Step-by-step: prove a registrant has no legitimate interest in a .clo…

Step-by-step: prove a registrant has no legitimate interest in a .clo. UDRP and ccTLD domain recovery and defense across .cloud. Email the firm to assess your…

A brand owner searches a new gTLD zone and finds its mark registered as a .cloud domain — pointed at a pay-per-click landing page, a competitor's site, or simply parked and dark. The registrant is anonymous. There is no license, no prior use of the name in any business context, and the domain was snapped up days after the brand's product launch. The question is not whether something feels wrong. The question is whether the evidence will persuade a UDRP panel at WIPO that the registrant has no legitimate interest. That is a precise legal test, and it rewards preparation.

To prove a registrant has no legitimate interest in a .cloud domain under the UDRP, a complainant must satisfy the second element of Paragraph 4(a) of the Policy — establishing that the registrant holds no rights or legitimate interests in the domain — as part of a three-element test that also requires confusing similarity to a trademark and bad-faith registration and use. The .cloud gTLD operates under the UDRP at WIPO, meaning the standard Policy rules apply: the registrant has 20 days to respond once the case commences, and the only remedies are transfer or cancellation. This guide walks each evidentiary step, flags the trap hidden in each one, and closes with the realistic next move.

The sections below follow the order a practitioner builds the case: first the governing rules, then the elements in sequence, then the evidence layer, then the traps, then the outcome map.

Why the .cloud zone falls under the UDRP — and what that means for your case

The .cloud gTLD is accredited by ICANN and operated under the standard UDRP, meaning WIPO and the Forum both accept complaints in this zone. This matters immediately: there is no separate national law, no eligibility requirement tied to a country, and no registry-specific ADR layer to clear before filing. If your trademark qualifies and the domain is a .cloud, the UDRP at WIPO is the principal route to a transfer or cancellation order.

The three elements of Paragraph 4(a) are cumulative. A complainant must win all three. Winning two is not enough. A panel that finds confusing similarity and bad faith but identifies even a plausible legitimate interest in the respondent's favor will deny the complaint — and may make an adverse finding against the complainant for bringing a case without sufficient support. We have seen brand owners file strong complaints on elements one and three, only to discover the respondent had a thin but adequate explanation for element two that no one had tested before filing.

The UDRP does not require proof that the registrant never had any conceivable interest. It requires proof that the registrant has no rights or legitimate interests — a distinction panels take seriously. Legitimate interests under Paragraph 4(c) include a bona fide offering of goods or services before notice of the dispute, being commonly known by the name, and legitimate noncommercial or fair use. Each safe harbor is a potential escape route for the registrant. The complainant's job is to close each one in advance.

Step 1: Establish your trademark rights — the foundation that makes element two possible

Element one — confusing similarity — must be solid before element two becomes worth arguing. A complainant cannot prove a registrant has no legitimate interest in a name if the complainant's own rights in that name are uncertain. A registered trademark is the strongest foundation. Unregistered rights require substantially more evidence of use and recognition, and panels vary in how much weight they give common-law marks. In our practice, we assess trademark filing dates, registration jurisdictions, and the word-for-word match between the mark and the disputed domain before we evaluate the legitimacy question at all.

The trap in Step 1 is timing. A trademark registered after the domain was created does not automatically defeat a complaint, but it significantly complicates element three (bad faith at the time of registration). More importantly, a late-filing mark may cut off the complainant's ability to rely on prior rights in element two — because the registrant can argue it chose the name before the complainant held any protectable interest. Panels consistently hold that the relevant date for assessing rights is the date of domain registration, not the date of the complaint. Confirm your earliest-priority mark before assuming this element is resolved.

Step 2: How do you structure the element-two argument when the respondent has not appeared?

