Step-by-step: recover a .app domain held passively in bad faith

Step-by-step: recover a .app domain held passively in bad faith. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your case.

Your brand name sits registered as a .app domain. No website loads. No email bounces back. The registrant is unreachable. The silence is deliberate – and it is legally actionable. Passive holding of a domain that trades on your trademark is one of the most established bad-faith patterns under the UDRP, and the .app zone, operated by Google Registry, is fully subject to that policy.

To recover a .app domain held passively in bad faith, you must satisfy all three elements of Paragraph 4(a) of the UDRP: confusing similarity to your trademark, the registrant's lack of rights or legitimate interests, and bad-faith registration and use. Passive holding qualifies as bad-faith "use" under the consensus position of UDRP panels. The WIPO filing fee starts at USD 1,500 for a single-member panel, and a standard case concludes in approximately two months. Transfer or cancellation are the only available remedies.

This guide walks the process step by step – identifying every procedural trap along the way.

Why .app domains fall squarely under the UDRP

.app is a new generic top-level domain, launched by Google Registry in 2018. Because .app is an ICANN-accredited gTLD, all three UDRP elements apply in exactly the same form as they do for .com or .net. There is no separate national procedure and no eligibility gate for the complainant. Any party holding trademark rights – anywhere in the world – may file a UDRP complaint targeting a .app registration.

One feature of .app matters practically: every .app domain is served over HTTPS by default, enforced at the registry level. That means a passive registrant who controls the domain controls a trusted-certificate namespace your users might assume is yours. That association strengthens the confusion argument at Element One and deepens the harm argument when you describe bad faith at Element Three.

The forum of choice for .app matters is WIPO, which handles the large majority of gTLD disputes and whose panelists have developed the deepest body of passive-holding reasoning. The Forum (formerly the National Arbitration Forum) is a valid alternative, with filing fees beginning around USD 1,300 for a single-member panel on one or two domains. For budget-sensitive matters, the Czech Arbitration Court (CAC) is the lowest-entry option. All three forums apply the same Policy and the same legal test.

Step 1: Confirm you hold trademark rights before you do anything else

The first UDRP element is straightforward in phrasing and treacherous in application: the disputed domain must be identical or confusingly similar to a trademark in which you have rights. The trap most complainants walk into at this stage is assuming that commercial reputation alone will carry the point.

Registration is the cleanest basis. A registered mark in any jurisdiction supports the claim. The relevant comparison is the second-level label – "yourbrand" in "yourbrand.app" – stripped of the gTLD suffix. Panels set aside the TLD for comparison purposes, so ".app" itself adds nothing to, and subtracts nothing from, the analysis. If your mark is identical to that label, Element One is effectively resolved. If your mark is a phrase and the label is a misspelling or abbreviation, you need a fuller record of the mark's distinctiveness and of how users perceive the variation.

Common-law (unregistered) rights can also support a complaint, but they require evidence of acquired distinctiveness: sales figures, marketing expenditure, press coverage, consumer recognition. That evidence is harder to assemble quickly, and panels vary in how demanding they are about proof. If you are relying on common-law rights alone, factor in the additional preparation time.

Action at this step: pull your trademark registration certificates, confirm they predate the domain registration date (visible in public WHOIS/RDDS records), and identify any gap the registrant might argue.

Step 2: Build the "no legitimate interest" record

Element Two requires you to show that the registrant has no rights or legitimate interests in the domain. The burden is unusual: you must make a prima facie case, after which the burden shifts to the registrant to rebut. A passive holder who never responds never produces that rebuttal – and default is common in passive-holding cases precisely because the registrant has no credible story to tell.

The three safe harbors under Paragraph 4(c) of the UDRP define what a legitimate interest looks like: a bona fide offering of goods or services before notice of the dispute; being commonly known by the domain name; or a legitimate noncommercial or fair use without intent to mislead. A blank or parked page satisfies none of these. A holding page with pay-per-click links to your competitors satisfies none of them either – and in that scenario the bad-faith argument strengthens considerably.

Document what you find on, or behind, the domain. Take timestamped screenshots using a web archive service. Check historical captures of the domain. If the page has changed since you first noticed the registration, preserve both versions. Panels look for the registrant's conduct pattern, not just its conduct on the filing date.

