Run due diligence before buying a .com domain: what panels actually d…

Run due diligence before buying a .com domain: what panels actually d. UDRP and ccTLD domain recovery and defense across .com. Email the firm to assess your ca…

A brand team finds the perfect .com — short, memorable, exactly matching a product name in development. The seller is asking a mid-five-figure sum. The deal looks clean. Then, six months after closing, a UDRP complaint lands at WIPO and the panel orders the domain transferred to a third-party trademark holder. The purchase price is gone. The domain is gone. The product launch is in jeopardy.

When you run due diligence before buying a .com domain, you are not just checking that the seller owns what they claim to sell. You are assessing whether the domain carries a latent dispute risk that survives the sale — because under the UDRP, a change of registrant does not reset the clock on bad-faith registration. A panel evaluating a post-sale complaint will look at the entire registration history, including conduct predating your purchase, and may order transfer regardless of what you paid.

This analysis examines what panels actually scrutinize, how chain-of-title checks and prior-dispute searches bear on that inquiry, and how to structure the transaction to minimize exposure across every dimension of a .com acquisition.

Why .com acquisition risk is a legal question, not just a commercial one

A .com domain acquired in a private sale does not arrive with a clean title guarantee. The ICANN-accredited registrar transfers the registration; it does not warrant the domain's dispute history or trademark exposure. That distinction matters enormously when the asset carries a brand-identical or brand-adjacent string.

Under the UDRP — the mandatory dispute procedure governing all accredited .com registrars — all three elements of Paragraph 4(a) must be established for a complainant to obtain a transfer order: confusing similarity to a trademark, the registrant's lack of legitimate interest, and registration and use in bad faith. The critical phrase is "registered and used in bad faith." Panels assess bad faith at the time of registration. If the original registrant acquired the domain with the trademark in mind, that intent does not evaporate when the domain is sold on.

Panels have consistently held that a transfer to a new registrant who had notice of the trademark dispute risk — or who should have had notice — does not cleanse the bad-faith registration. In other words, a buyer who fails to investigate is exposed to the same order as a seller who originally cybersquatted the name. The question is not whether you acted in bad faith. The question is whether bad faith attaches to the registration history you are absorbing.

Does that mean every secondary-market .com purchase is hazardous? Not at all. Most are straightforward. But the acquisitions that generate post-sale UDRP complaints share a recognizable profile: the string is identical or very close to a known mark, the prior registration history shows a pattern of monetization or a prior dispute, and the buyer skipped the diligence that would have surfaced those signals.

What does a panel actually examine when the domain has changed hands?

Panels examine the full WHOIS and registration history available through RDDS lookups and historic WHOIS archives, prior UDRP decisions involving the same domain or registrant, trademark watch data showing who holds rights in the string, and the publicly visible use of the domain at each point in its history.

The first question a panel asks is whether the domain, as currently registered, is identical or confusingly similar to a mark in which the complainant has rights. A change of registrant after the complainant's mark achieved distinctiveness does not break that similarity. A buyer who re-registers an expired domain containing a famous mark is in the same position as the original cybersquatter — the similarity analysis runs against the string, not the person holding it.

The second question — legitimate interest — is where the buyer's own conduct becomes directly relevant. A purchaser who resells domains in bulk and parked the acquired .com on a pay-per-click page pointing at the trademark owner's competitors is unlikely to demonstrate a bona fide offering under Paragraph 4(c). A purchaser who acquired the domain as part of a genuine brand-building project, can document that project predating notice of any dispute, and is using the domain accordingly, is in a substantially stronger position. The distinction is between a domain investor who can show a legitimate business model and one whose use pattern maps directly onto Paragraph 4(b) bad-faith circumstances.

The third question — bad faith — is where registration history is dispositive. Panels regularly refer to the WIPO Overview of WIPO Panel Views on Selected UDRP Questions (the "WIPO Jurisprudential Overview") for the consensus position that a registrant who knew or should have known of a complainant's trademark rights at the time of registration has difficulty rebutting a bad-faith finding. A buyer who conducted no trademark search, no prior-dispute check, and no chain-of-title review is poorly placed to argue that registration (including re-registration or transfer) was innocent.

For a structured assessment of the dispute risk attached to a specific .com acquisition, contact info@cognomenlaw.com before signing the purchase agreement.

How does chain-of-title analysis reduce post-acquisition UDRP exposure?

