Step-by-step: defend a .xyz domain acquired as an investment

Step-by-step: defend a .xyz domain acquired as an investment. UDRP and ccTLD domain recovery and defense across .xyz. Email the firm to assess your case.

A complaint lands in your inbox. A brand owner claims your .xyz investment domain infringes its mark, and WIPO has commenced a proceeding. You have 20 days to respond. The domain cost you a registration fee. The complainant wants it for free. That is the economic reality of a UDRP complaint against a domain investor — and it is also why the defense, when it is well-built, matters.

To defend a .xyz domain acquired as an investment under the UDRP, you must defeat at least one of the three elements of Paragraph 4(a): confusing similarity to the complainant's mark, your lack of rights or legitimate interests, or the domain's registration and use in bad faith — all three must be proven by the complainant simultaneously. The .xyz registry operates under ICANN's accreditation and applies the standard UDRP, meaning the full body of UDRP jurisprudence governs your case at WIPO or the Forum. A response must be filed within 20 days of commencement or the registrant defaults.

This guide walks each step, names the trap hidden in it, and explains how to build a legitimate-interest record that survives panel scrutiny — including when an RDNH finding is realistically on the table.

Step 1: Does the UDRP Actually Apply to Your .xyz Domain?

The .xyz TLD operates under a standard ICANN-accredited registry agreement, and every ICANN-accredited registrar is bound by the UDRP. That means the Policy applies to your domain regardless of where the registrar is located or where you are based. WIPO and the Forum both accept .xyz complaints, and panels apply the same three-element test they use for .com.

The trap at this step is assuming the rules differ for new gTLDs. They do not — the UDRP text is identical. What differs is that .xyz was opened specifically as a generic string with no industry or geographic restriction, a fact that can actually help a respondent's legitimate-interest argument. A domain that incorporates a common word followed by .xyz carries a weaker inherent association with any one brand than the same string under .com. Panels have recognized that the choice of a generic or open TLD can inform the registration-intent analysis — though it does not displace the core three-element framework.

One procedural point matters here. The URS — the Uniform Rapid Suspension procedure — is also available for .xyz domains, because URS applies to new gTLDs. If you receive a URS rather than a UDRP complaint, the timeline is compressed and the standard is "clear and convincing evidence" rather than the preponderance standard common under the UDRP. URS decisions result in suspension, not transfer. That is a meaningful distinction: a suspended domain is not lost permanently. We address URS separately in our FAQ on URS suspension for new gTLD domains; this guide focuses on the UDRP path.

Step 2: Map What the Complainant Must Prove — and Where Their Case Is Weakest

Before drafting a single word of your response, read the complaint through the lens of what the complainant must establish, not what it alleges. Complainants control the narrative in the complaint. Your job is to isolate the element they cannot prove — or the element where the evidence actually runs against them.

The three UDRP elements are cumulative. Defeat any one and the complaint fails. Here is how each plays out for a domain investor holding a .xyz:

Element one: confusing similarity. This is rarely where investment-domain defenses are won. If the domain contains the complainant's registered mark in full, most panels will find confusing similarity even if the complainant's mark is not globally famous. The TLD is usually disregarded. Your energy is better spent on elements two and three.

Element two: rights or legitimate interests. This is the core battleground for domain investors. The Paragraph 4(c) safe harbors list the main pathways: a bona fide offering of goods or services before any notice of the dispute; being commonly known by the domain name; and legitimate noncommercial or fair use. For an investment domain, the first pathway — bona fide offering — is typically the most viable. The trap here is that "offering a domain for sale" is not, on its own, a bona fide offering of goods or services. Panels distinguish between generically valuable domains offered on the open market and domains whose value derives specifically from their correspondence to the complainant's mark. That distinction decides cases.

Element three: registration and use in bad faith. Both limbs must be established — the domain must have been registered in bad faith and be used in bad faith. If you registered the domain before the complainant's mark existed, or before the complainant achieved any trademark rights, registration in bad faith is very difficult to prove. That timeline question is therefore one of the first things we examine in any respondent engagement.

For a focused read on whether all three UDRP elements are met in your specific case, reach us at info@cognomenlaw.com.

How Do You Build a Legitimate-Interest Record as a Domain Investor?

