Step-by-step: prove a registrant has no legitimate interest in a .app…

Step-by-step: prove a registrant has no legitimate interest in a .app. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your ca…

A brand owner discovers that its software product's name has been registered as a .app domain by a stranger. The site either sits blank, redirects to a competitor, or hosts pay-per-click links. The natural first question is whether the registrant has any legitimate claim to the name – and the second question is how to prove they do not.

To prove a registrant has no legitimate interest in a .app domain under the UDRP, a complainant must satisfy the second element of Paragraph 4(a): that the respondent has no rights or legitimate interests in the disputed domain. Because .app is a new generic top-level domain administered under the standard UDRP framework, the same three-element test governs. A standard case resolves in roughly two months, with the respondent given 20 days to file a response. The only remedies are transfer or cancellation – no damages, no costs.

This guide walks through each step, identifies the trap hidden in it, and explains what evidence actually decides the outcome before a WIPO panel.

Why Does the Second UDRP Element Carry Special Weight in .app Disputes?

The second element of Paragraph 4(a) is structurally different from the other two. It carries an initial burden on the complainant to make a prima facie case – meaning the complainant must raise enough facts that, absent any response, no legitimate interest is apparent – then the burden effectively shifts to the respondent to rebut. That shift is significant: a respondent who does not engage often loses by default, but a complainant who fails to make a credible prima facie case can lose even against a non-appearing registrant.

The .app zone adds a layer of context that panels weigh. Google Registry operates .app as a secure zone requiring HTTPS. A significant proportion of .app registrations are held by or for software developers, app publishers, or technology businesses. When a complainant holds a trademark and the domain name matches it, panels ask whether the registrant plausibly has a developer or legitimate tech-use nexus to the name – or whether the registration looks opportunistic. The industry context is not a separate legal test; it is a factual backdrop that either strengthens or weakens the prima facie case.

In our practice, the most common mistake at this stage is submitting a bare assertion: "the respondent has no legitimate interest." That assertion alone does not satisfy the initial burden. What satisfies it is a methodical walk through the three safe-harbor grounds in Paragraph 4(c) and an affirmative showing that none of them applies.

Step 1: Confirm the Governing Rules Apply – and Check the .app Zone

Before any evidence is gathered, confirm that the UDRP applies to the specific .app registration and identify the available forums. Because .app is a new gTLD operating under the standard ICANN-accredited registrar system, the UDRP applies automatically. WIPO and the Forum each accept .app complaints; WIPO handles the large majority of new-gTLD matters.

The trap hidden in Step 1 is the assumption that all .app registrars behave identically on WHOIS disclosure. RDDS (the successor disclosure system to legacy WHOIS) may show privacy-masked contact details. A privacy service obscuring the registrant's identity is not itself evidence of bad faith under the second element, but it directly affects your ability to investigate who the respondent actually is. Before filing, run a historical RDDS lookup, search for any associated email, and document the date on which the domain became active. That chronology matters at Step 4.

Identify the registrar and confirm it is ICANN-accredited. Note the creation date of the registration relative to your earliest trademark priority date. The registration date anchors the bad-faith analysis under the third element, but it also provides context for the legitimate-interest inquiry: a registration predating your mark is a recognized safe-harbor factor, and if that possibility exists, you need to address it squarely in the complaint.

If you are at the preliminary stage – assembling the facts before deciding whether to file – we can assess the three UDRP elements against your specific evidence. For an assessment of your .app domain dispute, contact info@cognomenlaw.com.

Step 2: Map the Three Safe Harbors in Paragraph 4(c) and Eliminate Each One

The UDRP's Paragraph 4(c) gives a respondent three ways to demonstrate a legitimate interest. A complainant wins the second element by showing that none of the three applies. Each requires a different type of evidence.

Safe harbor one – bona fide use before notice of the dispute. Has the respondent, prior to receiving notice of this complaint, used the domain in connection with a genuine offering of goods or services? "Genuine" is the operative word. A pay-per-click page, a placeholder under-construction page, or links to competing products does not qualify. Panels have consistently held that parking pages and monetized link farms are not bona fide offerings. Gather a screenshot of the site as it existed before the complaint was sent – use a dated archive service – and ask whether any real commerce or communication was occurring.

Safe harbor two – commonly known by the name. Has the respondent been known, as an individual, business, or other organization, by the domain name? A registrant who holds a company name, a trading style, or a social-media identity matching the .app domain may invoke this ground. Check business registry records in the registrant's apparent jurisdiction, search trademark filings in the registrant's name, and review the registrant's own website (if any) for any claim to the name predating the dispute. Absence of any such record supports the prima facie case.

