Step-by-step: recover a .app domain confusingly similar to your trade…

Step-by-step: recover a .app domain confusingly similar to your trade. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your ca…

A brand owner searches for their product name and finds a .app domain registered by a stranger. The site may be parked, phishing-adjacent, or simply a placeholder waiting for an offer. Google enforces HTTPS on every .app domain, which means the squatter's page carries the green lock — and looks legitimate to users who do not check the registrant. That detail matters when you are calculating harm.

To recover a .app domain confusingly similar to your trademark, you must satisfy all three elements of Paragraph 4(a) of the UDRP: confusing similarity to a mark you hold, no legitimate interest on the part of the registrant, and registration together with use in bad faith. The WIPO filing fee for a single-member panel starts at USD 1,500, and a standard case runs approximately two months from filing to a transfer order. Transfer or cancellation are the only remedies available.

This guide walks each step in sequence, flags the trap hidden in each one, and closes with the evidence and forum choices that decide whether you prevail.

Why .app specifically — and what procedure applies?

.app is a generic top-level domain (gTLD) operated by Google Registry, launched during ICANN's new gTLD program. Because it is a gTLD and accredited registrars are ICANN-bound, the Uniform Domain Name Dispute Resolution Policy — the UDRP — applies directly. That means WIPO, the Forum, CAC, and ADNDRC all have jurisdiction to hear complaints about .app names, exactly as they would for .com.

The trap at this step: some brand owners assume .app disputes follow a bespoke Google procedure. They do not. Google Registry manages the zone technically; dispute resolution belongs to ICANN-accredited panels. Do not approach Google Registry as though it were a court or an arbitral body — escalate there only for clear abuse of registration policies, and separately file a UDRP complaint if a transfer is your goal.

One practical distinction does exist. Because .app sits within the new-gTLD round, the Trademark Clearinghouse (TMCH) was available during its launch sunrise period. If the registrant used sunrise or claims-notice protections, that history forms part of the legitimate-interest analysis — but it does not block a UDRP complaint if the other two elements are met.

If you are unsure whether your situation fits the UDRP or whether a faster URS suspension might serve the same purpose, reach us at info@cognomenlaw.com for an initial assessment.

Step 1: Confirm you hold trademark rights — and that the domain is confusingly similar

The first element of Paragraph 4(a) is the gateway: without rights in a mark, you cannot proceed. The UDRP accepts registered and, in many cases, unregistered (common-law) trademark rights, provided you can demonstrate use in commerce sufficient to establish secondary meaning. Registered rights are easier to prove and harder to challenge.

Confusing similarity is assessed on a comparison between the mark and the domain string, largely ignoring the TLD suffix and any generic additions. Panels have consistently held that appending ".app" does not distinguish a domain from the underlying mark. Where a registrant adds a generic word — "yourmark-app.app", "getyourmark.app", "yourmarkapp.app" — the addition typically reinforces rather than dispels confusion, because the word "app" is descriptive of the zone itself.

The trap here is over-relying on a registered mark that post-dates the domain's registration. While post-filing trademark registration does not automatically defeat the complaint on element one — panels generally find confusing similarity as of the complaint date — it creates a real problem on the bad-faith element, which requires the registrant to have been targeting your rights at the time of registration. If your mark was not yet filed when the domain was registered, the case becomes considerably harder. Address this in Step 3.

Practical checklist before moving to Step 2:

• Identify your registered trademark: jurisdiction, registration number, goods and services class, and priority date.
• Run a WHOIS/RDDS search on the .app domain and capture the creation date.
• Map every element of the domain string against your mark: prefix, suffix, and any additional words.
• Note whether the registrant used the domain with branding, color scheme, or imagery associated with your goods or services — that evidence is stronger than bare parking.

Step 2: Build the legitimate-interest record — and anticipate the respondent's safe harbors

The second element asks whether the registrant has any right or legitimate interest in the domain. The burden shifts: once a complainant makes a prima facie case, the respondent must come forward with evidence of legitimacy under Paragraph 4(c).

