Step-by-step: prove bad faith registration of a .online domain

Step-by-step: prove bad faith registration of a .online domain. UDRP and ccTLD domain recovery and defense across .online. Email the firm to assess your case.

A stranger has registered a .online domain that strings together your brand name – or a close variant of it – and the site either parks quietly or mimics your business. You want it back. The question is not merely whether you can win a UDRP complaint; it is whether you can meet every element of the test, in the right order, with the right evidence, before the 20-day response window closes for the registrant and the panel is appointed.

To prove bad faith registration of a .online domain under the UDRP, you must satisfy all three elements of Paragraph 4(a): confusing similarity to a mark you hold, the registrant's absence of rights or legitimate interests, and registration and use in bad faith. Because .online is a sponsored gTLD whose registrar agreements require compliance with the UDRP, WIPO and the Forum both accept .online complaints. A standard case at WIPO runs about two months from filing to decision, and the only available remedies are transfer or cancellation.

This guide walks each step in the order you must address it, flags the trap embedded in that step, and closes with the realistic evidence picture and next action.

Why the UDRP governs .online disputes – and what that means for your case

The .online registry, like every ICANN-accredited new-gTLD registry, requires its registrars to include the UDRP in their registration agreements. That means all three UDRP elements apply in full, with no national-law carve-outs and no softer "registered or used" standard such as Nominet's DRS applies for .uk. The bad-faith test is cumulative: registration in bad faith AND continuing use in bad faith. Missing either limb is fatal.

In practical terms, a .online complaint is filed before WIPO or the Forum just as a .com complaint would be, and the same Paragraph 4(a) tripwire governs the outcome. The timeline is the same. The fees are the same. The only significant structural difference is that a few .online registrations are held by registrars who may be slower to implement a transfer order – a factor worth confirming at the due-diligence stage before filing.

What changes in practice is the evidentiary picture. .online launched as part of the new-gTLD program and attracted a significant volume of defensive and speculative registrations. Panels have consistently observed that bad actors registering in a new-gTLD extension may do so precisely because the brand owner did not defensively register there, and panels treat that pattern as a factor bearing on intent at the time of registration – which is where the hardest element of the proof lies.

Step 1: Confirm you hold trademark rights – and identify the right mark

The first step is deceptively simple. You must hold rights in a trademark and the disputed domain must be identical or confusingly similar to that mark. The trap is in the word "rights": UDRP panels treat a registered trademark as the cleanest form of proof, but unregistered or common-law rights are accepted if the mark has acquired secondary meaning through genuine commercial use.

Start by pulling every trademark registration – by class, jurisdiction, and priority date – that could anchor the claim. The registration date matters. If your earliest registered mark post-dates the disputed domain's creation date, you may still proceed on common-law rights if pre-registration use is documented, but you have just handed the registrant an opening argument. We regularly advise brand owners who discover that their trademark filing program lapsed just before a new-gTLD round, leaving a gap that a competent respondent will exploit immediately.

The similarity analysis itself is usually straightforward: panels strip the gTLD suffix (.online is ignored as a technical requirement) and compare the remaining string against the mark. Typosquats, transpositions, and prefix/suffix additions are routinely found confusingly similar. The trap here is the descriptive suffix: "brandonline," "brandnow," or "brandsupport" may look like confusing similarity from your side of the desk, but panels examine whether the addition changes the overall commercial impression. A suffix that is descriptive of the goods or services associated with the mark compounds the confusion; one that clearly differentiates may not.

Step 2: Show the registrant has no rights or legitimate interests in the .online domain

Proving a negative is the procedural difficulty at the center of every UDRP complaint. The consensus view under the Policy is that a complainant need only establish a prima facie case that the registrant lacks rights or legitimate interests; once established, the burden of production shifts to the registrant to come forward with evidence of legitimacy under Paragraph 4(c).

The three Paragraph 4(c) safe harbors you must negate – or show are inapplicable – are: (1) a bona fide offering of goods or services before notice of the dispute; (2) the registrant being commonly known by the domain name; and (3) legitimate noncommercial or fair use. Each has a distinct evidentiary profile.

