Step-by-step: file a UDRP complaint for a .app domain

Step-by-step: file a UDRP complaint for a .app domain. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your case.

A developer or competitor registers the .app that carries your brand name, parks it behind a placeholder page, and quietly waits. You want it transferred. The question is what the fastest, most cost-effective path looks like – and where the traps are.

To file a UDRP complaint for a .app domain, you must satisfy all three elements of Paragraph 4(a) of the Policy: the domain must be identical or confusingly similar to a mark you hold; the registrant must lack rights or legitimate interests; and the domain must have been registered and used in bad faith. Because .app is a new generic top-level domain (new gTLD) operated by Google Registry and subject to ICANN's standard accreditation terms, the UDRP applies in full. A standard case runs about two months from filing to decision, and the only remedies available are transfer or cancellation.

This guide follows every step you must take, in order, and flags the practical trap hidden inside each one.

Why does the UDRP apply to .app, and what does that mean for your complaint?

The UDRP applies to .app because every registrar accredited by ICANN to sell new gTLD registrations is contractually required to incorporate the Policy. .app launched in 2018 under Google Registry as a restricted new gTLD – restricted to HTTPS-only content. That technical restriction does not change the dispute rules. Any trademark holder whose brand appears in a .app registration can file a UDRP complaint before WIPO, the Forum, the Czech Arbitration Court (CAC), or ADNDRC.

The restriction does, however, affect bad-faith analysis in a subtle way. Because .app domains require an SSL certificate and active HTTPS delivery, a pure parking page is harder to maintain invisibly than on a standard gTLD. A registrant who points a .app to a pay-per-click page – or worse, to a site impersonating your application – generates stronger bad-faith evidence than a dormant .com might. We regularly advise brand owners that the .app context makes passive-holding arguments slightly weaker for respondents and slightly stronger for complainants.

One further point: .app is not a ccTLD. It is not governed by a national registry procedure, a Nominet DRS, or a DENIC dispute block. The UDRP alone is the administrative remedy. If the UDRP falls short – for instance, because you also want monetary damages or the registrant's identity is genuinely unclear – US anticybersquatting litigation is the parallel court route, handled with local litigation counsel in the relevant jurisdiction.

Step 1: Confirm you have a qualifying trademark right

The first element of Paragraph 4(a) requires that you hold rights in a mark that is identical or confusingly similar to the disputed domain. That sounds straightforward. The trap is that "rights" is broader than a registered trademark but not unlimited.

Registered trademark rights are the cleanest basis. A national, regional, or international registration that pre-dates the domain registration is the most resilient foundation. But panels have consistently held that common-law trademark rights based on substantial and demonstrable use can also satisfy the first element – provided the evidence of that use is concrete and credible. If your mark is unregistered, you need to assemble documentation of market recognition: advertising spend, press coverage, customer testimonials, years of commercial use, and evidence that the public associates the name with your goods or services.

What trips complainants at this step? Two common mistakes. First, relying on a trademark application that has not yet matured to registration – applications do not confer UDRP rights. Second, filing a complaint for a domain that differs significantly from the mark. If your mark is NOVA TECH LABS and the domain is novatechsolutions.app, the first element may not be met unless your mark is also used in the shorter form. The confusing-similarity test under the UDRP compares the domain label (excluding the TLD) to the mark, so the .app extension itself is typically set aside in that comparison.

Before drafting a single paragraph of your complaint, confirm three things: the exact trademark you will rely on, the date of first use or registration, and the precise domain label you are challenging. If the comparison is close but not obvious, consider whether a three-member panel – which gives two additional decision-makers the chance to agree on a contested first element – is worth the higher filing fee.

For a read on whether the three UDRP elements are met in your .app dispute, reach us at info@cognomenlaw.com.

Step 2: Build the evidence record for bad faith and lack of legitimate interest

Elements two and three of Paragraph 4(a) are where most cases are actually won or lost. The complainant bears the burden on all three elements, but the practical burden on element two – lack of rights or legitimate interest – shifts somewhat once you make a prima facie showing, because the registrant is best placed to explain its own conduct.

For element three, Paragraph 4(b) of the Policy sets out a non-exhaustive list of circumstances that evidence bad faith. Four matter most in .app disputes:

• Registration primarily to sell the domain to the mark owner or a competitor at a price exceeding out-of-pocket costs.
• Registration to disrupt the business of a competitor.
• Intentional attraction of internet users for commercial gain by creating a likelihood of confusion with the complainant's mark.
• A pattern of registering domains containing the marks of others.

In a .app context, the "commercial gain by confusion" factor is especially powerful. Mobile-app users who type or tap a .app address expect to reach the app's official web presence. A third party operating a competing or deceptive site at that address leverages precisely that user expectation. Document every instance: screenshots of the site content, cached pages, RDDS/WHOIS records showing registration timing, screenshots of any offer to sell, and any communications from the registrant.

