Recover a .io domain held passively in bad faith: what panels actuall…

Recover a .io domain held passively in bad faith: what panels actuall. UDRP and ccTLD domain recovery and defense across .io. Email the firm to assess your cas…

A technology brand discovers its name registered as a .io by a stranger. The domain resolves to nothing — no website, no redirect, no email activity. Just a parked placeholder, held quietly, waiting. Is that passive holding enough to satisfy the bad-faith element of the UDRP? And can the brand recover the .io through the same complaint route it would use for a .com?

To recover a .io domain held passively in bad faith, a complainant must prove all three elements of Paragraph 4(a) of the UDRP: confusing similarity to a trademark, no legitimate interest on the registrant's side, and registration and use in bad faith. The .io zone operates under the UDRP through WIPO and other accredited providers, making the standard complaint route available. A case typically runs about two months, with the registrant given 20 days to respond. The only remedies are transfer or cancellation — no damages, no costs.

This analysis covers the passive-holding doctrine in full: the consensus view, the contrary positions, the evidence that tips a case either way, and the realistic path for a brand owner whose .io sits dark.

Why .io falls under the UDRP — and what that means for your claim

The .io country-code top-level domain is technically the ccTLD for the British Indian Ocean Territory, but its global adoption as a domain of choice for technology companies means it is treated, commercially and legally, much like a gTLD. Its registry has incorporated the UDRP into its dispute-resolution framework, so a complaint at WIPO or another accredited provider proceeds under the same Policy that governs .com. That alignment matters: it means the full body of UDRP precedent on passive holding applies directly to a .io dispute.

The practical implications are significant. First, a complainant with a registered trademark — or, in some cases, unregistered rights established through genuine use — can file a UDRP complaint against a .io registrant before WIPO just as it would for a .com. Second, the standard timeline of roughly two months from filing to decision applies. Third, the remedies are identical: transfer or cancellation, nothing more. There is no separate national administrative regime to navigate, no eligibility requirement tied to residency in the British Indian Ocean Territory, and no ccTLD-specific evidentiary standard imported from a local law. The UDRP runs its course.

One nuance deserves attention. The .io registry has, at various points, been subject to commercial and policy transitions. A complainant should confirm the current registry rules with counsel before filing, because registry-level policy can affect implementation of a transfer order even when the UDRP decision itself is straightforward. That verification step costs nothing but can save weeks of post-decision delay.

What is passive holding — and why does it complicate the bad-faith element?

Passive holding is the practice of registering a domain and then doing nothing visible with it: no website, no email, no monetization, no public content. Under Paragraph 4(a)(iii) of the UDRP, the complainant must show the domain was registered and is being used in bad faith. The conjunction matters. On a literal reading, a domain that is merely held — with no active conduct — could be argued not to be "used" at all, and therefore not to satisfy the element.

Panels confronted this argument early in the UDRP's history and the consensus answer has been firmly settled for more than two decades: passive holding can constitute use in bad faith where the surrounding circumstances make it implausible that the registrant could ever make any legitimate use of the domain. The question is not whether there is active conduct. It is whether the totality of circumstances — including the nature of the mark, the registrant's apparent knowledge at the time of registration, and the implausibility of legitimate use — supports a bad-faith finding.

This is the passive-holding doctrine. It does not lower the standard for bad faith; it relocates the analysis. Instead of asking "what is the registrant doing with the domain?" panels ask "is there any plausible legitimate explanation for the registration?" When the answer is no, bad faith is inferred.

The doctrine originated with generic top-level domains and has been consistently applied by panels in .io cases, given that .io operates under the same UDRP. A complainant relying on passive holding must still build the circumstantial record carefully — the doctrine is not a shortcut, it is a different route to the same threshold.

What factors do panels weigh when assessing passive holding in .io cases?

No single factor decides a passive-holding case. Panels look at the constellation of circumstances and ask whether, taken together, they make legitimate use implausible. The following factors recur most consistently in the decisions we have reviewed and in our practice advising complainants facing silent registrants.

