How to defend a .app domain acquired as an investment

How to defend a .app domain acquired as an investment. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your case.

A brand owner files a UDRP complaint against a .app domain you registered years before their trademark issued, or perhaps before their company even existed. The complaint arrives. You have 20 days to respond once the case commences. What you do in that window — and what you can prove about how and why you acquired the name — decides whether you keep the domain or lose it to a complainant who may have no stronger claim than a recently filed trademark application.

To defend a .app domain acquired as an investment, a registrant must demonstrate at least one of the Paragraph 4(c) safe harbors under the UDRP: a bona fide offering of goods or services before notice of the dispute, being commonly known by the name, or a legitimate noncommercial or fair use without intent to mislead. The .app zone is a new gTLD whose domains are subject to the full UDRP administered primarily at WIPO or the Forum. Because investment-grade registrations are routinely contested, the quality of your contemporaneous documentation is often the single factor that separates a successful defense from a default transfer.

This page covers the applicable rules, the evidence that decides outcomes, the realistic path to an RDNH finding, and what to do before the response deadline passes.

What rules govern a .app domain dispute — and why the UDRP applies in full

The .app zone is a new generic top-level domain delegated by ICANN, which means every .app registrar is bound by the standard UDRP Policy as a condition of accreditation. A complainant wanting to recover a .app domain must prove all three elements of Paragraph 4(a): confusing similarity to a mark, no legitimate interest in the registrant, and registration plus use in bad faith — all three, cumulatively. Fail on any one element and the complaint fails entirely.

That structure matters for investment registrations because panels routinely decide element two or element three in the registrant's favor when the chronology is clear. If the domain was registered before the complainant's mark existed — whether as a registered trademark or as an acquired distinctive identity — the "registered in bad faith" limb of element three typically cannot be satisfied, because bad faith requires targeting a mark the registrant knew or should have known about at the time of registration.

WIPO and the Forum together handle the overwhelming majority of UDRP proceedings. For a .app dispute, WIPO is the most common forum; its filing fee for a single-domain, single-member panel case is USD 1,500. Either party may request a three-member panel, which raises the fee to USD 4,000 with costs generally shared or borne by the requesting party. If the complainant chose WIPO, you respond there. You do not select the forum on defense — you meet the complainant where they filed.

The URS (Uniform Rapid Suspension) is an alternative procedure also available for new gTLDs. It applies a higher "clear and convincing" evidentiary standard and produces only suspension — not transfer — for the registration term. In practice, most complainants seeking a permanent transfer of a valuable .app domain choose the full UDRP, not the URS. Respondent-side URS defense is a narrower but faster proceeding; if you receive a URS notice rather than a UDRP complaint, the response window and procedural rules differ materially, and you should treat it as a separate track.

For an assessment of whether your .app investment registration is defensible under the UDRP, contact info@cognomenlaw.com.

How do the Paragraph 4(c) safe harbors protect a domain investor?

Paragraph 4(c) of the UDRP gives respondents three explicit safe harbors that, if demonstrated, establish a legitimate interest and defeat the complaint at element two. For a .app domain acquired as an investment, the most commonly argued safe harbors are the bona fide use harbor and — where the investor has developed or offered the domain — the legitimate noncommercial or fair use harbor.

The bona fide offering harbor does not require an active website. Panels have consistently held that the resale of domain names can constitute a legitimate business activity when the registrant acquired the name for its generic or descriptive value — not because of its correspondence to a specific brand. A domain investor who holds a .app domain reflecting a common English word, a descriptive phrase, or an industry term used across multiple companies has a materially stronger record than one who registered the exact name of a start-up two weeks before the start-up's Series A announcement.

What does the record actually need to show? At minimum: the date and circumstance of registration, the price paid (if any, from a secondary market), the generic or descriptive character of the term, the investor's broader portfolio as evidence of a pattern of registering descriptive names rather than brand names, and the absence of any direct targeting of the complainant. Written notes, emails, or contemporaneous purchase records from the acquisition date carry particular weight. Evidence created after the complaint is filed is viewed with skepticism; evidence predating any awareness of the complainant is far stronger.

The third safe harbor — legitimate noncommercial or fair use — applies when the registrant uses the domain in a way that does not mislead consumers or tarnish the mark. Commentary, criticism, fan sites, and similar uses have succeeded under this harbor, though their application to purely parked investment domains is limited. Where a .app investor has pointed the domain at a development-stage or placeholder page with content consistent with its generic meaning, that use may bolster the record under either of the first two harbors.

