Step-by-step: prove a registrant has no legitimate interest in a .xyz…

Step-by-step: prove a registrant has no legitimate interest in a .xyz. UDRP and ccTLD domain recovery and defense across .xyz. Email the firm to assess your ca…

A stranger holds a .xyz domain that matches your brand exactly. You find it parked, pointing at competitor ads, or simply dark – sitting there, blocking your expansion into that zone. The question is not whether to act. The question is how to build the middle element of a UDRP complaint so it holds up under scrutiny.

To prove a registrant has no legitimate interest in a .xyz domain, a complainant must satisfy the second element of Paragraph 4(a) of the UDRP, which applies to .xyz through ICANN's standard accreditation regime. The complainant establishes a prima facie case – showing the registrant is not commonly known by the name, made no bona fide offering before notice, and is not making legitimate noncommercial or fair use – after which the burden shifts to the registrant to rebut. A standard WIPO case for a .xyz domain runs roughly two months, with a USD 1,500 filing fee for a single-member panel.

This guide takes each step in sequence, flags the trap hiding inside each one, and sets out the evidence that moves a panel from "probably" to "clearly met."

Why .xyz Is a Genuine UDRP Zone – and Why That Matters

.xyz operates under the standard UDRP, administered by WIPO, the Forum, CAC, and ADNDRC – the same policy that governs .com. That is important because some brand owners treat .xyz as a secondary concern. Squatters do not. The zone is among the largest new gTLDs by registration volume, registration costs are low, and the barrier to abuse is minimal. We regularly advise complainants who discover that a .xyz variant of their brand name is directing visitors to a phishing page or a pay-per-click farm.

Because the UDRP applies in full, all three elements of Paragraph 4(a) are required: confusing similarity to a mark, no legitimate interest, and registration plus use in bad faith. This guide focuses on element two – but the three elements are cumulative. Missing any one is fatal to the complaint.

The practical implication: a strong bad-faith argument does not rescue a weak legitimate-interest analysis. Panels decide element two independently. That means you need to address it with the same care you give to the trademark element.

Step 1: Establish Your Prima Facie Case Before You File

A complainant does not need to prove a negative directly. The UDRP gives complainants a procedural advantage: demonstrate, at minimum, that the registrant is not commonly known by the domain name and has no obvious authorized use, and the burden of production shifts to the registrant to show a legitimate interest exists. The trap in this step is treating "prima facie" as a low bar requiring only the thinnest allegation.

Panels want more than an assertion. In our practice, the most effective prima facie cases document three things in combination: the complainant's trademark rights predate registration; WHOIS or RDDS data show no personal or commercial name matching the disputed string; and there is no license, franchise, or authorized reseller arrangement between the parties. Each point is a sentence in the complaint. Each needs a supporting exhibit.

What exhibits work? A screenshot of your trademark certificate, a letter confirming no license was granted, and a timestamped WHOIS printout together form the core. Add a screenshot of how the domain resolves – or a Wayback Machine capture if it has since been taken down. The trap here is filing without current WHOIS data. Registrant information can change between your first search and the complaint's filing date. Pull a fresh printout the day you file.

For a read on whether the three UDRP elements are met on your .xyz domain, reach us at info@cognomenlaw.com.

Step 2: Address Each of the Three Paragraph 4(c) Safe Harbors in Turn

Paragraph 4(c) of the UDRP gives a registrant three defenses, any one of which defeats the legitimate-interest element if proven. Your complaint must address each of them – not to prove a negative, but to show that the record does not support any of them. Skipping even one gives a panel an opening to deny the complaint on grounds you never answered.

The three safe harbors are: (1) the registrant used or prepared to use the domain in connection with a bona fide offering of goods or services before it received notice of the dispute; (2) the registrant is commonly known by the domain name; and (3) the registrant is making legitimate noncommercial or fair use of the domain, without intent for commercial gain by misleadingly diverting consumers.

Safe harbor one – bona fide offering. Look at what the domain actually does, or did. A pay-per-click page monetizing the trademark is not a bona fide offering under the consensus view. Neither is a blank page with no preparatory evidence. If the domain points at your competitor's products, that is evidence against a bona fide offering – and evidence that goes to bad faith simultaneously. Attach the screenshot and state both conclusions.

Safe harbor two – commonly known by the name. Check business registers in any jurisdiction where the registrant might operate. A quick company search in the obvious countries, combined with the absence of matching entries in the WHOIS organization field, closes this safe harbor cleanly for most panels. The trap is assuming common knowledge is impossible without checking. If the registrant actually has a trading name that matches the domain, the complaint is in trouble – a fact better discovered before filing than after a default that produces no response but still attracts panel scrutiny.

Safe harbor three – noncommercial or fair use. Commentary, criticism, and fan sites raise fair-use arguments even where the domain is identical to a mark. If the domain appears to host genuine criticism of the complainant, address the argument head-on. Panels distinguish between a site that genuinely criticizes the brand and one that mimics the brand to divert traffic, and they do not always agree on where the line falls. Where criticism is plausible, build your bad-faith case alongside the legitimate-interest analysis rather than treating element two as already won.

How Does the Registrant's Silence Affect Your Case?

If the registrant does not file a response within 20 days of commencement, the proceeding continues on the papers. Default is common in .xyz cybersquatting cases. The trap is believing that default automatically wins element two. It does not. Panels in default cases still require the complaint to make out a prima facie case. A well-documented complaint wins on default; a thin one may not.

