Recover a typosquatted .es domain: what panels actually decide

Recover a typosquatted .es domain: what panels actually decide. UDRP and ccTLD domain recovery and defense across .es. Email the firm to assess your case.

A brand owner searches for its registered trademark online and finds a .es domain – one keystroke off the real name – pointing at a pay-per-click parking page, a competitor's site, or a phishing lure aimed at Spanish-speaking customers. The registrant is anonymous. The demand, when it arrives, is well above fair value. The question is not whether this looks like abuse. The question is what the governing procedure requires, what evidence actually decides the outcome, and whether the panel view is as predictable as advisers often claim.

To recover a typosquatted .es domain, a complainant must satisfy the three elements of the applicable dispute procedure: a protected mark or right, no legitimate interest in the registrant, and registration or use in bad faith. For .es domains, Red.es administers a national dispute procedure distinct from the UDRP, though the analytical framework maps closely to the UDRP's Paragraph 4(a) structure. A standard case typically resolves within a matter of weeks to a few months, with transfer or cancellation as the only available remedies.

This analysis covers the governing rules for .es, the element-by-element analysis panels apply to typosquatting fact patterns, the evidence that determines winners and losers, the contrary view where a genuine split exists, and the practical steps for a brand owner who needs to move.

What governs .es domain disputes – and why the UDRP does not apply directly

The .es ccTLD is administered by Red.es, the Spanish public entity responsible for the national registry. Unlike zones such as .me or .tv, Spain has not appointed WIPO as its external dispute-resolution provider under the UDRP framework. Instead, Red.es operates its own national dispute procedure with its own rules, its own panel of qualified experts, and its own published fee structure. A complainant seeking to recover a typosquatted .es domain must use that procedure, not a WIPO or Forum UDRP complaint filed directly.

That distinction matters practically. The procedural calendar, the evidentiary standards, and the precise wording of the bad-faith test are all set by Spanish rules. In our practice, brand owners accustomed to UDRP filings sometimes assume a .es complaint runs on the same mechanics and the same timeline as a .com case. It does not. What the two procedures share is the underlying analytical structure: a three-part test that maps closely onto UDRP Paragraph 4(a). That shared logic means UDRP-developed doctrine – on confusing similarity, legitimate interest, and bad faith – often informs how .es panels reason, even though the controlling text is the national rule. Panels under the Spanish procedure regularly cite consensus UDRP reasoning when filling interpretive gaps, making familiarity with the international jurisprudence a practical advantage.

One key structural point: for any ccTLD whose national procedure has not been formally adopted into the UDRP system, the governing national procedure applies. Verify current rules with counsel before filing, because Red.es periodically updates its procedural guidelines.

Where a complainant holds rights in both a .com and a .es, the strategic choice is real. A UDRP at WIPO can resolve the .com in about two months, with a filing fee starting at USD 1,500 for a single-member panel over one to five domains. The .es must go to the Red.es procedure in parallel. Running both simultaneously is possible and sometimes necessary when the registrant is the same holder – but each requires a separate filing, separate evidence packages tailored to the respective procedure, and awareness that a panel decision in one forum does not bind the other.

If you are weighing the .es procedure against a simultaneous UDRP filing for related gTLD domains, email info@cognomenlaw.com for an assessment of how to sequence the two.

How do panels define typosquatting – and why does the definition matter for .es?

Typosquatting, in the consensus view across gTLD and ccTLD procedures alike, is the deliberate registration of a domain that differs from a protected mark by one or more characters – typically a transposition, an added or omitted letter, a phonetic substitution, or a common misspelling – with the intent to capture traffic that the user intended for the mark owner. Under the applicable .es procedure and under UDRP doctrine, this kind of variation almost never saves a registrant at the confusing-similarity stage.

Why not? Because the threshold test at element one (identical or confusingly similar) is a visual and phonetic comparison that deliberately excludes intent. A panel deciding whether "marcaejemplo.es" is confusingly similar to the mark MARCAEJEMPLO does not ask what the registrant meant. It compares the domain string against the mark and notes that a one-letter difference – a transposition, a doubled consonant, a missing vowel – is precisely the class of variation a user might type by accident. The confusion is structural. The confusing-similarity element is therefore routinely satisfied in typosquatting cases, and practitioners who have spent significant time in this area know the real fight is almost always at elements two and three.

