Protection of domain names as part of a digital brand strategy
Domain already seized: what to do and how much will it cost
The first step is not panic, but diagnosis. You need to check the WHOIS and EPP status of the domain: if it is still in the grace period (30 days after expiration of registration), recovery costs as much as a regular renewal. If the period has passed and the domain has gone to auction — the price can increase 5-10 times, and negotiations with the new owner become a commercial deal, not a technical issue.
There are three scenarios ahead, and you need to choose between them consciously, not out of inertia like 'they took it — let's go to court.'
- Direct purchase from a cyber squatter. Fast, but the price is not regulated — from several thousand to hundreds of thousands of rubles, and many companies consider paying a 'blackmailer' an absolutely unacceptable principle.
- Pre-litigation demand for blocking. For .ru and .рф domains, a trademark owner can set a domain block for 14 days without a court decision through the registry — this time is often enough to start a full procedure.
- UDRP or court — depending on the zone and the presence of a trademark.
| Parameter | UDRP | Russian Court |
|---|---|---|
| Duration | 45–60 days | 6–18 months |
| Cost | $1500–4000 (depends on the number of arbitrators) | 500 000–800 000 ₽ |
| Compensation | not provided, only domain transfer | up to 5 million ₽ |
| Applicability | international zones (.com, .net, etc.) | .ru, .рф and disputes within Russia |
The statistics are encouraging: in domain disputes in Russia, rights holders win 68–80% of cases. This means that if a registered trademark exists, the chances of recovering a domain are high — the only question is whether a company is ready to wait one and a half years and spend half a million rubles instead of immediately buying the domain for a fifth of that amount.
Portfolio of 200 domains: how not to lose control
VK's portfolio includes over 2000 domains; information about Sberbank's portfolio has not been confirmed in available sources. This is not the whim of lawyers, but a defensive strategy: the company registers all reasonable brand variations to prevent competitors and scammers from doing so first. The problem is that a portfolio of this scale operates by its own rules, and without centralized management it becomes a source of risk rather than protection.
The key figure rarely mentioned: the overwhelming majority of domains in .ru are registered to individuals (around 72–83% according to different sources 2026 year), with significantly fewer registered to legal entities. In practice, this means that a substantial portion of corporate domain assets is actually owned by specific employees — a marketer, IT specialist, contractor, who once registered a domain 'on the fly' to their personal account. Terminating such a person's employment may result in losing control over a corporate domain or even direct blackmail.
- All domains must be registered to the legal entity of the company, not to employees or subcontracting agencies.
- A single administrator with access to the registrar account is needed — not 'whoever registered first,' but a designated role within the company.
- Autorenewal must be enabled for all domains in the portfolio without exception — this is cheaper than any recovery.
- Quarterly portfolio audit: who the owner is, when registration expires, which domains are unused and why they are still needed.
A real scenario that is repeated at dozens of companies: an employee responsible for IT infrastructure is fired, and the domain registered on their personal e-mail remains out of the company's sight until the renewal period expires. The result is either blackmail by the former employee or loss of the domain in public access.
Technical measures that actually work
Here is the statistics is disheartening: among companies from the top-5000 by revenue 2FA on the registrar's account, according to researches, two-factor authentication is used inconsistently even by large companies, and access restriction by IP remains rare. It is precisely these two gaps — the main reason for account compromise, through which domains are taken over entirely, not just individual subdomains.
- Two-factor authentication on the registrar's account — is the minimum barrier that blocks most attempts to seize through phishing or password leak.
- EPP statuses clientTransferProhibited, clientDeleteProhibited and clientUpdateProhibited — three flags that physically block transfer, deletion and modification of domain data without manual removal of protection. Configured via the registrar panel, but many companies simply do not know about them.
- Access restriction by IP to the domain control panel — narrows the attack window to a specific corporate network or VPN.
- DNS monitoring — notifications upon any change of A-record, MX-record or NS-servers, to detect interception within hours, not weeks.
- dnstwist — a free tool that generates all possible variations of the domain (typos, homoglyphs, added words) and checks which of them are already taken. Should be run monthly, not just once upon brand registration.
According to Positive Technologies, phishing attacks increased by 33% in 2024 compared to 2023, and most of them use predictable techniques: typos (compnay.ru instead of company.ru), added words (company-secure.ru), or zone changes (company.com instead of company.ru). All these variations are detected by dnstwist in a single scan — this is not a theoretical threat, but a specific and inexpensive prevention.
