Step-by-step: prove bad faith registration of a .app domain

Step-by-step: prove bad faith registration of a .app domain. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your case.

A brand owner discovers that the .app version of its trademark is parked by a stranger who has no apparent connection to the name. The site resolves – sometimes. The registrant is silent. The demand, when it arrives, is five figures. The question is not whether this feels wrong. The question is whether it is provable wrong, in the specific sense the UDRP requires.

To prove bad faith registration of a .app domain under the UDRP, you must satisfy all three elements of Paragraph 4(a): confusing similarity to a trademark you hold, absence of any legitimate interest on the registrant's part, and registration and use in bad faith. The .app zone operates under UDRP rules at WIPO and the other accredited providers. A standard case runs approximately two months from filing to decision, and the only remedies available are transfer or cancellation of the domain.

This guide walks each step in sequence, identifies the trap inside every stage, and points to the evidence that most often decides the outcome.

Why does the UDRP apply to .app, and what are the only remedies?

The .app gTLD was delegated by ICANN and is subject to the full accredited-registrar system, which means every .app registrar is bound by the UDRP. There is no separate .app dispute procedure; the same Paragraph 4(a) test that governs .com governs .app. The available remedies are transfer of the domain to the complainant or cancellation of the registration – nothing else. No monetary damages, no legal-cost award, no injunction.

That remedy limitation matters more than most brand owners expect. If your goal is financial compensation from the registrant, the UDRP cannot reach it. If your goal is control of the domain name, the UDRP is typically the fastest and least expensive path. The filing fee at WIPO for a single-domain, single-member panel case is USD 1,500; at the Forum (formerly the National Arbitration Forum), the entry fee begins around USD 1,300. WIPO and the Forum together handle roughly 97% of all UDRP proceedings.

A common misconception is that .app's HTTPS-requirement (the registry mandates a valid SSL certificate on all .app sites) somehow affects the UDRP analysis. It does not. Panels assess the domain name itself and the registrant's conduct, not the technical configuration of the hosting.

Step 1: Confirm your trademark rights before anything else

The first element of Paragraph 4(a) requires that you hold rights in a mark to which the disputed domain is identical or confusingly similar. That threshold sounds easy. The trap here is registrants who file a UDRP before completing that rights inventory and discover midway through that their mark is pending, unregistered, or too narrow in scope to reach the domain.

Registered trademarks are the cleanest starting point. A national or international registration predating the domain's creation date establishes rights without argument. Unregistered or common-law rights are cognizable under the UDRP, but panels require evidence of actual use and secondary meaning – promotional materials, sales figures, press coverage, client declarations. The stronger the evidence of use, the more confidently a panel will find that rights exist.

The confusing-similarity comparison is generally straightforward: panels strip the gTLD (".app") and compare the second-level label to the mark. Where the domain is a phonetic equivalent, a deliberate misspelling (typosquatting), or the mark combined with a generic term, similarity is usually found. Where the domain is an acronym or an abbreviated variant, the comparison becomes harder, and the strength and distinctiveness of the mark become decisive.

Before filing, confirm: (1) what mark registrations you hold, in what jurisdictions, and as of what registration dates; (2) whether any of those registrations predates the disputed .app domain's WHOIS creation date; (3) whether the similarity argument is obvious or whether a panel would need coaxing. If the answer to (3) is "coaxing," prepare supporting argument before you file, not after.

Step 2: Build the legitimate-interest rebuttal before it is raised

The second element requires you to show that the registrant has no rights or legitimate interests in the domain. Under the UDRP, the complainant makes a prima facie showing; the burden then effectively shifts to the registrant to come forward with evidence of legitimacy. In practice, this means your complaint must preemptively address every plausible legitimate-interest argument the registrant might raise.

Paragraph 4(c) lists three safe harbors. A registrant can demonstrate legitimacy by showing: (a) use of, or demonstrable preparations to use, the domain in connection with a bona fide offering of goods or services before notice of the dispute; (b) being commonly known by the domain name; or (c) legitimate noncommercial or fair use without intent for commercial gain.

The trap at this step is treating the legitimate-interest element as a checkbox. Panels have consistently found complaints deficient where the complainant made only a bare assertion – "the respondent has no legitimate interests" – without addressing why each safe harbor is unavailable. Check the registrant's WHOIS details (now accessed through RDDS, the Registration Data Directory Service, as WHOIS privacy is standard on most .app names). Run a business registry search for the registrant's name. Screenshot the domain's resolving page. Check the Wayback Machine for historical content. If the domain has ever displayed content, that content is evidence in both directions.

