Harassers, Cybersquatters, and Your Name Online: What to Do Before the Next Escalation

Someone bought your name, built an attack site, or keeps finding new ways to contact you. The law has gaps. You still have ways to preserve the record, report the conduct, and ask the companies carrying it to act.

I get asked some version of this question more than you would think. Someone has bought a domain with my name on it. Someone keeps contacting me after I blocked them. Someone is using a website to send other people after me. What do I do?

The answer should not require another public argument, another inbox full of abuse, or a federal lawsuit before anyone will look at the record. Start with the conduct, the evidence, and the company providing the service. Then use the legal tool that fits.

Start Here: Preserve, Report, and Reduce Contact

If someone is threatening immediate harm or you believe you are in immediate danger, call 911. A website complaint is not an emergency response.

1. Save the clearest examples. Record the full URL, username or account ID, date, time and time zone, and the exact language used. Capture enough surrounding context to show what happened. Keep original messages and full email headers where available.
2. Report the specific conduct. Use the post, message, or profile reporting tool and the provider’s abuse form when appropriate. Select the accurate category: threats, harassment, impersonation, disclosure of private information, or another actual violation. Attach a short chronology and the strongest examples.
3. Reduce access to you. After preserving what you safely can, block or restrict contact, review who can see your location and personal information, and secure your accounts with unique passwords and multifactor authentication. You do not owe the person a confrontation.
4. Keep the ticket. Save the confirmation, report number, and response. If the conduct continues, add new incidents to that record and use the provider’s review or escalation process. A documented pattern is easier to assess than disconnected reports.

This is a way to start promptly. No provider or police agency can promise a particular result or completion date. Content removal, account termination, domain transfer, and criminal investigation are different outcomes.

GoDaddy, Tucows, and Hostinger: What Their Rules Actually Allow

The companies selling domains and hosting websites are the relevant providers here. Report the use of their services to target someone, including a child. Ask for an abuse review of the registration, connected services, and account. Providers have different rules and different responses; a complaint does not automatically produce termination.

For GoDaddy and Hostinger, account or service termination is a possible consequence of violating the rules. Those powers do not establish that every complaint will result in a permanent ban. Tucows’ published approach is more restrictive for content disputes. Readers need that difference spelled out before spending hours submitting the wrong complaint.

When a child is targeted, state that clearly and explain the conduct: threats, exposure of identifying information, impersonation, sexual exploitation, or use of a domain to direct harassment. Include evidence linking the registration to the conduct, such as messages claiming responsibility or sale demands. The child’s name in a domain is relevant context; it does not alone prove a policy violation.

A Focused Complaint You Can Adapt

Keep the initial complaint focused. Supply sensitive details through a suitable private channel when needed, and preserve the complete originals. You do not need to contact the person harassing your family to make a provider complaint. Tucows warns that some complaint information may be shared, so consider that before sending personal details.

For an Attack Website, Find the Company That Can Act

A registrar handles the domain registration. A host supplies the website’s server space. A social platform carries the posts. They may be three different companies, and a complaint to one does not automatically reach the others.

Use ICANN’s registration lookup to identify the registrar, then use its published abuse contact. Report the offending pages to the hosting provider too, if you can identify it. Explain any threats, impersonation, exposure of private information, or other policy violations with precise URLs. GoDaddy, for example, provides an abuse reporting portal and guidance on the evidence its review needs.

Owning a domain with your name does not by itself establish harassment. A registrar may treat a dispute over ownership differently from a host’s review of abusive content. Taking a site down also does not transfer the domain to you. Preserve sale offers separately if you want to pursue a personal-name cybersquatting claim.

A Comprehensive Evidence Package Takes Time. Your First Report Can Start Now.

It takes time to reconstruct months of messages, connect changing usernames, collect domain records, and show how individual incidents fit a pattern. Do not let that work become a reason to postpone reporting an active threat or suspected exploitation.

Start with a one-page summary: who is being targeted, what happened, when it started, where the evidence is, and what makes it urgent. Attach an incident log and numbered exhibits. Separate what you directly observed from what you suspect. If you do not know who controls an account, say so.

