Choose between URS and UDRP for a .app domain: what panels actually d…

Choose between URS and UDRP for a .app domain: what panels actually d. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your ca…

A mobile-software brand discovers its exact name registered as a .app domain, redirecting visitors to a rival app store. Two administrative procedures are available. Choosing the wrong one costs months and leaves the registrant in possession of a domain that – in the .app namespace – carries Google's mandatory HTTPS seal of trust.

Both the Uniform Rapid Suspension System (URS) and the Uniform Domain-Name Dispute-Resolution Policy (UDRP) apply to .app domains. The URS delivers a faster, cheaper suspension – but only suspension, not transfer. The UDRP requires a higher filing fee (starting at USD 1,500 at WIPO for a single-member panel) and runs roughly two months, yet it is the only administrative route that moves ownership. The choice turns on whether you need the domain transferred, how clear the infringement evidence is, and how quickly the harm is escalating.

This analysis covers the governing rules in the .app zone, the evidentiary standards each procedure demands, the pattern of panel reasoning in .app cases, cost and timeline trade-offs, and the realistic next step for brand owners and registrants alike.

What governs .app domains and why two procedures exist

The .app top-level domain is a new gTLD, delegated under ICANN's 2012 New gTLD Program and operated by Google Registry. As a new gTLD, .app is subject to the full ICANN dispute-resolution stack: the UDRP, which has applied to all accredited-registrar gTLD domains since 1999, and the URS, which ICANN introduced specifically for the new gTLD round as a faster, lower-cost supplement. Neither procedure is exclusive. A brand owner may, in principle, file either or both – though filing both simultaneously is rarely efficient and can create procedural complications.

The .app zone carries one feature that affects the dispute calculus: it operates under an HTTPS-only policy enforced at the registry level. Every .app domain must present a valid TLS certificate. That policy has two consequences for disputes. First, it means a cybersquatter operating a .app site has had to invest in infrastructure, which panels sometimes read as evidence of active use rather than passive holding. Second, it means the domain surface area is genuinely valuable to infringers mimicking a legitimate app developer's identity – phishing via brandname-app.app or brandnameapp.app is a documented pattern in this zone.

From a procedural standpoint, both WIPO and the Forum (formerly the National Arbitration Forum) administer UDRP complaints for .app domains. The URS is administered primarily through the Forum under ICANN's rules. Neither institution has published .app-specific rules beyond the standard procedures; the .app zone simply inherits the general new gTLD framework.

How does the URS standard differ from the UDRP standard in .app cases?

The URS applies a clear and convincing evidentiary standard, materially higher than the preponderance standard that applies under the UDRP. That distinction matters every time a brand owner considers how to choose between URS and UDRP for a .app domain. A case that sits in the "more likely than not" zone – a colorable registration with some ambiguity about intent – will often fail the URS while succeeding under the UDRP.

The three elements are substantively the same across both procedures: the domain must be identical or confusingly similar to a mark in which the complainant has rights; the registrant must have no rights or legitimate interests; and the registration and use must be in bad faith. Under the UDRP, those elements must all be met to the preponderance standard. Under the URS, each must be established by clear and convincing evidence. In practice, URS examiners have declined cases where the complainant's mark was geographically or descriptively weak, where the registrant offered a plausible business rationale, or where the bad-faith evidence was circumstantial rather than direct.

A second structural difference: the URS does not require the complainant to demonstrate that the registrant lacks rights or legitimate interests by building a full prima facie case and then shifting the burden. The URS is meant to catch only the clearest, most egregious registrations. For a .app domain used in active phishing – presenting a fake app download page under a well-known brand's exact mark – the clear-and-convincing threshold is regularly met. For a .app domain held passively, or used for a descriptive or generic term that has acquired secondary meaning in the complainant's brand, the threshold is harder to reach.

