How to prove bad faith registration of a .cloud domain

A stranger registers your brand as a .cloud domain, parks it at a pay-per-click page, and waits. The demand arrives within weeks: a five-figure sum to hand it back. You want to know whether a UDRP complaint will actually work here — and what evidence you need to win.

To prove bad faith registration of a .cloud domain you must satisfy all three elements of Paragraph 4(a) of the UDRP: confusing similarity to a mark you hold, no legitimate interest in the registrant, and registration and use in bad faith. The UDRP applies to .cloud because the registry has incorporated it as the governing dispute policy. A standard WIPO case runs approximately two months, with a filing fee of USD 1,500 for a single-member panel on one to five domains; the only remedies are transfer or cancellation.

This page sets out the legal test, the evidence that decides cases, the realistic process from filing to registrar implementation, and how to assess whether a UDRP complaint is the right route for your .cloud domain right now.

Does the UDRP apply to .cloud domains, and which forum handles them?

Yes. The .cloud registry operates under ICANN's standard new-gTLD program and has adopted the UDRP as the mandatory dispute policy, meaning every .cloud domain registered through an accredited registrar is subject to the Policy. Any of the four accredited UDRP providers — WIPO, the Forum, the Czech Arbitration Court (CAC), or ADNDRC — may administer a .cloud complaint, but in practice WIPO and the Forum together handle the overwhelming share of proceedings. We routinely file .cloud matters at WIPO because its published procedures are the most extensively documented and its panel pool is the largest.

Filing at WIPO for a .cloud dispute follows the same mechanics as a .com filing. You submit the complaint electronically, WIPO checks formal compliance, and the case commences once the respondent is notified. The registrar locks the domain on commencement, which prevents any transfer or deletion while the case is live — an important protection if the registrant is also trying to monetize or flip the name. From commencement, the registrant has 20 days to file a response. If no response arrives, the panel decides on the complaint alone.

One nuance for .cloud: the zone is a new gTLD, so the URS — the Uniform Rapid Suspension system — is technically also available. The URS requires a higher evidentiary threshold ("clear and convincing" evidence) and delivers only suspension for the registration term, not transfer. For most brand-owner complainants who want ownership of the name, the UDRP is the correct route. We address the URS versus UDRP choice in more detail in our FAQ on URS versus UDRP.

If you are ready to assess whether your .cloud dispute meets the three elements, contact us at info@cognomenlaw.com. We will review the domain history, the trademark position, and the registrant's conduct before recommending a route.

How do you satisfy the first UDRP element for a .cloud domain?

The first element is confusing similarity: the disputed domain must be identical or confusingly similar to a trademark or service mark in which the complainant has rights. Panels evaluate this element on a visual and phonetic comparison, adding or discounting the TLD as context requires.

For .cloud domains, the TLD itself is rarely a differentiator. A domain such as [yourbrand].cloud is typically found confusingly similar to a registered mark for YOURBRAND. The addition of the .cloud string does not dispel the similarity — panels treat the TLD as a technical requirement rather than a meaningful distinguishing element. Typosquats (deliberate misspellings), prefix additions ("get", "my", "official"), and suffix additions ("app", "store", "online") are all well-settled as confusingly similar to the underlying mark.

What does this element require in practice? First, rights in a mark. A registered trademark is the clearest evidence, but panels have also accepted unregistered marks where the complainant demonstrates sufficient secondary meaning and use predating the domain registration. Second, the comparison must be made against the domain name string itself — not the content at the URL or the registrant's intent. The confusing-similarity test is therefore typically the most straightforward of the three elements to establish. Where we see complaints fail at the first element, it is usually because the complainant's mark is highly descriptive, the registration postdates the domain by years, or the trademark registration is in a class unrelated to any plausible use of the domain.

What evidence proves the registrant has no legitimate interest in the .cloud domain?

The second element — no rights or legitimate interests — is where the complainant shifts the burden to the registrant. Under the consensus approach, the complainant need only make a prima facie showing; the registrant must then come forward with evidence of a legitimate interest, and absent a credible response, the panel draws an adverse inference.

The three safe harbors in Paragraph 4(c) of the Policy define what legitimate interest looks like: a bona fide offering of goods or services before notice of the dispute; being commonly known by the domain name; or a legitimate noncommercial or fair use without commercial intent to mislead. Evidence that displaces each safe harbor matters enormously. Consider the following fact patterns we assess in every .cloud case we handle.

