Step-by-step: recover a lapsed .org domain that was re-registered

Step-by-step: recover a lapsed .org domain that was re-registered. UDRP and ccTLD domain recovery and defense across .org. Email the firm to assess your case.

Your organization let its .org renewal slip. Someone else caught the drop and registered it. Now the domain you built your reputation on redirects visitors to a pay-per-click page – or, worse, a site designed to look like yours. Can you get it back?

Yes, recovery is often possible. The UDRP applies fully to .org domains, which are accredited gTLDs governed by ICANN-accredited registrars, and WIPO administers the procedure. To prevail, you must satisfy all three elements of Paragraph 4(a): confusing similarity to a mark you hold, no legitimate interest in the registrant, and registration and use in bad faith. The WIPO filing fee starts at USD 1,500 for a single-panel case. Recovery is not guaranteed – each step below carries a trap that can derail an otherwise strong claim.

This guide walks every decision point, from confirming the lapse to the moment the registrar implements a transfer order.

Step 1: Confirm what actually happened – and why it matters for your UDRP claim

A lapsed domain and a hijacked domain look alike on WHOIS but behave very differently under the UDRP. Before filing anything, you need to know exactly how the new registration came about.

Pull the RDDS (WHOIS) history through a registrar or a domain-history service. Identify the prior registration date, the expiry date, the deletion date, and the new registration date. The sequence matters. A domain that expired, entered a redemption grace period, was deleted, and was then caught by a drop-catching service has a clean chain from the registrant's perspective – they paid for a legitimately available name. A domain that was transferred out of your account without authorization is a theft, not a lapse, and the correct first step is registrar escalation, not a UDRP complaint.

The trap in Step 1: registrants sometimes assume "I used to own it, so the new registrant must be acting in bad faith." Panels do not share that assumption automatically. A party who registered a dropped domain without any knowledge of your prior use, and who had no intent to target your brand, may defeat the bad-faith element. Your prior ownership is useful context – it is not, by itself, proof of bad faith by the new registrant.

Note the registration date of the new .org precisely. The UDRP requires that the domain was registered and used in bad faith. If the current registrant registered the name after your mark became distinctive in commerce, that timing strengthens your claim. If your mark post-dates the new registration – even by days – the analysis shifts materially.

Step 2: Audit your trademark rights – the threshold element

The first UDRP element requires rights in a mark to which the domain is identical or confusingly similar. That element is the easiest to satisfy, but the audit here decides whether the remaining two elements are worth pursuing at all.

Gather your trademark registrations in every relevant jurisdiction. Unregistered or common-law mark rights can support a UDRP complaint, but panels apply greater scrutiny. For a lapsed .org, the most persuasive evidence of common-law rights is continuous commercial use predating the new registration: web archives showing the domain in active use under your name, press coverage, client records, or invoices. The prior registration history of the same domain under your control is relevant but not determinative.

The trap in Step 2: assuming that because you previously held the domain, you automatically have trademark rights in the corresponding string. The UDRP is a trademark proceeding, not a property-recovery proceeding. A domain registrant who loses a renewal does not acquire a trademark right by the act of prior registration alone. Panels have consistently held that the relevant question is whether the complainant holds a mark – not merely whether they once held a domain.

For an assessment of whether your rights meet the threshold, and whether the confusing-similarity element is satisfied for your specific .org string, contact info@cognomenlaw.com.

To weigh your trademark position and the strength of the bad-faith evidence before committing to a filing fee, email info@cognomenlaw.com.

How do you prove the second UDRP element – no legitimate interest – in a .org lapse case?

The second element requires showing that the current registrant has no rights or legitimate interests in the domain. Under the UDRP, the complainant establishes a prima facie case; the burden then shifts to the registrant to rebut it.

For a lapsed .org, three questions guide the analysis. First, is the registrant commonly known by the domain name? If the string is a generic or descriptive word – "research.org", "connect.org" – a third party can plausibly claim a legitimate interest in the term itself. Second, is the registrant making a bona fide offering of goods or services at the domain? A genuine business using the name, even one established after your lapse, weakens this element significantly. Third, is there a legitimate noncommercial or fair-use argument? Commentary sites, criticism sites, and fan sites have occasionally survived UDRP challenges under the Paragraph 4(c) safe harbor, though panels scrutinize them carefully where the use looks pretextual.

