Update: changes affecting how to prove a registrant has no legitimate…

Update: changes affecting how to prove a registrant has no legitimate. UDRP and ccTLD domain recovery and defense across .io. Email the firm to assess your cas…

The British Indian Ocean Territory's ccTLD, .io, has long occupied an unusual position in the domain industry. Technically a country-code zone, it operates under the UDRP – the same rules that govern .com – because its registry appointed WIPO as its dispute-resolution provider. That arrangement means brand owners and registrants alike follow the three-element test of Paragraph 4(a). But recent developments in how panels scrutinize the second element – whether a registrant has any legitimate interest – deserve attention from anyone monitoring a .io registration that may infringe their mark.

To prove a registrant has no legitimate interest in a .io domain, a complainant must satisfy all three UDRP elements under Paragraph 4(a), including a showing that the registrant cannot rely on any of the Paragraph 4(c) safe harbors: no bona fide offering before notice of the dispute, no common knowledge by the name, and no legitimate noncommercial or fair use. The 20-day response window and the roughly two-month case timeline are the same as for any UDRP proceeding at WIPO. The only remedies are transfer or cancellation.

This update covers what is changing, who is affected, and what to do now.

What Changed – and Why It Matters for .io

The .io zone has attracted a significant share of technology-sector registrations, and panels administering UDRP disputes over .io names have increasingly confronted a specific fact pattern: a registrant that points the domain at a generic or developer-facing landing page and asserts it was registered for a technology project, not to exploit the complainant's mark. That defense tracks the Paragraph 4(c)(i) safe harbor – a bona fide offering of goods or services before any notice of the dispute.

The emerging panel consensus is that the defense requires substance. A bare assertion of a planned project, without a credible business record, contemporaneous evidence of development activity, or some commercial presence predating the complainant's notice letter, is unlikely to carry the day. Panels have consistently held that self-serving statements alone do not satisfy the legitimate-interest inquiry. What has sharpened is the evidentiary bar: panels are looking for concrete corroboration, not just a plausible story.

This matters in .io specifically because the zone's association with the technology sector can tempt a respondent to offer a superficially credible developer narrative. Complainants must therefore be prepared to counter that narrative with evidence, not rely solely on the presumption that arises when they make out a prima facie case.

Who Is Affected?

Brand owners with technology-facing marks are most directly in scope. If a competitor or bad-faith actor has registered a .io domain that mirrors your brand – whether as an exact match, a typosquat, or a combination with a generic term – the legitimate-interest element is likely where the dispute is contested. A respondent who defaults loses the presumption of legitimate interest automatically. But a respondent who files a response and asserts a tech-project rationale forces the complainant to engage with that evidence on the merits.

Registrants who hold .io names for genuine development purposes are also affected. The tightened evidentiary expectations cut both ways. If your domain was registered in good faith – for a real project, with records to show it – the Paragraph 4(c) safe harbors remain fully available. Contemporaneous documentation of your project's scope and timeline is no longer optional. It is essential.

For an assessment of whether the three UDRP elements are met in your .io dispute, reach us at info@cognomenlaw.com.

What to Do Now

For complainants, the practical implication is evidence-first preparation. Before filing, document not just the trademark rights and the confusing similarity – the first Paragraph 4(a) element – but also the affirmative evidence that the registrant falls outside every Paragraph 4(c) safe harbor. A WHOIS or RDDS review showing no connection between the registrant's identity and the domain string, a review of the domain's content history, and a search for any credible business registration in the registrant's apparent jurisdiction are all relevant. The complainant bears the initial burden of making a prima facie case on the second element; that burden should be met with specifics.

For registrants, the message is preservation of records. If you hold a .io name for a legitimate project, gather and preserve all contemporaneous evidence now: incorporation records, development logs, communications with collaborators, and any public-facing evidence of the project predating any dispute notice. Waiting until a complaint arrives is waiting too long. The 20-day response window moves quickly, and a response built on real evidence is far stronger than one assembled under time pressure.

The right choice of forum also warrants attention. WIPO handles the large majority of .io disputes – as it does most UDRP proceedings. A single-member panel at WIPO carries a filing fee of USD 1,500 for up to five domains. Where the complainant anticipates a contested legitimate-interest defense, a three-member panel may offer greater confidence in the outcome, at a higher filing fee. We regularly advise clients on that forum-selection decision as part of pre-filing strategy.

In a recent matter – a .io cybersquatting complaint, early 2026, involving a technology brand whose name had been registered by a third party asserting a development project – we assembled the rebuttal evidence, demonstrated the absence of any credible project record, and secured a transfer order. The respondent's bare narrative did not survive scrutiny against documented evidence of the complainant's prior rights and the absence of any corroboration for the claimed project.

To weigh UDRP against a court action for your .io case, or to plan a respondent defense, email info@cognomenlaw.com.

Related at COGNOMEN

• UDRP Recovery – full service overview for gTLD and adopted-ccTLD disputes
• Recover a phishing domain under .me – UDRP procedure and evidence
• New gTLD launch protection – brand-owner options at zone opening