The burden-shifting mechanism in element two is one of the UDRP's procedural peculiarities. The complainant bears the initial burden, but panels universally accept that a complainant cannot prove a negative with certainty — it cannot know what private arrangements or unnamed businesses the registrant might claim. As a result, the consensus practice is that a complainant makes a prima facie showing of no legitimate interest, and the burden then shifts to the respondent to produce evidence of a right or interest under one of the Paragraph 4(c) safe harbors.

What constitutes a prima facie showing? Panels typically look for: the registrant is not a licensee and has never been authorized; WHOIS or RDDS data shows the registrant is not commonly known by the domain name; the domain is not used for a bona fide offering of goods or services; and there is no visible fair-use or noncommercial use of the name. Assembling these four markers, each supported by a screenshot, a registrar record, or a WHOIS lookup, is the minimum filing package for element two in a .cloud case.

The trap in Step 2 is over-relying on default. When the registrant files no response, panels do not automatically accept the complainant's position — they still require a prima facie case that holds up. A single paragraph asserting "the registrant has no legitimate interest" without underlying evidence is insufficient. We have reviewed complaints where element two was treated as boilerplate and the panel still asked pointed questions in a procedural order, or worse, denied the complaint on inadequate proof at default.

If you have identified a .cloud domain that may be registering your trademark without authorization, now is the point at which a case assessment prevents a wasted filing fee. For a read on whether the three UDRP elements are met, reach us at info@cognomenlaw.com.

Step 3: What evidence closes each Paragraph 4(c) safe harbor before the registrant can invoke it?

Each Paragraph 4(c) safe harbor requires a pre-emptive response in the complaint. Leaving one open invites the panel to consider it even when the registrant has not appeared, because panels sometimes raise alternative theories on the respondent's behalf in close cases. The three safe harbors are distinct; the evidence that closes each one differs.

Safe harbor (i) — bona fide offering before notice of the dispute. Close this with a confirmed date of registration relative to your mark's priority date, combined with evidence that the domain was never pointed at a genuine commercial offering. A parking page with pay-per-click links on a domain registered a week after your product announcement is not a bona fide offering. Archive screenshots from services such as the Wayback Machine, pulled for multiple time periods, are the standard evidentiary tool. Document the content at the URL at the time of filing and at the earliest available historical capture.

Safe harbor (ii) — commonly known by the name. This safe harbor is the one most brand owners underestimate. If the registrant happens to operate, or claims to operate, a business with a name that is phonetically or textually similar to the domain, the panel must evaluate that claim. The complainant closes it by establishing — through trademark searches, business-name registry lookups, and internet searches — that the registrant had no prior, publicly documented identity connected to the name before registration. WHOIS history showing a different registrant name, a business registration search showing no match, and an absence of any prior brand use all contribute. In .cloud disputes, the zone itself has no registration-period restriction, so recency of domain registration is not alone determinative; the absence of any pre-existing business name is.

Safe harbor (iii) — legitimate noncommercial or fair use. A criticism site, a fan site, or a nominative reference to a brand can sometimes qualify. The complainant closes this by showing the domain is not used for commentary, criticism, or any identifiable fan purpose — and that the content (if any) is commercial rather than expressive. An empty domain, or one that redirects to a parking or affiliate page, does not meet the fair-use standard. Panels have consistently held that passive holding with no use is not a legitimate interest.

The trap in Step 3 is the passive-holding edge case. If a domain is simply parked and the complainant argues that passive holding is itself evidence of illegitimate interest, the panel will also look at passive holding under element three (bad faith). The two elements are connected: a complainant who over-argues passive holding in element two may inadvertently suggest that the domain is not "in use," which can complicate the bad-faith-use prong. Frame the argument carefully.

Step 4: How does element-two evidence interact with the bad-faith case?

Elements two and three are legally distinct but factually overlapping. Evidence of no legitimate interest often doubles as evidence of bad faith, and experienced panels expect the complaint to show this connection explicitly. A registrant who is not a licensee, has no prior business identity using the name, and registered the domain immediately after a trademark announcement has no legitimate interest — and likely registered in bad faith. Presenting that sequence of facts under both elements, with the same underlying evidence referenced in each section, is more persuasive than treating the elements as silos.

