Step-by-step: prove a registrant has no legitimate interest in a .onl…

Step-by-step: prove a registrant has no legitimate interest in a .onl. UDRP and ccTLD domain recovery and defense across .online. Email the firm to assess your…

A stranger registers your brand as a .online domain. The page resolves to a pay-per-click farm or a blank holding page, and your customers are starting to notice. You know instinctively that the registration is wrong — but under the UDRP, instinct is not enough. You must prove it.

To prove a registrant has no legitimate interest in a .online domain, a complainant must satisfy the second element of Paragraph 4(a) of the UDRP: that the respondent has no rights or legitimate interests in the domain. The .online new gTLD is fully subject to the UDRP, administered before WIPO, the Forum, or another accredited provider. The standard WIPO filing fee for a single domain starts at USD 1,500, and a case is typically resolved within about two months of filing.

This guide walks the five steps a complainant must take — and the trap concealed inside each one — to build a case on this element and reach a transfer order.

Why the second UDRP element is the pivot point of any .online complaint

The second element of Paragraph 4(a) is widely called the hardest to carry cleanly. It is not enough to show that you hold the trademark and that the domain matches it. You must also show that the registrant stands on no legitimate ground — and that proof can be harder to produce than it looks.

Panels hearing .online complaints operate under the same UDRP rules that govern .com or .net. The .online registry is ICANN-accredited, and every accredited registrar has contractually adopted the Policy. That means the three cumulative elements — confusing similarity, absence of legitimate interest, and bad-faith registration and use — all apply in full. Satisfy two and miss the third, and the complaint fails.

Why does this element receive special attention? Because Paragraph 4(c) of the UDRP hands the respondent a set of named safe harbors: a bona fide offering of goods or services before notice of the dispute; common knowledge by the domain name; or legitimate noncommercial or fair use without intent to mislead. Any one of those three, adequately substantiated, defeats the complaint on element two alone — regardless of how strong the trademark or how clear the bad faith may appear to the complainant.

In our practice, we see complaints drafted with meticulous trademark evidence that stumble here because the complainant never asked a simple question: is there any universe in which this registrant has a colorable claim? Asking that question early, and answering it with evidence, is what the remaining steps are designed to do.

Step 1: Confirm that your trademark rights are sufficient before addressing the registrant's position

The second element cannot stand alone. Before you can assert the registrant has no legitimate interest, you must first satisfy element one — that you hold trademark rights in a name that the domain replicates or closely resembles. The trap here is moving to element two while element one is still shaky.

For a .online complaint, confirm that you hold a registered trademark, a pending application with demonstrable use, or unregistered common-law rights supported by evidence of acquired distinctiveness. Panels consistently hold that unregistered rights can ground a UDRP complaint, but the evidentiary bar is higher: you will need sales figures, advertising records, third-party references, and a geographic market in which the mark is recognized. The newer the mark, the more documentation you need before you even begin to address the registrant's side of the ledger.

One practical trap: .online domains are often registered precisely because the brand owner's registered trademark covers only a traditional TLD. Check whether your mark registration covers any TLD or only specific classes. The extension itself is irrelevant to confusing similarity — panels disregard the TLD when comparing the domain string to the mark — but the mark must exist and be alive before the comparison can be made.

For a read on whether the three UDRP elements are met for your .online domain, reach us at info@cognomenlaw.com.

Step 2: Map what the registrant would need to show — then find the gaps in their record

The formal burden of proof on element two rests with the complainant, but panels have consistently held that this burden is met by a prima facie showing — after which it shifts to the respondent to produce evidence of legitimate interest. Understanding what the respondent would need to produce is the most direct route to showing they cannot produce it.

Work through each of the three Paragraph 4(c) safe harbors in turn.

Bona fide offering before notice. Has the registrant, at any point before it received notice of the dispute, used the domain in connection with a genuine offering of goods or services — not a parking page, not a placeholder, not a redirection to an unrelated site? Search for any archived version of the resolving page. If the domain has served only as a pay-per-click portal generating revenue from clicks that divert your customers, the consensus view under the Policy is that this does not constitute a bona fide offering.

Commonly known by the name. Is there any public record — a business registration, a trademark application, a longstanding web presence — showing that the registrant is commonly identified by the exact string in the domain? In our experience, this safe harbor fails most often for cybersquatters who registered an exact brand match with no pre-existing identity under that name. If the registrant's own WHOIS or RDDS entry does not use the name, and no business record does, the safe harbor is unavailable.

