How to recover a .app domain after a failed buy-back negotiation

How to recover a .app domain after a failed buy-back negotiation. UDRP and ccTLD domain recovery and defense across .app. Email the firm to assess your case.

You found the domain. You made an offer. The holder came back with a price that no reasonable business justifies — or simply stopped responding. A failed buy-back negotiation is, in our practice, one of the clearest signals that the domain is being held in bad faith. It is also, under the UDRP, one of the best-documented paths to a transfer order.

To recover a .app domain after a failed buy-back negotiation, you must satisfy all three elements of Paragraph 4(a) of the UDRP: the domain is identical or confusingly similar to a trademark you hold; the registrant has no rights or legitimate interests in it; and it was registered and is being used in bad faith. A standard WIPO case runs approximately two months, with a filing fee of USD 1,500 for a single-member panel on up to five domains. The only available remedies are transfer or cancellation — no damages, no legal costs.

This page sets out the procedure, the evidence that decides the outcome, and the choices you face when a private purchase has already failed.

Why .app domains fall under the UDRP

.app is a generic top-level domain operated by Google Registry and, like all accredited gTLDs, it is subject to the Uniform Domain Name Dispute Resolution Policy. That means the same three-element test, the same forum choices — WIPO, the Forum, CAC, or ADNDRC — and the same remedies apply to .app as to .com or .net. There is no separate ccTLD procedure and no national registry authority to petition.

One feature of .app is worth noting at the outset. The .app TLD operates under a mandatory HTTPS requirement enforced at the registry level: every .app domain must present a valid TLS certificate or the browser blocks the site. That technical constraint shapes how a bad actor can monetize an .app domain. The most common patterns in our practice are pay-per-click parking pages served over HTTPS, redirect schemes routing traffic to third-party advertising networks, and passive holding — simply sitting on the name while waiting for a higher offer. Each of these can support a finding of bad faith under Paragraph 4(b) of the Policy.

Where does the UDRP file? WIPO and the Forum together account for roughly 97% of all UDRP proceedings. For a single .app domain and a straightforward bad-faith registration, WIPO is the most common choice: its published timelines and panel pool are well-established, and its decisions are indexed and searchable, which matters for precedent research.

How a failed negotiation becomes evidence of bad faith

A demand for a price far in excess of documented out-of-pocket registration costs is one of the Paragraph 4(b) bad-faith factors listed in the Policy itself: registration primarily for the purpose of selling the domain to the owner of the trademark for more than documented costs. A failed buy-back negotiation does not merely suggest this motive — in many cases it proves it, in writing, with timestamped communications.

What makes this situation particularly actionable is that the negotiation history you already hold is often the most direct evidence available. Screen captures of the demand, email threads, any third-party broker communications, the asking price relative to the registration fee — all of this goes into the complaint. Panels have consistently treated documented demands for five- or six-figure sums from trademark owners as strong evidence of Paragraph 4(b)(i) bad faith, especially when the registrant has no plausible legitimate use for the domain.

A word on timing. The UDRP does not have a statute of limitations in the traditional sense, but the passage of time between registration and your complaint can affect the analysis. If the registrant registered the domain before your trademark rights arose, the "registered in bad faith" element becomes more difficult to establish — that gap is something we assess at the outset. If the registration postdates your rights and the demand followed quickly, the inference of bad faith is strong.

In a recent matter — a .app domain held passively while a five-figure buy-back demand was conveyed through a broker, spring 2025 — we assessed the three elements, assembled the negotiation record as the primary bad-faith exhibit, and filed at WIPO. The transfer order was implemented approximately seven weeks after the complaint was filed, without any response from the registrant.

For an assessment of whether your negotiation record supports a UDRP complaint, contact info@cognomenlaw.com.

What are the three UDRP elements and how do they apply to .app?

The Policy requires proof of all three elements; a failure on any one defeats the complaint. Here is how they read in the context of a failed .app buy-back.