For a bona fide offering, check what the domain resolves to. A parking page monetizing pay-per-click links, a page that mimics your brand's site, or a domain pointed at a competitor's service – all undercut the claim to bona fide pre-notice use. Screenshot evidence from multiple dates, captured through an archival service, is the working evidentiary minimum. For the "commonly known by" safe harbor, a WHOIS lookup showing a registrant name unrelated to your mark – and no history of use under that name – is typically sufficient to negate it. For fair use, a domain that is actively monetized rarely qualifies as purely noncommercial.

The trap in this step is complacency. If the registrant actually does operate a business under a name that resembles your mark in a different market, or if the domain was once the registrant's legitimate trading name before your mark was registered, the safe-harbor argument becomes substantive. Do not draft the complaint assuming the registrant will default. Approximately fifteen percent of UDRP proceedings settle before a decision, and some contested cases turn entirely on the legitimacy evidence assembled – or not assembled – at this stage.

For a read on whether the three UDRP elements are met on your specific .online domain, reach us at info@cognomenlaw.com.

Step 3: Prove bad faith registration of a .online domain – the hardest element

Bad faith registration is where most complaints that should succeed actually fail. The element is cumulative: the panel must be satisfied that the domain was registered in bad faith at the moment of registration, not merely that it is being used badly now. If you can prove bad current use but cannot reconstruct the registrant's intent on the day of registration, you may not have a case – or you may need a court route instead.

Paragraph 4(b) of the UDRP lists four non-exhaustive circumstances that constitute evidence of bad faith. The most frequently invoked in .online disputes are:

• Registration primarily to sell to the mark owner – look for an unsolicited offer to sell the domain, a listing on a domain marketplace at an above-cost price, or a pay-per-click page that monetizes traffic driven by the mark.
• Registration to attract Internet users for commercial gain by creating a likelihood of confusion – this covers most parking and redirecting scenarios, and most impersonation sites.
• Registration to disrupt a competitor – relevant where the registrant operates in your market and has registered a domain corresponding to your brand to prevent you from reflecting it online.
• A pattern of abusive registrations – if the registrant holds multiple domains corresponding to other parties' marks, panels treat that pattern as a strong indicator of bad faith in the instant case.

For a .online domain specifically, the WIPO Jurisprudential Overview notes that panels have consistently held that passive holding of a domain – maintaining a registration without active use – can constitute bad faith use where it is implausible that the registrant could make any legitimate use of the domain in light of the complainant's mark. Passive holding arguments are especially credible where the mark is well-known or distinctive, the registrant has provided no explanation for its choice of the domain, and there is no conceivable legitimate use.

Reconstructing intent at registration requires timeline evidence. What was the complainant's mark's commercial profile at the date of registration? Had the brand been featured in press or trade coverage that the registrant could plausibly have noticed? Was the registration made shortly after a product launch, a trademark filing, or a press event? We have defended and prosecuted .online disputes where a registration date just two weeks after a major brand announcement was the single most persuasive fact in the record. Proximity of registration to a brand event is not conclusive, but panels treat it as a powerful circumstantial indicator.

In a recent matter (a .online domain incorporating a consumer software brand, autumn 2025), we established bad faith by combining a registration date three days after the complainant's product launch announcement with a parking page that monetized traffic under the mark's name. The panel transferred the domain approximately seven weeks after the complaint was filed.

Step 4: Assemble the evidence file before you file the complaint

Filing a complaint without a complete evidence file is the single most avoidable source of failure. The UDRP rules do not readily permit supplemental submissions; once the complaint is filed, the record is largely set. What does a minimum evidence file for a .online complaint look like?

• Trademark registration certificates (or evidence of common-law rights: dates of first use, marketing spend records, press coverage, sworn declarations).
• WHOIS / RDDS printout for the disputed domain, showing registrant, registrar, and registration date.
• Screenshots of the domain's current content, ideally from multiple capture dates via an archival service, timestamped.
• Historical captures of the domain's content, showing continuity or change of use over time.
• Evidence of the complainant's commercial prominence at and before the registration date – press, launch materials, advertising records.
• Any correspondence from the registrant offering to sell the domain, or any response to a cease-and-desist, if sent.
• Marketplace listings or broker communications if the domain is offered for sale.
• Evidence of other domains registered by the same registrant incorporating other parties' marks (pattern evidence).

The trap at this step is the cease-and-desist letter. Sending one before filing alerts the registrant, giving them time to alter the domain's content, update WHOIS to a proxy, or transfer registration. Capture all publicly available evidence – including current domain content – before any contact with the registrant. In our practice, we routinely archive domain content and WHOIS data on the day of intake, before any step is taken that might tip off the opposing side.

