Step-by-step: bring a court action when UDRP cannot reach a .cloud do…

Step-by-step: bring a court action when UDRP cannot reach a .cloud do. UDRP and ccTLD domain recovery and defense across .cloud. Email the firm to assess your…

A brand owner discovers that a .cloud domain matching its trademark has been registered by a stranger, redirected to a competitor's site, or used to send phishing emails to its customers. The UDRP looks like the obvious tool. But the situation may call for something the UDRP simply cannot deliver: monetary damages, an injunction, evidence obtained under court order, or a remedy against a registrant who cannot be found through WHOIS/RDDS.

To bring a court action when the UDRP cannot reach a .cloud domain, a brand owner must identify the applicable national court – typically the court with jurisdiction over the registrant's location or over conduct in the relevant territory – and pursue a statutory or common-law cybersquatting or trademark infringement claim that the UDRP does not offer. Unlike UDRP arbitration, court proceedings can award monetary damages, issue injunctions, compel discovery, and reach situations where bad-faith conduct falls outside the UDRP's narrow transfer-or-cancellation remedy. The UDRP filing fee for .cloud domains at WIPO starts at USD 1,500 for a single-member panel; court litigation costs substantially more, but it reaches what arbitration cannot.

This guide walks each step in sequence, names the trap hidden in each, and explains where the .cloud zone creates both opportunity and complication. Following WIPO's record caseload of 6,282 cases in 2025, domain disputes – including .cloud – are rising; understanding when to step outside arbitration is now a practical necessity for brand counsel.

Does the UDRP actually apply to .cloud, and when does it fall short?

The UDRP applies to .cloud because it is a new gTLD, and all ICANN-accredited registrars for new gTLDs are contractually bound by the Policy. A brand owner can file a UDRP complaint against a .cloud registrant at WIPO, the Forum, CAC, or ADNDRC, following the same three-element test that governs .com disputes. That is the good news. The limitation is the remedy: the only UDRP remedies are transfer or cancellation. No damages. No injunction. No costs award against an abusive registrant.

Several situations make a court route the better or the only path. First, if the registrant has already profited – through paid clicks, fraudulent sales, or diversion of customer payments – the financial harm cannot be undone by a transfer. Second, if the domain has been used in a phishing or fraud scheme, you may need law enforcement cooperation that only a court order can compel. Third, if the registrant is hiding behind a privacy service and the registrar will not disclose identity voluntarily, a court subpoena or equivalent discovery order is the mechanism. Fourth, if the abusive registration involves conduct that your jurisdiction treats as a tort or as a statutory violation carrying its own remedies – US anticybersquatting litigation is the clearest example – court offers a path that arbitration does not.

We regularly advise brand owners who have already won a UDRP transfer but still face a damages gap. The UDRP closed the naming problem; it did not close the financial one.

To assess whether your .cloud matter calls for court action rather than – or alongside – UDRP, contact info@cognomenlaw.com.

Step 1: Map the jurisdictional options before you file anything

Jurisdiction is the first trap. A brand owner eager to recover a .cloud domain often files a UDRP complaint immediately, without asking whether a parallel or sequential court proceeding would deliver more. The right question is: which court, in which country, can reach this registrant – and which remedy do you actually need?

For most brand owners, the most accessible court options are (a) the courts of the country where the registrant is located; (b) the courts of the country where the brand owner operates and where the harm is felt; or (c) in the United States, the federal courts under US anticybersquatting legislation, which can also proceed against a domain itself – a so-called in rem action – even when the registrant cannot be located personally. That in rem route is particularly useful for .cloud domains registered behind privacy services, because it attaches to the domain as property rather than to a person.

The trap in Step 1: assuming that a UDRP win makes court action unnecessary. It does not, in any case where the harm extends beyond the naming dispute. File the UDRP if you need the domain back quickly – a standard case runs about two months – but do not let that clock run out your court statute of limitations. In several jurisdictions, the limitation period for trademark or cybersquatting claims runs from the date of registration, not from the date of the UDRP outcome. Parallel planning is essential.

In our practice, we assess both routes at the outset for every new matter where financial harm is alleged or where the registrant's identity is concealed. That dual analysis is the only way to avoid foreclosing a remedy that the client needs.

