Recover multiple .co domains in one UDRP complaint: what panels actua…

Recover multiple .co domains in one UDRP complaint: what panels actua. UDRP and ccTLD domain recovery and defense across .co. Email the firm to assess your cas…

A brand owner discovers five .co registrations, each a slight variation on its trademark – typosquats, hyphenated versions, and a plural – all held by the same registrant. One complaint, one filing fee, one timeline. That is the obvious move. But is it the right one, and what does a panel actually need to see before it will accept jurisdiction over the entire set?

Under the UDRP as applied to .co domains, a single complaint may cover multiple domain names, but only where all domains are registered to the same holder as identified in RDDS/WHOIS records. The complainant must still satisfy all three elements of Paragraph 4(a) as to each domain – confusing similarity, no legitimate interest, and registration and use in bad faith. The WIPO filing fee for a single-member panel covering up to five domains starts at USD 1,500, and a standard case resolves in roughly two months. Transfer or cancellation remain the only remedies.

This analysis covers the consolidation doctrine as panels apply it to .co, the evidence that decides whether multiple domains live or die together, the realistic risks of bundling, and the contrary view that panels sometimes take when the registrant challenges joinder.

Why .co follows the UDRP: the jurisdictional foundation

.co is the country-code top-level domain for Colombia, but it is administered under UDRP-compatible dispute rules that appoint WIPO and the Forum as competent providers. The practical result is that a complainant filing against a .co cybersquatter uses the same UDRP complaint form, the same three-element test, and the same panel appointment process as it would for a .com. That alignment is why we regularly advise brand owners to treat a portfolio of .co cybersquats as procedurally equivalent to a gTLD dispute – with one important caveat: the registry's current rules should always be confirmed, because ccTLD operators retain the right to modify their procedures. Assuming .co's UDRP incorporation without checking the current registry terms is an avoidable risk.

From an evidentiary standpoint, the .co zone presents a specific pattern. Because .co reads as a credible abbreviation for "company," "Colombia," or "commercial," registrants have used it to build confusion-by-design portfolios – multiple variants that collectively flood a brand's namespace. That pattern matters, because it is exactly the kind of systematic registration conduct that panels read as evidence of bad faith under Paragraph 4(b).

What does "same holder" actually mean when you recover multiple .co domains in one UDRP complaint?

The single-complaint consolidation rule rests on one condition: the domains must be registered to the same holder. That sounds simple. In practice, panels have developed a more textured analysis around what counts as "same" when a sophisticated cybersquatter uses privacy shields, multiple registrant names, or shell entities to obscure common control.

The threshold question is whether RDDS/WHOIS records, at the time of complaint, show a common registrant name and contact details. Where a privacy proxy is in place, panels look behind it. They consider whether IP addresses resolve to common infrastructure, whether registrar records were disclosed under the applicable registrar's UDRP rules, and whether behavioral evidence – identical parking-page templates, shared DNS, coordinated registration dates – supports an inference of single control. We have seen matters where a registrant used three nominally different names across a dozen .co domains, yet the panel consolidated them because the technical fingerprints were consistent.

The contrary view deserves acknowledgment. A minority of panels takes a strict textual position: if the RDDS record shows different registrant names, consolidation requires affirmative proof of common control, not circumstantial inference. A complainant who bundles domains across apparently distinct WHOIS entries risks a procedural objection that delays the case or requires severance of the non-matching registrations. The safer approach, where RDDS names diverge, is a targeted motion for consolidation with supporting technical evidence filed alongside the complaint – not left to the panel's discretion without a road map.

For a read on whether the three UDRP elements are met across your .co portfolio, reach us at info@cognomenlaw.com.

How do the three UDRP elements apply when multiple .co domains are at stake?

Each domain in a consolidated complaint must satisfy Paragraph 4(a) independently. A panel that finds a single domain lacks confusing similarity, or is otherwise clean, will ordinarily deny the complaint as to that name even while transferring the others. Bundling does not average out weak cases against strong ones.

