What the expert actually files
The deliverable in a UDRP matter is not an argument. It is a set of exhibits and a written declaration that explains where each exhibit came from, how it was captured, on what date, with what tool, and what it does and does not show. The provider — the ICANN-approved dispute resolution service that administers the case, such as WIPO or FORUM, which is not a court — does not authenticate anything. The panel, the one or three neutrals who decide the case, weighs what it is given.
Two rules define the shape of that deliverable. Paragraph 4(a) of the Policy requires the complainant to prove three things together: that the domain name is identical or confusingly similar to a mark in which it has rights, that the holder has no rights or legitimate interests, and that the name was registered and is being used in bad faith (ICANN UDRP). And Rule 3(b)(xiv) requires the complainant to annex documentary evidence "together with a schedule indexing such evidence." The schedule is not a courtesy. It is a filing requirement, and in practice the expert's exhibit list.
Whether a complaint should be filed, and what it argues, is counsel's decision. This page describes only what the technical record consists of and how it is prepared.
Why the annex has to stand on its own
The Rules set no numeric length limit. Each provider does, through its supplemental rules, and the complainant chooses the provider. At WIPO the limit is explicit: "The word limit under Paragraph 3(b)(ix) of the Rules shall be 5,000 words" (WIPO Supplemental Rules, paragraph 10). CIIDRC sets the same figure and adds a cap on the annexes themselves: individual files not exceeding 10MB, and a total package of 50MB without prior approval.
Read those two constraints together and the consequence for an expert is concrete. The word limit bites on the grounds section, not on the annexes — so anyone who writes the technical explanation into the body of the complaint watches it get cut for space, and what survives is a conclusion with no method attached. The annex is where the explanation has to live. That means each one restates the question it answers, the sources used, the capture method and date, the limits of the data and the finding, in that order, so that a panelist who opens the annex without the complaint in front of them can still follow it.
The file-size cap has a separate consequence. A full-fidelity capture set of a large site can run to hundreds of megabytes and cannot be filed as collected. Deciding what is filed, and preserving the rest under hash, is part of the work rather than an afterthought.
One annex, one element
Because the three elements are conjunctive, evidence not labeled to an element helps nobody. I label each annex to the element it addresses — 4(a)(i), (ii) or (iii) — and mirror that labeling in the schedule, so the index reads as a map rather than a list of files.
The bad-faith circumstances in paragraph 4(b) are non-exhaustive, but each of the four listed maps cleanly onto a record type, which is what makes them documentable:
- Acquisition primarily to sell to the mark owner for a sum above documented out-of-pocket costs — offer correspondence with full message headers, marketplace and broker listings, price histories, and the dates on each.
- Registration to block the mark owner, where there is a pattern — portfolio data across a registrant's holdings, with the basis on which the holdings were linked stated openly.
- Registration primarily to disrupt a competitor — market and competitor records, and the dates on which each was published.
- Attracting users for commercial gain by creating a likelihood of confusion — page content, the advertising actually served, redirect chains and HTTP header traces.
Element (i) has a measurable component that is often argued when it could simply be shown. WIPO's overview treats a common, obvious or intentional misspelling of a mark as confusingly similar to it, and gives examples that include adjacent keyboard letters, similar-appearing character substitutions and non-Latin internationalized characters. Every one of those is documentable rather than assertable: keyboard adjacency, edit distance, homoglyph and Punycode decoding, and the actual resolution behavior of the string.
The capture window closes when notice goes out
The UDRP timetable is short and it runs in one direction. The registrar has two business days to answer the provider's verification request and confirm the lock. The provider forwards the complaint to the respondent within three calendar days of receiving fees. The response is due twenty days from commencement, with an automatic four-day extension available. A single-member panel is appointed five calendar days after that, must decide within fourteen days of appointment, and the decision reaches the parties within three business days.
Add it up and the evidentiary record is fixed within weeks — and effectively fixed before the case starts, because a respondent who receives notice can change the site that afternoon, and often does. Registration data, DNS records, page content, redirect chains and certificates therefore get captured before the provider notifies anyone, each artifact hashed at capture, with a contemporaneous log recording tool, version, operator, time and time zone. That log is itself an annex.