In our practice, lapsed .org cases most often turn on whether the current use is genuinely commercial or is a parking-page placeholder designed to monetize confusion. A registrant pointing the domain at a pay-per-click page that serves links related to your industry – without any independent business operating under that name – rarely satisfies the bona fide-use safe harbor. That pattern has consistently been held insufficient to establish legitimate interest under the UDRP.

The trap in Step 2: filing too early, before the bad-faith evidence is documented. If the registrant has a thin but colorable argument for legitimate interest and you have only weak evidence of targeting, a panel may deny the complaint – and that denial becomes part of the domain's dispute history, complicating any future filing.

How do you establish bad faith in a re-registration of a lapsed .org domain?

The third UDRP element is the most contested in lapse cases. The registrant can argue, sometimes convincingly, that they simply acquired an available domain and had no knowledge of your prior use. Bad faith cannot be inferred from the mere fact of registration. You need evidence of targeting.

The key bad-faith indicators for a lapsed .org are these. Pay-per-click content that directly mirrors your business category is strong evidence the registrant knew about your brand. A demand to sell the domain to you – particularly an unsolicited email sent to your organization shortly after registration – fits squarely within Paragraph 4(b)(i) of the UDRP. A pattern of registering lapsed brand-related domains by the same registrant across multiple zones strengthens the case further. And passive holding of a domain that is identical to a distinctive mark, with no active use, has been treated as bad faith in appropriate circumstances, though panels apply that doctrine narrowly.

In a recent matter (a .org recovery, spring 2025), we identified that the registrant had sent an unsolicited buy-back inquiry to our client within three weeks of catching the drop. That email, combined with the domain's PPC content mirroring the client's services, was central to the bad-faith finding. The transfer was ordered in approximately eight weeks from filing.

The trap in Step 3: over-relying on passive holding alone. Unless the mark is highly distinctive and the registrant offers no explanation for the choice of name, panels are reluctant to find bad faith from silence. Corroborating evidence of targeting – prior correspondence, the timing of registration relative to a known brand event, or PPC content – substantially strengthens the claim.

If a prior filing produced a denial or produced no action at all, a focused second read of the record can identify the element that was missed. Contact info@cognomenlaw.com to review the file.

Step 3: Choose the right forum and file the complaint

For a .org domain, the UDRP applies and the choice of approved provider is yours. WIPO and the Forum together handle roughly 97% of all UDRP proceedings. WIPO is generally preferred for international matters and brand-focused cases; the Forum processes a high volume of complaints efficiently at comparable cost. The Czech Arbitration Court (CAC) is an alternative at a lower entry price.

WIPO charges USD 1,500 for a single-member panel covering one to five domains. If the registrant requests a three-member panel – which they may do – the cost rises to USD 4,000, with the parties generally splitting the difference. WIPO also offers an expedited option delivering a decision within about one month for single-panel cases of up to five domains.

The complaint itself must include: a clear statement of the domain in dispute; the trademark rights on which you rely (with evidence); a statement of why the registrant has no legitimate interest; and the evidence of bad faith. Procedural defects – wrong registrant name, missing annexes, incorrect contact details – can cause a complaint to be declared administratively deficient and returned for correction, adding days to the timeline.

The trap in Step 3: naming the wrong respondent. If the WHOIS shows a privacy-protection service rather than the underlying registrant, the complaint must identify the registrant to the best of the complainant's ability. Most providers require you to name both the privacy service and, if known, the underlying holder. Failing to do so correctly can lead to a procedural suspension.

The registrant has 20 days to file a response after the case formally commences. If no response is filed, the panel decides on the complaint alone – but a default does not automatically produce a transfer. The panel still evaluates all three elements on the evidence before it.

Step 4: Manage the evidentiary record after filing

Once a UDRP complaint is filed, the record is largely closed. Supplemental submissions – additional evidence filed after the response – require leave of the panel and are disfavored. The rule is straightforward: assemble your complete evidentiary record before you file, not after.

