Recover a typosquatted .xyz domain: what panels actually decide

Your brand name lands in a .xyz domain — one letter transposed, one character added, or a common misspelling bolted onto your mark. Traffic follows the typo. So does the risk of phishing, counterfeit sales, or simple free-riding on your goodwill. The question is not whether the registration looks abusive. The question is what a UDRP panel will actually require before ordering a transfer.

To recover a typosquatted .xyz domain under the UDRP, a complainant must satisfy all three elements of Paragraph 4(a): confusing similarity to a mark the complainant holds, no legitimate interest on the registrant's part, and registration and use in bad faith. The .xyz registry is gTLD-accredited and fully subject to the UDRP. A standard case at WIPO typically resolves in about two months, with a filing fee of USD 1,500 for a single-member panel covering one to five domains. Transfer or cancellation are the only available remedies.

This analysis works through the three elements as panels actually apply them to typosquatting fact patterns in .xyz, identifies where complaints fail despite strong marks, and maps the contrary positions that have emerged on constructive knowledge and intent.

Why .xyz matters: the UDRP applies in full

.xyz is a generic top-level domain subject to ICANN's Uniform Domain-Name Dispute-Resolution Policy in its unmodified form. Every accredited registrar offering .xyz registrations is contractually bound to implement UDRP transfer orders. There is no special carve-out, no eligibility requirement for registrants, and no threshold that a complainant must cross beyond what the Policy itself demands. That open eligibility is part of the problem: .xyz was introduced as a low-cost, low-barrier zone, and its relative novelty made it a natural home for speculative and abusive registrations in the years following its delegation.

In our practice, .xyz typosquatting complaints have arrived in two broad clusters: cases where the registrant is clearly using the domain to siphon traffic or stage a phishing page, and cases where the domain simply sits parked, accumulating value from the likelihood of confusion. Both are actionable. The evidentiary path to success, however, differs between them, and panels have not always been uniform in how they handle passive holding in a relatively new zone where legitimate use of the string might be harder to hypothesize.

The relevant forum is almost always WIPO or the Forum, which together handle approximately 97% of all UDRP proceedings. For a single .xyz domain, the WIPO single-member filing fee is USD 1,500; the Forum's entry point is around USD 1,300 for one to two domains. The choice of forum matters at the margin — WIPO's panel pool and its searchable precedent database give it an advantage for nuanced evidentiary arguments — but the governing legal test is identical.

Element one: is the .xyz domain confusingly similar to your trademark?

The first element of Paragraph 4(a) is typically the easiest to satisfy in a typosquatting case, and panels across both major forums have consistently treated a misspelled or character-transposed version of a registered mark as confusingly similar to that mark. The logic is structural: a typosquat exists specifically to exploit the similarity, and the test does not require that a consumer be actually confused — only that the domain is objectively confusingly similar when compared to the mark.

Three sub-patterns appear most often in .xyz complaints. First, letter-transposition typosquats ("brannd.xyz" instead of "brand.xyz") receive almost uniform findings of confusing similarity because the domain retains the dominant textual element of the mark. Second, omission typosquats ("bran.xyz") require the panel to assess whether the omitted character materially changes the overall impression — and where the remaining string is still recognizable as the mark, panels generally find similarity. Third, addition typosquats ("brandshop.xyz") are the most litigated because the added element might argue for a legitimate descriptive use; panels examine whether the addition is purely descriptive or clearly modifies the mark's identity.

What does NOT satisfy the first element is a domain that merely uses a common dictionary word that happens to overlap with part of a trademark. If the mark is fanciful or arbitrary and the domain reproduces it with only a trivial variation, complainants almost always prevail on element one. Where the mark is descriptive or generic — or where the complainant's rights are unregistered and jurisdiction-specific — panels look harder at the scope of those rights before concluding similarity.

A word on trademark rights in the .xyz context: the Policy requires the complainant to hold trademark rights, but it does not limit those rights to registered marks. Unregistered or common-law rights are recognized, provided the complainant demonstrates they had acquired distinctiveness in the relevant market at the time the domain was registered. For a .xyz typosquat filed speculatively years ago, the date of registration may postdate the complainant's rights — which supports the third element — or it may predate them, which is a significant complication discussed below.

Element two: does the registrant have any legitimate interest in the domain?

The second element is where many complaints underestimate their burden. Technically the complainant need only make a prima facie case that the registrant lacks rights or legitimate interests; the burden then shifts to the registrant to rebut. But panels have vacated transfers where the complainant's prima facie showing was thin and the registrant offered a plausible (if unproven) alternative use.

The Paragraph 4(c) safe harbors are the registrant's primary defense. A registrant who, before receiving notice of the dispute, was using the domain in connection with a bona fide offering of goods or services — or who is commonly known by the domain name — has a legitimate interest that defeats the complaint. In typosquatting cases, these defenses rarely succeed on the facts, but they come up frequently in the pleadings.

