Step-by-step: recover a .xyz domain after a failed buy-back negotiati…

Step-by-step: recover a .xyz domain after a failed buy-back negotiati. UDRP and ccTLD domain recovery and defense across .xyz. Email the firm to assess your ca…

You made an offer. The registrant declined – or countered at five figures. Negotiations have stalled, and the .xyz domain that carries your brand remains in a stranger's hands. What happens next is not a coin flip. It is a structured legal process with a clear test, a defined timeline, and a limited set of outcomes.

To recover a .xyz domain after a failed buy-back negotiation, a UDRP complaint filed at WIPO is the standard route. The .xyz registry operates under ICANN's generic-TLD accreditation, which means the UDRP applies in full. You must satisfy all three elements of Paragraph 4(a): confusing similarity to your mark, no legitimate interest in the registrant, and registration plus use in bad faith. A standard case at WIPO costs USD 1,500 in filing fees for a single-member panel and typically resolves in about two months. The only remedies are transfer or cancellation – no money damages.

This guide walks each step of that process, flags the trap hidden in each one, and sets out what evidence controls the outcome. It also explains when a buy-back attempt becomes evidence against you – and how to avoid that mistake.

Why a failed negotiation changes the UDRP calculation

A broken buy-back attempt is not merely a failed business transaction; it can reshape the evidence available to both sides in a subsequent UDRP. Before filing a complaint, you need to understand what your negotiation communications show – and what the registrant's counterdemand reveals.

Under Paragraph 4(b) of the UDRP, one explicit indicator of bad faith is registration of a domain primarily for the purpose of selling it to the trademark owner for valuable consideration in excess of out-of-pocket costs. A registrant who demanded a sum well above any plausible registration cost has, in effect, handed you a Paragraph 4(b)(i) argument. That demand – especially if made promptly after registration or in an unsolicited email – is among the most useful pieces of evidence in a .xyz recovery action.

The trap on your side is different. Did your outreach expressly state that you consider the registration a trademark violation? If so, the registrant's lawyers may argue that a later, more measured complaint looks retaliatory. Keep pre-complaint communications factual and restrained. If the negotiation is live but stalling, pause outreach before you file – simultaneous settlement talks and a live complaint can complicate both.

In our practice, we regularly advise brand owners who have made informal buy-back approaches before engaging counsel. The approach itself is rarely fatal, but the specific language used can narrow or widen your evidentiary options at the complaint stage.

For an assessment of whether your buy-back record strengthens or complicates the three UDRP elements, contact info@cognomenlaw.com.

Step 1: Confirm that the UDRP applies to your .xyz domain

The UDRP applies to all gTLD domains registered through ICANN-accredited registrars, and .xyz is a new-gTLD that sits squarely within that accreditation structure. This means that WIPO, the Forum, the Czech Arbitration Court (CAC), and ADNDRC all have jurisdiction to hear .xyz complaints under the standard UDRP rules.

The trap here is assuming that .xyz has its own distinct procedure. It does not. Some ccTLDs – .de, .uk, .eu – operate under separate national or regional rules that differ substantially from the UDRP. The .xyz zone does not. You file a standard UDRP complaint, choose your forum, pay the forum filing fee, and the same three-element test applies as it would for a .com or .net.

One structural nuance: the URS (Uniform Rapid Suspension) is also available for new gTLDs including .xyz, but the URS only suspends a domain for the remainder of the registration term – it does not transfer ownership. If your goal is to acquire the domain rather than merely disable it, the UDRP is the correct path. URS is better suited to clear-cut infringement where speed matters more than transfer.

Confirm the registrant's WHOIS/RDDS record before filing. A complaint may cover multiple domains only when the registrant is the same holder. If the registrant has registered several .xyz variants of your mark under one account, a single complaint can address all of them at once.

Step 2: Map the three UDRP elements to your facts

Every element of Paragraph 4(a) must be satisfied; failing any one of the three results in a denied complaint. Work through each in sequence before committing to a filing.

Element 1 – Identical or confusingly similar to your mark. This element is generally the easiest to satisfy. You need a registered trademark or, in many panels' view, unregistered common-law rights. The domain's TLD – .xyz – is typically disregarded in the similarity comparison; what matters is the second-level string. If your mark is "ACME" and the domain is acme.xyz, identity is clear. Where the registrant has added a generic term – "acme-products.xyz" or "getacme.xyz" – the analysis turns on whether the addition is sufficient to dispel confusion, and most panels conclude it is not.

