Prove a legitimate interest in your .co domain: what panels actually…

Prove a legitimate interest in your .co domain: what panels actually. UDRP and ccTLD domain recovery and defense across .co. Email the firm to assess your case.

A UDRP complaint lands on your .co domain. The complainant is a brand owner, the demand is transfer, and the clock is running. You registered the name legitimately — but can you prove it to a panel that has seen every excuse in the book?

To prove a legitimate interest in your .co domain under the UDRP, a registrant must satisfy at least one of the safe harbors in Paragraph 4(c) of the Policy: a bona fide offering of goods or services before notice of the dispute, being commonly known by the domain name, or legitimate noncommercial or fair use. The respondent has 20 days to file a response once the case commences. The burden of production — though not the legal burden of proof — shifts to the respondent once the complainant makes a prima facie showing.

This analysis covers the governing rules for .co disputes, how the three safe harbors function in practice, what evidence panels actually credit, where the consensus view ends and the contested ground begins, and when a finding of reverse domain name hijacking is realistic.

Why .co Disputes Run Under WIPO and the UDRP

The .co registry, operated on behalf of the Republic of Colombia, adopted the UDRP as its dispute-resolution mechanism, which means every element, every procedural rule, and every evidentiary standard that applies to a .com complaint applies equally to .co. There is no separate national Colombian procedure for most registrants. WIPO and the Forum are the available fora; WIPO handles the overwhelming majority of .co cases, so panel practice from the broader WIPO corpus governs the interpretive landscape here.

That procedural alignment matters. A registrant defending a .co complaint faces exactly the same three-element test as one defending a .com — confusing similarity to a mark, no legitimate interest, and registration and use in bad faith. All three must be established by the complainant. Fail any one element, and the complaint fails entirely. The legitimate-interest prong is the second of those elements, and it is frequently the battleground where a well-built defense wins.

We regularly advise registrants who assume that because .co "is not .com" it carries less risk. That assumption is wrong. Because the same UDRP rules apply, a complainant with a strong trademark portfolio can file against a .co with exactly the same confidence it would file against a .com. The zone is irrelevant to the Policy's legal standard.

What Paragraph 4(c) Actually Requires: The Three Safe Harbors

The UDRP does not require a registrant to have a registered trademark to defeat a complaint. Paragraph 4(c) sets out three circumstances that, if demonstrated, establish a legitimate interest — and the list is expressly non-exhaustive.

The first safe harbor — a bona fide offering of goods or services before notice of the dispute — is the most litigated. Panels look for a genuine commercial activity that predates the complainant's notice, not an activity engineered after the complaint was filed. What does "before notice" mean in practice? Most panels treat receipt of a cease-and-desist letter, a WHOIS inquiry from the complainant's counsel, or even a credible constructive-notice date (such as the filing date of the complainant's trademark) as triggering the notice bar. Launching a website the day after receiving a cease-and-desist demand does not satisfy this element.

The second safe harbor — being commonly known by the domain name — is narrower. It captures individuals, businesses, or organizations whose name or business identifier genuinely corresponds to the registered string. A registrant whose business has traded as "Cordoba Online" has a colorable argument for a domain containing that identifier, even without a registration. Evidence here includes trade filings, invoices, business cards, press coverage, and social-media account history — all predating the dispute.

The third safe harbor — legitimate noncommercial or fair use without intent to mislead or divert consumers — covers commentary, criticism, fan sites, and noncommercial hobby use. It does not protect a domain that sits parked at a pay-per-click page that profits from trademark-related search traffic. That is the line panels draw. A parked domain pointing at generic advertising is not "noncommercial" use in any credible sense.

How to Build the Legitimate-Interest Record Before and During a Dispute

A strong legitimate-interest defense is assembled long before the complaint arrives. The registrant who can produce contemporaneous evidence of pre-registration research, pre-registration business planning, and prompt post-registration commercial activity is in a fundamentally different position from one who registers a domain and parks it indefinitely.

What does "contemporaneous" mean? Panels are skeptical of evidence that appears to have been created in reaction to the threat of a complaint. A business plan dated a week before the response is filed carries less weight than one dated near the registration date. Email threads, domain-purchase records, development invoices, hosting bills, and prototype screenshots all carry dating metadata that panels can and do assess.

Several practical steps materially improve the record:

• Document the reason for registering the specific string at or near the time of registration — an internal memo, a board resolution, an email exchange with a developer.
• Deploy a genuine website within a reasonable period after registration. "Passive holding" is not automatically bad faith, but a completely dormant domain held for years with no development is harder to defend.
• Avoid domain strings that are hyphenated versions of famous marks, phonetic equivalents, or deliberate typosquats. Those fact patterns make Paragraph 4(c) arguments nearly impossible.
• Keep WHOIS data accurate and current. A registrant who uses privacy services or who has inaccurate contact information gives the complainant an additional factual ammunition point.
• If the domain was purchased in the aftermarket, obtain and preserve the transfer history and any due-diligence records made at the time of purchase.

If your .co domain is under threat and you need a read on whether your current record supports a Paragraph 4(c) defense, contact us at info@cognomenlaw.com.