Remedies differ sharply. The URS results only in suspension: the domain is locked, its DNS resolution is suspended, and it reverts to the registrant at the end of the registration term unless the complainant pays to extend the suspension. The UDRP, by contrast, awards transfer or cancellation. For a brand owner who wants the .app domain permanently in its portfolio, the UDRP is not optional – it is the only administrative path to ownership.

If the fact pattern is close – a descriptively similar mark, a registrant who responded with a business claim, or a domain with a mixed commercial history – the choice of procedure can decide the outcome before the substantive arguments are even heard. For a read on which standard your evidence currently meets, contact info@cognomenlaw.com.

When does the URS make practical sense for a .app dispute?

The URS is the right primary tool in a narrow but important set of .app scenarios: the mark is famous or registered, the domain reproduces it exactly or with a transparent appendage (a generic word like "app," "download," or "store" added around the mark), the site is in active use for competitive or deceptive purposes, and the brand owner's immediate priority is to stop ongoing harm rather than to acquire the domain name itself.

Speed is the defining feature. A URS examination is typically completed substantially faster than a UDRP panel decision. For a .app phishing campaign – where every day the domain resolves increases the risk of consumer harm and credential theft – even a few weeks' difference is material. The URS filing fee is also lower than the WIPO or Forum UDRP fees, making it the proportionate tool for straightforward, high-visibility infringement. We regularly advise brand owners in the software and mobile-app sectors to lead with a URS filing when the infringement is visible, the mark is strong, and the goal is stoppage rather than acquisition.

There is, however, a consensus view in the examiner community that the URS is not a substitute for the UDRP when the complainant wants to own the domain. Filing a URS, winning a suspension, and then filing a UDRP to achieve transfer is a legitimate sequence – but it doubles the cost and the elapsed time. Panels under the UDRP do not treat a prior URS suspension as dispositive of the UDRP elements; they conduct a fresh substantive review. The practical result is that a sequential strategy is sometimes chosen when the brand owner initially underestimated its interest in holding the domain.

In a recent matter involving a .app typosquat (spring 2025), we filed a URS complaint on behalf of a software brand whose exact mark had been registered with a single transposed letter, pointing to a competing app store. The suspension issued quickly. The client subsequently instructed us to pursue UDRP transfer, which was completed within roughly ten weeks of the UDRP filing. The sequential path worked – but planning the UDRP from the outset would have been more efficient.

When is the UDRP the stronger choice for a .app domain?

The UDRP is the correct first filing in any .app dispute where the complainant wants to hold the domain, where the bad-faith evidence is strong but not necessarily overwhelming, or where the registrant is likely to respond and contest the case. It is also the right path when the mark carries some ambiguity – a common word elevated to trademark status, a brand with geographic or trade-dress components – because the UDRP's preponderance standard gives the complainant room that the URS does not.

For the .app zone specifically, panels have consistently applied the standard UDRP three-element test without any zone-specific modification. The confusing-similarity element is typically met quickly when the domain reproduces the mark plus "app," "apps," or a functional descriptor – because those terms describe the very product class associated with a .app registration. The legitimate-interest inquiry is where most contested .app cases are decided. A registrant who can show a genuine business reason for the .app registration, predating any notice of the complainant's rights, and who presents evidence of active development, has a viable Paragraph 4(c) safe-harbor argument. Without such evidence, panels have found the absence of a plausible non-infringing use to be a strong indicator supporting the bad-faith element.

Bad faith in the .app zone tends to involve one of two patterns. The first is registration for financial gain: the domain was registered immediately after a product launch, a funding announcement, or an app-store feature – events that produce the kind of public-notice record a complainant can anchor to. The second is active use for competitive diversion or phishing: the mandatory HTTPS enforcement in .app means that when a deceptive site is live, it carries Google's visual trust signal, making the consumer-confusion argument particularly compelling. Panels have treated both patterns as falling squarely within Paragraph 4(b) bad-faith circumstances, and we have observed no contrary trend specific to .app that would undercut that analysis.

