Protect a brand in a new .xyz gTLD launch: what panels actually decide

Protect a brand in a new .xyz gTLD launch: what panels actually decide. UDRP and ccTLD domain recovery and defense across .xyz. Email the firm to assess your c…

A brand owner watches the .xyz registry open its doors and discovers, within weeks, that a confusingly similar string has been registered by a stranger. The registrant points the domain at a parking page laden with pay-per-click links. Now what? The instinct is to file fast – but which procedure, before which forum, on which standard of proof?

To protect a brand in a new .xyz gTLD launch, a rights holder has two distinct procedural routes: the Uniform Rapid Suspension system (URS), which suspends a domain for the remainder of its registration term but does not transfer it, and the UDRP, which can order a full transfer on proof of all three elements under Paragraph 4(a) of the Policy. The URS applies a clear-and-convincing evidence standard – higher than the UDRP's preponderance-of-evidence norm – meaning an underprepared complaint will fail at the higher bar even if the same facts would win a UDRP. WIPO administers both procedures for .xyz, and the filing-fee entry point differs accordingly.

This analysis sets out the governing doctrine, the pattern of panel decisions for .xyz disputes, the key factual variables that move a case one way or the other, and the practical question of how to choose between URS and UDRP when you discover an abusive registration the day after a new gTLD launches.

What rules govern .xyz, and why does the choice of procedure matter?

The .xyz registry operates under the ICANN new-gTLD program and is bound by the ICANN Registry Agreement, which mandates both UDRP and URS as mandatory dispute-resolution procedures for every accredited registrar offering .xyz registrations. In practice this means a brand owner has access to WIPO's full range of new-gTLD procedures from day one of the open-registration period. The Policy itself – the UDRP – was adopted by ICANN in 1999 and applies equally to .com, .net, .xyz, and hundreds of other gTLDs; there is no special .xyz carve-out in the substantive test.

The URS, however, is a creature of the new-gTLD program specifically. It was introduced to give rights holders a lower-cost, faster path to stopping clear-cut abuse in the new namespace, with a filing fee substantially below the WIPO UDRP entry point of USD 1,500 for a single-member panel. That trade-off is the heart of the choice: speed and cost on the URS side, transfer and finality on the UDRP side. A brand owner who files URS today and wins gets the domain suspended for the rest of the registration term. The registrant can re-register after that term expires unless the brand owner takes further action. A brand owner who files UDRP and wins gets the domain transferred – permanently, subject only to court challenge.

Why does the distinction matter in a launch context? Because new-gTLD launches create a compressed window of risk. Sunrise periods, Trademark Clearinghouse (TMCH) claims notices, and the open-registration period each generate different waves of abusive filings. The brand owner who catches an infringer during the sunrise period may have registrar-level objections available. The one who wakes up to a post-launch parking page in month two is already in the dispute-resolution track.

In our practice, we regularly advise brand owners who have received a TMCH claims notice that the notice is not itself a dispute mechanism – it warns the registrant that a mark exists, but it does not stop the registration. If the registrant proceeds anyway, that act of proceeding after notice is significant evidence of bad faith in a subsequent UDRP proceeding under Paragraph 4(b) of the Policy.

How does the URS clear-and-convincing standard change what you must prove to protect a brand in a new .xyz gTLD launch?

The URS requires the complainant to establish the same three-element structure as the UDRP – identical or confusingly similar, no legitimate interest, bad faith registration and use – but the evidentiary bar is materially higher. The "clear and convincing evidence" standard is a US-derived concept that demands substantially more than a balance of probabilities. A complainant must eliminate meaningful doubt, not merely tip the scales. That distinction regularly defeats URS complaints where the identical complaint would have succeeded before a UDRP panel.

Panels in URS proceedings have consistently emphasized the procedure's purpose: rapid suspension of only the most obvious cases of abuse. Where the complainant's mark is famous and the domain is an identical string combined with a generic that points at a pay-per-click site in the complainant's own sector, the case sits squarely within URS territory. Where there is any genuine question – whether about the strength of the trademark rights, whether the registrant might have a plausible legitimate purpose, whether the domain predates the mark in a different market – the URS examiner typically declines to apply the suspension remedy and leaves the complainant to the UDRP.

