How to recover a .xyz domain held passively in bad faith

Your brand's .xyz domain sits registered in someone else's name. The site resolves to nothing — no content, no parked ads, no obvious use. Months pass. The registrant does nothing, says nothing, and refuses a reasonable offer. That pattern is not innocent. It is one of the most litigated fact patterns in domain-name disputes, and the UDRP has a direct answer for it.

To recover a .xyz domain held passively in bad faith, you file a UDRP complaint — the Policy applies to .xyz through ICANN's accreditation framework. You must prove all three elements of Paragraph 4(a): confusing similarity to a mark you hold, the registrant's absence of legitimate interest, and registration and use in bad faith. Passive holding satisfies the third element when the surrounding circumstances are strong enough. A standard case at WIPO is decided within approximately two months, with transfer or cancellation as the only remedies available.

This page covers what passive holding means under the UDRP, how the three elements play out for .xyz, the evidence that decides these cases, the cost and timeline, and how to assess whether your situation is ready to file.

Why does passive holding count as bad faith for a .xyz domain?

Passive holding is bad faith when inaction is itself an exploitation of the complainant's trademark. The registrant does not need to be running a phishing site or reselling counterfeit goods — not using the domain can be enough, provided the other circumstances compel that conclusion.

Panels have consistently held that the UDRP's bad-faith requirement is satisfied by passive holding where the respondent could not plausibly use the domain without infringing the complainant's mark, where the domain precisely matches a distinctive trademark, and where the registrant offers no credible explanation for the registration. The .xyz zone provides no shelter from this analysis. Because .xyz operates under the UDRP through ICANN's standard framework for new gTLDs, the full body of UDRP jurisprudence applies without modification.

What tips a passive-holding case in the complainant's favor? The strongest situations share most of the following: a mark with genuine recognition in the market, registration of the domain shortly after the mark achieved that recognition, a registrant with no plausible independent reason to hold the name, WHOIS data obscured by privacy services, no response to the complaint, and no use of the domain for any purpose — commercial or otherwise — over a sustained period. Any one of these elements is rarely decisive alone. Together they create a cumulative picture that panels regularly treat as satisfying the "use in bad faith" standard even when the registrant has done nothing visible with the name.

If your .xyz domain has sat unused in a stranger's hands for months or years, the question is whether the surrounding facts — your mark's strength, the registration date, the registrant's conduct — are strong enough to file. For an assessment of your domain dispute, contact info@cognomenlaw.com.

What are the three UDRP elements for recovering a .xyz domain?

Every UDRP complaint must satisfy all three elements of Paragraph 4(a) of the Policy. Failing any one is fatal to the complaint, regardless of how compelling the other two may be.

Element one: confusing similarity. The domain must be identical or confusingly similar to a trademark or service mark in which the complainant has rights. For .xyz domains the comparison strips the TLD itself and measures the second-level label against your mark. If the domain is your registered mark exactly, or a close variant — a typo, a phonetic equivalent, a mark plus a generic word — the first element is almost always satisfied. Unregistered marks can also qualify if the complainant can demonstrate acquired distinctiveness through use, but the evidentiary burden is higher. In our practice, we see the first element contested in far fewer cases than the second or third.

Element two: no rights or legitimate interests. The complainant bears an initial burden here, but it is lightened: once a prima facie case is raised that the registrant lacks any legitimate interest, the burden shifts to the registrant to show otherwise. The Paragraph 4(c) safe harbors are the registrant's tools — a bona fide offering of goods or services before notice of the dispute, being commonly known by the domain name, or a legitimate noncommercial or fair use. In a passive-holding situation, the registrant almost never engages with these safe harbors because there is no use to point to. Silence is not a safe harbor.

Element three: registration and use in bad faith. The conjunctive "and" matters. The complainant must show both that the registration was in bad faith from the outset and that the domain is being used in bad faith — or that the current circumstances constitute bad-faith use. Passive holding addresses the second limb. But the registration must also have been in bad faith: panels look to whether the registrant knew of the complainant's mark at the time of registration, whether the mark had prior fame, and whether there is any innocent explanation for choosing the name. A .xyz domain registered the week after a brand's major product launch is a very different case from one registered before the brand existed.