Legitimate noncommercial or fair use. Is the site used for criticism, commentary, or a genuinely noncommercial purpose? A blank page or a commercial parking page is neither. A site that mimics the brand owner's trade dress to attract consumers and then redirects them is neither. Panels distinguish closely between genuine criticism sites — which receive some protection — and gripe sites that are commercially motivated.

Mapping these three safe harbors systematically is not optional. Panels expect complainants to address them. A complaint that simply says "the registrant has no legitimate interest" without engaging with the safe harbor analysis is routinely criticized as conclusory — and a well-advised respondent will fill the gap with whatever narrative fits one of the three harbors.

How does the shifting burden actually work in a .online UDRP complaint?

Once a complainant makes a prima facie case — typically by asserting rights in the mark, noting the domain's identity or near-identity to that mark, and demonstrating that the registrant is not authorized — the evidentiary burden on element two shifts. The respondent must then come forward with evidence of legitimate interest, or the panel draws an adverse inference.

The trap in this step is overconfidence. A shifted burden is not a won element. The respondent who files a response — which must be submitted within 20 days of commencement — can and often does produce evidence that changes the picture. A registrant who operates a genuine business under the domain name string, even in a different geographic market, may satisfy the safe harbor. A registrant who holds a trademark registration — even a weak one or one obtained after the dispute arose — may raise a colorable argument under element one that ripples into element two.

What does this mean practically? Document everything about the registrant's identity, business history, and pre-dispute use before filing. Run WHOIS/RDDS lookups across multiple historical snapshots. Archive the resolving page and any cached versions. Check business-name registries, social-media profiles, and any trademark databases in the registrant's apparent home jurisdiction. If the registrant is a known serial cybersquatter — one who holds multiple domains that correspond to third-party marks — that pattern is powerful evidence that no legitimate interest exists, because it goes to both element two and element three simultaneously.

In a recent matter (a .online cybersquatting complaint, spring 2025), we assembled a chronological record of the domain's resolving page across more than twenty archived snapshots, demonstrating that it had pointed exclusively to pay-per-click advertising targeting the complainant's own customers across the full registration term. The respondent filed a bare denial with no supporting evidence. The panel found no legitimate interest and entered a transfer order.

Step 3: Gather the evidence that closes the safe-harbor gaps

Evidence for element two falls into three categories: what the registrant has done with the domain, who the registrant is, and what the registrant has not done — the last of which is often the most compelling.

What the registrant has done. Screenshot and archive the resolving website at the earliest possible point, and obtain archived copies from a publicly available web archive. If the page shows pay-per-click links targeting your brand's terms, goods, or services, that is strong evidence against a bona fide offering. If the page is blank, document that too — passive holding of a domain that corresponds to a well-known mark is itself a recognized form of bad faith, and it is inconsistent with legitimate interest.

Who the registrant is. The WHOIS or RDDS record may be privacy-shielded, but even shielded records often reveal the registrar, the registration date, and the registrant's apparent jurisdiction. If the registrant has a disclosed identity, cross-check it against trademark databases, business registries, and any professional directories. The absence of any public business record under the domain name string is relevant evidence that the registrant is not "commonly known" by that name.

What the registrant has not done. Panels treat the absence of use as significant when the domain corresponds to a distinctive mark. A domain that has been held for months or years without any genuine use — no developed website, no business activity, no demonstrable purpose — strongly suggests that the registration was speculative or opportunistic rather than grounded in legitimate interest. Document the registration date relative to when your mark was first used or registered; a registration that post-dates the mark's establishment in the market is a gap the registrant must explain.

One more evidence trap: do not rely solely on the UDRP complaint to put this record before the panel. The complaint is a pleading, not evidence. Exhibits must accompany it — screenshots, archived pages, trademark certificates, WHOIS printouts, and any communications between you and the registrant. Panels will not credit assertions unsupported by exhibits.

Step 4: Address element three in parallel — and understand why it reinforces element two

Elements two and three of Paragraph 4(a) are analytically separate but closely related in the evidence they require. Paragraph 4(b) lists four non-exhaustive circumstances that constitute bad faith: registration to sell to the mark owner at a price exceeding out-of-pocket costs; registration to disrupt a competitor's business; intentional attraction of users for commercial gain by creating confusion with the complainant's mark; and a pattern of abusive registrations. Any one of these, if proven, supports element three — and all four also bear on element two.

