Step-by-step: recover multiple .app domains in one UDRP complaint

Step-by-step: recover multiple .app domains in one UDRP complaint. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your case.

A brand owner searching their name one afternoon finds not one but six .app domains — each a slight variation of their trademark — all registered to the same WHOIS contact, all pointing at pay-per-click landing pages or a rival's site. The instinct is to file six separate complaints. The smarter move, often, is to fold them into one.

To recover multiple .app domains in one UDRP complaint, the domains must share the same registrant. The .app zone operates under standard UDRP rules administered by providers including WIPO and the Forum, so the same three-element test under Paragraph 4(a) applies to every domain in the bundle. A single-panel case typically resolves in approximately two months, with the WIPO filing fee starting at USD 1,500 for up to five domains. The only available remedies are transfer or cancellation.

This guide walks each step of the process — from checking consolidation eligibility through assembling evidence and selecting a forum — and flags the practical trap that hides inside each stage.

Step 1: Can you consolidate? Verifying the same-registrant requirement

The UDRP permits one complaint to cover multiple domains only when a single registrant holds all of them. That is the threshold gate; clear it first, before spending a minute on the merits.

Check the public RDDS (formerly WHOIS) record for each .app domain. Look for a shared registrant name, organization, email, or registrant ID. Identical details across domains are strong evidence of common control. Where privacy services mask the record, panel practice treats the listed privacy provider as the registrant of record for commencement purposes — but WIPO and the Forum both have procedures to request registrar disclosure of the underlying contact during the proceeding.

The trap here is partial overlap. Six domains registered to three different listed entities may still share a single beneficial owner — the same address, the same phone number, or the same URL in the RDDS contact field. Panels have permitted consolidation in those circumstances when the complainant can demonstrate, with reasonable evidence, that the registrations are under common control. Document every matching data point before you file.

A second trap: do not assume that because one domain was registered on a certain date all others were too. Registration dates matter for the "registered in bad faith" limb. List each domain's registration date separately in your complaint so the panel can assess each independently.

Step 2: Confirming that the UDRP applies to .app

The .app zone is a Google-operated new gTLD launched in 2018. Because .app is an ICANN-accredited gTLD, every accredited registrar must follow the UDRP — making the full three-element UDRP test available for trademark owners whose marks are being infringed in this zone.

That is good news. It means you have access to the same body of UDRP precedent that has built up across .com, .net, and .org over more than two decades. Panels deciding .app disputes apply the same Paragraph 4(a) elements, the same Paragraph 4(b) bad-faith factors, and the same Paragraph 4(c) safe harbors as any other UDRP proceeding.

There is one .app-specific note worth making: .app is a restricted zone that requires HTTPS. A registrant who has set up a functional HTTPS site — even a basic one — can argue the domain is "in use" in a way a pure parking page registrant cannot. That distinction can shade the bad-faith analysis. Document what each domain currently resolves to, and take screenshots with timestamps.

The URS (Uniform Rapid Suspension) is also technically available for .app as a new gTLD, but it offers only suspension for the registration term, not transfer. Where you want ownership of the domains — the standard goal — the UDRP is the correct route. For a comparison of URS and UDRP mechanics, see our case study on URS vs. UDRP for gTLD disputes.

Step 3: Assembling the three-element case for every domain in the bundle

Each domain in the bundle must independently satisfy all three elements of Paragraph 4(a). A multi-domain complaint does not allow you to prove the elements once and import the conclusion to the rest. The panel will assess each domain — so your evidence must be domain-by-domain.

Element one — confusing similarity — is usually the easiest. Your registered trademark (or, in appropriate cases, established common-law rights) is compared to the domain string. For a multi-domain complaint, list each domain in turn: the string, the mark it is compared to, and why it is confusingly similar. Typosquats, phonetic variants, and mark-plus-generic-word combinations all qualify under settled panel authority. One trap: ensure you have trademark rights that pre-date at least some of the registrations. If your mark was filed after the earliest domain, that domain will need to be argued under common-law acquired distinctiveness — harder and more evidence-intensive.

Element two — no legitimate interest — is proved by the complainant making a prima facie case, then the burden shifts to the respondent to rebut. In practice, showing that the registrant is not commonly known by the domain name, was never licensed by you, and is using the domain commercially (pay-per-click, redirect, or sale offer) is usually sufficient to establish the prima facie case. Gather screenshots of each domain's landing page. For a pay-per-click page, capture the specific links displayed; they frequently resolve to your own competitors, which directly supports bad faith.