Strength and distinctiveness of the mark. A highly distinctive, coined mark — a term with no generic meaning in any language — weighs heavily toward bad faith. When a registrant acquires a domain matching a coined trademark and then does nothing with it, the inference that it was registered to exploit that mark is difficult to rebut. Generic or descriptive terms require much more from the complainant, because legitimate explanations for the registration multiply.

The registrant's awareness at the time of registration. If the mark was well-established, widely advertised, or prominently identified with the complainant in the technology sector — exactly the sector where .io domains are concentrated — panels typically find it implausible that the registrant was unaware of it. This is especially true where the domain reproduces the mark exactly or adds only a generic term.

No response or implausible explanation. A registrant who defaults or who provides no credible explanation for the registration leaves the circumstantial record uncontested. Panels regularly note that failure to respond, combined with a strong mark, can tip the scales toward transfer. That is not a guarantee — some panels have denied complaints even on default where the complainant's own case was thin — but it is a recurring feature of successful passive-holding complaints.

Prior use of similar domains abusively. Evidence that the same registrant holds other domains matching other trademarks, or that the domain was briefly pointed at a competing or phishing site before going dark, strengthens the case materially. A pattern of registration, even if the current status is passive, is an independent bad-faith circumstance under Paragraph 4(b).

The timing of registration relative to trademark priority. A domain registered immediately following a product launch, a funding announcement, or a trademark application filing creates a circumstantial narrative that is difficult to explain innocently. We regularly advise clients to document the timeline precisely for this reason.

Where do panels disagree — and what is the minority position?

The consensus holds, but it is not universal. A minority strand of panel reasoning applies the passive-holding doctrine more cautiously, particularly where the complainant's trademark rights are not clear-cut, where the mark has descriptive or generic elements, or where the domain was registered before the mark acquired distinctiveness.

What does that minority position look like in practice? In cases where the disputed term has an obvious generic meaning — particularly in the technology sector, where acronyms and common vocabulary terms are widely used as .io domains — some panels decline to infer bad faith from silence alone. They reason that the passive holding could reflect an investor waiting to develop a project around the generic term rather than exploiting the complainant's mark. Under this view, the complainant must adduce something more: evidence of a prior approach, evidence the registrant knew of the mark specifically, or evidence that the domain was briefly active in a way inconsistent with any legitimate purpose.

There is also a divergence on the question of what a complainant must show to establish that the registrant had no legitimate interest under Paragraph 4(a)(ii). The consensus approach requires the complainant to make a prima facie showing, after which the burden shifts to the registrant to rebut. A minority of panels apply the burden more strictly, requiring the complainant to affirmatively negate any possible legitimate interest rather than simply alleging the negative. This matters in passive-holding cases because the very absence of visible use makes both sides of the legitimate-interest inquiry thin.

The practical consequence: a complainant in a .io passive-holding case must draft the complaint as if it will be decided by a skeptical panel applying the stricter view. That means building the affirmative bad-faith case — circumstantial evidence, timeline, mark strength, registrant history — rather than relying solely on the absence of a response.

For a read on whether the three UDRP elements are met in your .io matter, reach us at info@cognomenlaw.com.

How does the legitimate-interest element work in a silent-registrant case?

Establishing the absence of legitimate interest under Paragraph 4(a)(ii) is structurally the most delicate element in a passive-holding complaint, precisely because silence cuts both ways. The registrant has offered no explanation — which supports the complainant — but has also offered no damaging admissions or visible monetization that would make the case easy.

The three safe harbors under Paragraph 4(c) of the UDRP are: use of the domain in connection with a bona fide offering of goods or services before notice of the dispute; the registrant being commonly known by the domain name; and legitimate noncommercial or fair use without intent to mislead. A passive registration, by definition, satisfies none of these on its face. No offering, no apparent use, no known association. A complainant can make the prima facie showing by demonstrating that the registrant has no trademark rights in the name, no apparent business under that name, and no license from the complainant.