A domain that displays pay-per-click advertising using the complainant's own trademark terms is among the clearest scenarios. A domain that displays parking pages with links to the complainant's competitors is nearly as strong. A domain that has never resolved, in which the registrant has never publicly used the name, and which was registered shortly after the complainant's mark became publicly prominent – that combination has supported many successful complaints, even without active use, under the passive-holding doctrine.

At this stage in your analysis, you have likely identified whether the first two elements are strong, borderline, or weak. The strength of those elements shapes how you argue bad faith. For an assessment of your domain dispute before you file, contact info@cognomenlaw.com.

Step 3: Prove bad faith registration – the timing trap

Bad faith under Paragraph 4(a)(iii) is cumulative: the domain must have been registered and used in bad faith. This is the element most complaints lose on, and it is the step that contains the most consequential trap in the entire UDRP process.

The registration limb requires that the registrant knew of your mark, or should have known, at the moment of registration. If your mark did not exist – was not registered and had no meaningful marketplace presence – when the domain was created, panels will generally decline to find bad faith registration, even if the registrant is now clearly exploiting the name. Chronology is everything. Obtain the domain's WHOIS creation date and compare it precisely to your first trademark use, first registration, and first public market presence.

Paragraph 4(b) lists non-exhaustive bad-faith factors: registration primarily to sell to the mark owner at a price exceeding out-of-pocket costs; registration to disrupt a competitor's business; intentional attraction of users for commercial gain by confusion with the complainant's mark; and a pattern of abusive registrations across multiple domains. These are illustrative, not exhaustive – panels recognize bad faith in other forms, including passive holding where the surrounding circumstances make any good-faith use implausible.

Evidence for the registration limb typically includes: the registrant's actual or constructive knowledge of the mark (fame, prior registration, public market presence); correspondence in which the registrant offered to sell at a price far exceeding registration costs; simultaneous registration of multiple marks owned by different brand owners (a pattern); and the fact that the domain is a precise reproduction of a distinctive mark with no plausible alternative explanation.

In a recent matter – a .app domain dispute, spring 2025 – we built the bad-faith registration argument on the registrant's own communications: an unsolicited offer to sell the domain arrived within weeks of the domain's creation, before any third party had contacted the registrant. The offer price was far above any registration cost. The panel found registration in bad faith on those facts alone, without needing to reach the use limb.

Step 4: Prove bad faith use – closing the second half of the test

The use limb is distinct from registration, even though panels often assess both together. Bad faith use means the domain is being used – actively or passively – in a way that fits the Paragraph 4(b) factors or their recognized equivalents.

Active bad-faith use is easier to document. Pay-per-click pages monetizing the complainant's brand, phishing pages impersonating the complainant, or landing pages offering competing products: each is a clear Paragraph 4(b)(iv) scenario. Screenshot those pages, capture their source code if accessible, and preserve the metadata showing the date of capture. Panels treat contemporaneous preservation more seriously than screenshots taken after notice of the dispute.

Passive holding – where the domain does nothing at all – is more nuanced. The consensus view is that passive holding can constitute bad faith use when the overall circumstances support no plausible legitimate use. Those circumstances include: the complainant's mark is well known; the registrant has provided no evidence of any actual or intended good-faith use; and it is implausible that the registrant selected the name without awareness of the mark. The .app zone, which demands SSL and active hosting, adds a layer of context: a domain that was registered under a naming string identical to a distinctive brand and then left to resolve to a blank HTTPS page tends to support the passive-holding argument.

The trap here is conflating passive holding with default. If the registrant appears to have registered for some purpose – even one that is unclear – a panel may hesitate to find bad-faith use on passive-holding grounds alone. In that scenario, the strength of the bad-faith registration case becomes decisive.

Step 5: Select the forum and file the complaint

Once the three elements are analyzed and the evidence assembled, the next decision is forum selection. For a .app domain, WIPO and the Forum are the primary options. WIPO tends to attract higher-stakes disputes and is the largest single provider by volume. The Forum is a credible alternative with comparable timelines.

Forum selection is not merely procedural. WIPO publishes its full decision database and its Jurisprudential Overview, which provides a consolidated view of consensus positions across the three UDRP elements. Panels at WIPO have extensive exposure to .app disputes given the zone's age and growth. The Forum publishes its decisions publicly as well. Neither forum is inherently "easier" than the other; the outcome depends on the facts and the quality of the complaint, not the forum's identity.