A pay-per-click parking page filled with links to the complainant's competitors is strong negative evidence. It cuts against any bona fide commercial use claim. A domain that has been held passively for months without any developed website — particularly where the registrant shares no name with the domain string — undermines any claim of being "commonly known" by the name. Where the registration was made shortly after the complainant announced a new product or a brand launch, the timing alone puts the registrant's claimed legitimate use in doubt. In a recent matter — a .cloud typosquat of a software brand, spring 2025 — we documented all three of these facts in a single evidentiary annex: the parking page screenshot, the RDDS registration date, and the client's press release predating registration by four days. The panel found no legitimate interest without a response filed.

What evidence satisfies the bad-faith registration and use requirement in a .cloud complaint?

The third element is the most contested, and it is cumulative: registration and use in bad faith must both be demonstrated. Paragraph 4(b) of the Policy lists non-exhaustive bad-faith indicators, and each maps to a documentary record you must build before filing.

Registration to sell at a profit above out-of-pocket costs — the most common scenario in .cloud cybersquatting — requires evidence that the registrant approached the complainant or a broker with a demand, or that the domain was listed for sale at a figure clearly exceeding registration cost. Save the offer email, the broker listing URL (with a timestamp), the Afternic or Sedo listing, and any WhatsApp or LinkedIn message thread. These are exhibits, not background. A direct offer to sell a .cloud domain for a five-figure sum, made to a complainant who had not reached out first, is a paradigm Paragraph 4(b)(i) circumstance.

Attracting users for commercial gain by creating confusion with the complainant's mark — Paragraph 4(b)(iv) — covers the PPC parking page scenario. Evidence here is a screenshot of the resolving page, preferably captured through a web archive service that timestamps the capture. If the page displayed sponsored links to the complainant's competitors or to the complainant's own products, that screenshot is close to dispositive on bad faith use. Panels have consistently held that operating a PPC page that profits from the likelihood of confusion with the complainant's mark is bad-faith use.

What about passive holding? Where a .cloud domain does not resolve to any active page at all, panels apply a doctrine sometimes called "passive bad faith": even inaction can satisfy the use requirement where other surrounding circumstances — the strength and fame of the complainant's mark, the absence of any conceivable good-faith use, the pattern of similar registrations by the same registrant — make it implausible that the registrant holds the domain for any legitimate reason. Document those surrounding circumstances in the complaint narrative.

In another matter we handled — a passive-holding .cloud dispute for a technology company, autumn 2025 — the registrant had acquired approximately a dozen .cloud and .tech variants of the same brand on the same day. The registration pattern itself, documented through RDDS records, WIPO's case database, and prior-case screenshots, was sufficient to establish bad faith even though no website was live. The panel transferred all domains in that filing.

If you have received a demand letter, identified a suspicious registration, or want a second read on whether your evidence supports a UDRP filing, reach us at info@cognomenlaw.com. We assess the three elements against your specific record before advising on whether to file.

What does the UDRP process for a .cloud domain look like from filing to transfer?

A standard UDRP complaint at WIPO proceeds through five stages: filing, formal compliance review, commencement and response window, panel appointment and decision, and registrar implementation. For a .cloud domain, the process is identical to any other ICANN-accredited gTLD proceeding.

After you file, WIPO conducts a compliance check — typically a few business days — and then formally commences the case. The registrar locks the domain at that point. The respondent then has 20 days from commencement to file a response. If no response is received, the panel is appointed and the decision issues on the complaint alone. A single-member panel on a straightforward case typically delivers a decision within about two months of filing. WIPO also offers an expedited option that targets delivery within roughly one month for single-panel cases covering up to five domains — a useful option where the complainant faces immediate commercial harm from the infringing domain's active use.

Once a transfer order issues, the registrar implements it — typically within ten business days. The domain transfers into an account you designate at your chosen registrar. No monetary damages are awarded at any stage; the UDRP delivers transfer or cancellation only. If you need damages, the route is a US anticybersquatting court action, handled with local litigation counsel, which runs on a separate timeline and substantially higher cost.

Our process for a .cloud UDRP complaint: we assess the three UDRP elements, assemble the bad-faith evidence, select the forum, prepare the complaint with all annexes, manage any supplemental-filing requests, and monitor implementation through transfer. We keep clients informed at each stage gate rather than at the end.

How do the filing fees and legal costs break down for a .cloud UDRP complaint?

UDRP fees have two distinct components: the forum's official filing fee and the legal fee for complaint preparation and management. They are separate and should not be conflated.