What evidence decides the outcome of an investment-domain defense?

Evidence is where .app investment defenses are won or lost. A well-structured response identifies the strongest element — typically element two (no legitimate interest) or element three (no bad faith) — and builds the factual record around it rather than arguing all three elements with equal weight. Unfocused responses that assert everything without establishing a coherent narrative are less persuasive to a panel than a disciplined submission that concedes nothing and proves everything it claims.

The contemporaneous evidence checklist for an investment-domain defense includes the following:

• Registration confirmation and WHOIS/RDDS history showing the original registration date
• Proof of purchase price and any broker or secondary-market transaction records
• Trademark office searches conducted at or near the time of registration showing no conflicting marks (or an absence of the complainant's mark in relevant classes)
• The investor's domain portfolio demonstrating a pattern of generic or descriptive acquisitions
• Any documented rationale for the registration — emails, notes, or market research — explaining why the term had standalone value
• Evidence that the domain has been offered for general sale rather than targeted at the complainant
• Correspondence history (or the absence of targeted communications to the complainant)

In a recent matter — a .app domain registered as a technology-sector investment, spring 2025 — we assembled a portfolio chronology that demonstrated the registrant had acquired approximately a dozen similar descriptive domains in the same period, with no trademark conflicts at the date of registration. The complaint was denied. The panel's reasoning rested almost entirely on the absence of contemporaneous knowledge of the complainant's brand.

What if the term is not purely generic? Mixed cases — where the phrase has both generic meaning and trademark significance — are the hardest to defend. The panel will weigh the relative fame of the mark at the time of registration against the plausible generic rationale for the acquisition. Here the investor's contemporaneous evidence is critical: the stronger the paper trail of a generic rationale, the less a panel will infer targeting from circumstantial similarity.

To weigh UDRP against a court action for your case, or to assess whether your existing evidence is sufficient for a defense, email info@cognomenlaw.com.

When is an RDNH finding realistic — and why should you pursue one?

Reverse Domain Name Hijacking (RDNH) occurs when a UDRP complaint is brought in bad faith — not to vindicate a genuine trademark right, but to deprive a legitimate domain investor of a name the complainant simply wants. An RDNH finding is a reputational sanction against the complainant; it carries no monetary penalty but it is published in the panel's decision and creates a permanent record in the WIPO case database.

Why pursue it? Because an RDNH finding signals to the industry — and to future panels — that this complainant used the UDRP abusively. For domain investors, that published record can deter repeat filings. For brand owners evaluating whether to file against a seasoned investor with a legitimate record, the risk of an RDNH finding acts as a genuine check on overreach.

The conditions that make an RDNH finding realistic are well-established in panel practice. They include: the complainant knew or should have known it could not succeed on element three (typically because the domain predates the trademark); the complainant filed primarily to obtain a name it could not acquire commercially; the complaint misrepresented the complainant's trademark rights; or the complainant is a serial filer with a pattern of abusive filings. A respondent seeking RDNH must specifically request it in the response — and must support the request with argument, not merely assert the conclusion.

Not every losing complaint warrants an RDNH claim. Filing an RDNH request without a factual foundation risks crowding out the core defense arguments and irritating the panel. In our practice, we assess RDNH potential at the outset and pursue it only when the circumstances support it — when the complainant's overreach is demonstrable from the record, not merely implied by their defeat.

How does the UDRP element-by-element analysis play out for a .app investor?

Element one — confusing similarity — is almost always conceded in investment domain cases. If the domain incorporates a word that is also someone's trademark, similarity is typically found. This is a low bar; the real fight is at elements two and three.

Element two — no legitimate interest — is the respondent's burden to rebut. The Policy places the initial burden on the complainant to make a prima facie case, which then shifts the evidentiary burden to the respondent to show a safe harbor. For a .app investor, the response must affirmatively demonstrate one of the three 4(c) harbors, with evidence. A bare assertion without documentation does not discharge this burden. A response supported by portfolio records, a generic rationale, and registration-date trademark searches almost always does.