Step 2: Establish and document the trademark rights you hold

Court proceedings, like the UDRP, begin with proof of rights in a name. But the standard and scope differ. Under Paragraph 4(a)(i) of the UDRP, it is sufficient to show that the domain is identical or confusingly similar to a trademark in which the complainant has rights. A court may require proof of registered trademark, common-law rights established through use, secondary meaning, or a combination – depending on the applicable national law.

Assemble the following before the first meeting with court counsel: all registered trademark certificates for the mark, covering the relevant goods and services and the relevant jurisdiction; evidence of continuous use in commerce – sales records, advertising invoices, screenshots, brand guidelines; records of the domain's registration date versus the trademark's first-use date; and prior UDRP decisions involving the same mark if any exist, even if those decisions covered different zones.

The trap in Step 2: relying on a trademark registration in one jurisdiction as proof of rights worldwide. Courts generally apply national law. A registration in the European Union does not, by itself, establish rights in a US court, and vice versa. Local litigation counsel in the relevant jurisdiction will advise on what the applicable national trademark act requires. We work with local litigation counsel in each territory and coordinate the overall strategy from the domain-law side.

Step 3: Secure the domain before you serve process

A registrant who learns that court action is coming will move the domain. Transfer to a new registrar in a different jurisdiction, sale to a third party, or simply deletion – any of those can extinguish or complicate the remedy you are pursuing. The domain must be locked before the registrant has notice of the proceeding.

The standard tool is a registrar lock combined with an interim injunction or temporary restraining order from the court. The registrar-lock mechanism works as follows: you present the registrar with the court order (or in some jurisdictions, a formal demand letter supported by the filed complaint), and the registrar places the domain in a server-hold status that prevents transfer, deletion, or modification of registrant data. ICANN's Registrar Accreditation Agreement requires registrars to comply with valid court orders, but the procedure for submitting the order and the speed of implementation vary significantly by registrar.

For .cloud, the registry operator's terms must also be checked. Some new gTLD registries impose their own hold procedures that run parallel to the registrar's; others rely entirely on the registrar. Verify both layers before you serve the complaint.

The trap in Step 3: serving the complaint on the registrant before the lock is in place. Once the registrant has notice – even informal notice through a demand letter – the race to the registry begins. In a recent matter (a new gTLD cybersquatting case, spring 2025), we coordinated a registrar-lock request and an ex parte temporary restraining order simultaneously, which prevented a same-day transfer the registrant had already attempted.

For a read on whether the three UDRP elements are met alongside your court action requirements, reach us at info@cognomenlaw.com.

Step 4: Build the evidence record that court demands

Evidence that wins a UDRP case does not automatically meet the standard for a court action. Panels work on a balance of probabilities under the Rules, largely on written submissions. Courts require evidence admissible under the procedural rules of the relevant jurisdiction, and they can compel production of what the registrant will not give voluntarily.

The core evidence categories for a .cloud court action are:

• Identity and registration records: WHOIS/RDDS historical data showing registration date, registrant contact, changes in ownership or registrar, and any privacy-service disclosure. Where these are unavailable through public channels, a court order addressed to the registrar or registry can compel production.
• Screenshot and archive evidence: time-stamped captures of the domain's use – pay-per-click pages, redirect targets, fake storefronts, phishing content – ideally from a notarized or court-certified service to meet evidentiary standards.
• Financial harm evidence: customer complaints, diverted sales records, fraudulent invoices or payment instructions bearing your brand, and any quantifiable loss of business attributable to the domain's use.
• Bad-faith indicators: evidence of the registrant's awareness of your mark at the time of registration, offers to sell at above-registration-cost prices, a pattern of registrations targeting your brand family, and any communications demanding payment.
• Prior dispute history: if prior UDRP or ccTLD proceedings have involved the same registrant or the same mark, those decisions are relevant context even if not binding on the court.

The trap in Step 4: gathering evidence informally and then discovering it is inadmissible. Screenshots taken through a personal browser without a certified timestamp, or communications obtained without disclosure, can undermine the entire case. Evidence collection should follow the standard your local litigation counsel advises before you accumulate it.