Element three — registration and use in bad faith — is where multi-domain complaints often become their own best evidence. A pattern of registrations across multiple variants of the same mark is itself a factor listed under Paragraph 4(b). Panels have consistently held that registering multiple confusingly similar variants of a well-known mark, with no plausible legitimate purpose, satisfies the bad-faith requirement. Assemble the registration dates, the RDDS data, and the commercial use of each domain into a chronology that tells a single coherent story.

For a read on whether the three UDRP elements are met for your specific .app domains, reach us at info@cognomenlaw.com.

Step 4: Choosing the right UDRP forum for a multi-domain .app case

WIPO and the Forum together handle approximately 97% of all UDRP proceedings, and both accept .app complaints. The choice between them — or the Czech Arbitration Court (CAC) as a lower-cost alternative — turns on case size, budget, and the audience for the decision.

WIPO charges USD 1,500 for one to five domains under a single-member panel, rising to USD 2,000 for six to ten domains. A three-member panel costs USD 4,000 (one to five domains) or USD 5,000 (six to ten). The Forum's single-member entry starts around USD 1,300 for one to two domains; pricing for larger bundles should be verified directly. CAC offers the lowest entry point — roughly USD 500–800 — though it is the least-used of the major providers and is worth considering if the complaint is straightforward and cost is the primary driver.

For a multi-domain .app complaint involving five or fewer domains, WIPO's single-panel rate is the natural default. The WIPO case record is publicly searchable, which can deter future squatting. WIPO also offers an expedited option — delivering a decision within approximately one month — available for single-panel cases of up to five domains, useful when a domain is actively diverting customer traffic.

If the respondent then requests a three-member panel, the parties generally split the higher fee. That possibility affects your budget planning. With six or more .app domains, the filing fee climbs; legal fees are separate and depend on complexity.

One cross-zone point: if the same registrant also holds a matching .com or a ccTLD like a .uk version of your brand, you face a choice. A single UDRP complaint can only cover gTLD domains (or ccTLDs that have adopted the UDRP) registered by the same holder. The .uk domain would require a separate Nominet DRS filing, and the .de version would require German court action. Where the abuse spans multiple zones, coordinate the timing of each proceeding carefully — a transfer in one zone can cause the registrant to dig in elsewhere. For a detailed look at cross-zone recovery strategy, our analysis of multi-zone typosquat recovery sets out the options.

Step 5: Drafting and filing the complaint — what panels need to see

A well-drafted multi-domain complaint is organized the same way a panel decision will be written: element by element, domain by domain, with the evidence for each domain clearly identified rather than lumped together.

Open with a clear statement of consolidation grounds: the registrant is the same person or entity across all domains, and the claims arise from a common pattern of conduct. Panels respond well to that framing because it mirrors the consolidation standard they apply.

Structure the element-two and element-three sections as a series of short, domain-specific paragraphs. For element three in particular, a table or numbered list keyed to each domain — showing registration date, current resolution, and the specific bad-faith factor triggered — lets a panel write its decision efficiently. Panels that can write efficiently tend to be more thorough on each domain.

Annexes matter as much as the narrative. Submit screenshots of each domain as it currently resolves, RDDS printouts dated at the time of filing, and your trademark registration certificates. If any domain previously resolved to different content (for example, a site mimicking yours, then switched to parking after you sent a cease-and-desist), submit both versions with timestamps. Post-notice switching is strong evidence of bad faith under settled UDRP authority.

The filing itself goes to the chosen forum's online portal. WIPO's e-filing system is straightforward; it auto-generates the communication to the registrar and the respondent once the complaint passes administrative review. The 20-day response window begins from the date of formal commencement — not the date you submit.

What happens after you file? The timeline, the response, and the panel stage

Once the complaint is formally commenced, the respondent has 20 days to file a response. Most respondents in clear-cut multi-domain squatting cases default — they do not respond at all. A default does not mean automatic success. The panel still applies the three-element test, and the complainant must independently satisfy each element.

After the response window closes (or after a response is filed), the forum appoints the panel. A single-member panel typically delivers its decision within about two months of filing overall. A three-member panel takes a little longer. The panel may request supplemental submissions in complex cases — a step that extends the timeline but is relatively rare.