The minority position worth knowing: some panels have been more demanding at element one in cases involving marks that are themselves descriptive or that the complainant holds only in a figurative form with design elements. Where the mark's word element is generic or descriptive in Spanish, the visual comparison can become genuinely contested. A complainant should confirm that its trademark registration covers the word element in a form that survives that scrutiny before treating element one as settled.

What does "no legitimate interest" mean for a .es typosquatter?

The second element – that the registrant has no rights or legitimate interests in the domain – is where procedural posture and the burden of proof interact. Under UDRP consensus reasoning, the complainant makes a prima facie showing by asserting the mark and demonstrating that the registrant was not authorized to use it. The burden then shifts, in practice, to the registrant to produce evidence of a legitimate interest. Under the .es procedure, a comparable allocation operates.

Three safe-harbor categories appear in the UDRP at Paragraph 4(c) and have close equivalents in ccTLD procedures: a bona fide offering of goods or services before notice of the dispute, being commonly known by the domain name, and legitimate noncommercial or fair use. In a typosquatting fact pattern, all three face serious structural obstacles.

A pay-per-click parking page – the most common use pattern in .es typosquatting cases we encounter – does not constitute a bona fide offering of goods or services when the ads served relate to the mark owner's industry. Panels have consistently held that monetizing user confusion is not a bona fide commercial use. A registrant who defaults and provides no evidence whatsoever leaves the panel to draw reasonable inferences from the complainant's record. Where the record shows a one-letter-off domain pointed at commercially competitive content, those inferences run against the registrant.

The harder case arises when the registrant has operated a genuine business under the domain for an extended period before the dispute – offering services in Spain using a name that happens to be phonetically close to the complainant's mark. We have seen this argued in both directions. The analysis turns on whether the registrant actually acquired any secondary meaning for itself under the name, whether the use predated the complainant's trademark rights, and whether the goods or services overlap. Where these facts are genuinely mixed, the outcome is not predictable.

What constitutes bad faith in a .es typosquatting case – and where does the consensus break?

Registration and use in bad faith is the third element and the one where doctrine has the most texture. Under the UDRP, Paragraph 4(b) provides non-exhaustive bad-faith circumstances: registration to sell to the mark owner; to disrupt a competitor; to attract users by confusion for commercial gain; or a pattern of abusive registrations. The .es procedure operates on comparable reasoning.

Typosquatting is one of the paradigm cases of bad-faith registration. The consensus view across the UDRP and ccTLD jurisprudence is that a registrant who deliberately misspells a well-known brand to capture misdirected traffic, and then monetizes that traffic, has done both things the framework targets: registered in bad faith and used in bad faith. The structural logic is compelling. A one-letter deviation from a well-known mark does not arise by accident. A parking page served with competitively related ads does not arise by accident either. Taken together, panels routinely find both limbs satisfied.

A more contested area: passive holding. Where the domain resolves to a blank page or returns an error, a complainant still has a viable bad-faith argument – but it requires more evidence. Panels deciding passive-holding cases ask whether the domain was registered at a time when the mark was clearly well-known, whether the registrant has concealed its identity or provided false WHOIS/RDDS data, and whether no plausible legitimate use is conceivable given the distinctiveness of the mark. For a highly distinctive mark with strong Spanish market presence, passive holding by an anonymous registrant is typically sufficient for a bad-faith finding. For a mark with limited Spanish recognition or a descriptive word element, the argument is thinner. We address the passive-holding doctrine in detail in the context of recovering domains where passive holding is at issue.

The contrary view, which does appear in the record even for apparent typosquats: panels have occasionally declined to find bad faith where the complainant's mark was not shown to be known in Spain at the time of registration, or where the domain string could plausibly represent an abbreviation or acronym with a meaning independent of the mark. These decisions are the minority. But a complaint that treats bad faith as automatic – without assembling dated proof of the mark's Spanish-market prominence at registration – will occasionally lose on exactly this point.