The complaint itself must comply with the Rules for Uniform Domain Name Dispute Resolution Policy. A complaint covering a single .app domain with a single-member panel at WIPO costs USD 1,500 in filing fees. After filing, WIPO conducts a formality review before the case commences formally. Once it commences, the respondent has 20 days to file a response. If no response is filed, the panel decides on the record before it – the complainant's complaint – which typically favors the complainant if the evidence is solid, but panels are not obligated to grant transfer on an uncontested complaint alone.

Drafting the complaint is where most self-represented complainants encounter difficulty. The complaint must frame each element with specificity, cite the evidence for each, and address probable defenses before they are raised. A complaint that is conclusory on the legitimate-interest element – or that fails to address why passive holding constitutes bad-faith use – gives even a defaulting registrant a defensible position in panel deliberation.

What happens if the registrant files a response?

A response is not a loss. It is a normal part of the process and does not automatically reduce the probability of a transfer order. What a response does is require the panel to weigh competing submissions rather than decide on the complainant's record alone.

Registrants who respond typically raise one or more of three arguments: legitimate-interest grounds under Paragraph 4(c); a denial that the domain was registered with the complainant's mark in mind; or a challenge to the complainant's trademark rights (scope, validity, or priority). Each of those arguments can be anticipated and addressed in the complaint itself. A well-constructed complaint that preemptively closes each Paragraph 4(c) safe harbor, and that establishes the mark's priority and fame in detail, typically holds its ground against a response.

Where a respondent submits a response that raises a colorable legitimate-interest argument – say, that the registrant's legal name or business name corresponds to the domain – the panel will weigh the totality of the circumstances. The complainant may then seek leave to submit a supplemental filing, though WIPO panels grant supplemental filings sparingly, only where genuinely new evidence or arguments have emerged in the response.

If the complainant wins, the registrar implements the transfer or cancellation decision typically within days of the decision date. If the respondent wants to stop implementation, it must initiate court proceedings in the registrar's jurisdiction within a short window and formally notify WIPO. That rarely happens, but it is a procedural reality worth understanding before filing.

If a prior filing produced an unfavorable result, or if you have received a complaint against a .app domain you legitimately own, a focused review of the record can identify what element was missed or what defense applies. Email info@cognomenlaw.com to weigh your options.

Cross-zone and cross-forum considerations: when a .app dispute runs alongside others

Brand owners facing .app squatting frequently find the same registrant holds variants in .com, .io, .net, or a matching ccTLD. That pattern is itself bad-faith evidence under Paragraph 4(b)'s "pattern of conduct" factor. But it also creates a strategic choice: file a single complaint covering all domains held by the same registrant (permitted under the UDRP where the respondent is the same holder), or file sequentially by zone.

A multi-domain complaint at WIPO can cover .app, .com, .net, and .org variants in a single proceeding if the registrant of record is identical. The filing fee steps up with the number of domains: USD 2,000 for six to ten domains (single-member panel) compared to USD 1,500 for one to five. That is still substantially less than running parallel proceedings. The risk is that if any domain in the bundle has a materially different factual position – a different creation date, a different pattern of use – it may weaken the overall record. Consider whether to consolidate or sequence based on the coherence of the factual narrative across all domains.

Where the dispute also involves a ccTLD that does not use the UDRP – for example, a .de registration held by the same registrant – the .app UDRP and the German court action run on entirely separate tracks. Resolving the .app dispute does not automatically resolve the .de dispute, and vice versa. We work with local litigation counsel in the relevant jurisdiction for disputes that require national court action abroad.

Where the registrant is in a jurisdiction that allows US anticybersquatting litigation, and where you want damages alongside a domain transfer, a court action is the only path to financial recovery. The UDRP cannot award monetary relief under any circumstances. The decision whether to file in court instead of – or in parallel to – a UDRP complaint depends on the registrant's location, the damages at stake, and whether the complaint satisfies the higher evidentiary thresholds court proceedings generally require.

Related at COGNOMEN

• UDRP Recovery Service – filing complaints at WIPO, the Forum, CAC, and ADNDRC to recover domains
• Analysis: serial cybersquatter patterns in .me and what the evidence shows across cases
• Enforcing a UDRP decision in Canada through court action where arbitration cannot reach