For each incident, log the date, URL or account, conduct, supporting file, and report number. Preserve originals; make separate working copies for highlighting or redaction. Include blocked-account workarounds, threats, unwanted contact, and evidence that a site is directing others toward you. Ask the investigating agency about preservation requests for provider records you cannot access yourself.

When NCMEC and Michigan’s ICAC Are the Right Route

If the conduct involves suspected child sexual exploitation—such as sexual grooming, enticement, sextortion involving a child, or child sexual abuse material—submit a report to the National Center for Missing & Exploited Children’s CyberTipline at report.cybertip.org. You can report a reasonable suspicion; you do not need to finish a comprehensive evidence package first.

NCMEC reviews tips, works to identify the incident’s location, and makes the information available to the appropriate law enforcement agency for possible investigation. Michigan-related child-exploitation tips can be routed to the Michigan Internet Crimes Against Children task force, which is led by Michigan State Police. Referral does not guarantee an investigation, arrest, or immediate takedown.

This is a child-exploitation reporting route. General adult cyberstalking, a hostile domain, or criticism of a candidate does not become an ICAC matter merely because it happens online. For those cases, report suspected crimes to local police and report policy violations to the provider. Do not download, copy, or circulate suspected child sexual abuse material to assemble exhibits; report its location and follow the reporting channel’s instructions.

A Reporting Channel Is Not the Same as Help

My assessment is blunt: neither Michigan State Police nor the Michigan Attorney General’s office operates well. Their response to online harassment and cyberstalking is part of that broader failure. Listing an agency’s reporting channel is not an endorsement of its effectiveness. A place to submit a complaint means little if the person receiving it cannot recognize the pattern or explain what happens next.

In my assessment, law enforcement is woefully behind in cybersecurity and in the practical work of investigating online abuse. Victims encounter conduct that moves across domains, accounts, hosting services, and private messages. A response that treats each incident as an isolated post can miss the pattern entirely.

Michigan needs a much stronger emphasis on cybersecurity and cybercrime training. That means understanding how domains and hosting work, recognizing stalking across multiple accounts, preserving electronic evidence before it disappears, using lawful registration-data disclosure procedures, and assessing threats in the context of repeated conduct. Victims should not have to teach those basics while asking for help.

That is why my practical advice centers on provider enforcement. Keep official report numbers when you make a report, but do not treat submission or referral as proof that the abuse is being addressed. A NCMEC referral is a route for suspected child sexual exploitation, not a promise of an effective response from Michigan authorities.

Keep the First Response Out of the Courtroom

My practical advice is to start with the companies providing the service. A court case can consume time, money, and energy while the conduct continues. A provider complaint gives you a direct way to request review of the account or content under rules the company already has.

Michigan’s stalking statute, MCL 750.411h, includes electronic communications among forms of unconsented contact. Its requirements go beyond an unpleasant post and exclude constitutionally protected activity and conduct serving a legitimate purpose. If the facts suggest stalking or threats, report them to police while pursuing provider enforcement. You do not have to make a civil lawsuit your first project.

In my assessment, many courts are technologically inept, and you cannot bank on them to recognize online abuse or act effectively on digital evidence. Explaining every technical step does not guarantee that a judge will understand the pattern or respond to the harm. That is another reason I do not recommend making a court case the first step.

If legal proceedings become necessary, meaningful review requires an independent, impartial court with jurisdiction and the ability to assess the technical record. Seeking a different forum is subject to jurisdiction, venue, and procedural rules; “an independent court” is not a separate reporting service or a forum you can freely choose. The practical route outlined here remains evidence preservation and provider enforcement.

Give the provider a focused account of the conduct, the rule it violates, and the supporting records. Ask for review of the connected accounts and repeated violations where the evidence supports it. You are asking the company to enforce its own rules, and that is a concrete place to start.