A domain investor's legitimate-interest record is built from documents, not from declarations. Panels are appropriately skeptical of self-serving statements made after a complaint is filed. The weight of your response comes from contemporaneous evidence — records that predate the complaint and demonstrate the investment was made on a generic or descriptive basis, not to exploit the complainant's mark.

The following categories of evidence consistently carry weight across WIPO panels:

• Registration date vs. mark date. Establish precisely when the complainant's mark was first filed, when it registered, and when the mark acquired commercial recognition. If your registration precedes any of those points, document it with WHOIS history, registration confirmation emails, and the complainant's own trademark register entry. A complainant cannot prove bad-faith registration if the mark did not exist when you registered.
• Generic or dictionary character of the string. If the domain is a common word, a geographic term, an acronym with multiple expansions, or a descriptive phrase, compile that evidence. Dictionary definitions, search results, industry usage, and third-party registration patterns for the same string in other TLDs all support a finding that the term was sought for its generic value.
• Business model documentation. Evidence that you participate in domain investment as a business — registration of other generic domains, prior sales, listing on recognized aftermarket platforms, domain portfolio records — contextualizes the specific registration. A single domain held in isolation with no surrounding portfolio is harder to defend than a domain within a documented investment practice.
• No targeting of the complainant. Demonstrate that you did not know of the complainant at the time of registration, or that the complainant was not prominent in any market you could plausibly have targeted. Thin trademark rights — a mark registered in one country with no international presence — support the inference that you were not targeting that mark.
• Content of any website or parking page. If the domain resolved to a parking page carrying pay-per-click links, examine those links carefully. Panels treat parking pages as evidence of bad faith if the links are directed at the complainant's industry or competitors. A parking page with links related to the generic meaning of the word is in a far better position than one serving ads that compete with the complainant's products.

In a recent matter — a .xyz investment domain, spring 2025 — we built the legitimate-interest record around the generic dictionary character of the string, pre-dating evidence of the complainant's trademark filing, and a documented portfolio of similar generic-word registrations. The panel found the complainant had not established an absence of legitimate interest. No transfer was ordered.

Step 3: Is an RDNH Finding Realistic, and Should You Pursue It?

Reverse Domain Name Hijacking — an RDNH finding — occurs when a panel determines that the complaint was brought in bad faith to deprive a legitimate registrant of its domain. The finding is reputational, not monetary: the UDRP has no cost-award mechanism. But an RDNH finding is on the public record, published in the case decision, and indexed in WIPO's database. For serial complainants and their counsel, that matters.

When is RDNH realistic? The consensus across WIPO panels points to a cluster of scenarios: the complainant knew or should have known that the respondent held the domain legitimately (especially where registration predates the mark); the complaint relies on a thin or recently acquired mark clearly assembled to manufacture UDRP standing; the complainant launched the proceeding without any attempt to contact the respondent; or the complaint is factually inconsistent in ways that a competent attorney would have identified before filing.

The trap at this step is treating RDNH as an automatic add-on. Requesting an RDNH finding in a case where the complaint was weak but not abusive can read as overreach, and it does not strengthen the legitimate-interest defense. We assess RDNH as a distinct question: is there evidence that the complainant acted in bad faith in commencing this proceeding, separate from whether it can prove its case? If yes, we argue it. If the complaint is simply mistaken or overeager, we focus on defeating the elements.

Requesting a three-member panel is a related tactical decision. Where an RDNH finding is realistic, a three-member panel — which the respondent may request, with the parties generally splitting the higher forum fee — provides a richer deliberative record and, panels being collegial institutions, a somewhat higher statistical likelihood of a dissent or a strongly worded published opinion. That published reasoning becomes a precedent-level resource for future cases. We discuss the panel-size question further in Step 5 below.

Step 4: Drafting the Response — Structure and the Traps Inside It

A UDRP response is not a complaint in reverse. Its purpose is narrow: give the panel a clear, document-supported basis to deny transfer on at least one element. Every word that does not serve that purpose risks diluting the argument.

Effective responses follow a consistent structure. Open with the registration context — who you are, when you registered, and why. State the generic or descriptive character of the string immediately. Then address element two first (legitimate interest), because that is where most investor defenses are decided. Address element three (bad faith) second, focusing on the registration-date timeline and the absence of targeting conduct. Address element one only to the extent you have a genuine confusing-similarity argument — this is rare, and arguing it weakly suggests to the panel that you are padding.