Element one – confusing similarity. For each .co domain, the complainant shows that the second-level label (the part before ".co") is identical or confusingly similar to a trademark in which it holds rights. Typosquats – missing letters, transposed characters, added hyphens – consistently satisfy this element. Plurals and phonetic equivalents almost always do. The ".co" suffix is treated as a generic, non-distinctive element that neither saves nor condemns a registration, just as ".com" would be treated. Where a domain adds a descriptive term alongside the trademark ("brandsupportco.co"), the panel assesses whether the addition distinguishes the name or compounds the confusion. In our experience, generic additions such as "support," "shop," or "help" almost never break the confusing similarity finding.

Element two – no legitimate interest. In a multi-domain complaint, the respondent's failure to file a response to any one domain is generally treated as an admission as to that domain. Where a response is filed for some domains but not others, panels scrutinize the discrepancy. A registrant who can articulate a plausible legitimate use for one .co name and stays silent on four others invites a finding that the silent four were held without legitimate interest. We advise complainants to ensure the evidence package for each domain is self-contained – do not rely solely on a "no response" inference when affirmative bad-faith evidence is available.

Element three – bad faith registration and use. This is where the multi-domain complaint earns its strategic advantage. The simultaneous registration of multiple confusingly similar .co names by a single holder is itself a recognized pattern of abusive conduct under Paragraph 4(b)(ii), which treats registration to prevent a mark owner from reflecting its mark in a corresponding domain as bad faith – particularly where a pattern of such conduct is shown. A portfolio of five or ten .co variants is that pattern made visible. Panels have consistently held that a registrant who acquires multiple variants of the same trademark, with no apparent commercial purpose other than sale or disruption, cannot credibly claim good-faith registration across the entire set.

What evidence actually moves a panel in a consolidated .co complaint?

Evidence decides outcomes. The legal framework is settled; the facts are not. In a consolidated .co matter, the complainant who assembles a coherent, domain-by-domain evidence file wins faster and faces fewer surprises at the decision stage.

The foundational evidence layer is RDDS data: screenshots of current WHOIS records for each domain, showing registrant name, email, registrar, creation date, and the registrar's lock status. That data needs to be captured and dated on the same day, because registrants sometimes update details between the complaint filing and panel appointment. A moving WHOIS record becomes an argument, not a neutral fact.

The second layer is use evidence. What is each domain resolving to? A parking page with pay-per-click links to competitors satisfies bad faith under Paragraph 4(b)(iv). A blank page – no content, no obvious commercial use – requires a different argument: passive holding. Panels have accepted passive holding as bad faith where the domain is identical or closely similar to a well-known mark and the registrant offers no legitimate explanation. But passive holding doctrine is not automatic. The complainant must show that no plausible good-faith use of the name exists. In a .co context, that means addressing the abbreviation ambiguity head-on: yes, ".co" is plausibly a country code; no, a registrant who simultaneously holds ten typosquats of the same brand did not select each one for its geographic appeal.

The third layer is the registration narrative. When were the domains registered relative to the trademark's priority date? Were they registered shortly after a public announcement – a product launch, a company rebranding, an IPO – that would have put a knowledgeable registrant on notice of the mark? Coordinated registration dates across multiple .co names are powerful circumstantial evidence that the registrant acted with knowledge of the brand, which is a key predicate to a bad-faith finding. We have built complaints around a timeline that shows six .co domains registered within a 72-hour window immediately following a client's press release, with no competing explanation offered.

The fourth layer is the demand record. Has the registrant approached the brand owner, directly or through a broker, to sell the domains? A buy-back demand – especially one in excess of documented acquisition cost – is a textbook Paragraph 4(b)(i) bad-faith marker. Preserve every communication. Do not negotiate informally and then destroy the thread before filing.

Should you consolidate or file separate complaints? A decision framework

The consolidation question is not only procedural; it is strategic. Getting it wrong either overloads a winnable complaint with weak registrations or leaves transferable names out of scope.

Where all domains clearly share the same RDDS registrant, consolidation is almost always the right move. The WIPO filing fee for up to five domains on a single-member panel is USD 1,500 – the same as for a single domain. Including four additional registrations at no marginal forum cost, with one set of evidence and one timeline, is straightforward economics. The complainant takes slightly more care to make each domain's evidence self-contained, but the efficiency gain is significant.