Safe harbor three – legitimate noncommercial or fair use, without intent to mislead or divert traffic. Criticism sites, commentary, and satire can qualify, but only where the use is genuinely noncommercial and the domain clearly signals its critical purpose. A .app domain that mimics a software brand's name without any clarifying label is rarely a credible fair-use claim.

The trap here is failing to address all three. A complaint that dispatches only the most obvious safe harbor while ignoring the others gives a panel a gap to fill – and panels deciding close cases sometimes fill that gap in the respondent's favor. Address all three, even if the analysis for two of them is brief.

How Does the Respondent's Silence – or Response – Change the Analysis?

Roughly 15% of UDRP cases settle before a decision is issued, according to WIPO data. Many others proceed with a default – the respondent simply does not respond within the 20-day response window. A default does not mean automatic transfer. The panel still applies the three-element test and expects the complainant to have made a complete and adequate record.

When the respondent does file a response, the burden they must meet is to bring forward concrete evidence of one of the Paragraph 4(c) safe harbors. A bare denial is rarely enough. A respondent who provides registration records, a trading history, screenshots of a prior-use website, or a trademark registration of their own gives the panel something to weigh. That is why complainants should document the absence of any such evidence before filing – so that if a response is filed asserting safe-harbor rights, the complainant's reply (if the panel permits one) can directly contradict it.

In a recent matter – a .app typosquat targeting a fintech brand, spring 2025 – the respondent filed a response asserting it was "commonly known" by a name that varied only slightly from the complainant's mark. We had already pulled business-registry records from three jurisdictions showing no entity by that name. The panel found the safe-harbor claim unsupported and transferred the domain. No supplemental filing was necessary.

Step 3: Build the Affirmative Evidence Package

Evidence for the second element divides into two categories: records that document the complainant's rights and trademark use (relevant to context), and records that specifically address the respondent's side of the ledger.

On the complainant side, provide the trademark registration certificate, the priority date, and at least three examples of the mark in genuine commercial use predating the domain registration. This is not the first UDRP element – it does not need to re-prove the mark – but it establishes the commercial context the panel will use to evaluate whether the registrant's claimed use is plausible.

On the respondent side, gather:

• Dated screenshots of the domain's resolving page at multiple points in time (use a public archive service; note the capture dates).
• RDDS/WHOIS records showing the registration date, registrar, and any contact information visible at the time of filing.
• Business-registry searches in the respondent's apparent jurisdiction – specifically for any entity operating under or commonly known by the domain name.
• Trademark searches in major registries for any mark held by the respondent matching the domain.
• Any communications from the respondent, particularly an offer to sell the domain or a demand for payment, which is relevant to bad faith but contextually relevant to legitimacy as well.
• Social-media account searches – a registrant invoking "commonly known by the name" under Paragraph 4(c)(ii) should have a verifiable online presence under that name predating the complaint.

The trap in Step 3 is over-documenting the complainant's own trademark while under-documenting the respondent's actual use. Panels are not there to re-award the trademark registration; they are there to decide whether this particular registrant had any plausible claim to this particular name. Lean toward respondent-side evidence.

If you have already begun assembling evidence and want a second read on whether the package is sufficient, we regularly review pre-filing materials and identify gaps before the complaint is filed. Email info@cognomenlaw.com to discuss your case.

Step 4: Draft the Second-Element Argument – Structure and Common Errors

The second-element section of a UDRP complaint is not a narrative. It is an element-by-element analysis tied to the evidence annexed. Structure it as follows:

1. Opening prima facie paragraph. State the basis of the complainant's trademark rights (cross-referencing the first element), the date of the respondent's registration relative to that mark, and the absence of any authorization or license granted to the respondent.
2. Paragraph 4(c)(i) – no bona fide prior use. Describe the domain's actual use (or non-use), reference the relevant annexes, and explain why the use observed does not meet the bona fide threshold.
3. Paragraph 4(c)(ii) – not commonly known by the name. Reference the business-registry and trademark searches. Note the absence of any public identity under the name.
4. Paragraph 4(c)(iii) – no legitimate fair use. Address whether any noncommercial or critical use is apparent and why it is not.
5. Concluding paragraph. Restate that the prima facie showing is established and invite the panel to hold the respondent to its burden of rebuttal.

The most common drafting errors we see are: conflating the second and third elements (mixing bad-faith discussion into the legitimate-interest section); failing to address all three Paragraph 4(c) grounds; and submitting screenshots without a proper description of the date they were captured and by whom.