What the record should contain: screenshots of the domain's current use (timestamped, with the full URL visible); WHOIS history documentation; all trademark registration certificates or evidence of unregistered use; any correspondence with the registrant or a broker acting on their behalf; web archive captures showing your prior use of the domain; and any press or third-party references establishing the fame or distinctiveness of your mark in relation to the .org string.

For organizations that held the .org for years before the lapse, the web archive is particularly powerful evidence. Panels examining a lapsed-domain case regularly look at whether the domain carried a distinctive identity under the complainant's prior use, which in turn bears on whether the new registrant could credibly claim ignorance of that use at the time of re-registration.

In a second matter we handled (a nonprofit sector .org, autumn 2024), the complainant had strong trademark rights but weak archive documentation. We supplemented the record with third-party grant agreements and published annual reports that referenced the domain prominently. Those materials established the mark's reputation in a way that the web archive alone could not. The panel found bad faith on that basis.

The trap in Step 4: assuming the panel will search for evidence on its own. Panels decide on the written record. They do not conduct independent research, visit the domain independently as a factual exercise outside the submitted materials, or consider facts not in the annexes. Every material fact must be documented and annexed to the complaint.

What happens when the UDRP route is unavailable or insufficient?

The right route depends on the zone and the goal. For a .org domain where you seek a transfer and have a viable trademark claim, the UDRP is almost always the most efficient path – a standard case runs about two months and the only remedies are transfer or cancellation, with no monetary damages. If the registrant is a competitor and you want damages in addition to the domain, a US anticybersquatting action in court is the only path that reaches money, though that route is substantially more expensive and time-consuming.

If the dispute also involves a national ccTLD – for example, a .org and a .uk registered by the same party – a parallel Nominet DRS filing may be appropriate for the .uk. The Nominet procedure includes a free mediation stage before any expert decision, and the test differs from the UDRP: a registration that is abusive because it was registered or used in a way that takes unfair advantage of your rights can satisfy the DRS test, a lower bar in certain fact patterns than the UDRP's cumulative "registered AND used" standard. Timelines for a Nominet case run approximately 8–12 weeks once an expert decision is required.

If neither the UDRP nor a national procedure is available – for example, the registrant operates across multiple zones and you need injunctive relief or asset freezing – local litigation counsel in the relevant jurisdiction can pursue court action where arbitration cannot reach.

We regularly advise clients who face a multi-zone problem: the same bad actor holding both the .org and one or more ccTLD variants. In those matters, coordinating the filings across forums and timing them to maximize evidentiary overlap is a key strategic decision. A filing that forces disclosure of the registrant's identity in one proceeding can strengthen the factual record in the other.

Step 5: After the decision – implementation, appeals, and what to do if you lose

If the panel orders a transfer, the registrar implements it after a ten-business-day suspension period. During that window the registrant may file a court action in the applicable jurisdiction to block implementation. Court stays are uncommon but are filed in a small number of cases annually. If no court filing is made within the window, the registrar transfers the domain to you and the proceeding is complete.

There is no formal UDRP appeal mechanism. A dissatisfied registrant may pursue court action, and a dissatisfied complainant may also go to court – but an unsuccessful complainant who re-files a new UDRP complaint over the same domain faces a significant res judicata problem under the UDRP Rules. Courts reviewing UDRP decisions apply their own law independently; the panel decision carries no binding weight in litigation but is typically available as a matter of record.

If the complaint is denied, the panel may go further and find that the complaint was brought in bad faith – a finding of Reverse Domain Name Hijacking (RDNH). An RDNH finding carries no monetary penalty, but it is published, it follows the complainant's record, and it signals to future panels and negotiating counterparties that the complainant pursued an abusive filing. We have defended registrants against UDRP complaints over lapsed domains and secured RDNH findings where the complainant had weak trademark rights and the registrant held the domain with a genuine and documented purpose.

The trap in Step 5: treating the transfer order as the end of the matter. Once the domain returns to your control, update the registration immediately, enable registrar lock and WHOIS privacy, and set multi-year renewal cycles with calendar alerts. A domain that lapses once is a known drop target.

Related at COGNOMEN

• Domain transactions, due diligence, and brand-protection monitoring across gTLDs and ccTLDs
• Recovering a lapsed .co domain that was re-registered – procedure and strategy
• UDRP recovery where the domain is confusingly similar to a trademark