FAQ: bring a court action when UDRP cannot reach a .xyz domain

Does WIPO or a court decide a .xyz dispute?

Either forum can have jurisdiction over a .xyz dispute, but they decide different things and deliver different remedies. The UDRP, administered by WIPO or the Forum under the standard accredited-registrar agreement, is the default route for most .xyz disputes. A UDRP panel applies all three elements of Paragraph 4(a) – confusing similarity, no legitimate interest, and bad faith registration and use – and its only available remedies are transfer or cancellation of the domain. No money changes hands. No injunction issues. No third party is bound.

A court, by contrast, applies the applicable national law. In US cases, anticybersquatting legislation allows a complainant to seek both a transfer order and monetary damages, up to statutory maximums per domain, against a registrant who acted in bad faith. Courts can also bind registrars directly, compel specific performance, and reach conduct that pre-dates or post-dates the UDRP's scope. The practical consequence is that if the only goal is recovering the domain name, WIPO is typically faster – a standard case resolves in about two months. If the goal also includes compensation, deterrence, or a binding order against a third party, court is the necessary path.

In our practice we consistently advise brand owners to assess the full spectrum of remedies before defaulting to one route. The forum should follow the remedy, not the other way around.

When can I bring a court action when UDRP cannot reach a .xyz domain?

A court action becomes the primary route when the conduct at issue falls outside what UDRP arbitration can remedy or resolve. There are four recurring situations in which we see brand owners and registrants properly turn to litigation.

First, when money is the objective. The UDRP cannot award damages. If the registrant profited by redirecting traffic, collecting pay-per-click revenue, or impersonating the brand owner to divert transactions, only a court can quantify and order compensation. US anticybersquatting litigation is the most commonly used vehicle for this in the .xyz context, because most major .xyz registrars maintain operations within US jurisdiction.

Second, when the domain was stolen or hijacked. A UDRP proceeding between the true registrant and a bad-faith third party is designed for straightforward cybersquatting. Domain theft – where a registrant's account is compromised and the registration is fraudulently transferred – is a different problem. It requires registrar escalation, documentation of the account compromise, and frequently a court order compelling the registrar to reverse the transfer. UDRP panels are not equipped to adjudicate account fraud or to bind registrars as parties.

Third, when a UDRP complainant needs an emergency measure before the 60-day process concludes. Courts can issue interim injunctive relief – a temporary restraining order preventing the domain from being transferred, let alone monetized – on a timeline measured in days rather than months. This matters when a domain is being used in an active fraud campaign or when there is evidence the registrant is planning to transfer it further to evade an adverse decision.

Fourth, when the respondent is using the domain as part of broader unlawful conduct that a single UDRP transfer order would not resolve. Where the conduct also involves trademark infringement, fraud, or unfair competition in the physical world, a court action that addresses the whole dispute is more efficient than layering arbitration on top of separate litigation.

Who can bring a court action when UDRP cannot reach a .xyz domain for a .xyz domain?

Any party with standing under the applicable national law can bring a court action. For trademark-based cybersquatting claims over .xyz domains, standing typically requires either ownership of, or an exclusive license in, the trademark that the domain is alleged to infringe. This is broadly consistent with the UDRP's first element, but national courts may impose additional requirements – such as commercial use of the mark, registration in the relevant jurisdiction, or a demonstrated likelihood of confusion affecting consumers in that market.

For stolen-domain claims, standing belongs to the registered account holder whose credentials were compromised or whose registration was transferred without authorization. This may be an individual, a corporate entity, or in some cases a beneficial owner whose name did not appear in the WHOIS record. Establishing standing here turns on demonstrating a prior, legitimate interest in the registration – purchase records, renewal receipts, registrar correspondence, and evidence of original creation all support the claim.

A practical note: because .xyz is a gTLD with no geographic restriction, the universe of potential courts is determined by where the brand owner is domiciled, where the registrar maintains a presence, or where harm was felt. We regularly advise clients to identify the jurisdiction that offers the most favorable combination of standing, available remedies, and enforceability before selecting a litigation venue. For proceedings outside the client's home jurisdiction, COGNOMEN coordinates with local litigation counsel in the relevant jurisdiction.

What evidence decides the outcome of a .xyz court action?

The evidence that carries the most weight in a court action over a .xyz domain falls into three categories: proof of the trademark right, proof of the registrant's bad faith, and – where theft or account compromise is alleged – proof of the unauthorized act itself.

On the trademark side, a registered mark in the relevant jurisdiction is the strongest foundation. Unregistered marks can support a claim in many systems, but they require more extensive secondary-evidence: advertising spend, sales figures, media coverage, and consumer recognition surveys, all speaking to the period before and around the domain registration. The earlier the mark's use relative to the domain's registration date, the cleaner the priority argument.