The three safe harbors in Paragraph 4(c) are the registrant's main defenses. They are: a bona fide offering of goods or services before notice of the dispute; being commonly known by the domain name; and legitimate noncommercial or fair use without intent to mislead. Your job, at this step, is to gather evidence that none of them applies.

How do you do that? Start with the Wayback Machine and any archived version of the site. A parked page with pay-per-click (PPC) links, especially links pointing at your competitors or your own brand category, is the clearest signal that no bona fide offering exists. Screenshot every archived iteration. Then check whether the registrant has any trademark of their own that corresponds to the domain string — a business registration, a social media presence, a trading name that predates your complaint notice date. If you can show no such presence exists, you have made the prima facie case.

The trap: panels have denied complaints where a complainant dismissed a respondent's claimed use too quickly. A respondent who ran even a modest legitimate business under a similar name before receiving your complaint notice can defeat element two. Do not assume absence of a big web presence means absence of rights. Search trademark databases in the registrant's apparent jurisdiction, run corporate-name searches, and check the registrant's WHOIS history. Due diligence here prevents an unnecessary loss.

Step 3: Establish bad faith — the element that decides most cases

Bad faith under Paragraph 4(b) must be shown at registration and in use — both limbs are required under the UDRP, unlike some ccTLD procedures that read "or." This cumulative standard is the most common stumbling block.

Panels have consistently held that the four non-exhaustive circumstances in Paragraph 4(b) include: registering primarily to sell to the mark owner at a price exceeding documented out-of-pocket costs; registering to disrupt a competitor's business; registering to attract users for commercial gain by creating a likelihood of confusion; and a pattern of abusive registrations across multiple mark holders. For .app disputes, the "commercial gain by confusion" ground is frequently the most relevant — because .app names are inherently associated with software products and services, a domain that mimics a software brand is facially targeted at the brand's customer base.

What decides the element in practice? The most reliable evidence chain is: (1) the registrant's knowledge of your mark at the time of registration, shown through the mark's fame, prior use in the registrant's jurisdiction, or direct correspondence; (2) the domain's use for PPC links, phishing, or redirect to competitors; and (3) a demand for payment that exceeds documented registration costs. Any one of these is strong. Two together are usually decisive.

The timing trap is critical. If your mark was registered or achieved secondary meaning after the .app domain was created, the registrant could not have targeted your rights. You will need to show either that the mark predates the domain or that the registrant had independent notice of your trading name before filing. Common-law rights established well before the registration date can close the gap — but you need contemporaneous evidence: press coverage, sales records, invoices, third-party references.

In a recent matter involving a .app domain — autumn 2025 — we assembled a bad-faith record from archived PPC pages, a prior cease-and-desist email that went unanswered, and a WHOIS creation date that post-dated the client's trademark filing by approximately three weeks. The panel transferred the domain on all three elements without a hearing.

If you are reviewing a .app dispute where the domain predates your registered mark, email info@cognomenlaw.com before filing — the strategy depends on what common-law evidence you hold.

Step 4: Choose a forum and file the complaint

For .app disputes, all four ICANN-accredited UDRP providers accept complaints. The realistic choice is between WIPO and the Forum, which together handle approximately 97% of all UDRP proceedings. CAC offers the lowest entry fee — beginning around USD 500–800 for a single domain — but it is the least frequently used of the four, and panel depth for new-gTLD cases is broader at WIPO. ADNDRC is generally selected when the registrant is based in Asia and the complainant wants a regionally experienced panel.

WIPO's single-member panel fee is USD 1,500 for one to five domains. If you need three panelists — appropriate where the case involves a contested legitimate-interest defense or a high-value domain — that fee rises to USD 4,000. The Forum's entry fee starts around USD 1,300 for one to two domains, single-member panel. Legal fees are separate and vary with case complexity.