The trap: if your trademark registration postdates the domain registration, you must show that you had enforceable rights at the time the domain was registered. A pending application alone may not suffice, depending on the panel's view of constructive notice in your jurisdiction.

Element 2 – No rights or legitimate interests. The complainant carries the initial burden, which then shifts to the registrant to produce evidence of legitimacy. The Paragraph 4(c) safe harbors cover three scenarios: bona fide offering of goods or services before notice of the dispute; commonly known by the domain name; and legitimate noncommercial or fair use. A parking page with pay-per-click links that capitalize on your mark satisfies none of them.

The trap: a registrant who begins building a genuine website after receiving your buy-back inquiry may attempt to construct a retroactive legitimacy narrative. Document the domain's historical use – via web archives and screenshot captures – before sending any formal demand or complaint.

Element 3 – Registered and used in bad faith. This is the cumulative test. Both registration and use must be in bad faith. A registrant who acquired a domain in good faith cannot be ordered to transfer it even if current use has become objectionable. The Paragraph 4(b) factors are non-exhaustive, but a buy-back demand for a sum well above registration cost is your strongest anchor here, particularly if the domain was registered after your mark became known in the marketplace.

Passive holding – pointing the domain at a blank page or a "for sale" lander – does not automatically escape a bad-faith finding. Panels have consistently held that passive holding can constitute bad-faith use where the registrant had constructive or actual knowledge of the mark and had no plausible legitimate reason to register the name.

How does the WIPO filing process actually work for a .xyz complaint?

WIPO's online filing system accepts .xyz complaints in the same queue as any other gTLD. The USD 1,500 filing fee covers a single-member panel for one to five domains; a three-member panel runs USD 4,000. Filing is entirely online. WIPO performs a formal compliance review, and if the complaint meets the administrative requirements, the case commences – triggering the registrant's 20-day response window.

After the response window closes (whether or not the registrant files), WIPO appoints the panel. A single-member case normally reaches a decision within about two months of the original filing. WIPO's expedited option can shorten that to roughly one month for eligible single-panel cases of up to five domains.

The trap in forum selection: WIPO and the Forum together handle roughly 97% of all UDRP proceedings. The Forum's entry-level fee begins around USD 1,300 for one to two domains. The CAC is cheaper still – entry fees around USD 500 to 800 – but it is less frequently used, and some practitioners consider the pool of available panelists narrower. Forum-shop by considering the complexity of your case, the likely panel composition, and prior decisions in analogous fact patterns.

Once the panel issues its decision in your favor, WIPO notifies the registrar. The registrar implements the transfer within a brief waiting period. The domain then points wherever you direct it. That waiting period exists to allow the registrant to challenge the decision in a court of competent jurisdiction, which rarely occurs in practice but is a legally preserved right.

Step 3: Build the evidence file before you file

A UDRP complaint is a document-intensive process compressed into a short timeline. Building the evidence file before the complaint is submitted – not after – is the discipline that separates strong filings from weak ones.

The core evidentiary categories for a .xyz buy-back recovery are:

• Trademark record: Certificates of registration, filing dates, and goods/services classifications. For common-law marks, prior use evidence – invoices, press coverage, web analytics – covering the period before the domain registration date.
• Domain registration date: Pull the historical WHOIS/RDDS record. If the registration predates your mark, the complaint faces a structural obstacle that must be addressed directly.
• Buy-back communications: Every email, broker message, or platform listing where the registrant named a price. A demand significantly above out-of-pocket costs anchors Element 3. Capture the full thread, not edited excerpts.
• Historical use screenshots: Web archive captures of what the domain has resolved to, from registration through the present. Parking pages, pay-per-click links to competitors, and "for sale" landers are all probative. Take fresh screenshots immediately.
• The registrant's identity record: Does the WHOIS/RDDS entry match any person or entity with a plausible connection to the domain string? A registrant with no apparent legitimate reason to hold your brand's .xyz name strengthens the no-legitimate-interest element.
• Pattern evidence: If the same registrant holds other domains corresponding to third-party trademarks, that pattern supports the Paragraph 4(b)(ii) bad-faith factor. Document it before filing.

In a recent matter (a .xyz typosquat, summer 2025), we assembled the full evidence file – including three years of web archive captures and a broker-platform price demand exceeding five figures – before the complaint was filed, and the panel issued a transfer order without requiring supplemental submissions.

What evidence decides the outcome?