But panels have occasionally found that a respondent who provides a credible post-complaint explanation — for example, that the domain was acquired as part of a domain portfolio reflecting a geographic or technical term used in the registrant's business — can rescue the legitimate-interest element even after default. This is uncommon, but it illustrates why the complainant's showing on this element should be positive and specific, not merely a recitation of what the registrant has failed to do.

In our practice, we advise complainants to run a prior-use investigation before filing. Has the domain ever resolved? Has it been associated with any social media handle or business registration? Is the registrant identifiable in RDDS data (formerly WHOIS) as a trademark holder or as a professional domain investor? Each data point shapes the argument on legitimate interest and anticipates the rebuttal a default registrant might offer if it enters the proceeding late.

What does the three-element case look like built out — a worked example?

In a recent matter (a .io domain exactly matching a coined software-as-a-service mark, spring 2025), we prepared a UDRP complaint for a technology brand whose name had been registered by an unrelated party some months after the brand's product launch. The registrant had never pointed the domain at any content. No email records were found. The RDDS record listed a privacy proxy.

The similarity element was straightforward: the domain reproduced the mark exactly, without additional terms or variation. We addressed it in a single well-documented section with certified trademark registration certificates and priority evidence.

On legitimate interest, we submitted: a trademark search confirming no registered rights held by the registrant in the mark or anything similar; a screenshot archive confirming the domain had never resolved to any content; and a corporate registry search confirming no business entity associated with the registrant operated under the brand name. No bona fide offering, no known identity, no use. The prima facie case was made.

On bad faith, we built the circumstantial narrative: the mark's coined character, the timing of registration relative to the product launch, the concentration of the complainant's customers in the technology sector most closely associated with .io domains, and the complete absence of any plausible innocent explanation. The registrant did not respond. The panel transferred the domain roughly eight weeks after the complaint was filed.

A second matter from the same period (also a .io, summer 2025) reached a different result at the preliminary assessment stage: the mark in that case contained a two-letter acronym with multiple common meanings in the software industry. We advised the complainant that the passive-holding doctrine would be insufficient without additional evidence of the registrant's awareness, and that the weaker distinctiveness of the mark required a different investigative angle before filing. The complainant ultimately decided to wait for a triggering event before proceeding — the right choice on those facts.

How does a .io passive-holding case compare to the same dispute across other zones?

The right zone comparison matters because it shapes both strategy and expectations. Three main scenarios arise in practice.

If the same registrant holds both the .io and the .com, a complainant can often cover both domains in a single UDRP complaint, provided the registrant of record is the same holder. That saves a forum filing fee and aligns the factual record across both zones. The WIPO filing fee for a single-panel complaint covering up to five domains starts at USD 1,500 — the same as for a single domain — making multi-domain filings economically efficient where the registrant is consistent.

If the infringing presence is a .uk or a .eu rather than a .io, the governing procedure changes materially. A .uk domain dispute goes through the Nominet DRS, which uses a different test: "abusive registration," under which the complainant shows rights in a name and registration or use that takes unfair advantage of or is unfairly detrimental to those rights. Critically, the Nominet test reads "registered or used" abusively — a lower cumulative bar than the UDRP's "registered and used in bad faith." For a passive holding, that difference can be significant: a passive registration under the Nominet DRS may more readily satisfy the abusive-registration test without requiring the full circumstantial record the UDRP demands.

For a .eu domain, the EURid/ADR.eu procedure applies, with its own eligibility requirements and a remedy that may be transfer or revocation depending on whether the complainant meets EU/EEA nexus requirements.

If the domain in question is a .de, neither the UDRP nor any administrative procedure reaches it: German court proceedings are the route, with a DENIC DISPUTE entry available to block transfer while the litigation proceeds. That is a substantially longer and more costly path than a UDRP complaint — an important consideration for a brand deciding where to concentrate resources.

For a new gTLD (such as .tech or .app), URS is available as a faster-track suspension remedy where the evidentiary standard is higher ("clear and convincing") but the cost is lower than UDRP. URS suspends rather than transfers, however — ownership does not move, and the suspension runs only through the registration term. Where the complainant wants the name transferred rather than merely taken offline, UDRP remains the correct route regardless of zone.