More commonly, the registrant simply defaults — files no response at all. Default does not automatically mean transfer. Panels still require the complainant's evidence to support all three elements, and in our experience a default filing with weak evidence on element two is not the guaranteed transfer it superficially appears to be. The panel will look for affirmative evidence: Is the registrant known by the domain string? Is there any plausible noncommercial use? Has the domain ever been used in any manner consistent with a legitimate purpose?

In typosquatting fact patterns, the answer is almost always no. The deliberate misspelling itself is strong circumstantial evidence of intent to exploit the complainant's mark. Panels have consistently held that a typosquat — a domain that differs from a well-known mark only in a predictable keyboard error or phonetic substitution — is inherently implausible as a vehicle for legitimate interests unrelated to the mark. That reasoning has been applied in .xyz cases just as it has in .com cases; the zone does not alter the analysis.

For a read on whether the three UDRP elements are met in your specific .xyz situation, reach us at info@cognomenlaw.com.

Element three: was the domain registered and used in bad faith?

Bad faith under Paragraph 4(b) must be shown cumulatively — both at registration and in use. This is where .xyz typosquatting disputes generate the most contested panel reasoning, and where the minority view from complainants and panels diverges most sharply from the consensus.

The consensus approach is well settled. Panels regularly infer that a registrant who selected a predictable misspelling of a well-known mark did so with knowledge of that mark — and that such knowledge at the moment of registration is itself evidence of bad faith in registration. The Paragraph 4(b) factors are non-exhaustive. A pattern of abusive registrations (the same registrant holding multiple typosquats of the same or different marks), use of the domain to attract users through confusion for commercial gain, or a prior offer to sell the domain to the mark owner at a price far exceeding registration costs — each independently supports a bad-faith finding.

Where complainants most often stumble is on the "and used" limb when the domain is passively held — no website, no visible use, no monetization. The consensus view is that passive holding can constitute use in bad faith when the domain is so obviously connected to a famous mark that no legitimate use is conceivable. For .xyz specifically, panels have noted that the zone's low registration cost makes speculative holding particularly low-risk for the registrant, which supports the inference that passive holding was deliberate. That said, the minority position holds that passive holding requires additional circumstantial evidence before the inference fires — such as the registrant's concealment of identity, a pattern of conduct, or the known commercial value of the mark. Complainants who rely solely on passive holding without supplementing the record with WHOIS history, registrant identity analysis, or evidence of the mark's profile risk a denial on element three even when elements one and two are clear.

In a recent matter — a .xyz letter-transposition typosquat of a software brand's mark, spring 2025 — we assembled a bad-faith record that combined the registrant's concealed WHOIS data, a prior email sent to the brand owner offering to "discuss the domain's value," and the registrant's portfolio of similarly structured domains across multiple zones. The panel transferred the domain on all three elements. The offer-to-sell email was decisive; without it, the passive holding argument alone would have been a closer call.

What evidence actually decides .xyz typosquatting cases?

Evidence decides these cases. The legal test is the same across forums and zones; what separates transfers from denials is the quality of the evidentiary record the complainant builds before filing.

The strongest complainant records include: (1) a certified copy or registrar printout of the trademark registration, ideally with a priority date that predates the domain's registration; (2) screenshots or archived captures showing the domain's active or historical use — parking pages with pay-per-click links to the complainant's competitors are ideal; (3) evidence of the mark's commercial profile — advertising expenditure, market presence, press coverage — sufficient to support the inference that the registrant could not have selected the string innocently; (4) WHOIS or RDDS history showing registrant identity, privacy service use, or changes to registrant data after the mark became prominent; and (5) any communications from the registrant, particularly offers to sell.

What panels consistently discount: (a) conclusory assertions that the domain "must" have been registered to target the complainant, without supporting circumstantial evidence; (b) trademark registrations obtained after the domain's registration date, without evidence of prior common-law rights; (c) screenshots taken after the complaint was filed showing that the registrant has since modified the page — pre-filing captures via the Wayback Machine or similar archival tools are essential.

The contrary view worth noting: a minority of panels has declined to infer constructive knowledge of a trademark from the mark's general commercial prominence alone. Under this reasoning, a registrant in a different jurisdiction, or one who chose the string for ostensibly descriptive reasons, is not automatically presumed to have known of a foreign mark even if that mark is well known in its home market. This position has not become the dominant rule — panels applying the consensus will draw the knowledge inference from strong marks with wide recognition — but it remains a real risk where the complainant's mark is primarily national and the registrant is evidently based elsewhere.

If a prior filing produced an unexpected denial, or if you have received a complaint and need to assess the respondent-side record, email info@cognomenlaw.com.

How do .xyz disputes compare with .com and other gTLD typosquatting cases?

The legal test is identical across all gTLD zones; the zone name drops out of the analysis at Paragraph 4(a)(i) once the domain's similarity to the mark is assessed. What differs is context.

