Recover multiple .io domains in one UDRP complaint: what panels actua…

Recover multiple .io domains in one UDRP complaint: what panels actua. UDRP and ccTLD domain recovery and defense across .io. Email the firm to assess your cas…

A technology-sector brand owner discovers, in the space of a single afternoon, that a stranger has registered not one but a dozen .io variations of its name — some typosquats, some with generic additions like "app" or "cloud," all pointing at placeholder pages or worse. The instinct is to file one complaint and recover all of them at once. The question is whether that is actually possible, and what conditions a UDRP panel will insist upon before it agrees to hear them together.

To recover multiple .io domains in one UDRP complaint, the same registrant must hold every domain in the filing — that is the single explicit requirement under the UDRP Rules, which permit a complaint covering more than one domain where the holder is the same person. WIPO administers .io under its UDRP-based procedure, so the same three-element test of Paragraph 4(a) applies: confusing similarity to a mark, no legitimate interest in the registrant, and registration plus use in bad faith. Beyond the single-holder rule, panels have developed a broader body of practice around when joint filings are properly brought and how bad faith is assessed across a portfolio of registrations.

This analysis covers how the single-holder rule operates in practice, the evidence patterns that decide multi-domain complaints on the .io zone, the consensus and minority panel approaches, and the realistic next step for a brand owner or counsel preparing a filing.

Why .io falls under the UDRP — and what that means for a multi-domain filing

The .io zone is the country-code top-level domain assigned to the British Indian Ocean Territory, but it has been adopted widely as a domain of choice in the technology sector. Critically for brand owners, WIPO has been appointed as a dispute-resolution provider for .io, meaning that .io registrations are subject to a UDRP-based procedure rather than a bespoke national ccTLD process.

That appointment matters enormously. A brand owner who has recovered a .com under the UDRP is largely on familiar ground when pursuing .io domains: the same three elements of Paragraph 4(a) apply, the same 20-day response window runs from commencement, and the only available remedies remain transfer or cancellation. There are no damages, no costs awards, and no injunctive relief. The governing rules are the UDRP and the WIPO Supplemental Rules, not a separate national statute or ccTLD-specific procedure.

Where the .io context introduces nuance is in the multi-domain scenario. Because .io has attracted heavy investment from startups and technology companies, it is not uncommon for opportunistic registrants to take a portfolio approach — registering multiple variants of a target brand across one or more zones simultaneously. That behaviour is precisely the fact pattern that the UDRP's multi-domain provisions are designed to address, and panels have developed consistent guidance on how far a single complaint can reach.

In our practice, we regularly advise brand owners in the technology sector who face exactly this situation: a cluster of .io registrations, often combined with matching .com or .co registrations, all held by the same registrant or a set of registrants whose relationship needs to be established before the forum is chosen and the complaint is structured.

What is the single-holder rule, and how strictly do panels apply it?

The single-holder rule — drawn from the UDRP Rules — permits a complaint to cover multiple domains only where those domains are registered by the same domain-name holder. Panels apply this requirement strictly as a threshold matter. A complaint that names domains held by different registrants will typically be rejected or split, requiring the complainant to file separate proceedings.

In practice the rule raises three distinct problems. First, the relevant "holder" for UDRP purposes is the registrant of record in the WHOIS/RDDS data at the time of filing. Where a registrant uses privacy or proxy services — common on .io — the complainant must pierce that veil before or during the complaint, relying on WHOIS history, passive DNS data, and registrar disclosures.

Second, a sophisticated cybersquatter may deliberately spread registrations across several nominal registrant names — different email addresses, different street addresses — while controlling all accounts from a single operation. Panels have recognized this problem. The consensus view is that a complainant may consolidate domains held by nominally different registrants where the evidence demonstrates a common control — meaning the same individual or enterprise is the effective holder of all contested names. Evidence panels have found persuasive includes shared registration dates, shared nameservers, overlapping IP-address histories, identical monetization templates, and a demonstrable pattern of targeting the same brand family.

Third, there is a minority panel position that applies a more demanding standard: where the nominal registrant information is materially different and the complainant's evidence of common control is circumstantial, some panels have declined consolidation and required separate filings. That minority view creates a real risk for a complainant who files a combined complaint based on thin evidence of common control. If the panel declines to consolidate, the complaint may be dismissed as improperly filed, with the filing fee forfeited and the clock reset. Structuring the evidence of common control carefully is therefore not a procedural formality — it is a strategic decision.