There is a minority position worth acknowledging. Some panels have been reluctant to find bad faith where the .app domain was registered in a round of new gTLD launches and the registrant held a portfolio of descriptive or generic names across multiple new gTLDs. The argument – occasionally accepted – is that a domain investor acquiring generic-adjacent terms at launch is not targeting any specific mark owner, particularly if the domain was registered before the complainant's mark had significant global recognition. Brand owners facing this defense should document the chronology carefully: if the mark was well-known in the relevant market before the domain was registered, the "generic portfolio" defense is considerably weaker.

In another recent matter (a contested UDRP, autumn 2025), we defended a software developer who had registered a .app domain corresponding to its own product name, then received a UDRP complaint from a foreign software company claiming priority. We assembled a development timeline, beta-launch records, and app-store metadata demonstrating use as a bona fide offering well before the complainant's mark had US recognition. The panel denied the transfer and found that the complainant had failed on the legitimate-interest element. No RDNH finding was made, but the denial was decisive.

If a .app domain has already been registered against your brand, or if you have received a UDRP complaint targeting a .app domain you legitimately hold, the procedural choices that follow are time-sensitive. Email info@cognomenlaw.com to discuss which record to build and which procedure fits your position.

How do the evidence requirements compare across URS and UDRP for .app?

Evidence assembly is where the procedural choice becomes concrete. For the URS, the examiner reviews a complaint and supporting materials in a streamlined format; the standard is clear and convincing, so the complaint must be self-evidently strong. For the UDRP, the panel conducts a fuller review of complaint and response materials, and the complainant bears the burden on all three elements to the preponderance standard – though once a prima facie case is made on legitimate interests, the burden shifts to the respondent to rebut.

For a .app complainant, the core evidentiary package is consistent across both procedures: trademark registrations (or evidence of unregistered mark rights if relying on reputation), WHOIS or RDDS records showing registration date and registrant identity, screenshots of the domain's use in active operation, and a chronological argument tying registration date to the complainant's mark priority. In .app cases, app-store records – particularly the date of first publication on major app marketplaces – serve as strong, timestamped priority evidence.

For a .app respondent, the evidentiary task under the UDRP is to fit one of the Paragraph 4(c) safe harbors: a bona fide offering of goods or services under the name before notice of the dispute; being commonly known by the domain name; or a legitimate noncommercial or fair use without intent to mislead. In a .app context, the most credible of these is typically the first. App development timelines, internal product documents, beta records, and any public mention of the product before the mark-owner's notice letter all contribute. Courts and panels have recognized that software development leaves a richer documentary trail than most other businesses – and respondents who fail to present that trail without a plausible explanation tend to lose.

What is the decision matrix for choosing between URS and UDRP for a .app domain?

The right route depends on the combination of goal, evidence strength, and timing. If the domain is a .app and the objective is permanent transfer, the UDRP is the only administrative tool that achieves it. The WIPO filing fee starts at USD 1,500 for a single-member panel; the case runs roughly two months; and the evidentiary standard is met by a preponderance of evidence. That combination makes the UDRP the default for most .app recovery matters where ownership is the goal.

If the objective is rapid suspension of a .app domain causing active harm – a live phishing site, a competing app download under an exact trademark – and the mark is strong enough to meet the clear-and-convincing standard, the URS at the Forum is the faster, lower-cost intervention. The suspension stops the immediate harm, even though it does not transfer the domain.

If the evidence of bad faith is circumstantial – passive holding, a generic or descriptive mark element, or a registrant who filed a timely response with a facially plausible business claim – the URS will likely fail on its clear-and-convincing threshold, while the UDRP may succeed. Trying the URS first in this scenario wastes time and incurs a filing fee without resolving the dispute. Going directly to the UDRP is more efficient.

Where the same brand is registered as both a .com and a .app, and both are disputed, the complainant has flexibility to file a single UDRP complaint covering multiple domains if the same registrant holds both – which consolidates the proceeding and the fee. The WIPO filing fee for a single-member panel covering one to five domains is USD 1,500; where more domains are involved, the fee scales. A combined .com/.app UDRP is often a practical choice when portfolio squatting is the pattern.