The panel's only remedies are transfer or cancellation. It cannot award damages, costs, or injunctive relief beyond the domain itself. If you need monetary compensation — for diverted revenue, for example — a court action under applicable anticybersquatting legislation is the only path to money, and that is a substantially different undertaking in cost and time.

One risk worth planning for: if a panel finds your complaint was brought in an attempt to deprive a legitimate registrant — a Reverse Domain Name Hijacking (RDNH) finding — the finding is published and reputational. RDNH findings are uncommon in clear-cut squatting cases, but they occur when a complainant presses weak claims, particularly on element one or element three. A rigorous pre-filing assessment of each domain's merits is the best safeguard.

In a recent multi-domain matter (a bundle of five .app typosquats, spring 2025), we filed a consolidated complaint at WIPO, documented the common-registrant basis with matching RDDS contact data, and secured transfer orders for all five domains approximately eight weeks after commencement. The respondent defaulted; the panel accepted our element-three analysis based on the pattern of registrations alone.

What evidence most often decides the outcome?

Evidence quality — not legal argument — is what separates winning complaints from those that fail or stall. For a multi-domain .app complaint, the decisive evidence clusters into four categories.

First, trademark priority. Submit the earliest possible evidence of trademark rights — registration certificates, but also evidence of first use if your common-law rights pre-date the registrations at issue. For element one, the comparison to each domain string must be explicit: list the mark, list the domain, explain the similarity. Do not assume a panel will see the obvious connection without a written explanation.

Second, RDDS and registration records. Obtain and annex a RDDS printout for each domain at the time of filing. If registrant details are privacy-masked, note that in the complaint and request that the forum trigger registrar disclosure. Registration dates for each domain should be listed in a separate table or appendix so the panel can track them individually.

Third, domain use evidence. Screenshots — ideally from a third-party archive as well as a live capture — showing what each domain resolves to. Pay-per-click pages, particularly those displaying links to competing goods or services, go directly to the Paragraph 4(b)(iv) bad-faith factor: attracting users for commercial gain by creating a likelihood of confusion. An .app domain pointing at a functional HTTPS site selling competing products is even more direct.

Fourth, the pattern itself. For a multi-domain case, the aggregate picture is your strongest bad-faith argument. A single registration of a typosquat might be explained as coincidence. Six registrations of six different typographic and phonetic variants of the same mark, by the same entity, with no disclosed explanation, is a pattern — and panels have consistently treated such patterns as conclusive evidence of bad faith under Paragraph 4(b).

In a separate matter (a .app portfolio of seven domains, winter 2025), we documented the pattern argument with a registration-date timeline showing all seven registrations were made within a 72-hour window, immediately following our client's trademark registration announcement. That timing compressed the bad-faith inference from probability to near certainty.

If a prior filing or response produced a bad outcome, a focused second read can find the element that was missed. Email info@cognomenlaw.com to discuss a review.

How does this compare to other recovery routes for .app domains?

The UDRP is the primary route for transferring .app domains, but it is not the only one. Understanding the alternatives — and their limits — lets you choose the route that fits the facts.

If the domains were obtained by theft or account compromise rather than registration-by-a-stranger, the UDRP is not the right tool. Registrar escalation, account recovery, and in some cases court action for domain theft are the relevant routes. The UDRP presupposes an arm's-length registration; it does not address unauthorized transfers out of a legitimate registrant's account.

If you need only suspension — not transfer — URS is faster and cheaper, but the domain stays in the registrant's name. For brand protection purposes, transfer is almost always the right goal.

If the registrant is in a jurisdiction where a court action would allow damages, US anticybersquatting litigation can reach monetary compensation alongside a transfer order. That route is significantly more expensive and time-consuming; the UDRP is the right first step in most cases, with court reserved for situations where the economic harm is large enough to justify the cost.

One scenario that does not fit the UDRP: a dispute about a domain you legitimately purchased from someone who later claims they transferred it by mistake. That is a contractual dispute, not a cybersquatting complaint, and the UDRP is procedurally designed for trademark-holder-versus-cybersquatter situations. The distinction matters because filing outside the UDRP's designed use case raises RDNH risk.

Our UDRP recovery service page sets out how we assess a domain dispute and structure a complaint.

Related at COGNOMEN

• UDRP Recovery Service — complaint strategy, forum selection, and filing for gTLD domains
• Multi-Zone Typosquat Recovery Analysis — coordinating UDRP and ccTLD proceedings
• URS vs. UDRP for gTLD Disputes — a case study on choosing the right new-gTLD remedy