Step-by-step: recover a lapsed .app domain that was re-registered

Step-by-step: recover a lapsed .app domain that was re-registered. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your case.

Your brand's .app domain expired during a billing gap. Before you renewed it, a third party snapped it up. Now they are either parking it, pointing it at a competing service, or waiting for you to make an offer. This is not a hypothetical. In our practice we regularly advise brand owners in exactly this position – and the path forward is narrower than most expect.

Recovering a lapsed .app domain that has been re-registered by a third party is possible, but it is not automatic. The .app zone is a generic top-level domain operated by Google Registry; it falls under ICANN's accreditation rules and uses the UDRP as its dispute-resolution mechanism. That means you must satisfy all three elements of Paragraph 4(a) of the UDRP: confusing similarity to a mark you hold, absence of legitimate interest in the registrant, and registration and use in bad faith. A standard WIPO case takes roughly two months; the filing fee starts at USD 1,500 for a single-member panel.

This guide walks through each decision point in sequence – and names the trap hidden at each step.

Step 1: confirm that the UDRP applies to your .app domain

The UDRP applies to all ICANN-accredited gTLD registrations, and .app is unambiguously a gTLD. This is the foundation. Before you do anything else, confirm the governing dispute-resolution policy in the registration agreement for the specific .app domain in dispute. Google Registry's .app operates under the standard UDRP and the UDRP Rules as adopted by ICANN.

The trap here is assuming the procedure mirrors a ccTLD. It does not. There is no .app-specific national registry with its own rulebook. There is no "registered OR used" standard of the kind the Nominet DRS applies to .uk domains. The UDRP demands that the registrant both registered and is using the domain in bad faith – a cumulative test. If the new registrant is simply holding the domain passively, some panels have found that passive holding of a domain can constitute bad-faith use where the surrounding circumstances are strong enough; others have been more cautious. The doctrine is settled enough to rely on, but the facts still have to carry the weight.

Practical check: pull the current WHOIS/RDDS record, screenshot it with a date stamp, and verify the registrar. That registrar record will confirm which UDRP-accredited provider you can file with – WIPO, the Forum, the Czech Arbitration Court (CAC), or the ADNDRC. WIPO and the Forum together handle roughly 97% of all UDRP proceedings and are the default choice for .app disputes.

What trademark rights do you need before you can file?

Under Paragraph 4(a)(i) of the UDRP, the complainant must hold trademark rights – registered or unregistered – in a name that is identical or confusingly similar to the disputed domain. For a lapsed .app, this question is usually straightforward: you had the domain first because you held the brand. The trap is proving it now.

A registration certificate from a national or regional trademark office is the clearest proof. If you relied on common-law rights – trade dress, business reputation, prior use – you need documentary evidence: marketing spend, customer invoices, press coverage, social-media history showing the mark in commercial use before the re-registration date. Do not assume the panel will infer mark ownership from the prior registration history of the domain itself. Domain ownership does not create trademark rights; it can only corroborate them.

One further trap: if your trademark application postdates the re-registration, you have a harder road. Panels apply the trademark-rights test as of the complaint date, not the domain's original registration date. A pending application, without strong secondary-meaning evidence, rarely carries the first element on its own. File your trademark application immediately if you have not already done so, but build the evidentiary record in parallel.

At this stage many brand owners are unsure whether their rights are strong enough to carry the first element. For a read on whether the three UDRP elements are met in your situation, reach us at info@cognomenlaw.com.

Step 2: run the chain-of-title and prior-dispute check

Before you file – or before you pay to acquire the domain outright – you need to know its full history. A domain that has been through prior UDRP proceedings is a domain with a public litigation record. That record can work in your favor or against you.

Check the WIPO and Forum decision databases by searching the domain name. If a prior owner filed a UDRP and lost, the panel's reasoning is public. If the prior registrant was found to have legitimate interests in the name, that finding is not binding on a new panel – but it is available to a respondent's counsel who will use it to argue the domain has a history of non-abusive registration. If the prior registrant was found to have acted in bad faith and the domain was ordered transferred, then the current registrant took it on notice of that taint.