The minority view among practitioners – and occasionally among panels – is that the URS standard is not meaningfully different from the UDRP in practice for straightforward cases, because a well-evidenced complaint on a clear-cut fact pattern should meet "clear and convincing" without difficulty. That view has some force where the domain is identical to a registered mark, points at a page monetizing the mark's own keywords, and the registrant has a history of abusive registrations. Even there, however, we have seen URS examiners decline where the mark's registration postdated the domain, or where the complainant failed to document the use-in-bad-faith limb rigorously.

The practical lesson: treat the URS as a specialist tool for the most obvious cases. If there is any ambiguity in the fact pattern, file UDRP. A failed URS does not preclude a subsequent UDRP on the same domain.

For a read on whether the three UDRP elements are met for your .xyz domain, reach us at info@cognomenlaw.com.

What does the UDRP three-element test look like in a .xyz dispute?

The UDRP three-element test applies identically across every gTLD, including .xyz: (1) the disputed domain is identical or confusingly similar to a trademark or service mark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain was registered and is being used in bad faith. All three must be met – a strong showing on two of the three is not enough.

Element one is where .xyz panels tend to follow established consensus. The ".xyz" suffix is treated as a generic string that does not differentiate the domain from the complainant's mark; panels strip it for comparison purposes, just as ".com" is stripped. A domain that pairs a brand name with a generic term – think [BRAND]sale.xyz or [BRAND]support.xyz – is typically held confusingly similar unless the added term meaningfully distinguishes the domain from the mark. The consensus view is that descriptive additions rarely save the respondent at element one but may become relevant under element two.

Element two is where many .xyz disputes are genuinely contested. The complainant must make out a prima facie case that the registrant lacks rights or legitimate interests, whereupon the burden shifts to the respondent to rebut. The Paragraph 4(c) safe harbors – bona fide offering of goods or services before any notice of the dispute, being commonly known by the domain name, or legitimate noncommercial or fair use – are the standard defenses. In our experience defending registrants, panels look hard at whether any commercial activity on the site preceded the complainant's notice, and whether the domain was acquired as an investment in a short string rather than as a brand reference. A registrant who purchased [BRAND].xyz as part of a portfolio of three-letter or short-string domains, without knowledge of the complainant's mark, faces a different panel than one who registered [BRAND]services.xyz the week after a product launch was announced.

Element three – the conjunctive "registered AND used in bad faith" – is the element that fails most UDRP complaints in the new-gTLD space. Registration alone, even of a domain identical to a famous mark, does not satisfy the element if the domain has been parked passively with no monetization or active harm. The consensus UDRP view on passive holding is that passive use can constitute bad faith where the mark is well-known, there is no plausible good-faith use the registrant could make, and the registrant provided no credible explanation. Panels have consistently held that passive holding of a domain identical to a famous mark, combined with a registrant who appears nowhere in the record as a legitimate business, satisfies the use-in-bad-faith limb.

The contrary – and less commonly successful – argument is that a genuinely descriptive or generic domain purchased in the .xyz extension for its ordinary meaning cannot be held in bad faith merely because a trademark owner exists. Panels have occasionally accepted this argument where the disputed string is a common word or phrase and the mark is relatively weak or geographically limited. In a recent matter (a .xyz string that paired a common English adjective with the complainant's sector descriptor, autumn 2025), we secured a denial of transfer for a registrant who demonstrated through contemporaneous business records that the domain had been acquired for a bona fide descriptive use, notwithstanding the complainant's registered mark. The panel credited the registrant's evidence precisely because it predated any notice of the dispute.

What evidence actually decides a .xyz panel proceeding?

Evidence is the operative variable in almost every contested .xyz dispute. The applicable rules and elements are settled; what distinguishes a winning complaint from a losing one – or a winning defense from a default outcome – is the quality of the documentary record submitted within the 20-day response window after commencement.

For complainants, the high-value evidence categories are: (a) proof of trademark registration predating the domain's registration date, with priority evidence where relevant; (b) screenshots of the domain as it appeared at or near registration, captured from archive services; (c) evidence connecting the registrant to a pattern of abusive registrations, if available through WHOIS/RDDS or prior panel decisions; (d) evidence that the registrant received or had constructive notice of the mark before registering – the TMCH claims notice is particularly powerful here; and (e) expert or market evidence of the mark's fame where passive-holding bad faith is alleged.