What about passive holding – a domain that resolves to nothing? Panels have consistently found bad faith even in passive-holding cases where the respondent could not plausibly have a legitimate use for a mark-identical .app domain. The key factors are the strength of the complainant's mark, the respondent's apparent awareness of it, and the absence of any credible explanation for why the registrant chose that name.

For element two, look at the Paragraph 4(c) safe harbors the respondent might assert: bona fide use before notice of the dispute, being commonly known by the name, or legitimate noncommercial or fair use. Anticipate these defenses and address them in your complaint. If the domain registered the day after your app launched in a major app store, the "bona fide pre-dispute use" defense will be hard to run. If the registrant's RDDS record shows a name that shares no obvious connection to your mark, the "commonly known" defense collapses quickly.

How do you choose the right UDRP forum for a .app complaint?

You file with a provider approved by ICANN. Four providers accept UDRP complaints for .app domains: WIPO, the Forum, CAC, and ADNDRC. WIPO and the Forum together handle roughly 97% of all UDRP proceedings.

The choice matters more than some complainants realize. The filing fee varies. WIPO charges USD 1,500 for a single-member panel covering one to five domains. The Forum's entry fee starts at approximately USD 1,300 for one to two domains on a single-member panel. CAC offers the lowest entry point, beginning around USD 500–800. ADNDRC begins around USD 1,300 for one to two domains. These are official filing fees only; legal preparation fees are separate.

The decision-maker pool also differs. WIPO draws on a large, internationally diverse panel roster with extensive published jurisprudence – the WIPO Jurisprudential Overview is effectively the most widely cited interpretive resource in the field. The Forum has its own panel roster and, historically, a somewhat higher volume of US-based technology-sector cases. For a .app domain tied to a recognizable software brand with global trademark protection, WIPO is the most common choice in our practice.

Single-member or three-member panel? A single panelist is faster and cheaper. A three-member panel provides more robust legitimacy when the case is contested, the bad-faith evidence is circumstantial, or the domain has material commercial value to the registrant. If you file for a single-member panel but the respondent requests three members, the respondent typically shares the incremental cost – raising the complainant's share from USD 1,500 to USD 2,000 (the WIPO differential for three-member panels on one-to-five domains).

WIPO also offers an expedited option delivering a decision within about one month, available for single-panel cases covering up to five domains. For a single .app domain where speed matters – say, a product launch is imminent – the expedited route is worth considering, though eligibility and procedure should be confirmed with current WIPO rules at the time of filing.

Step 3: Draft and file the complaint

Each provider publishes its own complaint form, supplemental rules, and filing portal. The substantive structure, however, is the same across all UDRP providers because it is dictated by the Policy and the UDRP Rules themselves.

A complete complaint must contain: identification of the complainant and its authorized representative; the domain name(s) at issue and the registrar(s) of record; the trademarks on which the complainant relies, with registration details or evidence of common-law use; the grounds under each of the three Paragraph 4(a) elements with factual and legal argument; the remedy sought (transfer or cancellation); and certification by the complainant. Annexes – screenshots, WHOIS records, trademark certificates, correspondence – are attached separately.

The trap at this step is precision of the domain name. The complaint must name exactly the registered string as it appears in the registry – for a .app domain, that means including the full label and the .app extension in the way the provider's form specifies. An error in the domain string can require an amendment, which adds time and occasionally filing complications.

A second trap is forum shopping by implication. If a prior complaint on the same or a closely related domain was filed with a different provider, or a court action is pending, that history must be disclosed. Panels take omissions seriously.

Once the complaint is submitted and any deficiency cured, the provider serves it on the respondent through the registrar's WHOIS contact data. Commencement – the date the clock on the 20-day response window starts – is typically a few days after filing, once the provider confirms the complaint is formally complete.

What happens during the response period and after?

The respondent has 20 days from the date of commencement to file a response. No response defaults the case to the complainant's version of events – but panels do not simply award transfer on default. The panel still evaluates whether the complaint has made out all three elements on the evidence presented.

In a recent matter – a .app cybersquatting dispute, spring 2025 – the respondent failed to appear. The panel nonetheless examined the evidence carefully, and we secured a transfer order approximately seven weeks after filing. The lesson is that a well-evidenced complaint is not merely formality insurance; it is the document the panel actually reads when it has no other record to weigh against.

If a response is filed, the provider appoints the panel shortly after the response deadline. There is no oral hearing. The panel reviews the written record only – complaint, response, annexes, and any supplemental filings the panel chooses to admit. Supplemental filings are discretionary; most providers allow them only for genuinely new information that could not have been included in the original complaint or response.

The panel issues its decision, typically within roughly 14 days of appointment. The decision is published on the provider's website and notified to the parties and the registrar. If transfer is ordered, the registrar implements it after a brief waiting period – during which either party can file a court action to override the administrative result. In practice, court filings to block a UDRP transfer are rare.