If a prior filing or response produced an unfavorable outcome, a focused second read of the evidence record can often identify the element that was missed. Email info@cognomenlaw.com to discuss the options.

Step 5: Choose your forum and file – WIPO, the Forum, or CAC?

All four ICANN-accredited UDRP providers accept .online complaints, but the practical choice for most matters is between WIPO and the Forum. Together they account for roughly 97% of all UDRP proceedings. CAC offers the lowest entry-point fee – beginning around USD 500–800 – making it relevant for a cost-sensitive single-domain matter, though its caseload and panel pool are smaller.

The right forum depends on several factors. WIPO's panel pool is broader and includes panelists with deep .online and new-gTLD experience. WIPO also offers an expedited option delivering a decision within about one month for single-panel cases of up to five domains – useful where the infringement is causing active commercial damage. The Forum offers a comparable timeline at a starting fee of around USD 1,300 for one to two domains on a single-member panel. WIPO's base fee is USD 1,500 for one to five domains, single-member panel.

What about domains that span zones – for example, if the registrant holds both a .online and a .com version of your mark? A single UDRP complaint can cover multiple domains only if the same registrant holds all of them. Confirm registration details before assuming consolidation is available. If the same actor holds a .com and a .online version, a consolidated complaint saves one filing fee and produces a single coherent decision. If they are held by different named registrants – a common obfuscation tactic – you will need separate proceedings.

Is there a scenario where a court route outperforms the UDRP for a .online dispute? Yes. If you need monetary damages, the UDRP cannot reach them; only court anticybersquatting litigation can. If the registrant is using the domain to defraud your customers – not merely to monetize confusion – the urgency may justify court-ordered injunctive relief alongside or instead of a UDRP complaint. In a US anticybersquatting action, a court can order both transfer and damages. For matters outside the US, the applicable national anticybersquatting legislation and local litigation counsel would govern that route. We work with local litigation counsel in relevant jurisdictions when a court route is warranted.

In a spring 2024 matter (a .online domain used to conduct phishing against a financial services brand), we coordinated a UDRP complaint at WIPO in parallel with a registrar escalation for content takedown, achieving suspension of the offending site within the first week while the transfer proceeding ran its course.

Step 6: Manage the 20-day response window and the period to decision

Once the complaint commences, the respondent has 20 days to file a response. Most registrants in abusive .online registrations default – they do not respond at all. A default does not mean automatic transfer; the panel still examines whether the complaint meets all three UDRP elements. But a default removes the contested legitimacy argument from the record, typically simplifying the panel's task.

Where the registrant does respond, the record is closed after the response (absent exceptional circumstances for supplemental submissions). Panel appointment follows, and the decision typically issues within about two months of the original filing date. Plan for that timeline in your commercial response: if the .online domain is actively harming your brand, consider interim measures at the registrar level – a lock request or an abuse report – while the proceeding runs.

After a transfer order is issued, the registrar implements it; this typically takes a matter of days following the expiry of the mandatory ten-business-day stay period that allows a registrant to seek court review. The domain then transfers to the complainant's designated registrar account.

When might you face a reverse domain name hijacking finding instead?

Panels may find reverse domain name hijacking – commonly abbreviated RDNH – where a complaint was brought in bad faith to deprive a legitimate registrant of a domain they held with genuine rights. An RDNH finding carries no monetary penalty, but it is a formal, published reputational sanction. For a brand owner, the RDNH risk is real in three scenarios: filing against a registrant who demonstrably used the name before the mark was registered, filing where the mark is descriptive and rights are thin, or filing where the evidence of bad faith at registration is almost entirely speculative.

The RDNH risk is one reason why a careful pre-filing assessment – not just a trademark search, but a full reconstruction of the registrant's likely intent and legitimate-use options – is worth conducting before any complaint is filed. We have seen complainants with strong marks lose RDNH findings because the complaint was assembled too quickly and overstated the strength of the similarity argument. Filing a weak complaint is not free.

Related at COGNOMEN

• UDRP Recovery Services – full-service .com and gTLD complaint filing
• Prove bad faith in .app domain disputes – step-by-step guide
• Court recovery for stolen domains – when arbitration is not enough