Domain or trademark: what to register first
The question sounds like a dilemma, but in practice it is not 'either/or', but 'in what order'. Registering a trademark at Rospatent takes 8–12 months and costs 30–80 thousand rubles including patent search and legal support. An important nuance that few people take into account: the priority of the application is set by the date of submission, not the registration date. This means that even if the trademark has not yet been officially received, the date of submission already works as a legal starting point in a domain dispute.
| Criterion | Domain | Trademark |
|---|---|---|
| Speed of receipt | minutes | 8–12 months |
| Cost | from several hundred rubles per year | 30 000–80 000 ₽ |
| Legal basis for UDRP/court | by itself is insufficient | required to prove rights |
| Territory of application | bound to the zone (.ru, .com) | bound to the Nice Classes and country |
Practical conclusion: the domain must be registered immediately, on the day the brand name is approved — competitors and cybersquatters do not wait. But simultaneously, a trademark application must also be filed, because it is this that provides the legal basis for UDRP and court proceedings. A domain without a trademark in a dispute is de facto use without proven rights; a trademark without a domain is rights without digital presence. They only work together.
Why is a domain needed for a digital strategy, and not just a website
A domain is not a technical setting for hosting, but rather a part of a brand's digital identity at multiple levels simultaneously. First of all, it is a trust channel: corporate email on a custom domain looks more convincing than an address on a free service and reduces the probability that a company's email will be treated as spam or a forgery. Secondly, it is accumulated SEO capital — the history of links, domain age, reputation in search engines, which cannot be transferred to a new address without losing traffic. Thirdly, a domain is an asset during mergers, acquisitions, and business sales: lawyers directly check during due diligence who the company's domain is registered to and whether there is a risk of a legal dispute.
And finally, a domain is the first line of defense against phishing. When a malicious actor registers company-secure.ru and sends emails on its behalf to customers, the reputational damage falls on the real brand, not the fraudster. A company that has pre-purchased obvious variations of its domain and set up monitoring loses zero rubles from this. A company that learns about a phishing domain from customer complaints loses the trust of its audience — which is much harder and more expensive to restore than any domain.
Why portfolio protection pays for itself faster than court
Let's compare two paths. Preventive protection involves registering key variations of the domain, auto-renewal, 2FA, monthly dnstwist launches, and quarterly portfolio audits. The total cost of such a system for mid-sized business rarely exceeds several tens of thousands of rubles per year, and the most powerful monitoring tool in this set is completely free.
The alternative is a court process after the domain has been seized: 500–800 thousand rubles and waiting from half a year to a year and a half, plus reputational costs for the entire time while customers see a foreign site instead of yours. Even with a 68–80% chance of winning and the possibility of recovering up to 5 million rubles in compensation, this does not negate the simple fact: while the court case is ongoing, the brand loses traffic, sales, and part of audience trust every day. The investment in domain protection pays for itself not when the court ruling goes in your favor, but the moment when the case never reaches the court at all.
Domain already seized: what to do and how much will it cost
The first step is not panic, but diagnosis. You need to check the WHOIS and EPP status of the domain: if it is still in the grace period (30 days after expiration of registration), recovery costs as much as a regular renewal. If the period has passed and the domain has gone to auction — the price can increase 5-10 times, and negotiations with the new owner become a commercial deal, not a technical issue.
There are three scenarios ahead, and you need to choose between them consciously, not out of inertia like 'they took it — let's go to court.'
- Direct purchase from a cyber squatter. Fast, but the price is not regulated — from several thousand to hundreds of thousands of rubles, and many companies consider paying a 'blackmailer' an absolutely unacceptable principle.
- Pre-litigation demand for blocking. For .ru and .рф domains, a trademark owner can set a domain block for 14 days without a court decision through the registry — this time is often enough to start a full procedure.
- UDRP or court — depending on the zone and the presence of a trademark.
| Parameter | UDRP | Russian Court |
|---|---|---|
| Duration | 45–60 days | 6–18 months |
| Cost | $1500–4000 (depends on the number of arbitrators) | 500 000–800 000 ₽ |
| Compensation | not provided, only domain transfer | up to 5 million ₽ |
| Applicability | international zones (.com, .net, etc.) | .ru, .рф and disputes within Russia |
The statistics are encouraging: in domain disputes in Russia, rights holders win 68–80% of cases. This means that if a registered trademark exists, the chances of recovering a domain are high — the only question is whether a company is ready to wait one and a half years and spend half a million rubles instead of immediately buying the domain for a fifth of that amount.
Portfolio of 200 domains: how not to lose control
VK's portfolio includes over 2000 domains; information about Sberbank's portfolio has not been confirmed in available sources. This is not the whim of lawyers, but a defensive strategy: the company registers all reasonable brand variations to prevent competitors and scammers from doing so first. The problem is that a portfolio of this scale operates by its own rules, and without centralized management it becomes a source of risk rather than protection.
The key figure rarely mentioned: the overwhelming majority of domains in .ru are registered to individuals (around 72–83% according to different sources 2026 year), with significantly fewer registered to legal entities. In practice, this means that a substantial portion of corporate domain assets is actually owned by specific employees — a marketer, IT specialist, contractor, who once registered a domain 'on the fly' to their personal account. Terminating such a person's employment may result in losing control over a corporate domain or even direct blackmail.
- All domains must be registered to the legal entity of the company, not to employees or subcontracting agencies.
- A single administrator with access to the registrar account is needed — not 'whoever registered first,' but a designated role within the company.