Element one — confusing similarity. For .app disputes, the comparison is between your trademark and the second-level domain (the part before ".app"). Panels routinely exclude the TLD itself from the comparison, treating ".app" as a generic component. If the domain incorporates your mark exactly, or with a minor variation — a hyphen, a generic word appended, a common misspelling — confusing similarity is almost always met. This is the least contested element in practice.

Element two — no rights or legitimate interests. The complainant carries the initial burden of making a prima facie case that the registrant lacks a legitimate interest; the burden then shifts to the registrant to rebut. A registrant who held the domain for the purpose of reselling it to you has a difficult case to make. The Paragraph 4(c) safe harbors — bona fide offering of goods or services before notice of the dispute, being commonly known by the name, or legitimate noncommercial fair use — rarely apply where the domain's primary activity was to extract a payment from the mark owner.

Element three — registration and use in bad faith. This is the cumulative element: both registration and use must be shown. For .app domains where the holder made a direct demand, the registration intent is documented in the negotiation record. "Use" in bad faith has been interpreted broadly by panels: passive holding, pointing the domain to a parking page, or using it to redirect traffic all qualify. The failure to respond to a lowball offer — or to make any counter-offer at all — is contextual evidence panels weigh alongside the domain's technical configuration.

We regularly advise brand owners on whether the evidence they hold after a collapsed negotiation is sufficient to carry all three elements. The strength of the complaint turns on the detail: how precisely does the domain match the mark, what exactly did the demand communications say, and what has the domain been doing while the negotiation stalled?

The UDRP process: timeline, forum, and what happens at each stage

A standard .app UDRP proceeds through five stages. Understanding the timeline matters because the window between filing and implementation is fixed by the Rules — and the registrant's options narrow sharply once the clock starts.

Stage one — complaint preparation and filing. The complaint must set out the three elements, identify the registrant (as shown in WHOIS/RDDS records), and attach the evidence. For a buy-back situation, the evidence package typically includes trademark registration certificates, WHOIS records timestamped at the time of filing, the negotiation correspondence, screenshots of the domain's current use, and any HTTPS certificate data relevant to the registrant's identity.

Stage two — formal review and commencement. The forum (WIPO or the Forum) reviews the complaint for procedural compliance and formally commences the case. From that commencement date, the registrant has 20 days to file a response.

Stage three — panel appointment. If no response is filed (a default), the forum appoints a panelist and the case proceeds on the complaint alone. If a response is filed, the forum appoints a panel — single-member unless a party requests three members, at higher cost.

Stage four — decision. The panel reviews the record and issues a written decision. A standard case is typically decided within approximately two months of filing. WIPO also offers an expedited option — decisions in roughly one month — available for single-panel cases covering up to five domains.

Stage five — registrar implementation. After a transfer order, there is a ten-business-day waiting period during which the registrant may seek a stay by filing a court action in the "mutual jurisdiction" identified in the complaint. If no stay is filed, the registrar transfers the domain. In practice, the stay route is rarely used.

What is the cost? WIPO charges USD 1,500 for a single-member panel on one to five domains. A three-member panel costs USD 4,000 at WIPO for that same range. Legal fees, separate from the forum filing fee, typically fall in the range commonly seen in the market for straightforward single-domain complaints. COGNOMEN publishes its price ranges; contact us directly for the figure applicable to your matter.

In a second matter we handled — a .app domain incorporating a software brand name, summer 2025 — the registrant filed a response asserting generic use of the term. We had anticipated that argument and built the element-two rebuttal into the complaint. The panel transferred the domain approximately nine weeks after filing.

What evidence decides the outcome — and what the registrant will argue

Evidence is where UDRP complaints succeed or fail at the margins. A clear trademark, a documented demand, and a domain pointing nowhere are usually enough. But anticipating the registrant's defense sharpens the record before filing, not after.

On element one, the main risks are: your trademark postdates the domain registration (making bad-faith intent at registration harder to prove); the trademark is weak or highly descriptive (making the similarity argument closer); or the domain adds a word that the registrant claims is descriptive of its own business. Each of these is assessable before you file.