Chain-of-title analysis for a .com acquisition means tracing every registrant of record from the original registration date to the present, cross-referencing each holding period against trademark registration data and prior UDRP filings involving the domain or its registrant.

The primary data sources are RDDS (the successor to WHOIS) for current registrant data, historic WHOIS archives maintained by third-party data providers, the WIPO UDRP case search database, and the Forum's case index. Together these reveal whether the domain has ever been the subject of a prior complaint (and if so, on what grounds and with what outcome), whether any prior registrant was identified as a pattern cybersquatter under Paragraph 4(b)(ii), and whether the string itself appeared in a panel decision in another UDRP proceeding involving a different domain by the same registrant.

A prior UDRP transfer order on the same domain is a significant red flag but not automatically disqualifying. Panels have decided cases in which a domain was recovered by a trademark holder in UDRP, then legitimately sold to a third party who had no connection to the prior registrant and developed the domain in a way that was genuinely unrelated to the original trademark dispute. Those outcomes are fact-specific. The key is documentation: the buyer must be able to show, contemporaneously, that the purchase was for a legitimate purpose and that the trademark holder's rights were considered and reasonably distinguished from the intended use.

A prior UDRP complaint that was filed and withdrawn before a decision, or that resulted in a denial on the merits, tells a different story — and that story needs to be read carefully. A denied complaint may mean the prior registrant had a legitimate interest; it may also mean the complainant had weak trademark rights or chose the wrong forum. Panels in later proceedings involving the same domain are not bound by the earlier decision, but they will read it, and a buyer's counsel should read it first.

What prior-dispute signals should stop a .com acquisition?

Certain signals, when surfaced during due diligence, justify either abandoning the acquisition or restructuring it substantially. Not every signal is fatal, but each requires a deliberate legal judgment rather than a commercial workaround.

The clearest stop signal is an open UDRP or court proceeding involving the domain. A domain that is the subject of a pending complaint is registrar-locked under ICANN's transfer rules during the proceeding. Any purported sale during that period is unenforceable against the complainant if the panel orders transfer. We have seen situations — including a mid-five-figure .com deal that closed in spring 2025 — where a seller failed to disclose a pending complaint and the buyer's post-closing transfer request was blocked by the registrar implementing the panel's order. The purchase funds had cleared escrow. The domain had not.

A second serious signal is a pattern of UDRP losses by the current registrant across other domains. Paragraph 4(b)(ii) identifies a pattern of abusive registrations as a per se bad-faith indicator. A seller who has lost three or four UDRP complaints in prior proceedings is a registrant whose current holdings — including the domain being sold — carry elevated scrutiny. Panels have found bad faith by reference to a registrant's pattern of conduct across their portfolio even where the specific domain had not previously been challenged.

A third signal, less obvious but equally important, is a domain string that is phonetically or visually identical to a trademark currently in active commercial use in the same industry as the buyer's intended use. Even where no prior UDRP proceeding exists, the absence of a complaint means only that the trademark holder has not yet acted. Acquiring the domain and then using it in commerce is precisely the conduct that triggers a complaint. Due diligence here means a trademark clearance search — checking live registrations in the relevant jurisdictions, not just the .com zone — before any binding obligation is made.

How does escrow structure protect a .com buyer in a dispute-adjacent acquisition?

A well-structured escrow arrangement does two things: it protects the buyer's funds while verifying that a clean transfer is possible, and it creates a contractual mechanism for refund or price adjustment if a latent dispute materializes within a defined period after closing.

The mechanics of a .com domain escrow are straightforward. The buyer deposits funds with a licensed escrow agent. The seller initiates the domain transfer through the registrar, which generates an authorization code (also called an EPP code or transfer secret). The escrow agent releases funds only upon confirmed receipt of the domain by the buyer's registrar of choice. The transfer itself typically takes five to seven days under ICANN's inter-registrar transfer rules.

Where the acquisition involves a domain with any dispute-adjacent history, we recommend extending the escrow verification window to cover at least the registrar's standard 60-day post-transfer lock period, during which the domain cannot be transferred to a third party but during which a UDRP complaint can still be filed. That window does not suspend a panel's ability to order transfer — a UDRP complaint may be filed and decided regardless of registrar lock — but it keeps the buyer's position in view.