At WIPO, the filing fee for a .cloud complaint covering one to five domains before a single-member panel is USD 1,500. A three-member panel costs USD 4,000. If the case is withdrawn or settled before panel appointment, WIPO refunds a portion of the filing fee — commonly around USD 1,000 of a USD 1,500 filing. For six to ten domains in a single filing, the single-member fee rises to USD 2,000. The Forum's filing fee for one to two domains begins at around USD 1,300 for a single-member panel. CAC offers the lowest entry point at approximately USD 500–800, though it is less commonly used for .cloud matters.

Legal fees for a UDRP complaint — complaint drafting, evidence assembly, and management through transfer — commonly fall in the USD 3,000–7,000 range for a single domain on a straightforward fact pattern. Complex cases, multi-domain filings, and supplemental-filing disputes run higher. These are market ranges; our published pricing for standard matters is available on request. We separate the forum fee from our fee in every engagement letter so the client sees exactly where each dollar goes — a transparency commitment that many firms do not follow.

What does the choice between a single-member and three-member panel cost in outcome terms? If the complainant selects a single member and the respondent requests a three-member panel, the parties typically split the higher three-member fee. A three-member panel is worth that additional cost in cases where the evidence is nuanced, where the mark has descriptive components, or where the respondent has filed a substantive response raising a colorable legitimate-interest defense. We advise on panel composition based on the specific risk profile of each complaint — not as a default recommendation.

Which route is right: UDRP, URS, or court action for a .cloud domain?

The correct route depends on the goal, the timeline, and the nature of the harm. Here is how we frame the decision for .cloud matters specifically.

If the goal is transfer of ownership — getting the .cloud domain into your account — the UDRP is the primary route. It delivers transfer or cancellation at a defined cost and in roughly two months. That is the right choice for most brand owners who have discovered a cybersquat of their mark in this zone. If the goal is rapid suspension — taking the domain offline quickly while you assess whether to pursue transfer — the URS is faster and cheaper, but it suspends only for the remaining registration term and does not transfer the name to you. Use the URS when speed matters more than ownership, or as a complement to other enforcement action. Note the higher evidentiary threshold for URS: "clear and convincing" is harder to meet than the UDRP's preponderance standard.

If the registrant is also infringing a US trademark in commerce — operating a US-targeted site, causing actual consumer confusion, or diverting US customers — a US anticybersquatting court action can deliver monetary damages, an injunction, and a transfer order. It costs substantially more in legal fees and takes considerably longer, but it is the only route that reaches money. We work with local litigation counsel in the relevant jurisdiction for court-based actions.

A fourth scenario: you want the domain and the registrant is simply unresponsive, but there is also a .cloud.eu or another ccTLD variant registered by the same party. Multi-zone strategies — filing a UDRP for the .cloud alongside a separate national procedure for the ccTLD — are available where the registrant's identity is consistent across registrations. Coordination between filings matters: evidence gathered in one proceeding can inform strategy in the other, even if the governing rules differ. Our .cloud UDRP practice connects to our broader UDRP domain recovery services across gTLDs and ccTLDs.

What happens on the respondent side, and when is an RDNH finding possible?

Not every .cloud UDRP complaint is justified. A registrant who holds a .cloud domain in good faith — a domain investor who registered a generic or descriptive term, a business whose trading name genuinely corresponds to the domain, or a developer who built on the domain before the complainant acquired its mark — has a real defense and should file a response within the 20-day window.

Reverse Domain Name Hijacking (RDNH) is a panel finding that a complainant brought a complaint in bad faith to deprive a legitimate registrant of a domain. The finding is reputational rather than monetary — the Policy provides no damages for RDNH — but it is on the public record and it matters. RDNH is more likely where the complainant's trademark postdates the domain registration, where the complainant knew or should have known that the registrant had a legitimate interest, or where the complaint's bad-faith allegations are speculative or unsupported by evidence. We act on the respondent side as readily as on the complainant side and pursue RDNH findings where the record supports it.

If you have received a UDRP complaint regarding a .cloud domain you hold legitimately, the response deadline is 20 days from commencement. Missing that deadline does not automatically mean the complainant wins — the panel still reviews the complaint for sufficiency — but it eliminates any opportunity to put your legitimate-interest evidence before the panel. Do not let the deadline pass. For guidance on the full recovery path after a contested or settled dispute, see our guide to recovery after a .cloud buyback situation.

Related at COGNOMEN

• UDRP domain recovery — gTLD and ccTLD complaints across all zones and forums
• How to recover a .cloud domain after a buyback demand — step-by-step
• URS versus UDRP — when each procedure applies and how they compare

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.