Where Personal-Name Cybersquatting Law Fits

15 U.S.C. § 8131 is one of the few federal provisions protecting a living person’s plain, untrademarked name online. It is narrower than almost anyone expects. Its limits matter for domain recovery, but they do not erase provider rules or other laws addressing stalking, threats, and impersonation-related misconduct.

What the Statute Says

Section 8131 has four working parts. Paragraph (1)(A) creates the claim. Paragraph (1)(B) carves out an exception. Paragraph (2) sets the remedies. Paragraph (4) sets the start date. Paraphrased closely, it reads like this.

Read it slowly and the limits announce themselves. The verb is “registers.” Not uses, not traffics in, not redirects. The plaintiff must be living. The intent must be specific, and it must be intent to profit by selling the domain. The remedy is the domain itself, and possibly your lawyer’s bill. That is the entire statute.

Where It Came From

The section was born as part of the Anticybersquatting Consumer Protection Act, a Senate bill introduced in June 1999 by Michigan’s own senator at the time, Spencer Abraham. The Clinton administration’s Office of Management and Budget opposed Senate passage that August, arguing courts were already handling cybersquatting and that Congress should wait on work underway at the World Intellectual Property Organization. Congress passed it anyway, folded into the November 29, 1999 omnibus appropriations law, Pub. L. 106-113.

Most of the ACPA protects trademarks. That part lives at 15 U.S.C. § 1125(d) and comes with real teeth. The personal-name provision was a smaller add-on, first codified at 15 U.S.C. § 1129 and later moved by the Law Revision Counsel to § 8131 without any change in wording. Its sponsors justified it on two grounds: confusion about who is behind a website bearing a person’s name, and people holding other people’s names hostage for large sums. Only the second ground made it into the text as a basis for liability.

Intent to Profit Does Not Require a Completed Sale

Section 8131 requires specific intent to profit by selling the domain for financial gain. It does not require a completed transaction. A sale offer, financial demand, or proposed exchange can be evidence of that intent. Hostility and a financial motive can coexist; calling a domain an attack site does not settle the statutory question.

When Domains Become Negotiating Leverage

In Devine v. Wilson, No. 4:24-cv-00089 (E.D. Ark. Dec. 18, 2024), the complaint alleged that competing businesses controlled domains incorporating Devine’s name, redirected them, and offered them for $10,000. The court allowed the § 8131 claim to proceed and explained that using domains as negotiating leverage could suffice. The registrants did not have to approach Devine first. The order cited Tollefson v. Pladson, No. 3:11-cv-62, 2012 WL 3402107 (D.N.D. May 9, 2012).

This was a ruling on motions to dismiss, not a final finding of liability. The allegations supported a plausible claim; the order did not eliminate the statutory sale-intent requirement.

Other Decisions Show Why Context Matters

In Randazza v. Cox, 920 F. Supp. 2d 1151 (D. Nev. 2013), the court granted preliminary injunctive relief involving personal-name domains and demands for money. The plaintiffs included a minor child. The court found the required likelihood of success under § 8131; this was preliminary relief, not a final merits judgment.

In Bogoni v. Gomez, 847 F. Supp. 2d 519 (S.D.N.Y. 2012), offers to sell personal-name domains at very high prices supported preliminary injunctive relief. These decisions show why financial demands, proposed transfers, timing, and communications matter alongside the domain name itself.

Carl v. BernardJCarl.com illustrates the limit: retaliation alone did not establish profit through the means specified in the statute. That does not mean a retaliatory registration is immune if the evidence also supports an intent to profit by selling. Criticism alone, sale-related leverage, and threats are different facts that require different analysis.

What the Statute Does Not Reach

Put the text next to how name domains are actually used and the uncovered ground is wide. The statute covers registration with intent to sell. It does not cover a domain registered and pointed at an opponent’s campaign. It does not cover a domain registered to impersonate someone, or to host criticism, or to sit dark so the named person cannot have it. A name held quietly for years is harder to reach, because the statute looks at intent when the domain was registered. A later sale offer can supply the evidence, as it did at the pleading stage in Devine, but an explicit price is not the only possible evidence of intent at registration. It does not cover the dead, so the name of a murder victim or a deceased public figure is unprotected under this section. It awards no damages, so a successful plaintiff can spend thousands of dollars in federal court to recover a $12 asset.