For respondents, the critical evidence is contemporaneous: records that show the domain was acquired for a purpose unrelated to the complainant's mark, created before any notice of the dispute. Business plans, prior use of the string as a trade name, domain acquisition invoices, and correspondence predating the complaint all carry significant weight. Panels rarely credit after-the-fact explanations offered only in the response.

The TMCH claims notice point deserves particular emphasis in the .xyz launch context. When a potential registrant receives a claims notice identifying an existing TMCH record and proceeds to register anyway, that act of informed registration is treated by panels as evidence supporting the bad-faith registration prong. The registrant cannot later claim ignorance of the mark. We have advised brand owners to treat every claims-notice registration as a near-automatic UDRP candidate, subject to a quick check of whether the registrant has a plausible legitimate purpose.

One pattern that panels in new-gTLD proceedings – including .xyz – have consistently flagged is the monetized parking page. Where the domain resolves to a page displaying pay-per-click links organized around the complainant's keywords or product categories, panels treat that as strong evidence of both the use-and-bad-faith elements. The registrant's revenue model depends on the complainant's brand recognition. That is the economic argument for bad faith, and panels accept it regularly.

If a prior filing or response in a .xyz proceeding produced an adverse outcome, a focused second read can find the element that was missed. Email info@cognomenlaw.com to discuss your options.

URS versus UDRP: how should you choose when speed matters?

The choice between URS and UDRP is a strategic decision, not merely a procedural one. The right answer depends on the goal, the strength of the evidence, and the budget available. Here is how the decision runs in practice across the most common .xyz scenarios.

Where the domain is identical to a nationally or internationally famous registered mark, points at a commercial parking page, and the registrant has no discernible connection to the string, URS is the faster path to a suspension – at lower cost and within a compressed timeline. The outcome is suspension for the registration term, not transfer. If the registration term is lengthy, that may be sufficient; if the brand owner wants permanent control, a follow-on UDRP is available and a prior URS suspension will factor into the UDRP panel's assessment of bad faith.

Where the case has any complexity – a mark that is less than famous, a registrant who has put something on the site, a domain that combines the brand with a term the respondent might argue is descriptive – UDRP is the better initial route. The UDRP's preponderance-of-evidence standard is the appropriate one for disputed cases, and the remedy of transfer is final. A UDRP at WIPO for a single domain and single-member panel costs USD 1,500 in filing fees plus legal costs.

Where the abusive registration is one of many – a brand owner discovering a dozen .xyz variants all held by the same registrant – a single UDRP complaint can cover multiple domains against the same holder. That consolidation right is not available in URS without separate filings. For a brand owner managing a portfolio of new-gTLD threats, UDRP consolidation is a meaningful efficiency.

Where the concern is speed above all else and the case is clear-cut, WIPO also offers an expedited option that can deliver a decision within approximately one month for single-panel cases of up to five domains. That expedited path sits within the UDRP, not the URS, and carries the full transfer remedy.

And where the goal is monetary relief – damages, attorney's fees, an injunction against future registration – neither the UDRP nor the URS can reach it. Those remedies belong to court proceedings; in the United States, US anticybersquatting litigation is the mechanism, handled with local litigation counsel in the relevant jurisdiction. The UDRP and URS are arbitral mechanisms whose only remedies are transfer, cancellation, or suspension.

What is reverse domain name hijacking risk in a .xyz dispute?

Reverse domain name hijacking (RDNH) is a finding that the complaint was brought in bad faith – typically to deprive a legitimate registrant of a domain they registered and hold for lawful purposes. The UDRP rules expressly authorize panels to make this finding, and while it carries no monetary penalty, an RDNH finding is a reputational sanction against the complainant and its counsel.

In the new-gTLD space, RDNH risk is real where a brand owner overreaches. The most common triggers in .xyz cases that we have seen in our practice are: filing against a registrant who held a generic or descriptive string that happens to overlap with the complainant's mark; filing where the complainant's trademark rights postdate the domain's registration date; and filing where the complainant suppresses or fails to disclose evidence that the registrant had a plausible legitimate purpose. Panels have consistently held that filing a complaint that the complainant knew or should have known would fail – because the respondent's registration predated the mark, or because the string is plainly descriptive – is a basis for RDNH.