Where RDDS registrant names diverge across the target domains, the decision is more nuanced. If common-control evidence is strong – shared infrastructure, coordinated registrations, consistent behavioral fingerprints – consolidation with an explicit common-control argument is still defensible. A well-prepared motion filed with the complaint reduces the risk of a procedural objection. If common-control evidence is thin or absent, separate complaints are safer. A denial of consolidation on a multi-domain complaint that should have been split is a filing fee and a timeline wasted, and it can signal to the panel that the complainant is overreaching.

Where the portfolio spans both .co and other zones – a mix of .com and .co registrations held by the same party, for example – the complainant must confirm that all zones are covered by a UDRP-compatible procedure before consolidating. A .co/.com complaint at WIPO will proceed if both are under UDRP jurisdiction. A .co/.de complaint is more complicated, because .de is not under UDRP; the .de name requires a separate German court action. We handle exactly this cross-zone complexity routinely, coordinating UDRP filings with local litigation counsel in the relevant jurisdiction for any names that sit outside UDRP reach.

The respondent's counter-moves and the RDNH risk

What happens when the registrant pushes back? Respondents in consolidated .co complaints have several available objections, and a well-advised complainant anticipates each one.

The most common objection is a challenge to common control: the respondent asserts that the domains are held by distinct entities and that consolidation is improper. The panel must then weigh the complainant's technical evidence of common control against the registrant's denial. This is a fact question. A complainant who files with only RDDS data – and nothing deeper – is vulnerable to a well-supported denial. Technical evidence (shared nameservers, shared IP ranges, matching contact data beyond the registrant name field) is essential insurance.

A second objection is a substantive challenge to one or more domains on legitimate-interest grounds. A registrant who holds a genuine prior right in one of the .co names – a business operating under that name before the trademark's priority date, for example – can invoke the Paragraph 4(c) safe harbors. In a consolidated complaint, a successful safe-harbor defense as to one domain does not defeat the complaint as to the others; each domain is assessed independently. But a partial success for the respondent complicates the complainant's narrative and can affect the panel's overall read of the respondent's conduct.

The RDNH risk is real. Reverse Domain Name Hijacking – a finding that the complaint was brought in bad faith to deprive a legitimate registrant – is available in any UDRP proceeding, including .co disputes. Panels find RDNH where a complainant files knowing that one or more respondent domains cannot plausibly satisfy the three-element test: the trademark postdates the registration, the registrant has a clear prior use, or the complaint is plainly designed to leverage the procedure as a litigation tactic rather than address genuine cybersquatting. In a consolidated complaint, including a domain that is clearly clean – a generic name, a descriptive phrase, or a name with an obvious legitimate registration story – is not merely a losing move on that domain. It is fuel for an RDNH argument across the whole complaint. We scrutinize each candidate domain before filing.

In a matter from autumn 2025 – a .co portfolio complaint covering eight typosquat variations of a European consumer brand – we assessed the full set before filing and recommended excluding two registrations where the registrant had a plausible descriptor defense. The remaining six transferred. The excluded two became separate monitoring targets.

To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

Timeline, costs, and the forum choice for .co UDRP complaints

A standard consolidated .co UDRP complaint at WIPO proceeds through five stages: complaint and formal compliance review, commencement and the 20-day response window, panel appointment, the decision, and finally registrar implementation of any transfer order. End to end, a straightforward case resolves in roughly two months. A three-member panel adds both time and cost but produces a more authoritative decision – relevant where the registrant is likely to mount a serious defense or where the marks are anything other than distinctive and well-known.

At WIPO, the filing fee for one to five domains on a single-member panel is USD 1,500. For six to ten domains, the single-member fee rises to USD 2,000. A three-member panel for one to five domains costs USD 4,000; for six to ten, USD 5,000. If the complainant requests a single panelist but the respondent elects a three-member panel, the parties generally split the higher fee. Legal fees for preparing a complaint are separate from the forum filing fee; in the market, a straightforward single-domain UDRP complaint typically falls in a range of roughly USD 3,000 to USD 7,000 in legal fees, with consolidated multi-domain complaints at the higher end of that range given the per-domain evidence work required.