- Autorenewal must be enabled for all domains in the portfolio without exception — this is cheaper than any recovery.
- Quarterly portfolio audit: who the owner is, when registration expires, which domains are unused and why they are still needed.
A real scenario that is repeated at dozens of companies: an employee responsible for IT infrastructure is fired, and the domain registered on their personal e-mail remains out of the company's sight until the renewal period expires. The result is either blackmail by the former employee or loss of the domain in public access.
Technical measures that actually work
Here is the statistics is disheartening: among companies from the top-5000 by revenue 2FA on the registrar's account, according to researches, two-factor authentication is used inconsistently even by large companies, and access restriction by IP remains rare. It is precisely these two gaps — the main reason for account compromise, through which domains are taken over entirely, not just individual subdomains.
- Two-factor authentication on the registrar's account — is the minimum barrier that blocks most attempts to seize through phishing or password leak.
- EPP statuses clientTransferProhibited, clientDeleteProhibited and clientUpdateProhibited — three flags that physically block transfer, deletion and modification of domain data without manual removal of protection. Configured via the registrar panel, but many companies simply do not know about them.
- Access restriction by IP to the domain control panel — narrows the attack window to a specific corporate network or VPN.
- DNS monitoring — notifications upon any change of A-record, MX-record or NS-servers, to detect interception within hours, not weeks.
- dnstwist — a free tool that generates all possible variations of the domain (typos, homoglyphs, added words) and checks which of them are already taken. Should be run monthly, not just once upon brand registration.
According to Positive Technologies, phishing attacks increased by 33% in 2024 compared to 2023, and most of them use predictable techniques: typos (compnay.ru instead of company.ru), added words (company-secure.ru), or zone changes (company.com instead of company.ru). All these variations are detected by dnstwist in a single scan — this is not a theoretical threat, but a specific and inexpensive prevention.
Domain or trademark: what to register first
The question sounds like a dilemma, but in practice it is not 'either/or', but 'in what order'. Registering a trademark at Rospatent takes 8–12 months and costs 30–80 thousand rubles including patent search and legal support. An important nuance that few people take into account: the priority of the application is set by the date of submission, not the registration date. This means that even if the trademark has not yet been officially received, the date of submission already works as a legal starting point in a domain dispute.
| Criterion | Domain | Trademark |
|---|---|---|
| Speed of receipt | minutes | 8–12 months |
| Cost | from several hundred rubles per year | 30 000–80 000 ₽ |
| Legal basis for UDRP/court | by itself is insufficient | required to prove rights |
| Territory of application | bound to the zone (.ru, .com) | bound to the Nice Classes and country |
Practical conclusion: the domain must be registered immediately, on the day the brand name is approved — competitors and cybersquatters do not wait. But simultaneously, a trademark application must also be filed, because it is this that provides the legal basis for UDRP and court proceedings. A domain without a trademark in a dispute is de facto use without proven rights; a trademark without a domain is rights without digital presence. They only work together.
Why is a domain needed for a digital strategy, and not just a website
A domain is not a technical setting for hosting, but rather a part of a brand's digital identity at multiple levels simultaneously. First of all, it is a trust channel: corporate email on a custom domain looks more convincing than an address on a free service and reduces the probability that a company's email will be treated as spam or a forgery. Secondly, it is accumulated SEO capital — the history of links, domain age, reputation in search engines, which cannot be transferred to a new address without losing traffic. Thirdly, a domain is an asset during mergers, acquisitions, and business sales: lawyers directly check during due diligence who the company's domain is registered to and whether there is a risk of a legal dispute.
And finally, a domain is the first line of defense against phishing. When a malicious actor registers company-secure.ru and sends emails on its behalf to customers, the reputational damage falls on the real brand, not the fraudster. A company that has pre-purchased obvious variations of its domain and set up monitoring loses zero rubles from this. A company that learns about a phishing domain from customer complaints loses the trust of its audience — which is much harder and more expensive to restore than any domain.
Why portfolio protection pays for itself faster than court
Let's compare two paths. Preventive protection involves registering key variations of the domain, auto-renewal, 2FA, monthly dnstwist launches, and quarterly portfolio audits. The total cost of such a system for mid-sized business rarely exceeds several tens of thousands of rubles per year, and the most powerful monitoring tool in this set is completely free.
The alternative is a court process after the domain has been seized: 500–800 thousand rubles and waiting from half a year to a year and a half, plus reputational costs for the entire time while customers see a foreign site instead of yours. Even with a 68–80% chance of winning and the possibility of recovering up to 5 million rubles in compensation, this does not negate the simple fact: while the court case is ongoing, the brand loses traffic, sales, and part of audience trust every day. The investment in domain protection pays for itself not when the court ruling goes in your favor, but the moment when the case never reaches the court at all.
Recent articles
MegaFon, BMW, VTB and more 240+ companies. See how it looks in the showcase reel:
Our branding agency is approached to order:
Branding agency services
