How to run due diligence before buying a .xyz domain

How to run due diligence before buying a .xyz domain. UDRP and ccTLD domain recovery and defense across .xyz. Email the firm to assess your case.

A brand team identifies a .xyz domain that fits a new product line. The price looks reasonable. The registrant is willing to sell. Before any funds move, one question demands an answer: is this domain clean? A tainted acquisition can import an active dispute, a prior bad-faith history, or an unenforceable chain of title — problems that follow the domain into your portfolio.

To run due diligence before buying a .xyz domain, a buyer must verify the chain of title, check whether the domain has been the subject of a prior UDRP proceeding or cancellation order, confirm the registrant's authority to transfer, and structure payment through a neutral escrow service. Because .xyz operates under the UDRP via WIPO, any unresolved dispute — or a prior bad-faith finding — travels with the domain on transfer. The filing fee at WIPO starts at USD 1,500 for a complaint; acquiring a domain already in dispute can mean absorbing that cost as the defending party from day one.

This page covers the full due diligence checklist, the dispute-history analysis, the escrow structure, and the point at which legal review adds most value — so a buyer can move with confidence or walk away before it is too late.

Why does .xyz sit under the UDRP, and what does that mean for a buyer?

.xyz is a new generic top-level domain (gTLD) operated under ICANN's accreditation rules, which means it carries the Uniform Domain-Name Dispute-Resolution Policy (UDRP) by default — the same policy that governs .com, .net, and hundreds of other gTLDs. That single fact drives most of the due diligence analysis for a .xyz acquisition.

Under Paragraph 4(a) of the UDRP, any trademark owner worldwide can file a complaint against the registrant of a domain that is confusingly similar to their mark, alleging no legitimate interest and bad-faith registration and use. The complainant does not need to be in the same country as the registrant, and the remedy — transfer or cancellation — attaches to the domain name, not to the person who held it. A transfer to a buyer does not extinguish a pending complaint. It also does not necessarily reset the dispute history.

In our practice, we see acquirers surprised to learn that WIPO and the Forum both accept complaints filed after a commercial transfer if the underlying facts arose before the sale. Panels have consistently held that a new registrant who purchased a domain that was already tainted by bad-faith use inherits a difficult evidentiary position. That is reason enough to run a full review before closing.

For a buyer investing meaningful resources in a .xyz domain, the UDRP's reach is the first risk to price — because a successful complainant pays only the WIPO filing fee of USD 1,500 (single-member panel, one to five domains) to force a transfer away from the new owner.

How do you trace the chain of title on a .xyz domain?

Chain-of-title review on a domain name works differently from real-property conveyancing, but the underlying question is the same: does the seller have clear title to transfer, and has any prior holder compromised that title?

The starting point is the publicly accessible WHOIS or RDDS (Registration Data Directory Services) record, which shows the current registrant's name, organization, and registration date. Privacy or proxy service entries are common in the .xyz zone, as in most new gTLDs. Where a proxy obscures the underlying registrant, a buyer should require the seller to confirm identity and provide the underlying registrant contact as a condition of any purchase agreement.

Beyond the current record, historical WHOIS data — available through commercial domain research tools — reveals every registrant of record, every change in nameserver, and every transfer event. We routinely pull a three-to-five-year snapshot as part of pre-acquisition review. The analysis asks:

• How many times has the domain changed hands? Frequent short-hold transfers are a marker of speculative or abusive activity that panels notice.
• Did any prior holder operate a site that a trademark owner could characterize as infringing — a confusingly similar website, a pay-per-click landing page monetizing brand traffic, or a redirect to a competitor?
• Did the registration date predadte the complainant's trademark, or follow it? Timing is among the first facts a UDRP panel examines on the bad-faith element.
• Is the domain currently resolving, parked, or held inactive? Passive holding of a domain confusingly similar to a famous mark can itself constitute bad faith under the consensus view of the Policy.

A clean chain shows a consistent registrant, a plausible commercial use or development history, and no obvious brand-adjacency in the keyword. A troubled chain raises questions that may not have satisfactory answers.

What prior dispute history should a buyer check before any .xyz purchase?

Prior dispute history is the single most decisive factor in a .xyz pre-acquisition review — and the most commonly overlooked by buyers focused on price and keyword value.

WIPO, the Forum, CAC, and ADNDRC all publish their UDRP decisions. A domain that has already been the subject of a complaint — even one the respondent won — carries information a buyer must assess. A prior transfer order means the domain was once held to have been registered and used in bad faith. A prior denial may reflect a legitimate registrant who successfully established a Paragraph 4(c) safe harbor; or it may reflect a procedural failure by the complainant that can be corrected in a second filing.