Section 8131 does not contain an in rem procedure comparable to the trademark provision’s action against the domain itself. That can complicate recovery when the registrant is difficult to identify. Privacy protection, however, does not necessarily prevent lawful disclosure.

The private dispute system does not fill the gap. Every generic top-level domain is subject to ICANN’s Uniform Domain-Name Dispute-Resolution Policy, a fast and comparatively cheap arbitration process. But WIPO’s own panel guidance limits it to names that function as trademarks in commerce. A famous name is not enough. In a 2019 WIPO decision, a politician’s claim to unregistered rights in his own name failed precisely because it rested on his fame in politics rather than on use of the name to sell goods or services.

The Election-Season Problem

Campaigns are where the gap is most visible, because candidates’ names are valuable for reasons that have nothing to do with resale. A study by the Coalition Against Domain Name Abuse, reported by Campaigns and Elections, found third parties held the first-name, last-name dot-com for 52 percent of sitting U.S. senators at the time.

Michigan has its own example. In December 2009, as then-Rep. Pete Hoekstra prepared his run for governor, opponents registered PeteHoekstra.com through a privacy service and used it to publish attacks on him, according to Talking Points Memo. Whatever one thinks of the tactic, there was no sale offer to point to. Under § 8131, that is the end of the federal analysis.

Elsewhere the pattern repeats. In San Francisco’s 2018 mayoral race, London Breed’s campaign said the holder of LondonBreed.com demanded $99,000, and that after the campaign refused, the domain began redirecting to her opponent’s site. The demand alone fits § 8131’s profile. The redirect, standing alone, would not. In 2024, a self-described cybersquatter told NPR he had sold a Clinton-Kaine domain to an anonymous buyer for $15,000, and that the buyer turned out to be the Trump campaign, which used it to publish anti-Clinton material. A sale to a third party is exactly what § 8131 prohibits on paper. In practice, a candidate rarely sues over it, because by the time the use becomes visible the election is over and the remedy is a domain nobody needs anymore.

Some states decided not to leave this to federal law. California’s Political Cyberfraud Abatement Act, Elections Code § 18320, makes it unlawful to divert a political website by a similar domain, to register a similar domain for a political site, or to register and hold a domain to prevent its use, when done with intent to mislead, deceive, or defraud. A court can order the domain transferred. Idaho’s Senate unanimously passed a similar bill in 2003 after a state party officer registered a sitting senator’s name; it then stalled in a House committee. I could not find a Michigan statute that does what California’s does.

If Someone Registered Your Name: A Field Guide

The order of operations matters, because the most useful evidence disappears fastest. Before you contact the registrant, capture the record. Take dated screenshots of the site and of any sale listing. Run a WHOIS or RDAP lookup and save it, including the registrar and the creation date. Check the domain’s history through the Internet Archive’s Wayback Machine. If the registrant has made an offer, keep the full message with headers. Save sale listings, financial demands, proposed exchanges, and negotiation messages. The circumstances can support an inference of intent without a completed sale or a formal marketplace listing.

Then sort your situation by intent, because intent decides which tool applies. If there is a sale offer, § 8131 is in play. If your name is also a brand you sell under, § 1125(d) and the UDRP may be stronger, faster, and in the trademark case, worth money. If the site impersonates you or makes false factual statements, defamation, false light, or state consumer protection law may be the real claim. If the registrant is a campaign opponent in California, § 18320 applies. In Michigan, there is no election-specific statute to reach for.

Do not make a counteroffer to buy the domain before you have talked with a lawyer. A negotiated purchase may be the cheapest solution, but the exchange itself becomes evidence, and a poorly worded message can muddy the intent question for both sides. Do not threaten anyone. And because § 8131 offers no damages, weigh the cost of federal litigation against what you would actually recover. For many people the honest answer is a defensive registration of the obvious variations of their own name, done now, before anyone else does it.