In .com, the inference of bad faith is often almost automatic for a mark with strong global recognition — the zone's ubiquity means any registrant can be presumed to understand that .com registrations of well-known marks attract scrutiny. In .xyz, that inference is only slightly less automatic. The zone was marketed as a broadly available general-purpose extension, not a zone with any sector specificity. A registrant cannot credibly claim that .xyz usage conventions favor a different inference than .com for the same domain string.

Where the zone comparison becomes more important is in cross-zone attacks. A brand owner who discovers a typosquat in .xyz frequently also finds the same misspelling registered in .com, .net, or a ccTLD. A single UDRP complaint may cover multiple domains if the registrant is the same holder — a meaningful procedural advantage that avoids duplicate filing fees. Where the ccTLD is a .uk or .eu domain, the applicable procedure differs: the Nominet DRS governs .uk disputes using an "abusive registration" standard that reads "registered or used" abusively — a lower threshold than the UDRP's cumulative requirement — while .eu disputes go through the ADR.eu platform administered by the Czech Arbitration Court.

If the attack spans a .xyz and a .de, the picture changes further. There is no UDRP equivalent for .de; that dispute belongs in the German courts, with a DENIC DISPUTE entry available to block a transfer while litigation proceeds. A brand owner facing a multi-zone typosquatting campaign therefore needs a coordinated strategy: UDRP for the gTLD domains, the Nominet DRS for .uk, and local litigation counsel for .de and other purely court-based ccTLDs.

In another recent matter — a .xyz and .com dual typosquat by the same registrant, targeting a European financial services firm, autumn 2024 — we filed a single UDRP complaint covering both domains and secured transfers on both. The consolidation saved the client one full set of forum fees and produced a unified panel decision addressing the registrant's conduct across both zones.

The respondent's perspective: when a typosquatting complaint is wrong

Not every .xyz typosquat complaint is well-founded. We regularly advise registrants who hold .xyz domains that correspond — not by design — to a trademark they were unaware of. The key question is whether the registration pre-dates the trademark's filing or the mark's acquired distinctiveness. If a registrant chose a domain for independent descriptive or personal reasons before the complainant's mark achieved the profile the complainant now asserts, the Paragraph 4(c) safe harbor may be available.

Is this a realistic defense? It depends entirely on the facts. A registrant who holds "xyz-domain.xyz" and can demonstrate prior use — a business operating under that name, an email trail, screenshots of a live website predating the complaint — is in a materially different position from one who simply claims ignorance after registration. Panels apply the safe harbors skeptically but they apply them. Where the complainant's mark is recent, geographically limited, or describes a common term, a well-constructed response has a real chance.

The UDRP also recognizes Reverse Domain Name Hijacking — a finding that the complaint was brought in bad faith to deprive a legitimate registrant. RDNH carries no financial penalty, but the reputational consequence for the complainant and its counsel is real. In our practice, we seek RDNH findings where the complainant demonstrably knew the registrant had a legitimate interest and filed anyway, or where the complainant's mark was clearly junior to the domain's registration date. An RDNH finding on a .xyz complaint, while procedurally identical to one on a .com, may be particularly apt when a complainant attempts to leverage a newly acquired mark against a domain registered years before the mark existed.

Choosing between UDRP and other routes for .xyz typosquatting

The right route depends on what you need and what the domain is doing. Four scenarios illustrate the decision.

Scenario one: the .xyz domain is a clear typosquat of a registered mark, the registrant is anonymous, and the domain redirects to a competitor's site. File a UDRP complaint — WIPO for the strongest panel pool and most cited precedent, at USD 1,500 for a single-member panel. Expect a decision in about two months. Risk: low, assuming the evidence is assembled correctly.

Scenario two: the .xyz domain is passively held, the registrant's identity is masked by a privacy service, and there is no prior communication. File the UDRP, but invest in the evidentiary record — WHOIS history, the mark's commercial profile, any web archive captures showing previous active use. Passive holding alone is enough for some panels; it is not enough for all of them.

Scenario three: the .xyz domain is being used for phishing — impersonating the complainant's brand in email communications or on a replica site. Speed matters. A UDRP can run in parallel with a registrar abuse report and a request to the relevant email providers. A UDRP complaint covers the domain itself; the registrar abuse channel can seek an immediate administrative lock pending the proceeding. See also our guidance on recovering a phishing domain, where the evidentiary and timing considerations differ from a straightforward typosquat.

Scenario four: the complainant wants money damages, not just a transfer. The UDRP cannot award damages — it can only transfer or cancel the domain. If damages are a real objective, US anticybersquatting litigation is the only path that reaches them, handled with local litigation counsel in the relevant jurisdiction. That route is substantially more expensive and slower. Most brand owners pursuing a .xyz typosquat do not need it; most want the domain, not compensation.

Related at COGNOMEN

• UDRP domain recovery — full service across gTLD zones, WIPO, the Forum, CAC, and ADNDRC
• Recovering a phishing domain — timing, registrar escalation, and parallel UDRP strategy
• ccTLD transfer remedy in .uk — the Nominet DRS procedure and how it differs from UDRP

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.