Also check the domain's backlink profile and any archived content through a web-archive service. A domain that previously resolved to a brand-owner's website and now resolves to a competitor's service is a factual story that writes itself in a UDRP complaint. A domain that previously resolved to a brand-owner's website and now resolves to a parked page of generic links is a closer call, but panels have consistently found that a pattern of commercial misdirection supports bad faith.

The trap here is skipping this step because the answer seems obvious. We have seen complainants file without checking, only to encounter a respondent who produces evidence that the domain was actively used for a bona fide purpose before the complainant's own trademark registration. That single gap can defeat the complaint and, worse, produce a finding of reverse domain name hijacking – a public record that the complaint itself was an abuse of the UDRP.

Step 3: assess the bad-faith evidence before you commit to a route

The third UDRP element – bad faith in registration and use – is where most lapsed-domain cases are won or lost. The fact that you previously held the domain does not, by itself, prove the new registrant acted in bad faith. What it does is provide context. The question is what the new registrant did with that context.

Paragraph 4(b) of the UDRP lists non-exhaustive factors evidencing bad faith: registering primarily to sell to the mark owner at a profit; registering to disrupt a competitor; using the domain to attract users by creating confusion with the complainant's mark; and a pattern of such registrations across multiple domains. For a lapsed .app, the most common scenario is opportunistic registration – the new registrant monitored drop-catching services, noticed the brand's .app lapse, and registered it to extract a buy-back payment or to benefit from the residual traffic.

What evidence do you actually need? At minimum: a screenshot of the current landing page (if any); any communication from the new registrant offering to sell; the registration date relative to your trademark registration or first-use date; and any evidence of the new registrant's pattern of similar registrations. The RDDS record, the registrar's abuse-contact record, and any reverse-WHOIS lookup by registrant email are all part of the file.

In a recent matter – a .app cybersquatting complaint, summer 2025 – we assembled a bad-faith record based on a drop-catch registration timed to within 48 hours of lapse, an offer to sell at a five-figure sum sent before any outreach from the brand owner, and a registrant portfolio containing approximately a dozen similarly timed registrations. The case resolved in transfer roughly eight weeks after filing at WIPO. No outcome is assured by any single factor; the record as a whole carries the case.

Step 4: choose the right forum and route – UDRP, URS, or direct purchase

For a .app domain, the choice of route depends on what you need and how quickly you need it. Three paths are realistic: a UDRP complaint, a Uniform Rapid Suspension proceeding, or a negotiated acquisition. Each has a different cost profile, timeline, and risk.

The UDRP is the standard recovery route. Filing at WIPO costs USD 1,500 for a single-member panel covering one to five domains. A standard case resolves in roughly two months. If you need a decision faster – and the case involves a single panel and up to five domains – WIPO offers an expedited option that can deliver a decision in approximately one month. The remedy is transfer or cancellation; there are no monetary damages.

The URS is available for .app as a new gTLD. It is cheaper than the UDRP and faster, but it suspends the domain for the registration term rather than transferring it. If the brand is your core asset and you need it in your name, URS is usually the wrong tool. Where it fits is when you need to stop active harm quickly – phishing, customer misdirection – while a UDRP or purchase runs in parallel.

Negotiated acquisition can be faster than any proceeding and avoids litigation risk entirely. But it only works if the registrant will sell at a price that makes commercial sense. Paying a five-figure sum to a drop-catcher for a domain you should never have lost is a legitimate business decision. It is also a decision that rewards bad-faith behavior across the ecosystem. If the evidence is strong and the asking price is unreasonable, a UDRP complaint is the better path.

The Forum's filing fee starts at approximately USD 1,300 for one to two domains under a single-member panel – marginally lower than WIPO for a small case. CAC begins around USD 500–800 and is the lowest-cost option, though it sees less volume than the other two. The choice of forum is not purely about price; WIPO's published precedent database and larger panelist pool are real advantages for a complex bad-faith argument.

If you are weighing a UDRP complaint against a direct purchase for your .app domain, email info@cognomenlaw.com to compare the two paths against your specific evidence and timeline.