If a previous filing produced an adverse result or a denial on bad faith, a focused review of the evidentiary record can often locate what was missing. Email info@cognomenlaw.com to discuss.

What evidence actually decides a .es typosquatting case?

Evidence is where most disputes are won or lost, and where the advice "you have a strong case" can either prove out or collapse. For a .es typosquatting complaint, the evidence package must do specific work at each of the three elements.

At element one, the complainant needs its trademark certificate or equivalent proof of rights – a Spanish or EU trademark registration is the cleanest basis, but rights in an unregistered mark recognized under applicable law can also qualify. The key is showing that the protected element of the mark corresponds to the string being compared. A figurative mark with extensive design elements may require argument about which word element carries the rights.

At element two, the complainant typically annexes WHOIS/RDDS data showing that the registrant is not authorized, screenshots of the domain's current and historical use (including cached or archived versions showing PPC content), and a declaration that no license was granted. The Wayback Machine and third-party archive services are standard sources. In our practice, we document the parking-page content in detail: which ads appeared, which category of goods or services they advertise, and whether those categories correspond to the complainant's trademark class. That correspondence strengthens the argument that the registrant was aware of the mark and targeted it.

At element three, the critical evidence is chronological. The complainant must show that the mark predated the domain registration – in Spain or in a jurisdiction where the mark had reach at the time of registration. Trademark office records, dated press coverage, audit reports showing Spanish-market operations, and commercial invoices are all useful. For a mark with substantial Spanish-market history, a print or digital media archive showing the brand's public profile before the registration date is compelling. For newer marks or marks with limited Spanish use, this becomes the contested fact.

In a recent matter – a .es typosquat in a fast-moving consumer goods sector, spring 2025 – we assembled a chronological evidence package showing the complainant's Spanish trademark registration predating the disputed domain by several years, combined with archived screenshots of the PPC parking page and a brand-recognition survey from the complainant's Spanish market research. The complaint succeeded on all three elements. The registrant defaulted and offered no response.

A separate matter, also in 2025, involved a mid-size software company whose .es domain was held by a registrant actively operating a low-volume services site. The registrant responded, claimed it had been trading under the abbreviated name, and produced invoices. The element-two analysis became genuinely contested. The complainant ultimately succeeded, but only after a supplemental round of evidence addressing the invoices' date coverage – a procedural detour that added weeks to the resolution timeline.

How does the .es procedure compare to UDRP – a decision matrix for brand owners

The right dispute route depends on the zone, the evidence available, and the desired remedy. Consider four common situations.

Where the infringed domain is a .com typosquat and the brand owner wants a transfer, the UDRP at WIPO or the Forum is typically the fastest path: a standard single-member case resolves in about two months, with the WIPO filing fee starting at USD 1,500. Where the same mark is also infringed in .es, a separate Red.es filing is required; the two can run in parallel, each on its own procedural track.

Where the only infringed domain is .es and the registrant has made a buy-back demand, the Red.es procedure may be the most efficient route to a transfer. No monetary remedy is available – the only outcomes are transfer or cancellation, as in the UDRP – so if the brand owner also wants damages, a separate court action (handled with local litigation counsel in the relevant jurisdiction) is necessary. The Spanish courts can award monetary relief; the dispute procedure cannot.

Where a registrant holds typosquatted domains in multiple zones – .es alongside .com, .net, and .eu – a coordinated multi-forum filing strategy is typically more effective than sequential proceedings. The .com and .net can go into a single UDRP complaint (same registrant, multiple domains). The .es and .eu require separate national procedures. The .eu ADR procedure is administered through the Czech Arbitration Court's ADR.eu platform and operates under its own rules. For the .eu, see also our guide on national dispute procedures across ccTLD zones.

Where the complainant also wants to prevent future registrations of similar misspellings, the dispute procedure alone is not a complete answer. A brand-protection monitoring program that flags new registrations – including typo variations – across priority zones provides early notice before content is deployed. That monitoring function, coordinated with registration of defensive variants in .es, is a sustainable complement to reactive disputes.