A more protective structure in higher-risk acquisitions is a representation and warranty from the seller that no UDRP complaint has been filed or threatened, that no prior registration of the domain resulted in a UDRP decision adverse to the seller's predecessor in title, and that the seller is not aware of any pending trademark dispute involving the string. Those representations are enforceable as a matter of contract law. They do not stop a panel from ordering transfer — the panel's jurisdiction is over the domain, not the parties' private agreement — but they give the buyer a contractual remedy against the seller for breach.

In a recent matter (a .com acquisition in a technology sector, autumn 2024), we structured a split-escrow arrangement in which a portion of the purchase price was held in reserve for twelve months against any UDRP filing. The seller objected initially. When we walked through the chain-of-title analysis showing two prior registrants with UDRP histories, the seller accepted the structure. No complaint materialized. The reserve was released. But the buyer had twelve months of certainty that they would not be left holding an empty registration.

What evidence decides whether a post-acquisition UDRP complaint succeeds?

If a UDRP complaint is filed after a .com changes hands, the evidence that determines the outcome divides into two categories: evidence of the registration history (which the complainant assembles) and evidence of the current registrant's legitimate interest and good-faith acquisition (which the buyer-respondent assembles).

On the complainant's side, the most powerful evidence is a combination of a trademark predating the domain's original registration, RDDS history showing the domain was registered and used in ways targeting the mark, and prior UDRP decisions identifying the domain or its registrant as abusive. If the complainant can demonstrate that the current registrant acquired the domain with knowledge of those rights — through a trademark search that would have surfaced the mark, through industry proximity, or through explicit prior communications — the bad-faith element is substantially advanced.

On the respondent's side, what actually works? Contemporaneous documentation of the acquisition rationale is the single most important asset. A written legal opinion obtained before purchase, a trademark clearance report, a business plan predating the acquisition that uses the domain string in a context genuinely distinct from the complainant's mark, correspondence showing the buyer investigated and found no conflict — these are the materials that distinguish a good-faith purchaser from a knowing acquirer of a tainted name.

What does not work is a post-complaint narrative without contemporaneous support. Panels evaluate legitimacy at the time of the respondent's actions, not at the time the complaint is filed. A detailed explanation prepared by counsel after receiving the complaint carries substantially less weight than a due-diligence file assembled before the deal closed. The evidentiary asymmetry is stark.

The consensus view in UDRP panels is that a purchaser in the secondary market who conducts meaningful pre-acquisition diligence — trademark search, prior-dispute check, legal opinion on conflict risk — and then uses the domain in a manner consistent with that opinion, is in a defensible position even if the domain has a contested history. The minority position — and it appears in decisions where the panel was skeptical of the good-faith narrative — is that acquiring a domain that is a clear trademark match for a well-known brand is inherently suspicious regardless of what diligence was done, because no plausible non-trademark use exists. Both views are live in the current panel consensus, and the outcome depends heavily on how recognizable the mark is and how genuinely distinct the buyer's intended use is.

How does the .com analysis compare to ccTLD and cross-border acquisitions?

The UDRP applies globally to .com regardless of where the buyer or seller is located. That is its principal advantage as a dispute mechanism: a trademark holder in Europe can file at WIPO against a .com registrant in Asia, and the registrar — wherever accredited — must implement the panel's order. That global reach cuts both ways for a buyer: you are exposed to complainants from any jurisdiction whose trademark predates your registration.

The right route depends on the zone and the goal. If you are buying a .com and want to know your dispute exposure, the UDRP at WIPO or the Forum is the governing procedure, and your due diligence must encompass trademark rights worldwide, not just in your home market. A trademark registration in the European Union that predates the domain's creation, held by a company you have never heard of, is sufficient to ground a UDRP complaint against a .com you just acquired.

If the acquisition involves a national ccTLD alongside the .com — say, a brand acquiring both a .com and a .uk simultaneously — the risk profile diverges. The .uk is governed by Nominet's DRS, which applies the "abusive registration" test rather than the cumulative UDRP bad-faith standard. The DRS reads "registered or used" abusively, a lower bar than the UDRP's "registered and used" requirement. A domain that might survive a UDRP challenge could still be ordered transferred under the Nominet DRS if the current use — even by a good-faith purchaser — is found to take unfair advantage of a mark. Nominet's published expert fee for a full decision is GBP 750 plus VAT; a three-expert appeal costs GBP 3,000 plus VAT.