Step 5: Choose the right court route for the specific harm

Not all court routes are equal. The right path depends on what you are trying to accomplish, where the registrant is located, and what the applicable national law offers.

Where the registrant is located in the United States and you want damages and a transfer, US anticybersquatting litigation in federal court is the most direct route. The in rem variant is available for .cloud as a gTLD when the registrant cannot be found personally; the court asserts jurisdiction over the domain itself. This is procedurally efficient when a privacy service is blocking identity disclosure.

Where the harm is concentrated in a specific European jurisdiction and the registrant operates there, local trademark infringement or passing-off proceedings may be faster and more familiar to the court. An interim injunction can be granted on an ex parte basis in many EU member states, and it can be served on the registrar through the EU's civil procedure mechanisms.

Where the domain is being used in a fraud or phishing scheme, a criminal complaint filed with the competent national authority may run alongside a civil claim. Criminal proceedings can compel disclosure of registrant identity and freeze assets that a civil court would not reach as quickly.

Where none of the above fits cleanly – because the registrant is in a jurisdiction with no cybersquatting statute and no clear trademark tort – the practical path may be a combination: a UDRP complaint for the transfer, a court action in the registrant's jurisdiction for damages under the applicable national law, and a DENIC-style dispute entry if a parallel ccTLD is involved. We map each scenario individually, because no template resolves a cross-border dispute cleanly.

Step 6: Run the UDRP and court action in parallel where the rules allow

The UDRP Rules do not bar a complainant from pursuing a court action concurrently. Paragraph 4(k) of the UDRP expressly preserves the right of either party to submit the dispute to a court of competent jurisdiction for independent resolution before, during, or after a UDRP proceeding. This matters enormously for .cloud domain recovery strategy.

A parallel approach works as follows. File the UDRP complaint at WIPO to obtain the transfer quickly – within the approximately two-month standard timeline – while simultaneously filing a court action (or at minimum preserving the claim with a tolling agreement if limitation periods are a concern) to pursue damages and any injunctive relief the UDRP cannot provide. The UDRP decision, if it finds bad faith, becomes a powerful piece of evidence in the court proceeding. The court action addresses what the UDRP left open.

The trap in Step 6: assuming that filing court proceedings automatically stays the UDRP. It does not unless the court issues an order staying arbitration or the parties agree to a suspension. A respondent who files in court to delay a UDRP outcome – a tactic we have seen repeatedly – may still face the UDRP timeline running. Panels have consistently held that a court filing by a respondent intended primarily to obstruct the arbitration does not, on its own, suspend the proceeding.

In our practice, we have defended registrants and pursued complainants in matters where this interaction between the UDRP and a pending court action was the central tactical question. The analysis is fact-specific each time.

Step 7: After the court order – implementing the transfer

A court judgment ordering transfer of a .cloud domain is not self-executing. You must present it to the registrar and, in some cases, to the registry operator, and then follow the technical process to place the domain in your control. Several points of friction are common at this stage.

First, the registrar may be in a different jurisdiction from the court that issued the order. Some registrars accept foreign court orders; others require a domestic court to re-issue or recognize the order under the applicable private international law principles. Local litigation counsel in the registrant's or registrar's jurisdiction handles this step.

Second, the domain's registry – the .cloud registry operator – may impose its own technical hold or verification step before implementing a court-ordered transfer. Confirm the registry's procedure for court orders before you present the judgment; some registries have a dedicated abuse or legal channel.

Third, after transfer you should conduct a technical audit of the domain: verify DNS records, check for any residual redirect rules or malware injection in content previously served from the domain, and confirm that the domain is no longer associated with the registrant's email or other services. A transferred domain that still resolves to old content can create new legal exposure.

The trap in Step 7: treating the court order as the finish line. Execution – the actual transfer and verification – requires its own coordinated effort, and in our experience it is the step most often underestimated in timeline planning.

Related at COGNOMEN

• Court action and domain recovery: full service overview for gTLD and ccTLD disputes
• Registrar lock escalation and transfer reversal for stolen or hijacked domains
• New gTLD launch protection and AI-era brand risk: analysis for brand owners