For an assessment of whether your cluster of .io registrations can be consolidated in a single UDRP complaint, contact info@cognomenlaw.com.

How are the three UDRP elements applied across a portfolio of .io domains?

Once the threshold single-holder issue is resolved, a panel hearing a multi-domain .io complaint must still find that all three elements of Paragraph 4(a) are satisfied — and it must find them satisfied for each domain in the complaint, not just in the aggregate.

Element one — confusing similarity is generally the most straightforward limb in a portfolio complaint. Each domain is assessed against the complainant's mark individually. Where the portfolio consists of typosquats, the analysis is simple: transposition of two letters in a mark is confusingly similar, as is addition of a generic term such as "app" or "cloud." Where the portfolio also includes domains that combine the mark with a competitor's name or a geographic identifier, the analysis becomes more granular. Panels look at whether the dominant or distinctive element of the domain corresponds to the mark and whether the additions reduce rather than eliminate the confusing similarity.

Element two — no legitimate interest requires the complainant to make a prima facie case, after which the burden effectively shifts to the registrant to demonstrate a safe harbor under Paragraph 4(c). In a portfolio complaint the complainant's task is to show — for each domain or at least across the portfolio collectively — that the registrant was not making a bona fide offering of goods or services, was not commonly known by the domain names, and was not engaged in legitimate noncommercial or fair use. Where all domains in the portfolio are parked, all redirect to a common monetization platform, or all resolve to the same pay-per-click page, the inference of no legitimate interest across the portfolio is straightforward. The harder case arises where some domains in the portfolio point at arguably descriptive content and others are clearly parked — panels have occasionally declined to find element two satisfied for the descriptive-content domains while transferring the remainder.

Element three — registration and use in bad faith is where the multi-domain context provides the most powerful evidence. Registration of a portfolio of domains incorporating the same mark, often on or around the same date, is itself a strong indicator of bad faith. Panels have consistently held that a pattern of registrations targeting a single brand owner satisfies the Paragraph 4(b) bad-faith factor relating to a pattern of conduct. The co-registration date evidence — showing that a registrant acquired several .io variants of the same mark within days of each other — is the kind of fact that is difficult to explain away as coincidence. In autumn 2025, we successfully structured a multi-domain .io complaint around exactly this co-registration pattern: a technology-sector complainant demonstrated that approximately eight domain variants were registered within a 72-hour window shortly after the complainant's product launch was announced publicly. The panel found bad faith as to all eight domains without separate analysis of each use.

What evidence decides a multi-domain .io complaint, and where does the contrary view arise?

The evidence architecture for a multi-domain complaint differs from a single-domain filing in important ways. A single-domain complaint rises or falls on the specific facts of that one registration. A multi-domain complaint can benefit from cumulative evidence — a pattern that, taken together, is more compelling than any one domain alone — but it can also be undone by one weak domain dragging down the others if the panel insists on domain-by-domain analysis.

The evidence categories that carry the most weight in the .io multi-domain context are: (a) trademark registration history showing that the complainant's mark predates all the contested registrations; (b) co-registration dates demonstrating a coordinated campaign rather than separate independent decisions; (c) WHOIS and passive DNS evidence linking all domains to a common registrant or common infrastructure; (d) identical or near-identical monetization templates across all domains, showing commercial gain from confusion; and (e) any prior communication from the registrant offering to sell one or more of the domains to the complainant or a competitor.

The contrary view in multi-domain complaints emerges most sharply at element three. A minority of panels has held that passive holding — that is, a domain that resolves to nothing, carries no active content, and generates no evident revenue — cannot satisfy the "use in bad faith" limb of element three, even where the registration clearly targeted the complainant's mark. The consensus approach, which the large majority of panels follows, is that passive holding by a registrant with no plausible legitimate use is itself bad faith, particularly where the mark is well-known or distinctive, the registrant cannot have been unaware of it, and no credible explanation for the registration has been offered. Brand owners filing multi-domain .io complaints where some domains are passively held should anticipate the passive-holding argument and prepare evidence rebutting it: the distinctiveness of the mark, the registrant's awareness at the time of registration, and the absence of any plausible legitimate purpose are the three anchors.