On element two, registrants in buy-back situations typically argue that they registered the domain without knowledge of the trademark, that the term is generic or descriptive, or that they have a business that the domain could legitimately support. Panels scrutinize these arguments against the timing of the registration relative to your mark's priority date and against any actual use of the domain for that purported business.

On element three, the most common defense is that the registrant had no knowledge of your trademark at registration and therefore could not have registered in bad faith. This is a harder argument to sustain when: (a) your mark was registered or well-known before the domain was acquired; (b) the registrant is in your industry or a related one; or (c) the registrant made contact to sell the domain shortly after registering it. All three factors are common in buy-back situations that reach our desk.

What about RDNH? Reverse Domain Name Hijacking — a panel finding that the complaint was filed in bad faith to take a legitimately held domain — is a real risk if the complainant's trademark rights are thin, postdate the registration by years, or if the domain has a credible independent use. We assess this risk at the outset, because a filed complaint is public and an RDNH finding is on the record permanently.

To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

When UDRP is not the right route — and what to use instead

The UDRP is not the only route, and for some situations it is not the best one. Understanding the alternatives decides the strategy.

If the domain is a .app and you want it transferred — and you hold a trademark with priority over the registration — the UDRP at WIPO is almost always the fastest and least expensive path. Transfer in approximately two months, at a fixed forum fee, without any court attendance.

If you also want monetary damages — compensation for diverted traffic, lost revenue, or the cost of your failed buy-back negotiation — the UDRP cannot help you. It awards no money. US anticybersquatting litigation is the route that reaches damages and transfer together, handled with local litigation counsel in the relevant jurisdiction. That path is slower and substantially more expensive, but it is the only one that compensates the harm rather than simply ending it.

If the domain is a new gTLD (such as .app) and you need it taken down quickly — not transferred, just suspended — the Uniform Rapid Suspension (URS) procedure is available at a lower filing cost and with a faster decision, but it applies a higher "clear and convincing" evidentiary standard and the remedy is suspension for the registration term, not transfer of ownership. For a brand owner who wants the domain, UDRP is usually preferable to URS.

If the situation involves unauthorized transfer of an .app domain — account compromise, a hijack by a bad actor — rather than a registration dispute, the recovery route differs entirely: registrar escalation, documentation of the account compromise, and transfer reversal through the registrar's internal process and ICANN's procedures. We handle that route separately from a UDRP filing. See our page on recovering a stolen tech domain for the specifics of that procedure.

For the reader whose .app domain was registered by a third party to exploit a trademark — and who has already tried and failed to buy it back — the UDRP is, in the large majority of cases, the right tool. The negotiation record you already hold is your evidence. The question is whether the three elements are clearly met.

Is there a myth you need addressed before you decide?

The most common objection we hear at this stage: "I already made an offer, so the registrant will argue I acknowledged their ownership." That is a misconception. Making a buy-back approach does not constitute an admission that the registrant's ownership is legitimate or that the domain was registered in good faith. Panels understand that brand owners attempt private purchase before arbitration precisely because it is faster and cheaper. An approach to buy back a domain you believe is held abusively does not waive your UDRP rights or estop you from arguing bad faith.

A related concern: "The registrant will claim they own the name because they registered it first." Registration priority is not ownership in the trademark sense. The UDRP requires that the domain be registered in bad faith with respect to your trademark rights. If your trademark predates the domain registration — even by a short period — and the registrant knew of it (or should have known, given the .app context), the registration is not protected by mere chronological priority at the registry.

What we advise, practically: bring the full negotiation record to the assessment, including offers you made, responses received, the asking price, and any broker communications. That record, assessed against the date of your trademark rights and the domain's current configuration, tells us whether the three UDRP elements are clearly met and what the realistic risks are before you spend a dollar on filing fees.

Related at COGNOMEN

• UDRP domain recovery — the full service across all gTLD zones
• Proving the registrant has no legitimate interest — how panels assess the second UDRP element
• Recovering a stolen or hijacked tech domain outside the UDRP process