How to protect a brand in a new .app gTLD launch
A stranger registers your brand as a .app domain on launch day. The site resolves to a parked page – or worse, a competitor's storefront. You need it stopped, and you need to understand which tool fits the zone before you file anything.
To protect a brand in a new .app gTLD launch, a rights holder can invoke the ICANN Uniform Rapid Suspension system (URS) or the UDRP, both available for .app as a new generic top-level domain. The URS suspends the domain for the registration term under a clear and convincing evidentiary standard; the UDRP can deliver a full transfer through WIPO with the standard filing fee starting at USD 1,500. The right choice depends on whether you want suspension or ownership – and on the strength of your evidence from day one.
This page covers the mechanics of each route, the evidence that decides outcomes, the realistic timeline, and how COGNOMEN approaches new gTLD brand protection in the .app zone specifically.
Why .app is a distinct zone for brand protection
.app is a new generic top-level domain operated by Google Registry, and because it sits outside the legacy gTLD set, both the URS and the UDRP apply to it by default under ICANN's new gTLD program rules. That is the starting point for any rights holder trying to protect a brand in a new .app gTLD launch context. The .app zone has a mandatory HTTPS requirement, which means any infringing site must present a valid certificate – a detail that can narrow the field of potential abusers but does not change the legal test one line.
Unlike a ccTLD such as .de or .uk, there is no separate national registry procedure here. The applicable rules are ICANN's: the URS for rapid suspension and the UDRP for transfer or cancellation. A rights holder who prefers a national-court route can still pursue US anticybersquatting litigation with local litigation counsel, but for most brand owners the policy-based routes are faster and cheaper. The .app zone also has no sunrise or landrush period of its own active today – but that does not mean the launch phase risk has passed. Registrations continue, and opportunistic filings remain common against app-economy brands whose names are highly descriptive or popular.
In our practice we regularly advise technology companies and consumer-app brands that assume .app disputes will simply mirror .com disputes. They are largely correct on the legal elements, but the URS layer adds a strategic dimension that is absent from legacy gTLD work.
How does the URS work for a .app domain, and when should you use it?
The URS (Uniform Rapid Suspension) suspends a .app domain for the remainder of its registration term on a clear and convincing evidence standard – a higher bar than the UDRP's balance-of-probabilities approach, but a faster path to stopping the harm. Suspension means the domain resolves to an ICANN-mandated placeholder page. It does not transfer ownership to the complainant. That distinction drives the entire strategic choice between URS and UDRP.
Use the URS when the infringement is obvious, the evidence is documentary and immediate, and your primary goal is neutralization rather than ownership. The ideal URS fact pattern: an exact-match .app domain registered by an unknown party on or just after a launch date, with no plausible legitimate use, resolving to a pay-per-click page or a phishing-style interface. In that scenario the clear-and-convincing standard is achievable quickly, the URS fees are lower than the UDRP, and a decision typically arrives faster than a full UDRP panel cycle.
Where the URS is the wrong tool: when you need the domain transferred to your portfolio; when the registrant has constructed a defense (a website, a business name, prior use); or when the evidence of bad faith requires inference from circumstantial facts rather than documentary proof. In those cases the UDRP's fuller evidentiary process – and its transfer remedy – is the appropriate route.
For an assessment of which route fits your .app situation, contact info@cognomenlaw.com.
What are the three UDRP elements as applied to a .app domain?
Recovering a .app domain through the UDRP requires satisfying all three elements of Paragraph 4(a): the domain is identical or confusingly similar to a mark the complainant holds; the registrant has no rights or legitimate interests; and the domain was registered and is used in bad faith. Every element must be proved – a strong showing on two is not enough. Panels apply these elements the same way in .app as in .com, because the Policy text does not vary by zone.
The first element is usually the easiest to establish for brand owners with registered marks. An exact-match domain – brandname.app – will satisfy confusing similarity in virtually every case. Slight variations (brand-name.app, branddname.app) are nearly always sufficient given settled panel consensus on the irrelevance of the gTLD suffix to the comparison exercise.
The second element is proved negatively: the complainant asserts the registrant lacks legitimate interest, and the burden of production then shifts. If the respondent cannot demonstrate that it was commonly known by the name, that it made a bona fide offering of goods or services before notice of the dispute, or that it engaged in legitimate noncommercial fair use – the three safe harbors in Paragraph 4(c) – the element is met.
The third element is where most disputes are actually decided. Registration and use in bad faith are cumulative: both must be shown. Paragraph 4(b) lists four non-exhaustive circumstances that are themselves evidence of bad faith: registering to sell to the mark owner above documented costs; registering to disrupt a competitor; intentional attraction of users by creating confusion for commercial gain; and a pattern of abusive registrations. In the .app context, pay-per-click landing pages and app-store redirect schemes are common bad-faith fact patterns that panels have consistently found satisfy this element.
