand owners, and registrar operators to a WIPO conference in Geneva.

“The UDRP is an essential tool to help protect Internet users around the world against online deception and fraud,” said Daren Tang, Director General of WIPO, in a public statement on the policy’s role against cybersquatting. The system was designed in an era when most disputes involved a single registrant grabbing a single recognizable mark. It was not built for 537-domain phishing rings.

The Q1 2026 surge is partly an artifact of two unusual filings and partly a sign the system is being asked to do heavier work than it was scoped for. WIPO has begun pushing expedited UDRP case processing and ICANN is fielding proposals for true cancellation. Whether either gets to a final rule before the next mega-complaint lands is the open question. The WIPO domain name caseload tracker shows the filing rate is still climbing.

Frequently Asked Questions

How Much Does Filing A UDRP Complaint Cost?

Single-domain UDRP filings at WIPO start at $1,500 in panel fees for a sole panelist, with three-panelist cases running $4,000 or higher. Attorney fees sit on top of that and typically run $2,500 to $7,500 for a clean case. Mass complaints like Empower’s 537-domain filing carry tiered fee scales that climb with portfolio size. WIPO publishes the full schedule on its arbitration center site.

What’s The Difference Between Transfer And Cancellation?

Transfer moves the disputed domain into your account at a registrar of your choice, where you control renewal and DNS. Cancellation deletes the registration and returns the name to the public pool, where anyone, including the original cybersquatter, can re-register after the redemption period. Most trademark counsel choose transfer for control. Cancellation is used when adding the domain to a corporate portfolio creates renewal-fee bloat the brand does not want.

Can A Small Brand File A UDRP Without A Trademark Lawyer?

Yes, but the win rate is lower. UDRP procedure looks simple on paper and turns technical fast on questions of bad faith, common control, and evidence packaging. Filers who self-represent often miss the documentation panels expect, particularly screenshots of the offending site captured with timestamp tools and registrar abuse-report records. WIPO and the Forum publish filing templates if you go solo.

How Do I Spot A Phishing Domain Like The Empower Ones?

Check the exact spelling letter by letter, especially in SMS where fonts compress similar characters. Look for hyphens that the real brand never uses, swapped vowels, doubled consonants, and unfamiliar TLDs like .top, .xyz, or country-codes that do not match the brand. When in doubt, type the brand directly into a browser instead of tapping the link. Real retirement-plan providers will never ask for credentials through a text-message link.

The Q1 numbers will read as a record-breaking quarter for as long as people quote the 41% headline. Strip out two filings and the underlying business of cybersquatting looks like it always has, persistent, profitable, and hard to dent through one complaint at a time. The interesting part of the report is what the L’Oréal and Empower wins now make possible for everyone else.