On bad faith, courts tend to look at the same conduct that UDRP panels assess under Paragraph 4(b): offers to sell the domain to the mark owner at a price far exceeding registration cost, a pattern of registering marks belonging to others, use of the domain to redirect or intercept the mark owner's customers, and use in connection with fraudulent activity. Documentary evidence of ransom demands, redirect logs, screenshots of the landing page at registration and at relevant points thereafter, and WHOIS/RDDS history all matter. Screenshots should be captured with a timestamp and a neutral tool to avoid authenticity challenges.

Where the claim is domain theft or hijacking, the evidence of compromise is the crux of the case. This means registrar logs showing access from an unfamiliar IP address or location, authentication records showing a password-reset event that the true registrant did not initiate, email phishing records, and the sequence of transfer requests. In a recent matter – a .xyz registration compromised in spring 2025 – we assembled registrar escalation records, IP-geolocation evidence, and a forensic timeline of the unauthorized transfer to support the account-holder's court claim. The detail of that chain-of-events documentation is what allowed the claim to proceed.

A party should also preserve any communications from the current registrant, particularly any demand for payment in exchange for returning the domain. Those communications are frequently the clearest evidence of bad faith available.

What if the registrant does not respond?

A non-responding registrant triggers different consequences in the two forums. In a UDRP proceeding before WIPO or the Forum, default does not automatically mean the complainant wins. The panel still independently reviews the evidence and must be satisfied that all three elements of Paragraph 4(a) are met. A technically deficient complaint can be denied even when the respondent says nothing. What default does remove is the counterargument: no Paragraph 4(c) safe harbor is raised, no legitimate-interest evidence is filed, and the panel works from the complainant's record alone.

In a court action, procedural default rules apply. Most jurisdictions allow a complainant to seek a default judgment when the defendant is properly served and fails to appear. A default judgment can include the transfer order, damages, and in some US anticybersquatting cases, attorneys' fees. The practical challenge is enforcement: a default judgment against an anonymous registrant in a foreign jurisdiction may require additional steps to compel the registrar to implement the transfer. This is where the registrar's cooperation – or a court order directed at the registrar specifically – becomes the determining factor.

We advise brand owners not to treat a non-responding registrant as an automatic victory. The evidence record must still be complete, and the mechanism for implementing any order must be identified before the proceeding begins.

Can the decision be appealed or challenged?

A UDRP decision can be challenged in court by either party. The UDRP expressly preserves the right of any party – complainant or respondent – to submit the dispute to a court of competent jurisdiction before, during, or after the proceeding. A respondent who lost a UDRP transfer order can file suit within the registrar's standard implementation window (typically 10 business days after notification of the decision) to seek a stay of the transfer while the court action proceeds. A court that then rules in the registrant's favor can reverse or void the transfer.

This mutual right of recourse is why we treat UDRP and court action as complementary tools, not competing ones. A brand owner who wins a UDRP transfer but suspects the registrant will file a retaliatory lawsuit should have a court strategy ready. Equally, a registrant facing a UDRP complaint should consider whether a declaratory judgment action in a favorable jurisdiction would protect their position more reliably than a UDRP response alone.

Court appeals of first-instance court judgments follow the appellate procedure of the relevant jurisdiction. These vary substantially across systems. For matters reaching national courts outside the client's home jurisdiction, COGNOMEN works with local litigation counsel in the relevant jurisdiction to assess the appellate calendar and costs before a first-instance action is commenced.

What is the deadline once a case starts?

Deadlines in a UDRP proceeding are fixed by the Rules. Once a complaint commences, the respondent has 20 days to file a response. Missing that deadline results in default. The overall UDRP timeline to a decision is roughly 45 to 60 days for a standard single-panel case. WIPO's expedited option can deliver a decision in approximately one month for eligible single-panel cases involving up to five domains. These timelines are set by the procedure; neither party can unilaterally extend them without the panel's permission.

In a court action, the applicable limitation period is the first deadline to assess. National anticybersquatting statutes and trademark laws each carry their own limitation rules. Filing a UDRP complaint does not toll or extend a court limitation period, and waiting through a UDRP proceeding before deciding whether to litigate can, in some jurisdictions, narrow the window available for court action. This is a point we flag at the outset of every matter where litigation is a possible route.

Once a court action is filed, interim deadlines – for service, for a temporary restraining order hearing, for document exchange – depend entirely on the jurisdiction and the court's docket. The short answer for any brand owner who believes court action may be necessary is: get advice early, before the UDRP clock runs and before a limitation period closes.