In a recent matter – a .app typosquat targeting a consumer fintech brand, summer 2025 – we assembled the bad-faith case around the registrant's prior pattern of similar registrations combined with an app-store phishing redirect. The transfer was ordered without a substantive response from the registrant.
What evidence is needed to protect a brand in a new .app gTLD launch?
Evidence is the margin between a complaint that transfers a domain and one that gets denied. Assembling it before filing – not after – is the single most important step a rights holder can take to protect a brand in a new .app gTLD launch proceeding. Here is what the record needs to contain.
Trademark rights: a registration certificate, or evidence of acquired distinctiveness if the mark is unregistered. UDRP panels accept common-law rights, but the evidence must be compelling: advertising spend, press coverage, customer volume, and the date the mark achieved its reputation. For a new app brand that has not yet registered, the URS or UDRP filing will be harder to sustain; file for registration first or file on the basis of acquired distinctiveness with full corroboration.
The domain and its use: a WHOIS/RDDS printout at the time of filing; screenshots of the resolving page with full URL, date-stamp, and HTTP response; any app-store listing or redirect documentation; and archive captures (such as from the Internet Archive) where available. For a .app domain the HTTPS requirement means the site is actively maintained – blank resolution is less likely than in .com, making page evidence easier to collect and more probative.
Bad-faith indicators: prior correspondence with the registrant (demand for money, offer to sell the domain, failure to respond to legitimate inquiries); prior UDRP or URS decisions against the same registrant in any zone; WHOIS history showing registration timing relative to your brand's launch or publicity; and any evidence linking the registrant's commercial activity to exploitation of your mark's reputation.
Legitimate-interest absence: a search of business-name databases, trademark registries, and app stores for the registrant's name, to confirm no plausible preexisting use of the disputed string. Panels expect the complainant to perform this search and to address it on the record.
URS or UDRP: how to choose the right route for your .app dispute
The right route depends on four variables: the remedy you need, the evidence you have today, the registrant's likely defense, and your timeline. Here is how the choice plays out for common .app fact patterns.
If the .app domain is an exact-match registration pointing to a pay-per-click page, filed within the last few months, with no apparent registrant business presence – URS first, UDRP if the URS examiner denies on a technicality. The URS is cheaper, faster, and sufficient if your goal is to stop the harm. A URS suspension lasts through the registration term; if the registrant re-registers on expiry, a UDRP at that point is likely to result in transfer given the pattern.
If the domain is a close variant (typosquat) or a combination (brandname-app.app), go directly to the UDRP. The URS's higher evidentiary standard is more demanding on confusing similarity where the identity is less obvious. WIPO is the preferred forum for a .app single-domain case involving a well-known brand: the filing fee is USD 1,500 for a single-member panel, and a standard case resolves in approximately two months.
If the registrant has a website with apparent commercial use – even a thin one – the URS will likely fail on the evidentiary standard. File a UDRP complaint with a full evidentiary record and be prepared for a contested response. A three-member panel (which either party can request, at the higher WIPO fee of USD 4,000) provides an additional safeguard against an unpredictable single-panelist outcome in a close fact pattern.
If you also need monetary damages – for example, because the .app domain was used to defraud your customers – neither the URS nor the UDRP reaches money. That remedy requires US anticybersquatting litigation in federal court, handled with local litigation counsel. The UDRP and any court action can run concurrently in theory, but strategy must be planned around the interaction between them.
The WIPO filing fee for a single-domain case sits at USD 1,500; the Forum's entry fee is approximately USD 1,300 for one or two domains. WIPO handles the large majority of new gTLD disputes and has the deepest institutional familiarity with .app zone fact patterns.
To weigh URS against UDRP for your .app domain, email info@cognomenlaw.com.
What happens at the WIPO filing stage, and how long does the process take?
A .app UDRP complaint at WIPO goes through five stages: filing and compliance review, commencement and response period, panel appointment, decision, and registrar implementation. The respondent has 20 days from commencement to file a response; the entire standard case completes in approximately two months. WIPO also offers an expedited single-panelist option delivering a decision in about one month, available for cases of up to five domains – a useful option for straightforward .app disputes where speed matters.
The filing includes the complaint itself, the evidence annexes, the filing fee, and a registrar verification request. WIPO's Center reviews the complaint for formal compliance before it commences – this is not a substantive review, but deficiencies here can delay commencement by several days. We advise clients to allow a week of lead time between drafting and filing so that the record can be reviewed for formal completeness before submission.
Once the response period closes, the Center appoints the panel. For a single-panelist case the appointment typically takes a few days. The panel then issues its decision, which is published on WIPO's online database and transmitted to the registrar. The registrar implements the transfer (or cancellation) after a ten-business-day waiting period that allows a respondent to file a court action to stay the process. In the overwhelming majority of cases no stay is sought and implementation follows automatically.