Brand owners who use the UDRP as a low-cost acquisition tool for domains they want but are not entitled to reclaim face two risks: the complaint fails, and the panel declares RDNH. We advise clients to run a pre-filing assessment that includes a chain-of-title check, a review of the respondent's potential legitimate-interest arguments, and a realistic appraisal of whether the facts meet the bad-faith standard – not merely whether the domain is similar to the mark.

The RDNH finding in the URS context is less developed, but the principle applies. An examiner who concludes that a URS complaint was filed without any plausible evidentiary basis may note the overreach in the decision, and that notation becomes part of the institutional record.

Cross-zone considerations: when .xyz is just one front in a multi-domain problem

Brand protection in the new-gTLD era rarely involves a single domain. A registrant targeting a brand often registers the same string across multiple extensions: .com, .xyz, .online, .site, and a matching ccTLD. The .xyz component of that portfolio is only one front in the dispute.

For the .com component, the standard UDRP applies and the same WIPO panel can hear a combined complaint if the registrant is the same holder. For new gTLDs such as .xyz, .online, and .site, both UDRP and URS are available, as set out above. For ccTLDs – say a .uk or .de registration running alongside the .xyz – the procedure is entirely different: Nominet's DRS governs .uk (with its "abusive registration" standard, which reads "registered OR used" abusively rather than the UDRP's conjunctive "AND"), and German courts with a DENIC DISPUTE entry govern .de. A brand owner with cross-zone exposure needs a coordinated strategy, not separate reactive filings.

In a recent multi-zone matter (a .com plus two new-gTLD strings including .xyz, winter 2025), we coordinated a UDRP complaint covering the .com and .xyz under a single panel at WIPO, while simultaneously advising on a Nominet DRS filing for the corresponding .uk string. The two proceedings ran in parallel on different timelines and different evidentiary records, but the bad-faith evidence overlapped substantially – particularly the registrant's monetized parking pages across all three domains. The UDRP panel's findings on bad faith, once decided, informed the DRS submission.

That coordination is one of the practical advantages of a firm focused exclusively on domain disputes: the cross-zone analysis is not a secondary consideration but the organizing principle from day one.

For brand owners also dealing with a ccTLD that has no UDRP – such as .de – the DENIC DISPUTE entry is a procedural step worth taking early. It prevents the domain from being transferred to a third party while the dispute is pursued in the German courts, but it does not itself decide ownership. Local litigation counsel in the relevant jurisdiction handles the court component; we coordinate the overall strategy.

What the consensus panel view means for your enforcement calendar

The doctrine across .xyz disputes, read together, produces a predictable enforcement calendar for a brand owner who plans ahead.

Before the registry opens: register through the sunrise period if TMCH records are in place. The sunrise period is the single best opportunity to block abusive registrations before they occur. Brands with TMCH records can file sunrise applications that, if successful, put the domain in the brand owner's hands before open registration.

At the claims-notice stage: any registration that proceeds after a TMCH claims notice is an informed registration. Document it. That documentation becomes the foundation of the bad-faith argument if a UDRP or URS is needed later.

Post-launch monitoring: systematic monitoring of new .xyz registrations – through WHOIS/RDDS feeds or commercial brand-monitoring services – allows the brand owner to identify infringing registrations quickly. Speed matters because the registrant's conduct in the weeks immediately after registration (what the site resolves to, what content appears, whether pay-per-click links are activated) generates the use-in-bad-faith evidence.

At dispute filing: assess URS versus UDRP on the criteria set out above. File URS only where the case is clear-cut and suspension is an acceptable remedy. File UDRP where the case has any complexity, where transfer is essential, or where the registrant is likely to defend.

Post-decision: a UDRP transfer order is implemented by the registrar after a 10-business-day waiting period, during which the respondent may file a court action to stay implementation. That stay right is rarely exercised but should be factored into the timeline for planning purposes.

Throughout: maintain the TMCH record and keep trademark registrations current. A lapsed or narrowly-worded trademark registration is the most common point of failure in what should be a winning UDRP complaint.

Related at COGNOMEN

• URS and new-gTLD dispute services: suspension, UDRP, and brand-protection strategy
• TMCH claims notices in .xyz: what the alert means and what to do next
• Recovering a phishing domain in .au: procedure, evidence, and cross-border strategy