The trap in drafting is the unsupported assertion. Panels discount statements of the form "I registered this domain because I believed it had generic value" unless contemporaneous evidence supports that belief. The response should read as a record supported by annexes, not as a narrative asking the panel to take the respondent's word for it.

What to annex: WHOIS history; trademark office search results showing the complainant's filing and registration dates; screenshots of the domain's content at or near the time of registration (use the Wayback Machine if available); portfolio evidence; correspondence with third parties about the domain; any prior offers made to the complainant, if you initiated them, carefully framed (uninvited sale offers directed at the mark owner can hurt, not help).

Keep the response concise. WIPO imposes a word limit under its Supplemental Rules. Filing a response that requires leave for additional pages can signal disorganization. Panels read dozens of responses; a tight, well-organized filing with clear annexures is more persuasive than a lengthy argument that buries the key point.

If a prior response produced a decision you believe was decided on an incomplete record, a focused second read can identify the element that was missed. Email info@cognomenlaw.com to discuss your options.

Step 5: Forum Choice, Three-Member Panels, and the Cross-Zone Angle

In a UDRP proceeding the complainant selects the forum — WIPO, the Forum, CAC, or ADNDRC. You do not choose where the case is filed. What you can choose, within the Rules, is whether to request a three-member panel. If the complainant chose a single panelist, you may request three. The additional forum fee — bringing the total to USD 4,000 at WIPO for a three-member panel on one to five domains, versus USD 1,500 for a single panelist — is generally split between the parties when the respondent triggers the upgrade.

The tactical calculus is straightforward. For a domain with meaningful investment value, the cost differential is small relative to the asset. For a domain that cost a registration fee, the economics are different. The decision turns on two factors: the strength of the RDNH argument (three-member panels produce richer published reasoning), and whether the case turns on a genuinely contested legal point where panel diversity adds deliberative value. A strong, document-supported legitimate-interest defense can win before a single panelist.

Now consider the cross-zone dimension. What if you hold the same string in both .xyz and another zone — .com, or a ccTLD? A complaint that covers only the .xyz registration leaves the other domains intact — but a brand owner who loses a UDRP can refile against the other registrations. If the brand owner holds a .com or ccTLD with stronger rights, the defensive position on element one may be weaker there. Conversely, a respondent who defeats a complaint against .xyz on a well-documented generic record creates a persuasive record for any subsequent proceeding against related domains.

For investors holding a domain in a ccTLD alongside .xyz, the governing procedure for the ccTLD may differ entirely. A .de domain is not governed by the UDRP — disputes proceed through the German courts, and DENIC offers a dispute entry to block transfer while litigation proceeds. A .eu dispute is administered under EURid's ADR.eu rules with distinct eligibility requirements. We handle the ccTLD angle in our guide to defending investment domains in other jurisdictions.

Step 6: After the Decision — What Happens and What You Can Do

A UDRP decision is not self-executing. When a panel orders transfer, there is a 10-business-day implementation window during which you may file a court action in a "Mutual Jurisdiction" (either the registrar's principal place of business or the registrant's domicile, as specified in the Policy) to stay the transfer. Filing in court within that window halts the registrar's obligation to implement the decision. That is a meaningful right — but it requires immediate legal mobilization and cooperation with local litigation counsel in the relevant jurisdiction.

The economics of pursuing a court stay must be weighed against the domain's value. For a high-value investment domain, the court action may be worth pursuing. For a low-cost registration, it often is not. The decision is fact-specific and urgent.

If the panel denies transfer — the complaint fails — the domain remains in your control and the brand owner faces a higher bar to bring the same claim again. Refiling a substantially identical complaint is generally barred under UDRP principles except where new facts arise. A documented panel decision in your favor, especially one with an RDNH finding, is a significant deterrent to future claims by the same complainant or its affiliates.

In a second recent matter — a .xyz investment domain, late 2024 — we secured denial of transfer on element three, with the panel expressly noting that the complainant had not established registration in bad faith given the domain's pre-mark registration date. The complainant's subsequent attempt to reframe the claim around a different mark class was denied by the registrar as a resubmission of a substantially identical complaint.

Related at COGNOMEN

• UDRP Respondent Defense and RDNH — full service overview for domain registrants facing complaints
• Defending an investment domain in cross-border and ccTLD proceedings
• FAQ: URS suspension for new gTLD domains — how it differs from the UDRP