In a second matter we handled – a .app brand impersonation dispute, early 2026, involving a mid-size SaaS company – the case ran from filing to transfer order in approximately seven weeks under WIPO's expedited pathway. No response was filed and the record spoke for itself.
What respondent-side and RDNH considerations apply in .app?
Not every .app complaint is well-founded. Panels in gTLD proceedings regularly encounter complaints filed against legitimate .app registrants – developers, descriptive-use registrants, or domain investors who registered a generic term long before a complainant's brand existed. A finding of Reverse Domain Name Hijacking (RDNH) is available where the panel concludes the complaint was brought in bad faith to deprive a legitimate registrant of the domain.
An RDNH finding carries no monetary penalty under the UDRP, but the reputational consequences for the complainant are real. Published decisions are indexed and searchable. For a public company or a brand with regular IP litigation activity, an RDNH finding on the record is a material negative. We advise complainants to run a rigorous pre-filing assessment of the three elements before filing – not as an obstacle, but as a discipline that strengthens the complaint and avoids this outcome.
For registrants who receive a .app UDRP complaint, the 20-day response window is not negotiable without a formal extension request. Defense strategy must begin on the day the complaint is served, not the day the response is due. The record of good-faith registration – a prior business use of the string, an app development history, a legitimate descriptive-use rationale – must be assembled quickly and presented completely. We regularly defend registrants in gTLD proceedings and pursue RDNH findings where the record supports it.
Cross-zone considerations: when a .app dispute intersects with other registrations
A brand-protection problem in .app rarely comes alone. The same registrant who files a .app may also hold the .com, the .io, or a national ccTLD equivalent. Understanding the cross-zone picture before filing shapes both the forum choice and the complaint scope.
A single UDRP complaint can cover multiple domains provided the registrant of record is the same across all of them. If a registrant holds both yourbrand.app and yourbrand.com, a single WIPO complaint naming both domains costs the same filing fee as a complaint naming only the .com. Filing jointly is almost always more efficient than sequential complaints, and it eliminates the risk of a panel reaching different conclusions on the same registrant's conduct in separate proceedings.
Where the related registration is a ccTLD, the analysis shifts. A .uk domain belongs in the Nominet DRS, which uses a distinct "abusive registration" standard and includes a free mediation stage before any expert decision. A .eu domain falls under the EURid ADR.eu procedure administered by the Czech Arbitration Court, with its own eligibility and remedy rules. A .de domain has no policy-based arbitration route at all – disputes go to the German courts, with a DENIC DISPUTE entry available to block transfer in the interim. Each zone requires its own procedure, its own evidence standard, and in some cases its own eligibility to hold the domain.
Where a dispute spans .app and one or more ccTLDs, our approach is to assess each zone's procedure in parallel and file simultaneously where timeline and evidence permit. Waiting for the UDRP decision before addressing the ccTLD rarely serves the client's interest: the infringing use in the ccTLD continues throughout, and ccTLD panels do not treat a prior UDRP win as binding, though they may treat it as persuasive.
Related at COGNOMEN
Frequently asked questions
When should I protect a brand in a new .app gTLD launch?
Act as soon as you identify an infringing .app registration – delay weakens the bad-faith record and gives the registrant time to develop a defense. The ideal moment is within weeks of discovering the registration, before the infringing site acquires traffic, links, or commercial history. If your brand has not yet launched publicly, monitor new .app registrations and file a URS or UDRP complaint the moment an abusive registration appears. The rights that matter are those you hold at the time of the registrant's bad-faith conduct, not those you acquire after the fact.
What happens if the other side ignores the case?
If the registrant files no response to a UDRP complaint, the case proceeds to a panel on the complainant's record alone. The panel does not automatically decide in the complainant's favor – it still evaluates each of the three elements against the evidence filed. Default strengthens the complainant's position, particularly on the second element, but a weak complaint can still be denied even without opposition. Under the URS the standard remains clear and convincing regardless of default. Filing a complete, well-evidenced complaint is essential even when you anticipate no response.
How is WIPO different from a national court for .app?
WIPO's UDRP process decides only whether the domain should be transferred or cancelled – it awards no damages, no costs, and no injunction. It is faster and far less expensive than litigation, but the remedies are narrower. A national court (most commonly a US federal court in an anticybersquatting action, handled with local litigation counsel) can reach monetary compensation and a broader injunctive order, but the timeline and cost are substantially higher. For most .app brand-protection matters the UDRP at WIPO is the efficient first route; court action is reserved for cases where the infringing use caused measurable financial harm or where the registrant has engaged in conduct beyond the domain registration itself.
Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.