The Paragraph 4(b) bad-faith factors list non-exhaustive circumstances. The most directly relevant in .cloud cases involving no legitimate interest are: registration to sell to the mark owner at a profit (factor i), registration to disrupt a competitor (factor iii), and registration to attract users for commercial gain by creating confusion (factor iv). Each of these presupposes an absence of legitimate interest. Where a complainant can show the domain was listed for sale at a price exceeding registration costs shortly after the mark's priority date, that single fact often satisfies both elements simultaneously.

In a recent matter — a .cloud typosquat targeting a software brand, spring 2025 — we assembled a complaint where element two rested on four pillars: no license, no WHOIS identity match, a parking page active from the first month of registration, and a domain listed for sale at a five-figure asking price. The registrant filed no response. The panel transferred the domain within approximately eight weeks of filing. That outcome was not guaranteed; it reflected a compact, evidence-dense complaint that left no safe harbor open.

Step 5: Building the evidence package — what the file must contain before you file

A UDRP complaint in a .cloud case is evaluated on the written record. There is no hearing, no cross-examination, and no discovery. The file you submit is the file the panel decides. Incomplete annexes cannot be corrected after the response window has closed — supplemental filings are disfavored under the rules, and panels frequently refuse to admit them except in extraordinary circumstances. Assembling evidence before filing is not procedural caution; it is the practice.

The minimum evidence package for element two in a .cloud UDRP complaint typically includes the following.

• A certified copy or printout of the trademark registration (including the priority date and the goods/services specification).
• WHOIS or RDDS records for the disputed domain, showing registrant name, registration date, and registrar.
• Historical WHOIS records where available, showing continuity or changes in registrant identity.
• Screenshots of the domain's current resolving content, with date and URL metadata visible.
• Archived screenshots from historical web captures covering multiple dates from registration forward.
• A business-name or trademark registry search in the registrant's apparent jurisdiction, showing no match to the domain name.
• Any commercial listing of the domain for sale, including the asking price.
• Evidence of the complainant's own established use — website, product pages, press coverage — predating the registration, to foreclose any argument that the registrant could not have known of the mark.

The trap in Step 5 is incompleteness on the registrant's identity. If WHOIS is privacy-shielded, the complainant must name the registrar's privacy service as the formal respondent and request registrant disclosure. WIPO and the Forum both have established procedures for this. Missing the disclosure step does not invalidate the complaint, but it may delay commencement or limit the panel's ability to assess whether the registrant is "commonly known" by the name. Start the WHOIS inquiry before filing.

If you are approaching the filing stage and want a second read on the evidence package, email info@cognomenlaw.com before submitting. A gap in the annex set is harder to fix after commencement than before.

Step 6: Choosing the forum and filing the complaint in the .cloud zone

For .cloud domains, both WIPO and the Forum accept UDRP complaints, and the choice between them affects timeline, cost, and — to a modest extent — the pool of available panelists. WIPO's filing fee for a single-member panel covering one to five domains is USD 1,500; the Forum's comparable entry point begins around USD 1,300. WIPO and the Forum together administer roughly 97% of all UDRP proceedings globally. In our practice, we typically assess the specific facts — panel appointment speed, specific forum rules on supplemental filings, and whether a three-member panel is warranted — before recommending one over the other.

The decision matrix works as follows. If the case is straightforward — a clear trademark, a domain registered after the mark's priority date, a parking page, no respondent presence — a single-member panel at WIPO is usually the most efficient path. A standard case runs about two months from filing to a transfer order. If the facts are closer, or the claimed legitimate interest is plausible and you want a more deliberate review, a three-member panel at WIPO costs USD 4,000 for one to five domains and takes somewhat longer. If the registrant appears in jurisdictions served by the Forum, that forum can also be appropriate; its processes and fee structures differ in some procedural respects, and counsel can model the trade-offs.

