Step-by-step: recover a .dev domain held passively in bad faith

A registrant holds your brand's .dev domain. No website loads. No emails arrive from that address. The WHOIS record shows a privacy proxy, and the registration date post-dates your trademark by years. You have tried to contact the holder. Silence. That pattern – registration matching your mark, zero active use, and no response to reasonable inquiry – is what domain-dispute practitioners call passive holding. Under the UDRP, passive holding can and regularly does satisfy the bad-faith element, provided you assemble the evidence correctly.

To recover a .dev domain held passively in bad faith, you must prove all three elements of Paragraph 4(a) of the UDRP: that the domain is identical or confusingly similar to a mark you hold; that the registrant has no rights or legitimate interests in it; and that it was registered and is being used in bad faith – with passive holding recognized by panels as qualifying bad-faith "use." A standard case at WIPO takes about two months from filing to decision, and the filing fee starts at USD 1,500 for a single-panel case covering up to five domains. The only remedies available are transfer or cancellation.

This guide walks every step, names the trap hidden in each one, and tells you what evidence actually decides the outcome.

Why .dev domains fall under the UDRP – and what that means for your case

.dev is a generic top-level domain (gTLD) operated by Google Registry, and like all accredited gTLDs it is subject to the UDRP as mandated by ICANN. No separate ccTLD procedure applies. There is no national eligibility requirement to hold a .dev domain, which means the same three-element test that governs a .com dispute governs yours – with one notable practical difference. The .dev namespace was marketed explicitly toward developers, which means panels will consider whether a registrant has any plausible legitimate developer or technology business reason to hold the name. If you are a technology brand, that context cuts your way; the registrant's silence reinforces the implausibility of a legitimate reason.

The governing rules are the UDRP itself, the UDRP Rules, and the supplemental rules of the chosen provider. WIPO and the Forum together handle roughly 97% of all UDRP proceedings, and either is available for a .dev complaint. WIPO is the more commonly chosen forum for cases with an international dimension or where the trademark record is complex. The Forum is a reasonable alternative at comparable cost for straightforward single-domain matters.

The trap at this step: confirming that UDRP applies is easy. The harder preliminary question is whether you hold a trademark right in the string that forms the .dev domain. Unregistered rights, trade names, and descriptive phrases can qualify, but they require additional evidence at Element 1. Start by mapping every mark registration you hold – national, regional, and international – against the exact domain string.

For an assessment of whether your trademark rights support a .dev UDRP complaint, contact info@cognomenlaw.com.

Step 1: Does your mark satisfy Element 1 – the confusing-similarity test?

Element 1 is typically the least contested part of a passive-holding case, but it can be lost on technicalities. The test compares the alphanumeric string of the domain – stripping the .dev suffix, which panels treat as non-distinctive – against the text of your trademark. Identical strings are straightforward. Confusingly similar strings include common misspellings, phonetic equivalents, transpositions, or the addition of a generic word such as "tech" or "app" around your core mark.

What panels do not examine at Element 1 is intent or use – those belong to Elements 2 and 3. The test is textual and objective. A panel will not, at this stage, consider whether the registrant knew of your mark when registering the domain.

The trap at Step 1 is filing on a mark that was registered after the domain. Some complainants assume that the existence of a trademark registration closes the issue. It does not. If the domain predates the trademark, you have a difficult but not impossible case at Element 3, because the panel must find the registrant knew of your rights when registering. In a passive-holding case involving a post-trademark domain, timing is your strongest evidence.

Prepare a certified copy or equivalent of every relevant trademark registration. If you rely on unregistered or common-law rights, prepare evidence of use before the domain registration date: advertising spend figures, press coverage, web traffic data, sales records. The UDRP does not require a registered mark, but proving unregistered rights demands a more substantial evidentiary record.

For a detailed treatment of how panels analyze confusing similarity in the .dev space, see our analysis at Confusingly Similar Trademark in .dev – COGNOMEN Analysis.

Step 2: Can you show the registrant has no rights or legitimate interests?

Element 2 requires you to make a prima facie showing that the registrant lacks rights or legitimate interests. The burden then shifts to the registrant to rebut. In a passive-holding case, that shift is structurally helpful: a registrant who has held the domain for months or years without developing any use, without operating any business under the name, and without responding to your inquiry has very little material to offer in rebuttal.

The three Paragraph 4(c) safe harbors that a registrant could rely on are: a bona fide offering of goods or services before notice of the dispute; being commonly known by the domain name; or legitimate noncommercial or fair use without intent to mislead. Passive holding satisfies none of these on its face. A domain sitting at a parking page, a blank IP address, or an inactive registrar nameserver is not a bona fide offering. A privacy-proxy WHOIS record that reveals no business name or identity makes "commonly known by" implausible. And a domain held speculatively with no content cannot claim noncommercial or fair use.