WHOIS Privacy Is Not Immunity

Privacy services and redacted registration records can hide identifying details from public searches. They do not erase the registrar’s underlying records or necessarily bar lawful disclosure. For generic top-level domains, start with ICANN’s RDAP-based Lookup.

The ICANN Registration Data Request Service lets people with a legitimate interest request nonpublic registration data from participating registrars. Disclosure is not guaranteed. For other registrars, ask about their disclosure process. Where litigation is involved, appropriate legal process may provide access to relevant registration or account records; that is an additional avenue, not this article’s recommended first step.

ICANN’s 24-Hour Timeline for Urgent Disclosure Requests

ICANN added a 24-hour response framework in May 2026 for qualifying Urgent Requests for Lawful Disclosure of nonpublic gTLD registration data. These cover imminent threats to life, serious bodily injury, critical infrastructure, or child exploitation where disclosure is necessary to address the threat.

Under Section 10.7 of the Registration Data Policy, qualifying authenticated requests are to receive acknowledgement within two hours and a response without undue delay, within 24 hours absent exceptional circumstances. A justified extension can run no longer than 72 hours from receipt.

The implementation condition matters: ICANN says these obligations take effect when the required requestor-authentication policy is fully implemented. Marking an ordinary RDRS request “expedited” does not itself establish eligibility or trigger a universal 24-hour deadline. This is a registration-data response framework, not a promise to take a website offline or disclose the requested data.

Minor Children’s Names Are Easy Targets Too

My family found out how easy it is for someone to target a minor child’s name with a domain registration. The fact that a child is involved does not put a preventive barrier in front of the registration. Families are left responding after it happens.

A child’s name is not excluded from § 8131 merely because the child is under 18. But the statute still requires the specific intent to profit by selling the domain; it does not supply a special registration safeguard for children. That gap matters when the goal is intimidation rather than a sale.

A domain using a child’s name does not, by itself, make the matter a NCMEC or ICAC case. Report the actual conduct to the provider, and use the child-exploitation reporting route when there is suspected sexual exploitation. The complaint should explain what is happening to the child, rather than assume the domain alone establishes the violation.

What Fixing It Would Actually Require

None of this calls for inventing a new body of law. The fixes already exist elsewhere in the same statute and in other states’ codes.

First, Congress should conform § 8131’s conduct element to the trademark provision, covering anyone who registers, traffics in, or uses a living person’s name as a domain, so that intent formed after registration counts. Second, the intent element should expand beyond sale to include intent to impersonate, to divert visitors by confusion, and to prevent the named person from using the domain, with an express safe harbor for genuine commentary and criticism so that a homeowner like the one in Lucas Nursery stays protected. Third, the remedy should include modest statutory damages, enough that recovering your own name is not a net loss. Fourth, § 8131 should borrow the in rem procedure of § 1125(d)(2), so that a named person can proceed against the domain when the registrant hides behind a proxy.

At the state level, Michigan should adopt a political cyberfraud statute modeled on California Elections Code § 18320, with a transfer remedy, an expedited hearing during the 60 days before an election, and a registrar exemption. That would give Michigan candidates for every office, including the judicial seats that appear on the nonpartisan section of the ballot, a forum that moves at the speed of a campaign. ICANN and WIPO, for their part, could revisit the 2001 decision to exclude non-trademark personal names from the UDRP, at least for registrations that impersonate the named person.

Why This Matters

A person using your name to intimidate you is counting on the process being exhausting. You should not have to spend every day watching their account, arguing with them, or explaining the entire history from scratch.

Preserve the strongest evidence. Send a focused complaint to the company carrying the abuse. Report suspected crimes through the correct channel. Keep building the record while those reports are reviewed. If children are being sexually exploited, use NCMEC. Taking abusive content offline and obtaining ownership of a domain are separate problems; a provider complaint can address the former without resolving the latter.

The goal is to reduce the person’s access to you and get an actionable record in front of someone who can respond. You do not owe a harasser an audience.