The corollary is worth stating plainly: material not preserved before filing may simply be unavailable, and no later work recovers it. There is no discovery in a UDRP.
The registrar verification response
One piece of evidence in a UDRP is generated by the proceeding itself and exists nowhere else. Under Rule 4(a) the provider sends the registrar a verification request that includes a request to lock the domain. Under Rule 4(b) the registrar has two business days to provide full Registration Data — the registrant, administrative and technical contact data the registrar holds — and to confirm that the lock has been applied (UDRP Rules).
Since public registration data became routinely redacted, this step is frequently the first point at which the party behind a privacy or proxy service — a service that substitutes its own details for the registrant's in the public record — is identified, and it happens without a subpoena. It also means the pre-filing attribution work is provisional by design. When the disclosure arrives, the analysis is re-run against it, and any divergence between the pre-filing record and the disclosed record is noted rather than quietly overwritten. A registrant name that changes between the public record and the Rule 4(b) response is itself a fact about the record, and burying it costs more credibility than it saves.
What a UDRP annex cannot establish
The gaps are specific and worth naming before opposing counsel does.
There is no discovery, no hearing and no cross-examination. Rule 15(a) confines the panel to "the statements and documents submitted," and Rule 10 leaves admissibility, relevance, materiality and weight to the panel. An unexplained method is not challenged in a UDRP. It is simply given less weight, silently, and nobody tells you.
Hosting logs, payment records, registrar account access logs and ad-network revenue reports are not obtainable. They require legal process the UDRP does not provide. Any question that turns on them is unanswerable in this forum.
Registrar disclosure is a snapshot, not a history. It covers only the disputed names and only what that registrar currently holds.
Archive coverage is selective. The Internet Archive crawls what it crawls; the absence of a capture is evidence of a collection gap, not evidence that no page existed.
Panels are not bound by precedent. WIPO states that the UDRP does not operate on a strict doctrine of binding precedent and that prior decisions are not strictly binding on panelists, who consider the particular facts of each proceeding. So a technical annex that leans on "panels have held" is leaning on something the panel is free to set aside. It has to stand on its own records and its stated method.
Everything filed may become public. Policy paragraph 4(j) requires that all decisions be published in full absent exceptional redaction.
Authentication, and the annex that outlives the proceeding
The UDRP applies no formal rules of evidence. Capture discipline still matters, for two reasons: weight inside the proceeding, and re-use outside it.
Policy paragraph 4(k) expressly preserves court proceedings before the administrative proceeding begins or after it concludes, and a registrar will not implement a transfer or cancellation until ten business days have passed without court documentation being filed. In practice that means a UDRP annex is a candidate court exhibit from the day it is created. An annex built to a filing deadline and no further — undated screenshots, no hashes, no capture log — is one that has to be rebuilt from scratch if the matter moves.
United States federal practice only: authentication of electronic records runs through Federal Rule of Evidence 901, including 901(b)(9) for evidence describing a process or system, with self-authentication available under 902(13) and 902(14) for certified records generated by an electronic process and hash-verified copies from an electronic device. Business-records treatment runs through 803(6). No view is expressed here on how any court would apply them; that is counsel's assessment, and outside the United States a different framework governs entirely.
What a retaining attorney should expect
A declaration that reads cold. Scope stated at the top, including what was not examined and why. Sources named individually rather than as a category. Capture timestamps with time zones, tool names with versions, and hash values for each artifact. One proposition per annex, labeled to the element it addresses. A plain statement, in the declaration itself, of what each source cannot show.
What you should not expect is a view on how the panel will decide, a characterization of the other side's motives, or a recommendation about filing. Those are counsel's territory, and an expert who wanders into them makes the technical material easier to discount.
One further point that surprises people. Panels do conduct limited factual research into matters of public record — published decisions record panels searching the Internet Archive themselves. That discretion cuts both ways. It is not a substitute for annexed evidence, and it means the record a filing left out may be found anyway.
I have testified in domain-related legal cases and have provided expert witness reports in other cases, and have worked in this field since 1996. The current engagement record is maintained at hartzer.com rather than here.