There is no utility in filing a court action for a .cloud domain if the UDRP will reach the same remedy faster and at lower cost — transfer or cancellation. Court routes become relevant where damages are sought (the UDRP offers no monetary remedy), where the respondent is likely to relitigate the UDRP result in a national court, or where the domain is used as part of a broader fraud scheme that requires injunctive relief. For straightforward .cloud cybersquatting, the UDRP at WIPO or the Forum is the right starting point.

Step 7: After filing — managing the 20-day response window and the panel phase

Once a UDRP complaint commences at WIPO, the registrant has 20 days to file a response. That window is fixed. It does not extend automatically because the registrant is difficult to locate or because WHOIS shows a privacy proxy — the forum serves the complaint through all available registrant contact points, and the panel proceeds whether or not a response arrives. A registrant who intends to argue a legitimate interest must file within that window or forfeit the opportunity.

For the complainant, this period is not passive. Counsel monitors for a response, evaluates whether a supplemental filing is warranted if new facts emerge, and prepares for the possibility that the registrant raises a safe-harbor argument that was not anticipated. If the registrant does appear and asserts — say — that it operates a cloud computing consultancy using the domain name, the complainant's prior evidence package on safe harbor (ii) becomes immediately relevant. This is why closing each safe harbor in the complaint, rather than relying on default, is the correct practice.

After the response window, the provider appoints the panel. The panel may issue procedural orders requesting additional information, but this is uncommon in well-prepared cases. The panel then issues a decision — typically within weeks of appointment — and the registrar implements the order, usually within ten business days of notification. The end-to-end timeline from filing to a transfer order in an uncontested case is approximately two months.

In a recent matter — a .cloud domain targeting an enterprise software trademark, autumn 2025 — the registrant filed a response asserting it was commonly known by a similar name and operated a consultancy under that brand. We had pre-empted that argument with a business-registry search in the registrant's apparent home jurisdiction, showing no entity registration predating the domain. The panel transferred the domain. That outcome reflected preparation at the complaint stage, not a response filed after the registrant appeared.

What happens if the respondent raises a legitimate-interest argument you did not anticipate?

Respondent-side arguments that succeed at element two share a common feature: the complainant's evidence package had a gap the registrant exploited. Common gaps include: failure to search for the registrant's prior trademark filings in its home jurisdiction; failure to check business-name registries in the relevant country; and failure to investigate whether the domain name corresponds to a personal name or a geographic term with a plausible non-infringing use.

If the registrant raises a legitimate-interest argument in its response, the complainant may seek to file a supplemental submission — but panels are reluctant to admit these unless the argument raised is genuinely new and could not have been anticipated. A supplemental submission that simply re-argues existing points will be disregarded or weigh against the complainant. The better practice is to anticipate the most plausible defenses in advance and foreclose them in the original complaint.

Where a complaint is denied — whether on element two or on the full case — the complainant can consider a court action in the registrant's jurisdiction or, in some circumstances, re-file a complaint if materially different evidence emerges. Neither is a straightforward substitute for a well-prepared original filing. We regularly advise brand owners who received a denial and want to understand whether re-filing or a court route is viable; the analysis is fact-specific and the answer is not always the same.

The audience myth worth addressing directly: some brand owners assume that because they own the trademark, element two is automatic. It is not. A trademark owner must still demonstrate, affirmatively, that the registrant lacks a legitimate interest. The registrant's use of a common word, a geographic modifier, or a personal name — even one that happens to match the complainant's brand — can create a plausible safe-harbor argument. The second element requires evidence. Ownership of the mark alone does not supply it.

Related at COGNOMEN

• UDRP recovery service — assess and file a complaint to recover a domain across gTLD zones
• Recover after a buyback demand — when a registrant is asking for payment to return the name
• Respondent defense when the domain predates the trademark — how to document good-faith registration