The connection matters because complainants sometimes win on element three and lose on element two, or vice versa. That is a failed complaint. The evidence that shows the registrant commercially exploited the domain through confusion-based click revenue goes to both elements simultaneously: it negates a bona fide offering (element two) while also establishing bad faith by intentional attraction for commercial gain (element three). Build your evidence architecture so that a single exhibit serves both elements.

The decision matrix here is straightforward. If the domain resolves to a commercial parking page, that evidence addresses both elements two and three. If the registrant has made an unsolicited offer to sell the domain to you at a substantial premium, that implicates Paragraph 4(b)(i) bad faith and simultaneously negates any claim to legitimate interest. If the registrant holds a pattern of domains corresponding to third-party marks — a fact we regularly document for serial cybersquatter cases — that pattern is relevant to element two because it makes any claim to a legitimate individual interest in your specific name implausible.

If a prior filing produced a bad outcome on element two, a focused second read often finds the evidence that was missing. Email info@cognomenlaw.com to discuss.

Step 5: Select the forum and understand the .online procedural mechanics

The .online gTLD is a new gTLD subject to the full UDRP, and complaints may be filed before WIPO, the Forum, CAC, or ADNDRC. For most complainants, WIPO and the Forum are the practical choices: together they handle approximately 97% of all UDRP proceedings. WIPO has the deeper institutional track record on new gTLD disputes and offers an expedited single-panel procedure for straightforward cases involving up to five domains, delivering a decision within roughly one month.

The Forum's entry filing fee for one to two domains in a single-member case begins around USD 1,300, slightly below the standard WIPO rate of USD 1,500. CAC offers the lowest entry point, though it is the least frequently used of the four. None of these figures includes legal fees, which in the market for a straightforward single-domain UDRP complaint typically run in the USD 3,000–7,000 range, separate from the filing fee.

Which forum fits a .online dispute? The choice turns on factors beyond the filing fee. WIPO's published panel appointment process is well understood by the domain industry; its panelists have developed a substantial body of new-gTLD precedent. If the respondent elects a three-member panel — triggering the higher fee of USD 4,000 at WIPO for a single panel — the parties generally split that cost. Factor that possibility into your budget before filing.

One procedural point that many first-time complainants miss: the complaint must accurately identify the current registrant. If the domain has changed hands since you first became aware of it, or if privacy shielding conceals the registrant's identity, the complaint must still be directed to the correct registrant of record. WIPO's Center can assist with WHOIS verification before filing, but the complainant bears responsibility for correct identification. An incorrectly named respondent can create procedural complications that extend the timeline.

In a second matter we handled (a .online brand-match complaint, late 2024), the registrant had used a privacy service that masked the underlying owner. We worked with the registrar to obtain the disclosed underlying registrant identity before filing, confirmed that the domain had not been transferred, and filed a complaint naming the actual registrant. The case proceeded without a procedural delay, and the panel issued a transfer order approximately eight weeks after commencement.

What are the realistic outcomes, and what happens after the decision?

Under the UDRP, the only remedies are transfer of the domain to the complainant or cancellation. There are no monetary damages, no cost awards against the losing party, and no injunctions. If you prove all three elements — including that the registrant has no legitimate interest — the panel will order transfer. If you fail on any one element, the complaint is denied.

Transfer orders are implemented by the registrar after a mandatory ten-business-day waiting period following the decision. During that window the respondent may seek a court order staying the transfer — in practice this is rare, but it is the respondent's right. Once the waiting period passes without a court filing, the registrar implements the transfer.

What about Reverse Domain Name Hijacking? If the complainant brings a complaint without a genuine basis — asserting, for instance, that a registrant who demonstrably predates the trademark has no legitimate interest — a panel may find RDNH: a finding that the complaint was filed in bad faith to deprive a legitimate registrant of its domain. The finding carries no monetary penalty, but it is a public record attached to the case and a reputational consequence. We regularly advise complainants on RDNH risk before filing, and we have also defended registrants against complaints that warranted an RDNH finding.

The myth worth addressing here: some complainants believe that filing a UDRP complaint and paying the fee is itself sufficient pressure to cause the registrant to abandon or sell the domain. That is a significant misreading of the process. A sophisticated registrant who has a legitimate defense will file a response and present it. A successful complaint requires evidence at every step, not just a filing fee and a trademark certificate.

Related at COGNOMEN

• UDRP recovery service — assess the three elements, assemble evidence, select the forum, and file
• Case study: serial cybersquatter — how a pattern of registrations resolves element two and three together
• Guide: TMCH claims notice — how to act on a claims notice before a .online dispute arises