Finally, for a .app domain where the complainant wants damages in addition to transfer, no administrative procedure reaches monetary relief. The UDRP and the URS both exclude monetary awards entirely. US anticybersquatting litigation in a federal court is the only route to financial remedies, and that path is longer and substantially more expensive. In our practice, we advise brand owners to treat the administrative procedures as the default and to reserve court action for cases where the infringer's conduct is egregious enough to justify the investment in damages, or where the registrant is beyond the reach of ICANN procedures.

What does the respondent-side picture look like in .app UDRP cases?

The .app namespace attracts legitimate software developers, indie studios, and startup founders who register domains corresponding to their own products. Those registrants are disproportionately targets of complaints from larger companies seeking to consolidate their presence across new gTLDs – sometimes with a genuine grievance, sometimes without. In our respondent practice, we see .app UDRP cases where the complainant's trademark registration postdates the domain registration by months or years, and where the brand owner is in substance using the UDRP as a substitute for a purchase negotiation.

Where a complaint is brought without a legitimate basis – particularly where the complainant knew the registrant had its own competing product and filed anyway – the panel may find reverse domain name hijacking (RDNH). An RDNH finding is reputational in effect: no monetary penalty attaches, but the finding is published and carries weight in the domain community and in any subsequent court proceedings. Panels award RDNH findings where the three elements are clearly not met and the complainant had the information to know that before filing.

Respondents in .app cases should act promptly. The UDRP response window is 20 days from formal commencement of the case. Missing that window does not automatically result in transfer – the panel still reviews the complaint on its merits – but a default eliminates the respondent's opportunity to present the Paragraph 4(c) safe-harbor evidence that frequently decides contested cases. We have defended .app registrants against complaints that, on the face of the filing, appeared strong; in each instance, the development record the client was able to provide was determinative.

Cross-zone implications: .app alongside .com, .io, and other new gTLDs

A .app dispute rarely exists in isolation. Software brands typically have presence across .com, .io, .dev, .software, and other zones, and cybersquatters or domain investors frequently register across multiple TLDs simultaneously. The procedural choices in a multi-zone situation multiply.

For .com and other legacy gTLDs, the UDRP is the only administrative route – the URS does not apply to legacy TLDs. For new gTLDs (.app, .dev, .io-when-treated-as-new, .software), both URS and UDRP are available. For ccTLDs with their own dispute procedures (for example, .uk domains under the Nominet DRS, or .de domains which require German court action), the zonal rules override the ICANN framework entirely. A brand dealing with simultaneous registrations in .com and .app can file a single UDRP covering both if the same registrant holds both; it cannot add a .uk domain to the same proceeding, which must go through Nominet separately.

The .io zone is worth a brief note. Historically administered by a ccTLD registry, .io was a popular technology-sector TLD; its dispute-resolution status has been an evolving question at the registry level. Brand owners with .io disputes should confirm the current governing procedure with counsel rather than assuming UDRP coverage. The .dev TLD, also operated by Google Registry, mirrors .app in both the HTTPS-only policy and the ICANN dispute-resolution framework.

When we advise on a multi-zone cybersquatting matter, we typically map the zones, identify which procedure applies to each, confirm registrant identity across the portfolio (consolidation is only possible when the same registrant holds all the contested domains), and then sequence the filings to minimize cost and elapsed time. A combined .com/.app UDRP proceeding at WIPO, followed if necessary by a Nominet DRS filing for any .uk equivalent, is a common sequence for software brands operating in both US and UK markets.

Related at COGNOMEN

• URS and new-gTLD dispute services: URS, UDRP, and .app recovery across the new gTLD namespace
• New gTLD launch protection: sunrise, trademark clearinghouse, and pre-delegation monitoring
• How to recover a .com domain through a UDRP complaint: the step-by-step guide