The single most outcome-determinative question panels ask is: why did the registrant register this exact string? When the registrant provides no coherent answer – because none exists – the inference of targeting is strong. Your job is to foreclose the plausible alternatives and present the inference the panel should draw.

The buy-back demand price is powerful but not sufficient on its own. Panels want corroboration: the timeline of registration relative to your trademark's public profile, any communications showing the registrant knew of your mark, and the absence of any genuine commercial purpose at the domain. A registrant who registered three days after your product launch and immediately listed the domain for sale is in a far weaker position than one who held the name for five years and built an unrelated website.

Panels have consistently required that the bad-faith finding rest on the registration as well as the use. If your evidence shows only that current use is problematic – but registration looked innocuous at the time – the complaint may fail on Element 3 even if Elements 1 and 2 are solid. This is the most common reason otherwise meritorious complaints are denied.

The trap for complainants: over-pleading. A complaint that asserts every Paragraph 4(b) factor regardless of evidence dilutes the argument. Panels notice when a complainant applies boilerplate bad-faith language to a fact pattern that only supports one or two of the listed grounds. We assess the three UDRP elements precisely and build the complaint around the factors that the evidence actually supports.

If a prior filing produced a denial and you are assessing whether the evidentiary gaps are fixable, email info@cognomenlaw.com.

Step 4: Choose the right forum and file strategically

Forum selection for a .xyz complaint is not automatic. The right choice depends on the registrant's likely sophistication, the complexity of the bad-faith argument, and your timeline.

For a straightforward case – strong trademark, unambiguous buy-back demand, parking-page use – WIPO's standard process is reliable. The filing fee of USD 1,500 for a single-member panel is modest relative to the value of the domain, and WIPO's case management is well documented. Where the registrant is likely to engage and the bad-faith argument requires nuanced treatment, a three-member panel at WIPO (USD 4,000) provides an additional layer of scrutiny that can preempt appeals.

The Forum is a credible alternative, particularly when you want a slightly lower entry fee or when the registrant is US-based and the Forum's procedural familiarity may be a factor. The CAC is appropriate for cost-sensitive cases involving multiple low-value domains in the same complaint.

What the UDRP cannot reach: if the registrant is operating in a jurisdiction where the domain is also registered as a ccTLD variant – say, a .de or a .uk alongside the .xyz – those names require separate proceedings under their own procedures. The DENIC system for .de provides no UDRP; disputes go to German courts. The Nominet DRS handles .uk disputes under an "abusive registration" test that reads "registered or used" abusively – a lower bar than the UDRP's cumulative standard. We identify the governing national procedure, check eligibility, and prepare filings for each zone separately where cross-border recovery is needed.

If the registrant is using the .xyz domain to commit fraud or divert payments – not merely squatting – court action alongside the UDRP may be warranted. US anticybersquatting litigation can reach monetary damages that the UDRP cannot. For fraud-adjacent abuse, we coordinate with local litigation counsel in the relevant jurisdiction to pursue parallel remedies where the facts support it.

Step 5: Handle the response window and the decision phase

Once the case commences, the registrant has 20 days to file a response. Many registrants in buy-back-dispute scenarios do not respond – particularly where the domain was registered for speculation rather than any genuine purpose. A default does not automatically mean you win; the panel still evaluates the complaint on its merits. But an unresponded case typically moves faster and the panel has only your evidence to consider.

Where the registrant does respond, expect them to assert one or more of the Paragraph 4(c) safe harbors: that they were making a bona fide offering, that they are commonly known by the domain string, or that use is nominative or fair. A well-constructed response with supporting declarations can shift the panel's view on Element 2 even where Elements 1 and 3 are clear.

Supplemental filings – additional submissions beyond the complaint and response – are not a matter of right. Panels admit them only where genuinely new evidence has emerged that could not have been included in the original submission. Do not plan your case around the opportunity to supplement; build the complete record in the complaint itself.

The panel's decision is published in WIPO's online database. If the decision orders transfer, the registrar implements it after the brief challenge period – typically fifteen days – during which the registrant may file a court action to suspend the transfer. In practice, that route is uncommon. Once transferred, the domain is yours to configure as your brand requires.

Related at COGNOMEN

• UDRP recovery service – assess the three elements and file at WIPO or the Forum
• Proving no legitimate interest – what evidence panels require under Paragraph 4(c)
• TMCH Claims Notices – how trademark clearinghouse notices interact with new-gTLD disputes