Panels have held that a registrant who acquires a domain after a transfer complaint has been filed, or even after a complaint has been denied, does not necessarily acquire a clean slate. Where the underlying confusing similarity to a mark persists, the new registrant's conduct — and the mark owner's rights — remain at issue.

In practice, the dispute check covers:

• WIPO UDRP case search — the WIPO online database is searchable by domain name and shows all decisions rendered. Every decided case is publicly accessible and includes the panel's reasoning on each element.
• Forum and CAC archives — because WIPO and the Forum together account for roughly 97% of all UDRP proceedings, a search across both covers almost the entire universe of gTLD disputes.
• Pending proceedings — a complaint filed but not yet decided creates a registrar lock that should appear in the RDDS record or through a direct inquiry to the registrar. Buying into a pending case is among the clearest avoidable errors in domain acquisition.
• URS decisions — for new gTLDs including .xyz, the Uniform Rapid Suspension system operates in parallel with the UDRP. A prior URS suspension finding signals that a panel concluded, under a clear-and-convincing standard, that the domain was abusively registered.

For a read on whether the three UDRP elements are met — and whether a domain you are considering carries hidden dispute risk — reach us at info@cognomenlaw.com.

How should a .xyz domain purchase be structured through escrow?

Escrow is not optional for a domain purchase of any size. It is the mechanism that prevents a seller from delivering nothing — or the wrong thing — once funds have moved.

A domain escrow transaction works as follows: the buyer deposits funds with a neutral escrow agent, the seller initiates the transfer at the registrar level, the buyer confirms receipt and control of the domain in the new registrar account, and the escrow agent then releases payment to the seller. At no stage does money and domain change hands simultaneously between the parties directly.

For a .xyz acquisition, escrow structure should address several points that go beyond the basic payment mechanics:

• Domain lock during escrow: the domain should remain registrar-locked and free of any incoming or outgoing transfer authorization code (auth-code / EPP code) release until due diligence is complete and the buyer is satisfied. A seller who pushes to release the auth-code before escrow opens should be treated as a red flag.
• Representations on title: the purchase agreement should include a seller warranty that, to the seller's knowledge, the domain is not subject to any pending dispute, claim, or court order. This does not eliminate the risk of an undisclosed complaint, but it creates a contractual remedy if one surfaces post-closing.
• WHOIS accuracy at closing: the buyer should confirm, as a closing condition, that the registrant record has updated to reflect the buyer's information before releasing escrow funds. A domain still showing the prior registrant's name in RDDS after a purported transfer is a transfer that has not completed.
• Dispute-history disclosure: requiring the seller to disclose any prior UDRP, URS, or court proceeding in writing — and making that disclosure a condition of closing — shifts the informational asymmetry that favors sophisticated sellers in domain aftermarket transactions.

In a recent matter (a .xyz keyword domain, spring 2025), we identified a pending URS proceeding against the seller's domain during pre-acquisition review. The buyer was able to renegotiate the purchase price to reflect the litigation risk — or, alternatively, to walk away cleanly before funds were committed. Neither outcome would have been available without a structured review before signing.

What evidence decides whether a .xyz domain acquisition is safe?

The decision to proceed with a .xyz purchase turns on four evidence categories, evaluated together rather than in isolation.

First, trademark adjacency. Does the domain string — the second-level label — correspond to, or closely approximate, any registered or common-law trademark? The confusing-similarity element of the UDRP is assessed on the face of the domain against the mark; it does not require the buyer to have any intent to infringe. A domain like [brand]xyz.xyz or [brand]-service.xyz sits in a higher-risk band than a dictionary-word or invented-term domain, regardless of the buyer's intended use.

Second, registrant conduct history. Did any prior registrant use the domain in a way that a mark owner could characterize as bad faith — click-through advertising targeting brand terms, a confusingly similar website, or a documented offer to sell to the trademark owner at a premium? Prior conduct follows the domain. A buyer who acquires such a domain and continues the same use is almost certainly inheriting the prior registrant's bad-faith posture.

Third, the buyer's planned use. A bona fide commercial development plan — a genuine product or service launched under the domain — is among the strongest defenses to a UDRP complaint under Paragraph 4(c). Buyers who can document their planned use before acquisition are in a materially better position than those who park the domain post-transfer. We advise clients to preserve a contemporaneous record of the business rationale at the time of acquisition.

Fourth, the seller's registration date relative to any mark. If a trademark existed before the domain was first registered, and the domain is confusingly similar, any subsequent sale — including to a good-faith buyer — does not reset that chronology. Panels look to the original registration date, not the most recent transfer date, when assessing whether the domain was "registered in bad faith" for purposes of the UDRP's cumulative third element.