A note on the .app-specific context: because the zone is marketed to and associated with app developers, a registrant who claims to be building or planning to build an app may invoke that context as a colorable argument. The strength of that argument depends on whether any development activity is documented and how closely the claimed app concept aligns with the complainant's brand. Panels have declined to treat a vague "future use" plan as a bona fide interest where no development was evidenced. If the domain resolves to a blank page with no development record, that fact supports the prima facie showing. Document it.

Step 5: Choose the Forum and File the Complaint

For a .app dispute, the realistic options are WIPO and the Forum. WIPO administers the large majority of new-gTLD cases and is the dominant forum for international complainants. The Forum is a US-based alternative with comparable procedures. The Czech Arbitration Court (CAC) also accepts UDRP filings and has a lower entry fee, but it is less commonly used in practice.

The right route depends on the situation. A single .app domain with a clear-cut legitimate-interest failing and no anticipated response is well suited to a WIPO single-member panel at a filing fee of USD 1,500. WIPO also offers an expedited option targeting approximately one month to decision for straightforward single-panel cases. If the matter is factually complex, the registrant is likely to respond vigorously, or the trademark rights are not straightforwardly registered, a three-member panel at USD 4,000 provides greater weight and is harder to challenge post-decision.

The Forum begins around USD 1,300 for one to two domains. For a single .app domain dispute where cost is a priority and the case is uncomplicated, the Forum is a viable alternative. WIPO and the Forum together handle roughly 97% of all UDRP proceedings.

If the .app domain is one of several related domains held by the same registrant – including .com, .io, or other gTLD variants – a single complaint may cover all of them, provided the registrant of record is the same. That consolidated approach avoids separate filing fees and produces a single, consistent panel decision on all domains at once.

The trap in Step 5 is filing without first confirming the registrant of record for each domain. If a respondent holds some domains through a proxy and others directly, the registrant of record may differ, requiring separate complaints.

What Evidence Decides the Outcome: A Decision Matrix

Understanding which fact patterns consistently succeed – and which consistently fail – is more useful than a list of abstract principles. Here is how the second element plays out across common .app fact patterns.

Where the domain resolves to a pay-per-click page containing links to the complainant's competitors, the prima facie case is strong. Monetized use exploiting a trademark's drawing power is not a bona fide offering. Panels have consistently held this position. Combine it with an absence of any business registration or prior use, and the second element is well established.

Where the domain is passively held – no content, no use – the analysis is similar but not identical. Passive holding alone does not establish a legitimate interest, and panels regularly find the second element met in passive-holding cases where the complainant's trademark is well-known and there is no plausible legitimate reason for the registration. For a .app domain in particular, a registrant who offers no development-use explanation for a blank domain is in a poor position.

Where the registrant holds a trademark of its own, even a national or common-law mark, the second element becomes genuinely contested. That scenario is different in kind. It is worth noting that panels in those cases often look closely at the relative timing of the trademark and the domain registration, the geographic and commercial relationship between the two marks, and whether the registrant's mark genuinely predates the complainant's notice. A registration that post-dates notice of the dispute does not generate legitimate interest.

In a recent matter – a .app domain held by a developer who claimed to be building a scheduling application, autumn 2024 – the respondent asserted a Paragraph 4(c)(i) bona fide use defense. We obtained development-hosting records showing the project was created after the complainant's cease-and-desist letter. The panel held the claimed use was reactive, not genuine, and transferred the domain.

What Happens After the Decision?

A UDRP decision ordering transfer does not execute itself. The panel issues a decision; the case administrator notifies the registrar; the registrar then implements the transfer after a brief waiting period. The registrant has a narrow window to file court proceedings to stay the transfer. In practice this is rare, but it is a recognized respondent option.

If the panel denies the complaint on the second element, the complainant is not permanently barred. A new complaint on materially different facts or following a change in the domain's use may be filed. However, refiling on substantially the same record is disfavored and panels will typically reject it as an abuse of the process. A denial is not the time to refile immediately; it is the time to reassess the evidence, identify what the panel found lacking, and decide whether court action is more appropriate.

Where the panel finds the complaint was brought abusively – for example, where the registrant clearly held a prior legitimate interest and the complainant persisted – a finding of Reverse Domain Name Hijacking (RDNH) may be issued. An RDNH finding carries no monetary penalty but is a reputational mark against the complainant. We act for both complainants and respondents, including RDNH defense, and we assess the risk of an RDNH finding as part of every pre-filing review.

Related at COGNOMEN

• UDRP domain recovery service – full-service UDRP complaint preparation and filing across gTLD zones
• How to recover a .app domain used in phishing – a step-by-step guide for brand owners
• Respondent defense for developers – fair use, legitimate interest, and RDNH in .app and new-gTLD disputes