A further split in panel practice concerns the treatment of generic additions in element one. Some panels take a lenient view — that any domain incorporating the complainant's mark as its dominant element is confusingly similar regardless of what is appended — while others require a more careful assessment of whether the addition is genuinely descriptive of the domain's content, potentially creating a colorable fair-use argument. On .io, where additions like "dev," "api," "cloud," and "app" are endemic in the technology sector, this distinction matters. A complainant facing a portfolio that includes several "mark + tech-generic" combinations should address the fair-use question directly rather than relying on the leniency of the element-one standard alone.

If a prior filing or response produced a bad outcome, a focused second read can find the element that was missed. To discuss a multi-domain .io complaint that is under-performing, email info@cognomenlaw.com.

What does the process and timeline look like for a multi-domain .io filing?

A multi-domain UDRP complaint at WIPO follows the same five-stage structure as a single-domain filing: complaint → response → panel appointment → decision → registrar implementation. The timeline, however, can extend when the complaint is more complex or when a three-member panel is warranted.

At the filing stage, the complainant submits a complaint covering all contested domains, identifies each registrant of record, and pays the applicable WIPO filing fee. For a portfolio of one to five domains, the standard single-member fee is USD 1,500; for six to ten domains, it rises to USD 2,000. For portfolios above ten domains, WIPO quotes a fee on application. If the registrant requests a three-member panel in response, the three-member fee for up to five domains is USD 4,000, with the parties generally splitting the differential between the single-member and three-member rates.

The respondent has 20 days from commencement to file a response. Where no response is filed — a common outcome in mass-registration cybersquatting campaigns — the panel decides on the papers alone, typically resulting in a faster decision. A standard case runs approximately two months from filing to a transfer or cancellation order. Multi-domain complaints with actively defended responses, or complaints where consolidation is contested, can run longer.

WIPO's expedited option — delivering a decision within about one month — is available for single-panel cases covering up to five domains. For a brand owner facing active abuse of multiple .io domains (for example, a registrant redirecting traffic or soliciting customers), the expedited route is worth considering where the portfolio falls within the five-domain ceiling.

After the decision, implementation falls to the registrar. For .io, the relevant registry authority processes the transfer or cancellation order consistent with the panel's direction. Implementation is typically completed within a matter of days after the decision becomes final.

How does recovering multiple .io domains compare to a court or alternative route?

The choice between the UDRP and alternative routes for a multi-domain .io problem turns on the remedy sought, the number of domains, and the registrant's apparent jurisdiction.

If the goal is transfer and the domains are all .io, the UDRP at WIPO is the natural path. It is faster than court litigation, cheaper at the official filing level, and the remedy — transfer — is exactly what a brand owner needs. The limitation is that the UDRP provides no damages. A registrant who ran a phishing campaign or diverted customers cannot be made to pay monetarily through the UDRP alone.

Where the registrant appears to be located in a jurisdiction where US anticybersquatting litigation is accessible, and where the value of the domains or the scope of the harm justifies the cost and complexity of court proceedings, US anticybersquatting litigation offers the only route to monetary damages and, in egregious cases, statutory damages per domain. That route is substantially more expensive and slower, but it is the appropriate tool when the brand owner's objective extends beyond recovery of the domain names themselves.

A brand owner holding a portfolio that spans both .io and .com registrations by the same registrant has a further structural choice: consolidate all zones in a single UDRP complaint, or file separate complaints. The single-holder rule permits multi-zone consolidation — there is no requirement that all domains share the same TLD extension. A complaint naming five .com domains and three .io domains held by the same registrant is procedurally permissible. The advantage of consolidation across zones is efficiency and coherence: the panel sees the full pattern of conduct in a single proceeding. The disadvantage is that if any domain in the complaint is problematic — for example, a .com that was registered years before the mark — that weakness can create procedural complications or invite the panel to scrutinize the entire filing more carefully.

In a recent matter (winter 2025), we advised a technology company that held a registered mark and faced six .io domains and four .com domains all registered by the same entity within a three-week window following the company's Series B announcement. We filed a consolidated UDRP complaint at WIPO covering all ten domains. The panel transferred all ten, finding that the co-registration timing and the identical monetization infrastructure across all domains demonstrated bad faith without requiring separate bad-faith analysis for each extension.

What fact patterns have led panels to deny a multi-domain .io complaint?

Understanding where multi-domain complaints fail is as important as knowing how they succeed. Panel denials in multi-domain contexts tend to cluster around four fact patterns, all of which can be avoided with careful preparation.