The decision matrix runs like this. If speed is the priority and the facts are clear-cut — a parked .app domain, a strong registered mark, no apparent legitimate-interest defense — file a single-member WIPO complaint. If the registrant is likely to contest aggressively, a three-member panel adds credibility and reduces the risk of an adverse decision that creates an adverse precedent. If you are pursuing more than one domain across the same registrant's portfolio, a single complaint can cover multiple names held by the same holder, which reduces both filing cost and the risk of the registrant transferring names between submission and decision.

What about URS? The Uniform Rapid Suspension system is available for .app domains as a new gTLD. URS suspends the domain — it does not transfer it. If your goal is to get the domain back in your portfolio, URS does not accomplish that. It is appropriate only if suspension alone (preventing the registrant from using the domain for the rest of the registration term) is sufficient, or as a holding measure while a parallel action is filed. The evidentiary standard for URS is also higher — "clear and convincing" rather than the preponderance standard used in UDRP.

The trap at filing: a complaint that is formally deficient — missing an exhibit, wrong registrant name, no description of the domain's current use — can be returned for correction, which restarts the clock. WIPO's Center will review formal compliance before commencement, but substance gaps (thin evidence, poorly argued bad faith) are not caught at that stage; they appear in the panel decision.

Step 5: Manage the 20-day response window

Once the case commences, the respondent has 20 days to file a response. During that window, a complainant's choices are limited. You can monitor the registrar lock (the domain should be locked in place by the provider once the case commences). You cannot unilaterally withdraw without potentially losing the filing fee. If the registrant reaches out to negotiate, any settlement must be documented and communicated to the provider to suspend proceedings.

Default — the registrant's failure to file a response — does not guarantee a transfer. Panels decide on the merits of the complaint even when no response is filed. A weak complaint is denied even in default. The panel's job is to determine whether the complainant has made out all three elements, regardless of whether the other side participated.

The trap: some complainants assume a default means an automatic win. Panels have consistently denied complaints where the evidence of bad faith was thin, even with no response from the registrant. File a complete, evidence-rich complaint on day one — do not rely on the respondent's silence to carry a deficient filing.

Step 6: Assess the panel decision and implement the transfer

A standard UDRP case at WIPO runs approximately two months from commencement to a decision. After the panel issues its ruling, there is a mandatory ten-business-day waiting period before the registrar implements the transfer, allowing a respondent who wishes to seek court relief to act. In practice, the great majority of registrants do not seek court review, and the registrar executes the transfer at the end of the waiting period.

If the complaint is denied, you cannot refile the same complaint on the same facts before the same or another UDRP provider — that is res judicata under the Rules. You may, however, pursue a national court action, and a denial does not preclude court proceedings. For a .app domain, US anticybersquatting litigation in federal court remains available where the registrant has a US nexus and damages — not merely transfer — are sought. That route involves substantially higher cost and timeline; engage local litigation counsel if court action becomes necessary.

Reverse Domain Name Hijacking (RDNH): if the panel finds your complaint was brought in bad faith — typically where the complainant knew the registrant had a legitimate claim yet filed anyway — an RDNH finding is entered. There is no monetary penalty, but the reputational effect for a brand that abuses the UDRP is real. We have seen RDNH findings influence how subsequent panels treat repeat complainants.

In a recent matter involving a European software company (a .app dispute, spring 2025), the complainant's mark had been registered approximately six months after the domain's creation date. Rather than file on a weak bad-faith record, we advised pursuing a documented negotiation first, backed by evidence of the brand's common-law priority. The registrant accepted a transfer at a modest price — well below what UDRP litigation would have cost — avoiding both the filing cost and the risk of an RDNH finding.

Related at COGNOMEN

• UDRP domain recovery — full service for gTLD complainants, including .app, .com, and new gTLDs
• Confusingly similar trademark analysis in domain disputes — how panels apply the test across zones
• URS and TMCH claims notices for new gTLDs — when suspension is the right tool