These four categories together produce one of three conclusions: the domain is clean and the acquisition can proceed; the domain carries identified risk that the price should reflect; or the domain is effectively untransferrable without triggering a strong UDRP complaint. Knowing which category applies before closing is the entire purpose of due diligence.

To weigh the evidence on a specific .xyz domain — including trademark-adjacency analysis and dispute-history review — email info@cognomenlaw.com.

How does the route differ if the domain is already in dispute — UDRP versus court?

The right route depends on where in the dispute lifecycle a buyer or seller finds themselves. Three distinct scenarios arise in practice, each calling for a different approach.

Scenario A: Domain is pre-dispute, buyer wants to acquire it. This is the standard due diligence scenario. The UDRP is the governing policy for .xyz; there is no court required and no national trademark office involved. The buyer's task is to complete the review described above, satisfy themselves that the domain is clean, and structure the escrow. If a post-acquisition complaint were filed, the UDRP at WIPO or the Forum is the forum — with a standard case resolving in approximately two months and legal fees for a respondent defense in the range commonly seen in the market.

Scenario B: Domain is already the subject of a UDRP complaint when the buyer is approached. Acquiring a domain mid-proceeding is deeply inadvisable without specialist review. A panel may proceed against the original respondent, and the decision — including a transfer order — may apply to the domain regardless of who holds it at the moment of decision. The buyer should either require the seller to resolve the dispute first, or treat the pending case as a reason to walk away.

Scenario C: Buyer wants a domain held by a third party and is considering initiating a UDRP complaint rather than purchasing it. This is a different service entirely — the recovery route, not the acquisition route. Under Paragraph 4(a), the complainant must have trademark rights, must show no legitimate interest on the respondent's side, and must demonstrate that the domain was registered and is being used in bad faith. Filing a UDRP complaint to recover a domain is a separate analysis from due diligence on a voluntary sale. In our practice, we assess both routes when a client has trademark rights to a desired domain; sometimes the better path is a complaint rather than a purchase at an inflated price.

Court action for .xyz sits in yet another lane. The UDRP is not the exclusive remedy; a trademark owner with US rights can bring a US anticybersquatting action in court, which can reach monetary damages — something the UDRP cannot provide. Court actions are substantially slower and more expensive than UDRP, and for most .xyz disputes the Policy is faster and sufficient. Where the registrant's conduct is egregious and damages are worth pursuing, we coordinate with local litigation counsel in the relevant jurisdiction.

What are the most common errors buyers make when acquiring a .xyz domain without legal review?

Buyers who bypass due diligence tend to make the same set of avoidable errors. Understanding them is the clearest argument for structured review before any funds move.

Relying on the seller's representation of a clean history. The domain aftermarket operates with significant informational asymmetry. A sophisticated seller may accurately know that a prior UDRP complaint was denied on procedural grounds — and that the underlying trademark owner retains the right to refile a corrected complaint. Telling the buyer "there's been a case and we won" is technically accurate and operationally misleading.

Treating WHOIS privacy as a substitute for registrant verification. Privacy proxy services obscure the registrant's identity, but they do not eliminate the registrant's legal exposure — or the buyer's need to know who they are actually contracting with. A domain held through a proxy whose underlying owner is subject to a sanctions regime, a prior fraud finding, or an active litigation hold creates risks beyond the UDRP.

Moving funds before confirming the transfer is complete. The auth-code mechanism means a transfer can be initiated without being complete. Funds released before the domain appears in the buyer's registrar account — under the buyer's credentials — have been released without consideration received. Escrow eliminates this error entirely.

Ignoring the planned-use question. A buyer who acquires a .xyz domain with a confusingly similar string, parks it without development, and then faces a UDRP complaint has no Paragraph 4(c) safe harbor to invoke. Passive holding of a domain confusingly similar to a mark is a recognized bad-faith indicator. The planned use should be documented at the moment of acquisition, not assembled after a complaint arrives.

In a second recent matter (a .xyz brandable domain, autumn 2025), we reviewed a purchase where the buyer had already released funds and the domain had transferred — but a UDRP complaint arrived within weeks. A dispute history check would have revealed a prior complaint filed against the same domain string under an earlier registrant. The buyer ultimately needed respondent defense services rather than the clean acquisition they had expected. That sequence of events is entirely avoidable.

Related at COGNOMEN

• Domain transactions, escrow, and portfolio brand-protection services
• Due diligence analysis for domain acquisitions involving app-related marks
• How to defend a generic or descriptive .xyz domain against a UDRP complaint