The first is the consolidation failure: the complainant names domains whose registrants, on the evidence presented, cannot be shown to share a common controller. Where one domain is registered to a named company and another to an anonymous privacy service with a different registrar, and the complainant's only consolidation argument is that both target the same mark, most panels have declined to consolidate. The remedy is to build the common-control evidence before filing — not to rely on the panel to infer it.

The second denial pattern arises from a failure at element one for one or more domains in the portfolio. Where a domain combines the complainant's mark with a highly generic term that the panel regards as descriptive — and the domain's content, or lack of content, supports a descriptive reading — some panels have declined to find confusing similarity or have found that the addition neutralizes the confusion. This is more common in .io than in .com precisely because "tech-generic" additions carry real descriptive weight in the technology sector.

The third failure mode is a legitimate-interest finding for one domain. Where a registrant can demonstrate — even for a single domain in the portfolio — that it was making a bona fide offering before notice of the dispute, that finding can complicate the overall complaint, particularly if the complainant's bad-faith narrative rests on the uniformity of the registrant's conduct across all domains. Experienced respondents sometimes sacrifice one domain to establish a legitimate-interest precedent within the proceeding that colors the panel's view of the others.

The fourth pattern is the most avoidable: a complaint drafted at too high a level of generality, treating all domains as interchangeable and failing to address each one individually. Even where panels take a portfolio-level view of bad faith, they typically require at least a threshold domain-by-domain analysis at elements one and two. A complaint that asserts "all domains are confusingly similar for the same reasons" without domain-specific analysis gives the panel less to work with and the respondent an easy target.

What does the complainant's evidence package look like in practice?

A well-structured multi-domain .io complaint presents its evidence in two layers. The first layer addresses each individual domain in sequence — confusing similarity, no legitimate interest, bad faith — with domain-specific facts. The second layer presents the cross-domain evidence: the co-registration dates, the shared infrastructure, the common monetization pattern, and any direct communications from the registrant. The two layers reinforce each other. The per-domain analysis establishes the baseline; the cross-domain evidence elevates the bad-faith finding from a per-domain inference to a pattern-of-conduct finding under Paragraph 4(b).

The documentary record typically includes: certified screenshots of each domain's resolving content, taken as close to the filing date as possible; WHOIS/RDDS printouts for each domain; passive DNS records linking all domains to shared nameservers or IP ranges; trademark registration certificates predating all contested registrations; and any screen-captured offers to sell, demand letters, or communications from the registrant. Where the .io domains redirect to a single landing page, a single screenshot captures the bad-faith use for all domains simultaneously — a practical advantage of the portfolio configuration over a single isolated domain.

We have consistently found that panels respond well to a complaint that presents a timeline — visually or narratively — showing the sequence of events: the complainant's mark establishment, the product launch or public announcement that preceded the bulk registration, the registration dates for each domain, and the complainant's date of discovery. That timeline converts what could appear to be a sprawling multi-party filing into a coherent narrative of targeted opportunism.

Should a complainant request a three-member panel for a multi-domain .io filing?

Requesting a three-member panel increases the WIPO filing fee — from USD 1,500 to USD 4,000 for up to five domains — but in certain multi-domain situations the investment is justified. Three-member panels are generally warranted where the complaint presents novel consolidation questions, where the registrant is likely to actively defend, or where the case presents split panel practice (such as the passive-holding or common-control questions discussed above) and the complainant benefits from a majority decision rather than a single panelist's view.

For a straightforward portfolio of parked typosquats — all held by the same named registrant, all using identical templates, all registered after a well-known mark was established — a single panelist is typically sufficient and faster. The three-member option adds cost and time without proportionate benefit where the facts are strong and the law is settled.

The calculus shifts where the registrant is sophisticated. A registrant who has previously been the subject of a UDRP complaint and who has filed substantive responses in those proceedings — traceable through published WIPO decisions — is more likely to mount a serious defense. In that situation, a three-member panel provides a better hedge against a single panelist's idiosyncratic application of the minority view on passive holding or consolidation. The strategic decision of single versus three-member is one of the first we work through with a client assembling a multi-domain .io complaint.

Related at COGNOMEN

• UDRP domain recovery: how we assess the three elements and select the forum for your complaint
• Step-by-step guide to filing a UDRP complaint for app and technology-sector domains
• How to suspend a new gTLD domain through URS when speed matters in tech disputes