What Evidence Panels Actually Credit — and What They Discount

Panel decisions across thousands of UDRP cases reveal consistent patterns in how evidence is weighed. Understanding those patterns is the analytical core of any respondent-side strategy.

Evidence that panels credit reliably includes: a developed website with genuine commercial or informational content that predates notice; third-party corroboration of the registrant's identity (news articles, social-media profiles, trade directories) using the domain string or a closely corresponding name; documentary evidence of a business plan or investment preceding registration; and correspondence with third parties — suppliers, customers, or developers — referencing the domain before any dispute arose.

Evidence that panels routinely discount includes: self-serving declarations filed only in the response with no corroboration; a website that mirrors the complainant's goods or services (raising confusion rather than defeating it); pay-per-click parking pages, even ones that do not target the complainant specifically; and registration histories showing a pattern of acquiring trademark-adjacent domain strings across multiple companies or industries.

There is a meaningful distinction — one that panels handle with some inconsistency — between a domain that was registered by someone in the domain-investment industry and one registered by an operating business. Professional domain investors can and do establish legitimate interests, but they face a higher evidential burden because the panel's instinct is to ask whether the acquisition was made with the trademark owner in mind. Evidence of independent descriptive value — that the string has a common dictionary meaning, a geographic reference, or an industry use wholly separate from the complainant's mark — is the best counter to that instinct.

In a recent matter (a .co domain dispute, spring 2025), we helped a registrant demonstrate that its acronym-based domain corresponded to a two-decade-old company name in a sector entirely unrelated to the complainant's goods. The complainant, a consumer brand with a similar acronym, had filed at WIPO. The response included corporate registration certificates, early-stage invoices, and a timeline of website development predating the complainant's trademark registration date by several years. The panel denied the complaint on the legitimate-interest element. The registrant kept the domain.

The Consensus View and the Contrary Position: Where Panels Disagree

On most Paragraph 4(c) questions, the UDRP panel consensus is reasonably stable. On a few, it is not.

The consensus view holds that a registrant who offers the domain for sale at a price clearly exceeding out-of-pocket registration costs demonstrates bad faith under Paragraph 4(b) and simultaneously undermines any Paragraph 4(c) argument. That position is well-settled and panels rarely deviate from it. A respondent who has sent an email offering to sell the domain for five or six figures to the trademark owner has a very difficult legitimate-interest argument to sustain.

The contested ground concerns "passive holding." The consensus is that passive holding — owning a domain, pointing it nowhere, and doing nothing with it — does not automatically constitute bad faith. But a vocal minority of panel decisions disagree, particularly where the mark is famous or the string has no plausible non-trademark use. For .co domains specifically, the zone's geographic and phonetic closeness to .com is a factor some panels invoke to heighten scrutiny of passive holding: the argument is that a registrant choosing .co for a string identical to a known mark is more likely anticipating confusion with the .com version of that mark. That reasoning is contested, but it appears in decided cases, and respondents should be aware of it.

A second area of tension is the "commonly known" harbor when the registrant is an individual, not a business. Panels generally accept personal-name claims where the evidence is strong. They are more skeptical when the personal name corresponds neatly to a well-known corporate brand — particularly if the registrant's claimed use of the name is hard to verify independently.

The minority view on registrant intent sometimes accepts that a domain was registered without the complainant in mind even where the string is confusingly similar to a mark, if the registrant can show a plausible independent reason for the choice — a geographic term, a common acronym, a descriptive phrase. Not all panels accept this reasoning; some hold that a highly distinctive mark, even if abbreviated, makes any non-trademark reading implausible. The lesson: the more distinctive the complainant's mark, the more compelling the independent-reason evidence needs to be.

When Is a Reverse Domain Name Hijacking Finding Realistic?

Reverse domain name hijacking (RDNH) is a formal finding by a UDRP panel that a complaint was brought in bad faith — essentially, to deprive a legitimate registrant of a domain the complainant could not have acquired on the merits. The finding carries no monetary penalty, but it is published, reputationally damaging for the complainant, and has become increasingly sought by well-advised respondents.

When do panels make RDNH findings? The cases fall into recognizable categories. The clearest is where the complainant knew, or should have known, that the registrant predated the mark — filing despite a domain registration date that precedes the trademark's first use is almost always RDNH territory if the respondent can prove it. A second clear category: where the complainant's mark is weak or descriptive and the domain's string has a plausible generic meaning, but the complaint frames the issue as if the mark were famous. A third: where the complaint omits material facts that the complainant's own counsel clearly knew — an earlier cease-and-desist exchange, a prior licensing discussion, or an earlier failed UDRP proceeding against the same domain.

RDNH is not available as a standalone remedy and is not an automatic consequence of losing. A respondent must actively seek it and must build the argument in the response. The elements to develop are: the complainant's actual or constructive knowledge that the registrant had a legitimate interest; the absence of any colorable bad-faith argument; and, ideally, evidence of the complainant's improper motive (competitive pressure, a failed acquisition negotiation, retaliatory filing after a licensing dispute).