For a read on whether the three UDRP elements are met in your .app situation, reach us at info@cognomenlaw.com.

Step 3: Understand why passive holding satisfies bad faith

The passive-holding doctrine is the conceptual center of this guide – and the step most likely to trip a brand owner who researches the UDRP only superficially. Paragraph 4(a)(iii) requires that the domain was registered and is being used in bad faith. The word "and" seems to demand active conduct. It does not.

The consensus view under the Policy is that passive holding can constitute bad-faith use where the totality of circumstances makes it "impossible to conceive of a plausible legitimate use" by the registrant. Panels apply a multi-factor analysis that typically weighs: the distinctiveness of the complainant's mark; whether the registrant had constructive or actual notice of the mark at registration; the absence of any response or explanation; the lack of any active use; and whether the registrant's identity or prior conduct discloses a pattern of abusive registrations.

For a .app domain, the HTTPS-only nature of the zone is a useful additional fact. Obtaining a .app registration implicitly required the registrant to configure TLS, signaling technical sophistication and intentional acquisition rather than a casual default. That detail belongs in your bad-faith argument.

The registration date matters too. If the .app domain was registered after your mark became well known – or shortly after a product launch, a funding announcement, or a press event – that timing is circumstantial evidence of awareness. Capture the timeline precisely: the date of the domain registration, the date your mark was registered, the date of any public event that might have drawn the registrant's attention.

What evidence actually decides the outcome?

A complaint succeeds or fails on its evidence record. The Policy gives panels discretion; evidence tips that discretion. In passive-holding matters specifically, the absence of a plausible legitimate use is the load-bearing argument, and it must be demonstrated rather than asserted.

The core evidence package for a passive-holding .app complaint should include:

• Trademark registration certificates or, for common-law rights, a signed witness statement with supporting commercial records.
• WHOIS/RDDS records showing the registration date, the registrant's listed identity (often redacted under privacy proxy), and the domain's current nameserver configuration.
• Timestamped screenshots of the domain's current state – blank page, parked page, or redirect – together with historical captures from a web archive.
• Evidence of the mark's public profile around the time the domain was registered: press articles, product pages, social media presence, or advertising records that establish what a reasonable registrant would have known.
• Any communications between you and the registrant, including unsolicited offers to sell the domain, demands, or the registrant's silence after a cease-and-desist notice.
• Evidence of the registrant's conduct pattern: other domain registrations incorporating third-party marks, prior UDRP proceedings (these are publicly searchable), or similar behavior.

The trap at this step is under-documentation. Complainants sometimes assume that a blank page speaks for itself. It does not. The panel needs to see that the domain resolves, that no legitimate use is visible, and that context makes any innocent explanation implausible. Each of those three showings requires a separate exhibit.

In a recent matter (a .app passive-holding dispute, spring 2025), we assembled a timeline tracing the domain's registration to within weeks of our client's product launch announcement, documented eight months of a blank DNS configuration, and included prior correspondence in which the registrant had not replied. The panel transferred the domain without supplemental filings.

Step 4: Choose the forum and file the complaint

Once the evidence is assembled, the procedural decision is which forum to use. For a .app domain involving a single registrant, the practical choice is between WIPO, the Forum, and the CAC.

WIPO is the default recommendation for passive-holding cases. Its panelist pool has the widest institutional familiarity with the passive-holding doctrine, its case manager communication is reliable, and its published decisions carry strong precedential weight within the broader UDRP community. The WIPO filing fee for one to five domains with a single-member panel is USD 1,500. A three-member panel costs USD 4,000 for the same domain count. If budget is a constraint and the case is straightforward, the CAC entry fee begins around USD 500–800, but its decision library is smaller and its panelist selection more limited.

Should you request a three-member panel? In passive-holding cases the answer is usually no, unless the domain has significant monetary value, the mark is contested, or the complainant anticipates a credible defense that a single panelist might resolve against it. A single experienced panelist can transfer a domain as effectively as three, and the fee savings go toward legal preparation.

The complaint document itself must be precise. It should state each element separately, cite the applicable paragraph of the Policy, attach exhibits in the order referenced in the text, and contain no legal argument not traceable to the Policy or to the evidence record. WIPO's Rules require the complaint to certify completeness and accuracy. File that certification only after a final review of every exhibit.

