Is buying domains to resell legal?

Yes. Registering or buying a domain and selling it for a profit is lawful, and WIPO's published overview of panel views says resale at a profit does not by itself show bad faith. The trouble starts when the name is chosen because it matches someone else's trademark. This is general information, not legal advice.

What is cybersquatting?

Cybersquatting is registering, buying or using a domain name in bad faith to profit from someone else's trademark, for example a typo of a famous brand or a brand name with a keyword attached. It can be challenged through the UDRP, which can transfer or cancel the name, and in the United States through the Anticybersquatting Consumer Protection Act, which allows a court to award statutory damages of $1,000 to $100,000 per domain name.

How do I avoid trouble when flipping domains?

Search the exact string in trademark databases before you bid, read the name's archive history, pass on brand-plus-keyword names and typos of known companies, and keep a dated note of why you bought each name. Plain dictionary words and ordinary combinations with many possible users are the safe core of the market.

Is Domain Flipping Legal? Yes, Here's the Line to Avoid

Buying and reselling domains is legal. The risk is cybersquatting: names aimed at someone's trademark. Here is the line, the two enforcement routes and a risk scorecard.

Yes, domain flipping is legal. Buying domain names and reselling them for more than you paid is ordinary commerce, and nothing in ICANN policy or U.S. trademark law forbids it. The line you cannot cross is buying or registering a name to profit from someone else’s trademark. That is cybersquatting, and it carries two kinds of exposure: a UDRP arbitration that can take the name away, and in the United States a federal lawsuit under the Anticybersquatting Consumer Protection Act. Dictionary words, common names and brandable inventions sit on the safe side. Misspellings of famous brands and brand-plus-keyword names do not. This is general information, not legal advice.

The interesting part of this question is the small slice where the answer flips. I have been around domain names for twenty years, and the investors who get into trouble almost never get there by accident. They buy a name because it points at a company, and the company notices. Everyone else, the people who hold .com words and plain two-word combinations, spends a career without a single dispute.

Is buying domains to resell them legal?

Yes. Registering an available name is allowed, buying one at auction is allowed, and selling it at whatever price a buyer agrees to is allowed. The domain market works like any other secondary market: scarce, well-placed assets trade above their cost.

You do not have to take my word for the resale part. WIPO’s published Overview of WIPO Panel Views on Selected UDRP Questions says panels have generally found that registering a domain for later resale, even at a profit, does not by itself support a finding of bad faith. Reselling is the business. What the panels examine is who the name was aimed at.

Where does it stop being legal?

It stops where a name is chosen because of someone else’s trademark. The ordinary shorthand is cybersquatting, and the framing in both of the main legal routes is the same: a trademark owner has to show you acted in bad faith, not merely that you own a name they would like to have. Owning a name a company wants is not an offense. Buying it because it is their name is.

In practice a handful of patterns account for nearly all of the trouble:

A famous brand with a word attached. Names built as brand plus “login”, “support” or “official” are written to catch that company’s customers.
A deliberate typo of a brand. The extra letter, the swapped pair, the missing vowel. The only reason to hold one is traffic meant for someone else.
A name that can only mean one company. Invented words that are somebody’s registered mark have no other buyer.
A name you plan to pitch to the mark owner. The intent to sell the name to the trademark holder at a premium is a textbook bad-faith circumstance.

What does “bad faith” mean in practice?

Bad faith is about your purpose at the moment you acquired the name and what you did with it afterward. The UDRP lists four example circumstances: registering primarily to sell to the mark owner or a competitor for more than your costs, blocking an owner from a matching domain as part of a pattern, disrupting a competitor, and using the name to attract visitors by creating confusion with the mark. The U.S. statute lists a longer set of factors, including whether the name contains your own legal name or reflects a legitimate prior use, and whether you have registered many names that match other people’s marks.

Two details matter to anyone who buys rather than registers new. First, WIPO’s overview says that if you acquire a name after the complainant’s trademark rights exist, the panel looks at the circumstances on the date you acquired it. An auction win is an acquisition, so the screening has to happen before the bid. Second, the policy requires bad faith in both registration and use, so what you put on the name matters. A plain for-sale page is a different posture from a page that imitates a company or runs ads on its brand terms.

What are the two ways a trademark owner can come after you?

	UDRP	ACPA (U.S. lawsuit)
What it is	An administrative arbitration every gTLD registrant agrees to when registering a name	A federal statute, 15 U.S.C. § 1125(d), enforced in court
What the owner must show	A similar mark, no legitimate interest, and bad faith registration and use	A protected mark, and your bad-faith intent to profit from it
What you can lose	The domain: transfer or cancellation. No money awards, per WIPO’s own guide	The domain, and a court can award statutory damages of $1,000 to $100,000 per domain name
Speed	A matter of weeks to a couple of months	The ordinary pace of a federal case

The damages range comes from 15 U.S.C. § 1117(d), which lets a plaintiff elect statutory damages for a violation of the cybersquatting provision, and the liability test is in 15 U.S.C. § 1125(d). The statute also contains a safe harbor for a registrant who believed and had reasonable grounds to believe the use was lawful, which is one more reason to keep a record of why you bought each name. If a UDRP does land, my UDRP guide for domain investors walks through the three elements and the ten-day window after a loss.

A bad-faith risk scorecard for any name

Here is the scorecard I would run on a name before bidding. Count the yeses. Zero or one is the normal territory of a working investor. Two or more means pause and look harder.

Signal	Risk it adds	What I do about it
The exact string is a registered mark in a live industry	High	Walk unless the word is plainly generic for that field
A famous brand appears inside the name	High	Pass. No bid is cheap enough
Looks like a typo of a known company	High	Pass
Archive history shows a real business under that name	Medium	Read the history and check whether the mark is still held
The only buyer I can imagine is the company itself	High	That is the bad-faith pattern. Pass
My planned page imitates or advertises against a brand	High	Change the plan or skip the name
Dictionary word or ordinary combination with many users	Low	Proceed, keep a note of why

What keeps you clear?

Everything on that scorecard happens before money moves, which is the cheap place to solve it. My routine:

Search the string. Run it through the USPTO trademark search, including plurals and typos. The full routine is in the domain trademark check guide.
Read the name’s past. The Wayback Machine shows whether the name used to be somebody’s business.
Hold names with many possible users. Plain words and generic combinations are what the legal tests protect.
Keep a dated note of why you bought each name. If a complaint arrives, your own contemporaneous reasoning is the best evidence you have.
Talk to an attorney the day a notice arrives. The deadlines are short and this page is not legal advice.

If you want the wider craft this sits inside, the plain-English definition of domain sniping covers the three moments a name can be caught, and how to make money flipping domains covers the economics.

Screening takes time when thousands of names end in the Namecheap Market’s daily batch. PounceDomains watches the aftermarket around the clock and surfaces the names that match your filters with the data attached, so the few that deserve a trademark look reach you first. The decision to buy or walk stays with you.

The bottom line

Flipping domains is legal. The risk lives in a narrow, predictable band: names that point at a specific brand. Screen for that before every bid, keep a record of your reasoning, and the odds of ever seeing a dispute drop close to zero. Start free with PounceDomains and let the discovery filters bring you names worth checking.