What if bad faith is found against the complainant instead? Panels may make a finding of Reverse Domain Name Hijacking (RDNH) where the complaint was brought in bad faith to deprive a legitimate registrant. RDNH carries no monetary penalty but is published and reputationally damaging. It is a reason to assess the case honestly before filing, not after losing.

What evidence actually decides the outcome of a .app UDRP case?

Evidence is the difference between a complaint that transfers a domain and one that collapses at element three. In our practice, we consistently see the same categories of evidence carry the most weight before panels in .app disputes.

Timing is the most decisive single factor. A registration that post-dates the complainant's trademark by a short interval – especially where the mark was publicly known in the tech sector before the domain was registered – strongly supports bad-faith registration. Conversely, a domain registered before your mark's priority date raises a near-insurmountable first-element issue.

Site content matters greatly in the .app zone. Screenshots of a live .app site impersonating your application, offering a competing product, or harvesting user credentials go far beyond the kind of passive parking that panels treat as circumstantially problematic. Preserve every screenshot with a timestamp and source URL. Use an archival service if possible – archived captures are harder to dispute than single-session screenshots.

Correspondence is double-edged. An unsolicited email from the registrant offering to sell the .app at five figures is among the strongest bad-faith indicators available. But a reckless cease-and-desist letter that overstates your rights, makes threats outside your actual trademark claim, or gives the respondent time to construct a back-dated use narrative can also damage your case. Correspondence strategy before filing matters.

RDDS/WHOIS history – where accessible – shows when the domain was registered, who registered it, and whether the registration data has been obscured or changed around the time of your public brand launch. Privacy screens are common on new gTLDs, but the underlying registrar data is available to providers through the UDRP process and typically disclosed to the panel.

Myth to correct: does filing a UDRP complaint automatically freeze the domain?

A common misconception is that filing a UDRP complaint immediately locks the domain so it cannot be transferred or modified. It does not. A registrar lock – known under the Policy as the registrar's obligation to suspend transfer of the domain once the proceeding commences – takes effect at commencement, not at the moment of filing. The period between filing and formal commencement, while generally short, is a window of vulnerability.

What should you do? Instruct your representative to check the domain's current registrar-lock status and RDDS record before filing. If there is evidence of imminent transfer – a change in WHOIS ownership, a sudden drop in DNS resolution, or communications suggesting a sale to a third party – consider whether an urgent court injunction is needed alongside or instead of the UDRP. For a .app domain in active commercial use, the stakes can be high enough to justify parallel action in the relevant jurisdiction with local litigation counsel.

A second misconception worth addressing: many brand owners believe the UDRP is essentially a quick version of trademark litigation, with similar discovery, similar evidence standards, and similar legal argument. It is not. There is no discovery, no oral testimony, no cross-examination. The panel reads what the parties submit. A complaint that reads like a litigation brief, burdened with background narrative and doctrinal exposition, often buries the three-element analysis that is all the panel is permitted to decide. Discipline in drafting is not optional.

To weigh UDRP against a court action for your .app case, email info@cognomenlaw.com.

Cross-zone and cross-forum considerations: what if the same registrant holds related domains?

Brand owners defending against domain abuse rarely face a single .app problem in isolation. In many cases the same registrant holds a matching .com, a .io, or even a national ccTLD version of the same name. How does that affect your strategy?

A single UDRP complaint may cover multiple domains, provided all domains are held by the same registrant and filed with the same provider at the same time. Filing a consolidated complaint is more efficient than sequential filings and also signals to the panel the breadth of the registrant's conduct – which is itself a Paragraph 4(b) pattern indicator. The WIPO fee for a multi-domain filing increases with the number of domains: USD 2,000 for a single-member panel covering six to ten domains, with quotes available for larger portfolios.

What if the registrant also holds a .de or a .uk version? Those ccTLDs are outside the UDRP's reach. A .de dispute belongs in the German courts, with a DENIC DISPUTE entry to block transfer while litigation proceeds. A .uk dispute proceeds through the Nominet DRS, where the governing test is "abusive registration" and the standard reads "registered or used" abusively – a lower cumulative bar than the UDRP's "registered and used in bad faith." In a second matter we handled – a multi-zone dispute spanning a .app and a .uk version, autumn 2024 – parallel UDRP and Nominet filings succeeded on both fronts, with the .uk proceeding resolving first given its faster procedural cadence.

The decision-point here is sequencing. Filing the UDRP first and the Nominet DRS simultaneously is generally the most efficient path where both apply. If the .com is also in dispute, the URS (Uniform Rapid Suspension) is not the answer for .com – the URS applies only to new gTLDs and suspends rather than transfers ownership. For a companion .app problem where you only need a suspension while a broader dispute resolves, the URS is worth assessing as a lower-cost parallel mechanism. See our guidance on URS protection for new gTLD launches for the evidentiary standard that applies.

Related at COGNOMEN

• UDRP domain recovery – the full service and what it covers
• Confusingly similar trademark analysis in UDRP complaints
• URS and new gTLD launch protection for .dev and adjacent zones