The trap at Step 2 is over-relying on the burden shift. The burden shifts only after you establish a prima facie case. That means your complaint must affirmatively state, with evidence, that you searched for any business operating under the domain name and found none, that you searched for any trademark or trade name registration in the registrant's name corresponding to the domain string and found none, and that you have no contractual or licensing relationship with the registrant. Do not leave Element 2 as an assertion without that underlying search record.

Step 3: Building the bad-faith case around passive holding

Element 3 is where passive-holding cases are won or lost. The UDRP requires both registration and use in bad faith – but panels have long recognized that "use" includes passive holding. The reason: a registrant who registers a well-known brand string and then warehouses it is, in effect, using the domain to block the mark owner and to preserve a latent commercial asset, even if no active website operates.

The evidence that drives passive-holding findings falls into clusters. First, the strength and notoriety of your mark. A highly distinctive or well-known mark makes innocent registration of the same string highly improbable. Second, the registrant's identity and conduct. A privacy proxy at the time of registration, non-existent or false WHOIS contact details, and silence in the face of a reasonable cease-and-desist inquiry are all adverse indicators. Third, the implausibility of legitimate use. In the .dev zone in particular, where the namespace carries a developer connotation, a registrant holding a technology-brand string without any development project is harder to explain away.

The Paragraph 4(b) bad-faith factors include an offer to sell the domain to the mark owner at a price exceeding registration costs. Not every passive-holding case reaches that point – some registrants never engage. But if the registrant did quote you a price, preserve that correspondence meticulously. It is the clearest bad-faith indicator available and removes any ambiguity about motive.

The trap at Step 3 is the cumulative standard. You must show bad faith at the time of registration AND bad faith in ongoing use (even passive use). A complainant who focuses only on current passivity, without addressing why the registrant had no legitimate purpose at the time of registration, risks a denial. Review the registration date, the state of your trademark rights at that date, and any public coverage of your brand that would have made your mark known to a registrant in the same or an adjacent industry.

To weigh UDRP against a court action for your .dev case, email info@cognomenlaw.com.

Step 4: Choosing the forum and filing the complaint

For a .dev domain, WIPO and the Forum are both available. The procedural path is the same at either provider: file the complaint, pay the filing fee, and the provider verifies formal compliance before commencing the case. Commencement triggers the 20-day response window for the registrant.

WIPO's standard filing fee is USD 1,500 for one to five domains before a single-member panel. A three-member panel costs USD 4,000. In a passive-holding case, a single-member panel is usually appropriate unless the case involves unusually high-value marks or competing contentions that justify the additional cost and a more deliberate process. WIPO also offers an expedited track delivering a decision within approximately one month for single-panel cases of up to five domains – worth considering if you face a time-sensitive product launch or are losing SEO equity to a parked or inactive domain.

The Forum's fee begins at around USD 1,300 for one or two domains before a single-member panel. It is a reasonable choice if you want competitive pricing and have a well-documented, factually straightforward case.

The decision of where to file is not purely cost-driven. Panel composition varies by provider. Some practitioners observe that certain fact patterns have generated a richer body of passive-holding precedent at WIPO, which can be helpful when arguing the bad-faith element in a nuanced case. We regularly assess filing forum against the specifics of the evidence before recommending one over the other.

The trap at Step 4 is a formal deficiency in the complaint. A provider will reject or suspend a complaint that names the wrong registrant (check the WHOIS/RDDS record carefully, including the underlying registrant revealed after a privacy-proxy disclosure request), uses an incorrect domain string, or omits required annexes. A rejected complaint restarts the clock and signals your strategy to the registrant, who may take defensive action – transferring the domain to a related entity, for instance.

What happens during the 20-day response window – and if the registrant defaults

Once the provider commences the case, the registrant has 20 days to file a response. In passive-holding cases, default is common. The registrant's silence throughout your pre-filing outreach often continues into the formal proceeding. Default is not automatic victory: the panel still reviews your complaint on its merits and must find all three elements met before ordering transfer or cancellation.

A defaulting respondent, however, cannot introduce evidence to rebut your prima facie case on Element 2 or to offer an innocent explanation for the timing of registration. That makes a well-constructed complaint substantially stronger in default proceedings than in a contested case.

If the registrant does respond, the response may include: a claim that the domain was registered without knowledge of your mark; an assertion of a prior or independent right to the name; a claim that the domain is held for legitimate personal or development use; or, most aggressively, a counter-allegation that your complaint itself constitutes reverse domain name hijacking (RDNH). We return to the RDNH risk below.

The trap at this step is assuming a default means a fast decision. The timeline still runs through panel appointment and the panel's deliberation period. The overall case rarely resolves in under six weeks even without a response. Budget for approximately two months from filing to decision.

How should you handle a contested response – and what is the RDNH risk?