We regularly advise brand owners who have clear grounds on elements one and two but face a genuine dispute about the registration date versus the mark's priority. That timing question deserves rigorous analysis before filing — a complaint that loses on element three can waste the filing fee and, in clear cases of overreach, attract an RDNH finding against the complainant.

How does the UDRP process work for a .xyz domain, and how long does it take?

A .xyz UDRP proceeding follows the same five-stage process as any gTLD complaint: filing, commencement and formal compliance review, the respondent's window to file a response, panel appointment, and the decision followed by registrar implementation.

Filing is with an ICANN-accredited provider. WIPO and the Forum together account for roughly 97% of all UDRP proceedings. For passive-holding .xyz cases, both are appropriate. WIPO offers name recognition, a well-developed jurisprudence on passive holding, and an expedited single-panel option for cases involving up to five domains. The Forum is a common alternative, particularly where the complainant prefers its filing interface or its panelist pool.

Once the case commences formally, the registrant has 20 days to file a response. In passive-holding cases, default — no response — is common. A default does not automatically mean the complainant wins, but it means the panel assesses the complaint on the record as filed. A well-constructed complaint with complete evidence of passive holding is therefore especially important where default is the likely outcome.

After the response window closes, a single-member panel is appointed. The decision typically follows within two to three weeks of appointment. Registrar implementation — the actual transfer of the .xyz domain — follows the decision by a short mandatory waiting period during which the registrant may seek court review. In practice, the full cycle from filing to transfer runs approximately two months for a straightforward case with a single-member panel and no procedural complications.

In a recent matter — a .xyz passive-holding complaint, spring 2025 — we filed a complete evidential record at the outset and the domain was transferred to our client approximately seven weeks after commencement, the registrant having filed no response and the panel having found all three elements satisfied on the written record.

If you are ready to assess whether a .xyz UDRP is the right step, reach us at info@cognomenlaw.com to evaluate the three elements against your specific facts.

What evidence decides a passive-holding .xyz case?

The complaint is the only submission the complainant controls entirely. In a passive-holding case, where the registrant is likely to stay silent, the complaint must carry the full weight of the factual record.

The core evidentiary package for a passive-holding .xyz complaint typically includes: proof of trademark rights (registration certificates, evidence of prior use if the mark is unregistered or not yet registered), WHOIS or RDDS records showing the registrant's identity and privacy-service use, domain registration date records, screenshots confirming that the domain resolves to nothing or to a blank page, any communications with the registrant (including an offer to purchase), and market evidence of the trademark's recognition — press coverage, revenue data, or user-base metrics that support the inference that the registrant knew of the brand when registering.

Two categories of evidence carry particular weight in passive-holding analyses. First, the distinctiveness of the mark at the time of registration: the more distinctive and well-known the mark, the stronger the inference that registration was targeted. Second, the implausibility of innocent use: can the registrant conceivably use the domain for any legitimate purpose without reference to the complainant's mark? If the answer is no, that finding anchors the passive-holding conclusion. A domain consisting of a coined word that is also a registered mark, held dormant for eighteen months with no content, by a registrant with no obvious connection to the term, presents a near-textbook passive-holding scenario.

Evidence to gather early includes archived versions of the domain from web archive tools (showing the domain has been consistently blank or parked), any prior-auction or aftermarket listing for the domain (showing the registrant intended to sell it), and any other domain registrations by the same registrant that follow a similar pattern — registrations that mirror other brands' marks raise the issue of a pattern of conduct under Paragraph 4(b) of the Policy.

In another recent matter — a .xyz domain, summer 2025 — we identified through open-source research that the registrant held approximately a dozen further domains each mirroring a distinct consumer brand. That pattern evidence was central to the panel's bad-faith finding, reinforcing the passive-holding analysis with a Paragraph 4(b) pattern argument.

Is the UDRP the only route, or should you consider a court action or other procedure?

The right route depends on what you need and what the domain is worth.

If the domain is a .xyz and the goal is transfer or cancellation at reasonable cost, the UDRP at WIPO or the Forum is almost always the primary path. It is faster than litigation, confined in cost, and designed precisely for this type of dispute. The filing fee starts at USD 1,500 at WIPO for a single-member panel covering one to five domains. Legal fees for a straightforward single-domain complaint are commonly in the USD 3,000 – 7,000 range, separate from the forum fee, though they vary with complexity.