Can a registrant defend a .es typosquatting complaint – and when might RDNH arise?

Respondent-side analysis belongs in any serious treatment of this doctrine. Not every .es complaint for a one-letter-off domain is a legitimate enforcement action. Panels – under the UDRP and under national procedures that recognize the concept – have found Reverse Domain Name Hijacking (RDNH) where a complaint was brought with no genuine basis, or where the complainant filed knowing the registrant had a legitimate interest it chose not to address.

When might a registrant have a defensible position against a .es typosquatting complaint? Several patterns arise in practice. The registrant may have registered the domain before the complainant acquired trademark rights in Spain – or in any jurisdiction where the mark had reach at that time. Registration in good faith cannot become bad faith retroactively simply because a complainant later acquired a mark. The registrant may also be a legitimate business whose name happens to be phonetically similar to the complainant's mark, and whose domain registration reflects its own trading identity. A company whose registered Spanish name is an abbreviated form of its full corporate name, and whose domain reflects that abbreviation, has a coherent legitimate-interest argument even if the domain also resembles a foreign complainant's mark.

A complainant who brings a complaint in those circumstances – without adequately investigating the registrant's business history and trademark landscape – risks an RDNH finding. Under the UDRP that finding is reputational, carrying no monetary penalty. Under the .es procedure, the consequences are comparable. An RDNH finding is nonetheless significant: it is a public determination that the complaint was filed in bad faith to strip a legitimate registrant of a domain it lawfully holds. We act for registrants as well as complainants. In our practice advising respondents, the RDNH argument is viable when the complainant's timeline does not add up – when registration clearly predates the mark, or when the complainant filed against a registrant with documented use of the name in Spain.

For brand owners, the practical takeaway is this: conduct a pre-filing investigation of the registrant's apparent business activity, confirm the trademark's priority date relative to the domain registration date, and do not rely solely on the visual similarity of the string. A complaint that skips that diligence may fail and produce an RDNH finding that the brand owner would rather not have in the public record. We assess the three elements, the registration timeline, and the risk of an adverse finding before recommending a filing – not after. That is the correct sequencing.

What is the realistic next step to recover a typosquatted .es domain?

The path is not complicated, but the details decide the outcome. The starting point is confirming that the complainant holds qualifying rights in Spain or in a jurisdiction with relevant market reach – a Spanish or EU trademark registration is the cleanest basis. The second step is a chronological review: when was the domain registered, and what is the mark's priority date? If the mark predates the registration, element three is live. If the domain predates the mark, the complaint has a structural problem.

The third step is an evidence audit: what does the domain currently resolve to, what did it resolve to historically, and is there any public information about the registrant's business identity? Archived content, WHOIS/RDDS history, and any communications from the registrant are all relevant. If the registrant has made a buy-back demand, that demand is itself potential evidence of bad-faith registration intent.

The fourth step is choosing the procedure. For a .es domain, the governing national procedure through Red.es is the required route. If a .com or other gTLD typosquat is also at issue, the UDRP filing for the gTLD can run in parallel. For a full overview of UDRP recovery across gTLD zones, including how to structure a complaint that addresses both confusing similarity and bad faith efficiently, the linked service page covers the complete process.

The fifth and final step before filing is a realistic assessment of risk. Where the registrant is known to be operating an active business, a response is likely and the evidence package must be built to anticipate the legitimate-interest argument. Where the domain is passively held or resolves to commercial PPC content, a default or a weak response is more probable – but not guaranteed. No dispute procedure, whether UDRP or national ccTLD, produces a certain outcome. Panels decide on the facts and on the evidence put before them.

COGNOMEN assesses the three elements, assembles the bad-faith evidence, selects the appropriate forum, and files the complaint. Where the matter is a .es dispute requiring coordination with the national procedure, we manage that filing directly and coordinate any parallel gTLD UDRP proceedings.

Related at COGNOMEN

• UDRP recovery service: file a complaint to recover a domain across all major gTLD zones
• Recovering passively held domains: the doctrine and evidence strategy for tech-sector marks
• National dispute procedures: a guide to ccTLD filings beyond the UDRP