Cybersquatting
Registering a domain that matches somebody else's trademark in bad faith, usually to sell it back or profit from the brand's traffic, is cybersquatting, and the main remedy is a UDRP complaint, which transfers the domain in about two months without going to court.
The patterns
Straight brand registration. Someone registers yourbrand.com on an extension you do
not hold. The most clear-cut case, particularly where they then offer to sell it.
Typosquatting. A deliberate misspelling that catches mistyped traffic:
yourbarnd.com, yuorbrand.com, a missing letter, a doubled letter. Panels treat
deliberate misspellings of a distinctive mark as strong evidence of targeting. In
LinkedInD2015-1679 WIPO decision, 2015, swapping the second "i" in LinkedIn for an "l" was enough, and
linkedlnjobs.com was transferred.
Extension squatting. Your .com is safe but someone takes .net, .shop, .online
or a country-code version and runs a copy of your site. Virgin MediaD2016-2140 WIPO decision, 2016 transferred
virginmedia.shop in 2016, and the panel held it made no difference that Virgin had not
registered during the .shop sunrise period.
Parked pages. The domain shows an automatically generated page of pay-per-click ads, often for your competitors. It counts even where a parking service generated the ads without the registrant choosing them. It fails where the domain has another genuine meaning: in MarlboroD2015-1128 WIPO decision, 2015, marlboro.party stayed with a registrant that held hundreds of town names, because several places are called Marlboro.
Resale demands. The registrant contacts you, or lists the domain at a price far above registration cost. Keep the correspondence. It is often the best evidence in the case.
Phishing and impersonation. The domain sends mail that appears to come from you, or hosts a copy of your login page. This is the most damaging pattern and the most urgent. A website is not needed: AccentureD2016-0367 WIPO decision, 2016 transferred accenturejobs.com, which had no site at all, because it was used for a fake recruiting email address.
What to do first
Do not contact the registrant. It raises the price and their reply can be used against you.
Capture evidence instead: dated screenshots, Archive.org history, WHOIS records including the creation date, and any emails sent from the domain.
If the domain is being used for phishing or malware, report it to the registrar's abuse address and to the hosting provider in parallel. That route is measured in days rather than the two months a UDRP case takes.
When a UDRP complaint will work
You need a trademark, a registrant with no legitimate claim to the name, and bad faith at both registration and use. Classic squatting fits all three comfortably.
The case fails where the registrant has a genuine business under the name, or where the domain was registered before your trademark rights existed. Check the WHOIS creation date before you spend anything.
Preventing the next one
A trademark watch service tells you when someone files a mark similar to yours. For domains specifically, registering the obvious variants and extensions yourself costs a few hundred euros a year and removes most of the target.
Registering your trademark is what makes any of this enforceable. Without it you have no first element and no complaint.