For a .de, neither the UDRP nor the Nominet DRS applies. Disputes proceed through the German courts. DENIC offers a DISPUTE entry — a registration block preventing transfer while the claim is pursued — but it does not itself adjudicate ownership. A buyer acquiring a .de alongside a .com must factor potential German court proceedings into the risk calculus, typically through local litigation counsel in the relevant jurisdiction.

The practical lesson is that a multi-zone acquisition — .com plus one or more ccTLDs — requires due diligence tailored to each zone's governing procedure, not a single-track UDRP analysis applied across the board.

If a prior filing or a complex chain of title is making a .com acquisition difficult to read, email info@cognomenlaw.com for a focused second read before you close.

What does a realistic due-diligence workflow look like before closing?

A due-diligence workflow for a material .com acquisition has five stages, each producing a deliverable that feeds the next and — critically — forms the contemporaneous record that protects the buyer if a complaint is later filed.

First: RDDS and historic WHOIS review. This establishes who has held the domain, in what sequence, and for how long. Privacy or proxy registrations at any point in the chain are a flag; they do not necessarily indicate bad faith, but they mean the chain of beneficial ownership cannot be reconstructed from public data alone and the seller should be asked to provide transfer history from registrar records.

Second: prior UDRP and ccTLD dispute search. This covers the WIPO case database, the Forum's case index, and — where relevant — Nominet's DRS decisions. The search should run against both the domain string and, separately, against each registrant of record in the chain. A registrant who has been a respondent in multiple UDRP proceedings, even for different domains, is a pattern actor whose current holdings carry elevated scrutiny.

Third: trademark clearance. This is not a domain search; it is a trademark search. A qualified trademark attorney reviews live registrations in the jurisdictions relevant to the buyer's intended use, the seller's history of use, and the domain string itself. Where the string is a dictionary word or a common abbreviation, the clearance scope should extend to the industry vertical the buyer intends to operate in. A word that is generic in one industry may be a registered mark in another.

Fourth: legal risk opinion. Based on the first three deliverables, counsel assesses the realistic probability of a post-closing UDRP challenge: whether the elements of Paragraph 4(a) could plausibly be made out against the current registration history, which trademark holders have the strongest potential claim, and what the buyer's legitimate-interest defense would look like if a complaint were filed tomorrow.

Fifth: transaction structuring. Based on the risk opinion, the parties agree on escrow terms, representations and warranties, any price adjustment mechanism, and — where risk is material — whether a pre-closing consent or co-existence agreement with the most likely complainant is feasible. In a small number of acquisitions, the right outcome at this stage is not to close.

Is this process lengthy? Stages one through three are typically completable within one to two weeks for a single .com acquisition. Stage four adds a few days. Stage five is a negotiation whose duration depends on the parties. For acquisitions in the five- or six-figure range, the cost of the diligence process is modest relative to the exposure it mitigates.

What is the RDNH dimension for buyers who become respondents?

Reverse Domain Name Hijacking (RDNH) — a finding that a UDRP complaint was brought in bad faith to deprive a legitimate registrant — is directly relevant to buyers who have conducted genuine due diligence and then face an abusive complaint by a mark holder attempting to extract a high-value .com without paying for it.

Panels have found RDNH in cases where the complainant knew or should have known that the respondent had a legitimate interest in the domain — a generic term, a domain registered years before the complainant's mark, or a domain used for a genuinely distinct purpose — and filed anyway, hoping the respondent would default or settle cheaply. A well-documented due-diligence file is the single most effective defense against this type of complaint, because it gives the panel contemporaneous evidence that the respondent's acquisition was considered, researched, and made in good faith.

RDNH carries no monetary penalty under the UDRP — the only consequence is a published finding that the complaint was abusive. But that finding appears in the panel's public decision, it is indexed in the WIPO database, and it has a material reputational effect on the complainant. For respondents who are domain investors or brand owners building a portfolio, an RDNH finding also signals to future panels that this complainant has a history of overreaching.

We regularly advise registrants who have acquired .com domains through documented, good-faith processes and subsequently faced complaints that rely on trademark rights of questionable strength or scope. In those matters, the due-diligence record is not just a defense tool — it is the foundation for a counter-narrative that may produce an RDNH finding and permanently deter future claims on the same or related names.

Related at COGNOMEN

• Domain transactions, pre-acquisition due diligence, and escrow structuring for .com and ccTLD names
• How to verify chain of title for a domain acquisition: frequently asked questions
• Court action for cybersquatting: when UDRP is not enough and how litigation proceeds