We have seen complaints with strong bad-faith arguments fail on the legitimate-interest element in default proceedings because the complainant never addressed safe harbor two – the panel noted that the registrant's name was never checked against business registers and declined to draw the inference automatically. Document the record as if the registrant will file a detailed response. If they do not, your complaint is still complete. If they do, you are ready.

Where a response is filed, the registrant will typically produce whatever evidence supports a legitimate interest. The most common defensive strategies in .xyz cases include: a claimed descriptive use of the domain string in an unrelated business; a claimed prior use predating knowledge of your trademark; or, less commonly, a nominative fair-use argument. Address each in your reply if the forum and your procedural posture allow supplemental filings – but note that supplemental filings are not a right under the UDRP and are admitted at the panel's discretion.

Step 3: Build the Evidence Record That Panels Actually Weigh

Evidence in a UDRP complaint is submitted with the complaint itself, not afterward. There is no discovery, no deposition, and no witness examination. The record closes when submissions close. That makes front-loading evidence – filing everything at the outset that you may later wish you had – a cardinal discipline.

The evidence most relevant to element two in a .xyz complaint falls into three categories. First, identity evidence: WHOIS/RDDS records, any available registrant business registration searches, and the absence of any license agreement in your records. Second, use evidence: what the domain resolves to now, what it resolved to historically (Wayback Machine captures are routinely accepted by WIPO panels), and any communications from or about the registrant regarding the domain. Third, relationship evidence: correspondence confirming no authorized use, no franchise, no reseller agreement.

In a recent matter – a .xyz domain matching a mid-size technology brand's registered mark, spring 2025 – we assembled a full identity and use file before filing, capturing approximately seven Wayback Machine captures over eighteen months showing the domain cycling through different pay-per-click configurations. The panel found element two met without discussion, and the transfer issued roughly eight weeks after filing.

What about private WHOIS? ICANN's post-GDPR RDDS regime has obscured registrant identity data across all zones, including .xyz. Where the registrant is listed as a proxy service or simply as a privacy redaction, your prima facie case should note the absence of identity information and argue that no matching individual or business name can be confirmed. Panels understand the environment; the absence of identity data does not require you to abandon element two.

To weigh UDRP against a court action for your .xyz case, email info@cognomenlaw.com.

Step 4: Choose the Forum and File

For a .xyz domain, WIPO and the Forum are the dominant choices, accounting for roughly 97% of all UDRP proceedings across zones. Both accept .xyz complaints. The choice turns on several practical factors.

WIPO's filing fee for a single-domain complaint before a single-member panel is USD 1,500. The Forum's filing fee begins around USD 1,300 for one or two domains with a single panelist. WIPO offers an expedited option – a decision within approximately one month, available for single-panel cases covering up to five domains – which can be valuable where the registrant's conduct is causing active harm. The Czech Arbitration Court (CAC) offers the lowest entry point, beginning around USD 500–800, and is worth considering for straightforward single-domain cases where cost is a priority.

The right forum decision is also about the panel pool. WIPO's panel composition for .xyz cases tends toward practitioners with international trademark and internet law backgrounds. The Forum's pool is comparable. Neither forum can be directed to produce a particular outcome, and panel selection is not a lever parties control directly. What you control is the quality of the record you submit.

Once filed, the timeline is set by the Rules. The registrar is notified, the respondent has 20 days to respond, a panelist is appointed, and a decision issues. From filing to decision typically runs about two months absent procedural complications. Transfer implementation by the registrar follows the decision.

The decision matrix in brief: if you hold a registered trademark and the .xyz domain is clearly cybersquatted with no plausible legitimate use, file at WIPO or the Forum with a single-member panel – the fastest, most cost-efficient path. If the registrant's claimed legitimate interest is factually complex (a genuine business dispute, a reseller gone rogue, or a prior use argument with documentary support), consider requesting a three-member panel; the higher cost is justified by the broader deliberation. If the domain appears to be connected to fraud, identity theft, or criminal activity, the registrar escalation and theft-recovery route runs in parallel and does not require a UDRP proceeding to begin.

The Trap That Defeats Otherwise Strong Complaints

Experienced complainants lose element two for a single consistent reason: they treat it as the element that proves itself once the bad-faith case is strong. It does not. Panels apply all three elements with equal independence. A complaint that spends fifteen pages on bad faith and two sentences on legitimate interest telegraphs to a panel that the complainant assumed the middle element was obvious. Panels are not persuaded by confidence; they are persuaded by evidence.

The second trap is ignoring the registrant's online footprint. A registrant with a years-old website, an established social media presence under the domain name, or a demonstrable trade use has a legitimate-interest argument even where the domain is confusingly similar to a trademark. We regularly advise brand owners to run a thorough pre-filing investigation – not merely a WHOIS lookup – before treating element two as a formality. A complaint filed without that investigation, against a registrant who actually has a history of use, risks not only losing but producing a Reverse Domain Name Hijacking (RDNH) finding. An RDNH finding is reputational, not monetary, but it is public and it follows the complainant into any subsequent proceeding.

To read about how bad-faith evidence interacts with the legitimate-interest element in a related context, see how panels approach bad-faith evidence in domain disputes. For a closer look at one of the recurring patterns in .xyz disputes – passive holding – see recovering a passively held .xyz domain.

Related at COGNOMEN

• UDRP Recovery Service – full-service UDRP complaint filing for gTLD domains including .xyz
• How panels weigh bad-faith evidence alongside the legitimate-interest element
• Recovering a passively held .xyz domain – a worked case study