If the UDRP fails — for instance, the panel finds the registration predates the trademark's acquired distinctiveness — the complainant may pursue a court action for US anticybersquatting claims where the registrant is US-based, or equivalent national proceedings elsewhere. A court action is substantially more expensive and time-consuming than the UDRP, but it reaches monetary damages, which the UDRP cannot. For cases where the bad-faith registration caused genuine commercial harm — diverted traffic, lost customers, damaged brand reputation — a court route handled with local litigation counsel in the relevant jurisdiction may be appropriate as a follow-on or parallel strategy.

URS is not the right tool here. The Uniform Rapid Suspension System applies to new gTLDs including .xyz, but its remedy is suspension only — not transfer — and it requires a higher evidentiary standard of "clear and convincing" evidence. For a passive-holding case where the facts need careful argument, URS's higher bar and limited remedy make the UDRP preferable.

Could the registrant file a court challenge to the UDRP decision? Technically yes, during the mandatory waiting period before transfer. In practice, a defaulting passive holder rarely does. But a well-documented complaint that addresses each element in detail reduces that risk.

What are the common mistakes that sink a .xyz passive-holding complaint?

Is a passive-holding complaint easy to win? Not automatically. Panels do not presume bad faith from inaction alone — every element must be established from the record. The most common failures we see in passive-holding cases are instructive.

Filing before the mark is established. A complainant who holds only a pending trademark application — with no registration and limited evidence of prior use — will struggle on element one and, critically, on the inference that the registrant targeted a mark that may not yet have existed. Filing too early, before registration issues or before the brand achieves recognizable distinctiveness, is a significant risk. The better strategy is to secure the registration, then assess.

Thin evidence on the registration-date bad faith inference. Panels require something that connects the registrant's decision to register the domain to the complainant's mark. If the mark was obscure, regional, or unpublicized at the time of registration, the inference is harder to draw. Anticipating this gap in evidence — and filling it with third-party press coverage, marketing spend data, or web traffic metrics as of the registration date — is a core drafting task.

Ignoring potential Paragraph 4(c) defenses. Even in a passive-holding scenario, a registrant who wakes up and files a belated response claiming a generic or descriptive legitimate interest can complicate a case the complainant thought was clean. Panels give weight to credible innocent explanations. Closing off the obvious escape routes in the complaint — by showing the domain is not descriptive or generic in the registrant's jurisdiction, that the registrant is not known by the name, and that no legitimate use has ever been made — is standard practice.

Underestimating the RDNH risk. If the complainant's mark is weak, the domain is descriptive, or the complaint overstates the similarity, a panel can find RDNH — that the complaint was brought in bad faith to deprive a legitimate registrant. An RDNH finding does not carry monetary penalties, but it is a public reputational mark against the complainant and a signal to future panels. We assess RDNH exposure in every engagement before advising whether to file.

How to assess your case and start a .xyz recovery

A passive-holding .xyz case is ready to file when the following conditions are met: your trademark rights are established and clearly predate the registration; the domain precisely targets your mark with no plausible innocent explanation; the registrant has offered nothing — no content, no response to outreach, no business purpose — that suggests a legitimate interest; and the evidence package is complete enough that a panel reading only your complaint would understand why the registration was in bad faith from day one.

Our process begins with a structured review of those four conditions. We examine the mark registration record, the domain's registration timeline, the WHOIS history, any communications with the registrant, and any related-domain pattern data. Where the case is strong, we draft the complaint, select the forum, and file. Where a gap exists — typically on the registration-date bad-faith inference or the mark's strength at the time of registration — we identify what evidence is needed before filing is advisable.

A UDRP complaint filed with a complete, well-reasoned record is a fundamentally different document from one filed in haste with thin evidence. The standard case timeline means that the complaint is the complainant's primary and often only submission. We structure it to withstand a default scenario and a contested response equally.

For complainants managing multiple zones — a .xyz passive hold alongside a .com, a .net, or a ccTLD registration by the same party — a coordinated filing strategy across forums can address all variants efficiently. A single UDRP complaint can cover multiple domains held by the same registrant, reducing duplicated effort and cost.

Related at COGNOMEN

• UDRP domain recovery – the full service across WIPO, the Forum, CAC, and ADNDRC
• FAQ: dealing with a serial cybersquatter holding .org and other gTLD domains
• Court recovery – reversing an unauthorized domain transfer in cross-border matters

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.