Step 5: prepare the complaint – and the traps inside the filing

A UDRP complaint is a structured legal document. It must address each of the three elements, attach exhibits, identify the forum, pay the filing fee, and elect a single or three-member panel. Each of those choices has consequences.

Complainants who elect a single-member panel save on fees. A three-member panel costs USD 4,000 at WIPO. But if the respondent files a response and requests a three-member panel, the fee is generally split, and both sides bear a share of the higher cost. For a clear case, a single-member panel is appropriate. For a case where the bad-faith element is genuinely close, a three-member panel reduces the risk of a minority dissent that undermines the decision on appeal or in follow-on litigation.

The trap inside the complaint is overreaching. Complainants sometimes allege all four Paragraph 4(b) bad-faith factors when only one is clearly supported. An overreaching complaint can lead a panel to find that some allegations were unsupported, which in turn weakens the overall credibility of the filing. State the best case; omit the weak arguments.

The other trap is service of process. The UDRP requires that the complaint be sent to the registrant at the email address in the RDDS record. If the RDDS record shows a privacy service rather than the underlying registrant, the provider – WIPO or the Forum – will serve through the registrar. Confirm the registrar's abuse contact and confirm that the registrar will cooperate with service before you file. If the registrar is unresponsive, that is itself a fact worth noting in the complaint.

Step 6: respond to a default or a filed response

If the respondent does not file a response within 20 days of commencement, the case proceeds on the complaint alone. Default is not automatic transfer – the panel still applies the three-element test. But default removes the respondent's opportunity to present a legitimate-interest defense, which significantly narrows the panel's fact-finding task.

If the respondent does file, the stakes shift. A well-prepared response identifying a bona fide use, a registered business name, or a prior trademark can force the panel to weigh competing evidence. In a minority of cases, a respondent files and succeeds; in the majority, a genuine bad-faith registration does not survive a well-evidenced complaint. But the difference between winning and losing often lies in how the complainant's counsel anticipates the response in the original complaint – addressing the predictable defenses before the respondent raises them.

One scenario specific to lapsed .app domains: the new registrant may argue that they registered a generic or descriptive name without knowledge of the complainant's mark. The .app TLD is associated with software applications, and some registrants legitimately register descriptive .app names for application-related services. If your mark is at all descriptive of a software category, expect this argument. Meet it head-on in the complaint by distinguishing the specific distinctiveness of your mark from the generic category.

Step 7: implement the transfer – and protect against lapse again

Once a panel orders transfer, the registrar implements it within the post-decision implementation window. No further court order is required for a UDRP transfer. The domain moves to the registrant designated by the complainant. That is usually the complainant directly, or a holding entity they nominate.

The trap at this final step is the one that created the problem in the first place: inadequate renewal controls. A lapsed domain that was re-registered once can lapse again. Once you recover the domain, take the following steps immediately: enable auto-renewal with a payment method that will not expire before the next renewal date; set a calendar alert at 90 days and again at 30 days before expiry; consider a multi-year registration to reduce the renewal cycle risk; and lock the domain at the registrar level to prevent unauthorized transfer.

In a recent matter – a .app portfolio recovery, spring 2025 – we coordinated the post-transfer lock-down for a brand with approximately a dozen .app registrations that had become vulnerable after a change in payment processor. The recovery itself took roughly seven weeks from complaint to implementation. The post-recovery lock-up took one afternoon. The asymmetry is instructive.

If you are also acquiring a .app domain by purchase rather than through a dispute procedure, the chain-of-title check at Step 2 applies with equal force. A domain that carries an unresolved dispute history, a prior RDNH finding, or a pending UDRP complaint transfers those risks to the new owner. Pre-acquisition due diligence on any .app registration should include a dispute-history search, a trademark-similarity screen, and a review of any prior abuse-contact records associated with the registrant.

Related at COGNOMEN

• Domain transactions, due diligence, and brand-protection monitoring – how COGNOMEN structures acquisition and portfolio work
• Domain assignment agreements in .au – transferring a ccTLD domain by contract and what to check before signing
• Check ccTLD eligibility for .eu – confirming EU/EEA nexus before filing or acquiring a .eu domain