A registrant who actually responds to a well-evidenced passive-holding complaint faces an uphill task. The cumulative absence of any business, development project, or legitimate use before the complaint was filed is difficult to explain. Experienced respondent-side practitioners will focus their arguments on three pressure points: the strength of the complainant's trademark rights (particularly if the mark is descriptive or geographically limited); the timing argument (if the domain predates the trademark); and the complainant's conduct (whether the cease-and-desist contained an offer to purchase at a premium, which a creative respondent may characterize as evidence of a pretextual complaint).

RDNH – reverse domain name hijacking – is a panel finding that the complaint was brought in bad faith to deprive a legitimate registrant of their domain. The finding carries no financial penalty, but it is reputational and publicly indexed in WIPO and Forum decision records. A complainant brings RDNH risk on itself by filing a complaint where: (a) the domain predates the trademark by years; (b) the mark is highly descriptive; or (c) the complainant made an above-registration-cost purchase offer before filing, signaling that the complaint was a pressure tactic rather than a genuine rights assertion. In our practice, we assess RDNH exposure as a standard part of pre-filing due diligence on every complaint.

In a case we handled in summer 2025 involving a .dev typosquat of a mid-size software brand's trademark, the registrant filed a response asserting that the domain had been registered for a future open-source project. The panel found that no evidence of that project existed at registration or at any point before the complaint, that the domain string was non-descriptive and closely matched the complainant's registered mark, and that passive holding for over two years without any development activity was inconsistent with the claimed purpose. Transfer was ordered. The RDNH allegation was rejected.

The trap at this step is under-preparing for a contested case. Many complainants treat a passive-holding complaint as a guaranteed win and are surprised when a responsive registrant raises credible arguments on timing or mark strength. Prepare your complaint as though it will be contested, even when default seems likely.

The decision, implementation, and what comes after

A panel issues its decision in writing. The two available remedies are transfer of the domain to the complainant, or cancellation of the registration. Transfer is the usual preference because it delivers the domain to you; cancellation simply eliminates the registration and leaves the string available for anyone to register, including the prior holder under a new identity.

After a transfer order, the provider notifies the registrar, and the registrar implements the transfer. There is a brief implementation period during which the respondent may seek a court stay of the transfer by filing a court action in the jurisdiction specified in the registration agreement. That period is typically ten business days. Few respondents take this step, but it is a structural feature of the UDRP: the decision is not final and binding in the way a court judgment is. A court action in the relevant jurisdiction could, in theory, reverse the transfer. In practice, this very rarely occurs in passive-holding cases where the panel's findings are well-supported.

Once the domain transfers, the follow-on steps are practical rather than legal: verify that DNS is correctly pointing, check that no pre-existing links, email configurations, or applications were built on the inactive domain by the former holder, and run a brief due-diligence check for any third-party claims against the domain that predate your complaint.

In a second matter we handled in spring 2025 – a .dev registration matching the exact brand string of a European fintech company – the registrant had held the domain inactive for approximately eighteen months, demanded a five-figure sum during pre-filing negotiations, and then defaulted on the complaint. The panel transferred the domain within seven weeks of filing. Post-transfer implementation by the registrar was completed within the standard window. The client resumed a planned product launch that had been delayed by the dispute.

When UDRP is not the right route – and what else is available for .dev

The right route depends on what you need and what the registrant has done. UDRP at WIPO or the Forum is the standard path for a .dev passive-holding case: it is relatively fast, the fee is published, and transfer is the remedy. But it is not the only option, and in some fact patterns it is not the best one.

If the registrant is actively using the domain to pass off as your business – running a site that impersonates you, collecting leads, or redirecting your customers – you may need interim relief faster than the UDRP timeline provides. In that situation, court action (particularly under US anticybersquatting legislation, if the registrant is within reach of US jurisdiction) offers interim injunctive relief and the possibility of damages. UDRP delivers no damages and no injunction. For court action in any jurisdiction, we work with local litigation counsel in the relevant jurisdiction.

If you hold both a .dev and a .com version of your brand and both have been registered by the same holder, a single UDRP complaint can cover both – a single complaint may address multiple domains provided the registrant is the same holder. That consolidation can reduce cost and present the pattern of conduct more forcefully to the panel.

If the .dev registration was part of a broader theft of your domain portfolio or an account compromise at the registrar, UDRP is not the first step. Registrar escalation, account freeze, and transfer-reversal procedures come before any arbitration filing. For domain recovery after theft, see our case study at Case Study: Recovering a Stolen Domain in .it.

Finally, if your goal is to build a portfolio protection strategy rather than recover a single name, the analysis changes. Pre-acquisition monitoring and defensive registration across relevant new gTLDs may be more cost-effective than recurring dispute filings. That is a separate planning exercise, but one informed by an understanding of which zones generate passive-holding disputes and at what frequency.

Related at COGNOMEN

• UDRP Recovery Services – filing, forum selection, and strategy for gTLD disputes
• Confusingly Similar Trademark in .dev – how panels analyze Element 1 in the .dev namespace
• Case Study: Recovering a Stolen Domain in .it – escalation, registrar procedure, and outcome

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.