We have pursued RDNH arguments in .co disputes and in parallel .com proceedings where the same complainant filed on both zones simultaneously. A finding in one proceeding does not bind the panel in the other — each case is decided on its own record — but the published RDNH finding in the first matter is available as persuasive context in the second.

If a complaint against your .co domain looks retaliatory or lacks a credible bad-faith argument, email info@cognomenlaw.com to assess whether an RDNH defense is viable.

Choosing the Forum: WIPO, the Forum, or Another Provider?

The choice of provider is the complainant's, not the respondent's. But understanding the forum's tendencies helps a respondent calibrate the response.

For .co domains, WIPO is the dominant provider. Its published filing fee for a single-domain, single-member panel complaint is USD 1,500. If the complainant requests a one-member panel and the respondent prefers a three-member panel — which a respondent may do — the parties generally split the higher three-member fee of USD 4,000. A three-member panel is often worth requesting where the case is close, the mark is descriptive, or the respondent has strong evidence but the single-panelist draw carries meaningful variance risk. Three-member panels also produce a more thorough written record, which matters if the decision is ultimately challenged or used in subsequent proceedings.

The Forum is available for .co disputes as well, with filing fees beginning around USD 1,300 for one to two domains. Forum panel practice on the legitimate-interest element is broadly consistent with WIPO's, though the Forum has at times shown slightly more tolerance for domain-investor arguments where the evidence of descriptive value is strong. The difference is marginal and unpredictable — it does not warrant a forum-shopping strategy — but a respondent building a descriptive-value argument should be aware that panel composition and forum culture are not entirely uniform.

One zone-comparison point merits attention. The .co UDRP standard — "registered and used in bad faith" — is cumulative. This is the standard UDRP formulation. It differs from the Nominet DRS for .uk domains, which reads "registered or used" abusively — a lower threshold for complainants. A brand owner who has filed a Nominet DRS complaint for a parallel .uk domain and a UDRP complaint for the .co should not assume the outcomes will align: the .uk complainant may succeed on "abusive use" even where the .co complainant cannot establish bad-faith registration in the first place. Registrants managing disputes on both zones simultaneously need to coordinate their defense strategies accordingly.

The .co Registrant's Cross-Zone Exposure: Managing Parallel Complaints

Brand owners who hold trademark registrations increasingly file simultaneously against a .co and the corresponding .com, .net, or regional ccTLD. The UDRP allows a single complaint to cover multiple domains, but only where the registrant of record is the same holder. Where the same registrant holds both the .co and a .com version, expect a consolidated complaint.

A consolidated complaint is more expensive for the complainant and more resource-intensive for the respondent, but it is adjudicated as one proceeding. The legitimate-interest record must cover both domains — separate deployment evidence for each, separate documentation of the registrant's identity and business, and a consistent narrative that does not contradict itself across the two zones.

In one recent matter (a consolidated .co and .com complaint, autumn 2025), a registrant faced a complainant who had acquired trademark rights after the domain registrations. The registration-predates-the-mark argument succeeded on both domains — but the panel required separate documentation of the registrant's business activity under each domain, because the sites had different content and slightly different audiences. Presenting a single unified set of evidence without differentiating by domain had left a gap the complainant's reply tried to exploit. The response fixed that gap by filing supplemental exhibits that the panel admitted under its procedural discretion. The complaint was denied. No RDNH finding was made, because the complainant had a colorable (if ultimately failed) argument that its mark predated at least one domain's last-renewal date.

The lesson: parallel complaints demand parallel evidence trails, presented with discipline and without contradiction.

What Happens After the Decision: Implementation and the Court Alternative

A UDRP panel that finds for the respondent leaves the domain with the registrant. The registrar is notified; no transfer occurs. The complainant may, within the standard waiting period, seek review in a court of competent jurisdiction — typically the court governing the registrant's domicile or the court identified in the registration agreement. That court can override the UDRP decision, though court challenges to UDRP decisions are comparatively rare and have a mixed record.

A UDRP panel that finds for the complainant orders transfer or cancellation, subject to a brief implementation period during which the registrant may seek a court stay. The registrant's strongest option at that stage is a court action in a jurisdiction that provides injunctive relief pending full trial. This route is expensive and time-sensitive. In our practice, we advise clients at the response stage whether a parallel court preservation strategy is worth preparing in the event of an adverse decision — not as an attempt to avoid the UDRP outcome, but as a genuine hedge where the underlying legal merits justify it and the domain has material business value.

For registrants operating under a ccTLD that does not use the UDRP — .de being the clearest example, where disputes go to the German courts and the DENIC DISPUTE entry blocks transfer during litigation — no such hybrid strategy is available. The court is both the first and final forum. We work with local litigation counsel in the relevant jurisdiction for any matter requiring national court action abroad.

Related at COGNOMEN

• Respondent defense and RDNH: protect your domain from abusive UDRP complaints
• Prove a legitimate interest in your .eu domain: panel standards and defense strategy
• How to file a UDRP complaint: a step-by-step guide for brand owners in cloud-sector disputes