After filing, WIPO conducts an administrative review for compliance. Once the case commences, the registrant has 20 days to file a response. That window is a structural trap for complainants: the temptation is to relax after filing, but the 20 days is the moment to prepare for the possibility that a response arrives. A surprise response – claiming the registrant is commonly known by the name, or that it runs a legitimate business that happens to share the label – requires a fast, focused rejoinder strategy, which means having your supplemental filing argument ready before the response period closes.

Step 5: Manage the response period and panel appointment

Most passive-holding cases produce a default. The registrant does not respond. That default does not mean automatic transfer – the panel still reviews the complaint on the merits – but it does mean the registrant has forfeited the rebuttal opportunity, and the shifted burden on Element Two goes unmet.

If a response does arrive, it is almost always one of three arguments: (1) the registrant claims it registered the domain for a legitimate business purpose it has not yet launched; (2) it claims the term is generic or descriptive and therefore not exclusively associated with your mark; or (3) it disputes your trademark's validity or scope. Each argument has a standard counter-structure grounded in the Policy and in the consensus view of panels. An unregistered or undefended complainant encountering these arguments for the first time can lose a winnable case on procedure alone.

Panel appointment at WIPO typically follows within days of the response deadline. The panel then has 14 days (extendable) to issue its decision. In total, a standard case from commencement to decision sits in the two-month range. Implementation – the actual domain transfer by the registrar – occurs after a brief waiting period following the decision, absent a court action filed by the losing party to stay implementation.

What if the case is more complex? Routes beyond the standard UDRP

The UDRP is the right tool for most .app passive-holding disputes. But the right route depends on the goal and the facts. Consider these scenarios:

If you want monetary damages in addition to transfer, the UDRP cannot help. The only remedies are transfer or cancellation. A US anticybersquatting action in federal court is the route that reaches money. That path is substantially slower and more expensive, and requires engagement with local litigation counsel in the relevant jurisdiction. It makes sense where the registrant's conduct has caused measurable financial harm and where recovery of damages is a priority alongside or over transfer speed.

If the same registrant holds typosquat .app domains alongside a .com version of your mark, a single UDRP complaint can cover multiple domains registered by the same holder. That efficiency is worth capturing: one complaint, one filing fee, one decision covering all domains. Confirm the registrant of record is identical across all domains before bundling them.

If the registrant transfers the domain to a third party after becoming aware of the dispute – a tactic called "domain warehousing" – the new registrant steps into the same legal position for UDRP purposes if the transfer was made to frustrate the proceedings. Document any registrar change immediately after filing, and flag it to WIPO's case manager.

For a .app domain that is also exploited for phishing – routing users to a spoofed login page rather than sitting passively – the URS (Uniform Rapid Suspension) may be the faster initial step. URS applies to new gTLDs, suspends the domain for the registration term under a higher "clear and convincing" standard, and operates at lower cost than UDRP. Suspension is not transfer, but it stops the harm immediately. See our related guide on recovering a phishing domain for the distinct considerations that apply when active fraud is present.

To weigh UDRP against a court action for your .app case, email info@cognomenlaw.com.

The myth that doing nothing eventually resolves the problem

Brand owners sometimes assume that a passive registrant will simply let the domain expire. That happens – but the timeline is unpredictable, the domain may be renewed automatically, and the registrant may activate it at any time in a way that causes immediate harm: a phishing page, a competitor redirect, or a sale to a bad actor at a price that excludes you. Passive holding is not a stable equilibrium for the brand owner.

There is also a subtler risk. The longer a domain sits registered against your mark, the more a future panel might weigh your delay. Unreasonable delay is not itself a defense under the UDRP – unlike laches in trademark law – but a gap of several years invites a respondent to argue that the complainant acquiesced or that the mark's association with the domain had weakened. Filing promptly preserves the clearest record.

We regularly advise brand owners who waited 18 months or more before acting, only to find the registrant had renewed and, in one case, listed the domain for sale at a five-figure asking price. Earlier action would have resolved the matter at lower cost.

Related at COGNOMEN

• UDRP domain recovery services – the full complainant-side process across all gTLD zones
• FAQ: recovering a typosquat .store domain – common questions answered
• Guide: recovering a phishing .com domain – when URS, UDRP, and court action each apply