To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

What evidence do you actually need to file — and what breaks a complaint before it starts?

A complaint that fails at the evidence-assembly stage wastes both the filing fee and the element of surprise. Panels reviewing a passive-holding complaint look for a specific evidentiary structure, and a complaint that skips a category is vulnerable even on default.

The core documentary record for a .io passive-holding complaint should include:

• Certified trademark registration certificates or, for unregistered rights, extensive evidence of use establishing secondary meaning — sales figures, media coverage, consumer recognition materials — ideally predating the domain registration by a clear margin.
• A timestamped screenshot archive of the domain's resolution history, showing the domain has never served legitimate content. Tools that archive historical DNS and page-resolution data are useful here; their output should be submitted with a declaration of accuracy.
• RDDS / WHOIS records showing the registrant's identity, registration date, and any use of a privacy proxy. Where a proxy is in place, the complaint triggers registrar disclosure procedures that typically produce the underlying registrant's identity before the response deadline.
• A corporate and trademark registry search in the registrant's apparent jurisdiction confirming no rights in the mark or related term.
• Any evidence of communications: an unsolicited approach from the registrant offering to sell, a broker inquiry, or a demand letter. Even one such communication moves a passive case significantly toward the Paragraph 4(b)(i) bad-faith circumstance — registration to sell to the mark owner at a premium.
• Timing evidence: the date of the complainant's product launch, trademark filing, or significant publicity event, cross-referenced to the domain's registration date. A registration made days after a public announcement is a fact pattern panels notice.

What breaks a complaint before it starts? Three failure modes recur in our practice. First, a complainant who files before the trademark is registered — and has not assembled sufficient unregistered-rights evidence — hands the registrant a factual defense on element one that could otherwise have been avoided by waiting or by preparing the unregistered-rights record thoroughly. Second, a complainant who overlooks a business association between the registrant and the mark (a former licensee, a former distributor, a party who once had a legitimate reason to use the name) files into a Paragraph 4(c) safe-harbor defense. Third, a complaint drafted with conclusory bad-faith allegations — "the respondent clearly knew of our mark" — without circumstantial support gives a careful panel reason to deny even on default.

What is the realistic outcome range — and what does the minority of denials look like?

Panels transfer the domain in the majority of passive-holding cases where the mark is distinctive, the registrant is unresponsive, and the circumstantial record is built correctly. That is the consensus outcome. But the minority of denials has a consistent profile that a complainant should understand before filing.

Denials in passive-holding cases cluster around three scenarios. First, cases where the mark is weak or descriptive: the complainant holds rights in a term that has obvious generic uses in the technology sector — exactly the industry most associated with .io domains — and the panel declines to infer bad faith from silence alone when innocent explanations are plausible. Second, cases where the complainant cannot establish rights that clearly predate the registration: a domain acquired before a trademark application was filed, or before the brand achieved any measurable recognition, is difficult to frame as bad-faith exploitation of a mark that did not yet exist. Third, cases where the complaint itself is insufficiently documented: panels reviewing a sparse record on passive holding have denied the complaint and, in some instances, have noted the inadequacy of the evidence even where the registrant defaulted.

The RDNH risk — reverse domain name hijacking, a panel finding that the complaint itself was brought in bad faith — is present in any case where a complainant targets a registrant who has a plausible legitimate interest. In the passive-holding context the risk is lower than in cases involving a domain investor's clearly descriptive portfolio name, but it is not zero. A complaint against a registrant who turns out to have registered the domain for a legitimate but dormant project, and who has documentary evidence of that, can generate an RDNH finding that is reputationally damaging even without a monetary penalty. We assess this risk at the outset of every matter we handle.

Related at COGNOMEN

• UDRP recovery service — assess, prepare, and file a UDRP complaint across all accredited forums
• Recover a domain via UDRP: AI-sector considerations and the technology brand context
• How to prove no legitimate interest in a tech-sector UDRP — the evidentiary standard explained