The Forum is an alternative provider for .co where the registry rules recognize it. Its entry-level filing fee for one to two domains begins around USD 1,300. WIPO and the Forum together account for the vast majority of UDRP proceedings. The Czech Arbitration Court (CAC) has a lower entry point but lower utilization. For most .co complainants, WIPO is the natural default: it has the deepest panel pool and the most extensive published jurisprudence, which matters when the complainant wants a predictable outcome on a well-developed multi-domain complaint.

Cross-zone considerations: when .co is one piece of a larger portfolio problem

Brand owners rarely face a single-zone problem. A registrant who targets a brand in .co often holds parallel registrations in .com, .net, or new gTLDs. The consolidation principles discussed above apply within a single UDRP complaint; across zones, the analysis changes.

A combined .com and .co complaint at WIPO is procedurally straightforward where both zones operate under the UDRP and the registrant is the same holder. The same complaint covers both, the same evidence package applies, and the panel issues a single decision. In our practice, we have handled mixed-zone complaints where a registrant held the same trademark variant across four gTLD and ccTLD zones simultaneously. That breadth of registration is itself probative of a deliberate anti-brand strategy.

Where the portfolio includes a .de registration, a different calculus applies. .de does not operate under UDRP – disputes require action in the German courts, typically with a DENIC DISPUTE entry to prevent transfer during litigation. A brand owner facing a registrant who holds .co, .com, and .de variants of its mark must pursue parallel tracks: UDRP at WIPO for the UDRP-covered zones, and German court proceedings for .de, coordinated with local litigation counsel in Germany. Timing those tracks is important; a UDRP decision in the complainant's favor on .co and .com does not bind the German court, but it can be submitted as contextual evidence of the registrant's abusive pattern.

For new-gTLD variants held by the same registrant, the Uniform Rapid Suspension (URS) procedure offers an alternative where suspension rather than transfer is the goal. URS operates under a higher "clear and convincing" standard but at lower fees, and the result is suspension for the domain's registration term – not permanent transfer. In a portfolio cleanup context, URS is most useful for low-value new-gTLD variants where a rapid take-down is more important than ownership.

See also our analysis on using the URS to suspend domains in the finance sector and our guide to recovering a phishing domain in .biz, where many of the same evidentiary principles apply across zones.

What the minority view means for complainants: the contrary position on passive holding and portfolio complaints

Not every panel reads the evidence the same way. The consensus view – that a portfolio of typosquats by a single registrant satisfies bad faith under Paragraph 4(b)(ii) – is well-settled. But a minority strand in UDRP jurisprudence requires more than registration of multiple similar names. Those panels insist on affirmative evidence of use in bad faith: PPC links, a demand to sell, active confusion of internet users, or some conduct beyond the mere act of registering.

This minority approach has the most traction in passive-holding cases. Where every domain in a consolidated complaint resolves to a blank or under-construction page, and the registrant has never contacted the brand owner or made a demand, some panels decline to infer bad faith from silence alone. The majority view permits such an inference where the mark is well-known and no good-faith use is conceivable. The minority requires something more concrete.

The practical implication for a consolidated .co complaint is this: do not file on passive-holding evidence alone if the complainant's mark is not broadly famous or if there is any colorable argument that the registrant could have a legitimate reason to hold the name. The safer filing is one that combines registration-pattern evidence (dates, coordination, volume), use evidence (even thin PPC activity qualifies), and if available, a communication or demand record. That triple-layer approach satisfies both the majority and minority standards and leaves no gap for a panel inclined toward the stricter view.

Is the minority approach growing? In our observation, the trend runs toward the majority consensus, particularly for obvious typosquat portfolios. The minority position is most visible in cases involving generic or descriptive domain names where the mark's distinctiveness is contested. For a portfolio of .co typosquats of a strong, distinctive brand, the consensus view is almost always applied. But "almost always" is not "guaranteed" – and the facts of each domain in the complaint remain the controlling variable.

Related at COGNOMEN

• UDRP domain recovery service – assess the three elements, assemble evidence, select the forum, and file
• Guide: recovering a phishing domain in .biz – cross-zone evidentiary principles
• Guide: suspending a domain through URS in the finance sector – the rapid-suspension alternative