Element three — bad faith — requires the complainant to show both that the domain was registered in bad faith and that it is being used in bad faith. The cumulative requirement is significant. Even if the current use of a parked .app domain looks passive, registration-date bad faith is a separate and independent question. Passive holding of a domain does not automatically establish bad faith; panels examine whether there is any conceivable good-faith use of the name, whether the respondent has a plausible legitimate explanation, and whether the complainant's mark was sufficiently well-known at the time of registration to make targeting the obvious inference.

Consider the decision matrix in practice. If the complainant's trademark postdates the registration: element three fails, and the case should be denied regardless of elements one and two — this is the strongest ground for an investment-domain defense, and potentially the clearest RDNH scenario. If the trademark predates the registration but the domain is generic: the fight is at element two (the safe harbor) and element three (whether the registrant actually knew of and targeted the brand). If the trademark is famous and predates the registration, and the domain mirrors the brand exactly: the defense is harder, but not impossible if the portfolio record supports a generic-rationale argument and the price paid is consistent with generic-market value rather than brand-extraction pricing.

What does it cost and how long does a .app defense take?

A standard UDRP defense at WIPO for a single .app domain runs approximately two months from the commencement of proceedings to the panel's decision. That includes the 20-day response window, the panel-appointment period, and the deliberation phase. The registrar implements the decision — transfer or denial of transfer — within days of its publication.

There is no official filing fee for the respondent at WIPO in a standard single-member case. The filing fee (USD 1,500 for a single-member panel) is paid by the complainant. However, if you request a three-member panel, you typically share the difference between the single-member and three-member fees — currently the difference between USD 1,500 and USD 4,000, meaning approximately USD 1,250 borne by the respondent. A three-member panel is worth considering when the domain is high-value, the case is close on the facts, or you want the RDNH request decided by a broader bench.

Legal fees for respondent defense are separate from the forum fees and are, in practice, a flat-fee or capped engagement for most standard cases. Market rates for a well-prepared UDRP response in a contested investment-domain case typically fall in a range comparable to the complainant side — commonly in the USD 3,000 – 7,000 range for a single-domain matter, depending on complexity and the volume of contemporaneous evidence to be assembled and analyzed. Cases requiring a supplemental submission, a three-member panel request, or an RDNH argument will sit toward the top of that range or above it.

In a recent matter — a high-value .app portfolio acquisition dispute, winter 2025 — we prepared a full response with portfolio-chronology exhibits and an RDNH request within the 20-day window. The case concluded with a denial of transfer and an RDNH finding against a complainant whose mark postdated the registration by more than two years. The total timeline from complaint to published decision was approximately nine weeks.

Cross-zone and multi-forum considerations for .app investors

A .app dispute is a UDRP dispute. Full stop. There is no ccTLD alternative, no national registry DRS, and no separate European procedure for the .app zone. What there may be, however, is a parallel dispute if the complainant also holds your name as a .com, a .io, or a ccTLD with its own procedure.

Brand owners who target a domain investor will sometimes file across multiple zones simultaneously. A .com complaint goes to WIPO or the Forum under the UDRP. A .uk complaint goes to Nominet under the DRS — a distinct procedure with a different test ("abusive registration," which reads "registered OR used" rather than the UDRP's cumulative "registered AND used in bad faith"). A .de domain has no arbitration path at all; the German courts are the only route, with a DENIC DISPUTE entry available to block transfer pending litigation.

If you hold a portfolio that includes both a .app domain and a .com or ccTLD variant, and a complainant files across multiple zones, the responses should be coordinated rather than filed independently. Inconsistent positions across proceedings — particularly on the question of why you registered the name — can be used against you in either forum. We regularly coordinate multi-zone defense strategies for investors holding portfolios across gTLDs and ccTLDs, ensuring that the factual record is consistent and that each forum receives arguments calibrated to its specific legal standard.

If the complainant ultimately pursues a US court action under anticybersquatting legislation rather than — or in addition to — the UDRP, that litigation route can produce monetary damages against the complainant if the investor's registration was lawful. Court action is a longer and more costly route, but it is also the only path that can reach the complainant's conduct directly. We coordinate with local litigation counsel in the relevant jurisdiction for matters requiring that route.

Related at COGNOMEN

• Respondent defense and RDNH — full service overview across gTLDs and ccTLDs
• Defending a UDRP complaint for a .cloud domain investment
• URS versus UDRP — which procedure applies to your new gTLD domain