Recover a .co domain used for phishing: what panels actually decide

A phishing site goes live on a .co domain that mirrors your brand. It collects credentials, redirects your customers, and arrives in your inbox as a fraud report from a bank or a cybersecurity team. You need the domain stopped and transferred to you. The question is not whether a remedy exists – it does – but whether the evidence you have maps cleanly onto the test a UDRP panel applies.

The .co country-code registry operates under the UDRP, which means a complaint filed at WIPO or the Forum can reach a phishing domain in that zone. To succeed, a complainant must prove all three elements of Paragraph 4(a): confusing similarity to a trademark the complainant holds, no legitimate interest on the registrant's part, and registration and use in bad faith. A standard case resolves in roughly two months; the WIPO filing fee begins at USD 1,500 for a single-member panel. The only remedies are transfer or cancellation.

This analysis covers what governs .co disputes, how panels read phishing evidence across each of the three UDRP elements, the fact patterns that have driven transfers, and the minority positions worth knowing before you file.

Why .co operates under the UDRP – and what that means for phishing cases

The .co registry has appointed WIPO as a dispute-resolution provider and adopted the UDRP in full, meaning the same three-element test that applies to a .com complaint governs a .co phishing dispute. That is not automatic for country-code zones. Many ccTLDs run entirely separate procedures. For .co, the complainant can file at WIPO or the Forum with the same form, the same evidentiary rules, and the same panel-appointment pool as a standard gTLD case.

This matters in a phishing context for two reasons. First, the UDRP allows a complaint to be filed very quickly after a domain is weaponized – there is no mandatory waiting period. Second, panels deciding .co cases draw on the broad body of UDRP jurisprudential guidance developed across gTLD disputes. Phishing is one of the most consistently decided fact patterns in that body of guidance. The consensus position is well established: a domain used to impersonate a brand for the purpose of collecting credentials or diverting payments is registered and used in bad faith, and the registrant has no plausible legitimate interest.

What complicates .co phishing cases is not doctrine – it is evidence. Phishing infrastructure disappears fast. Sites go down within days of being flagged. Screenshots taken at 48 hours may be all that survives. We regularly advise brand owners in this sector to treat the evidence-preservation stage as separate from, and prior to, the filing decision. What a panel sees in the record is what it decides on.

How does the confusing-similarity element work in a phishing dispute?

Confusing similarity under Paragraph 4(a)(i) is the least contested element in a phishing case. The registrant almost always chose the domain precisely because it is confusingly similar to the target brand – that is the mechanism of the attack. A domain that adds a generic word ("secure-," "pay-," "login-," "verify-") or a country suffix to a registered trademark is consistently found confusingly similar by panels across all UDRP zones, including .co.

Two sub-questions arise. First: does the complainant need a registered trademark, or will unregistered rights suffice? Panels can recognize unregistered trademark rights under Paragraph 4(a)(i) if the complainant demonstrates sufficient common-law use and reputation. In a phishing case – where the registrant chose the domain because the brand is recognized – the argument for unregistered rights is often strong on the facts. The complainant must document it explicitly, however. A filing that simply asserts reputation without evidence invites a denial on the first element, which is a costly procedural failure. Second: how is similarity assessed? The UDRP instructs panels to compare the domain (excluding the zone suffix) with the mark. A domain of the form [MARK]-verify[.co] or [MARK]secure[.co] passes this test without difficulty. The more interesting cases involve a partial inclusion of the mark alongside a generic industry word – "bankingmark" reduced to "bnkmark," for example. Panels have generally been willing to find similarity where the phonetic or visual impression of the mark is preserved, but a complainant relying on a heavily truncated domain should expect the panel to examine the similarity argument closely.

For an assessment of whether your trademark rights and the disputed domain meet the confusing-similarity standard, contact info@cognomenlaw.com.

What evidence establishes that a phishing registrant has no legitimate interest?

Legitimate interest under Paragraph 4(a)(ii) is where phishing cases are most clearly decided. A registrant operating a phishing site has no legitimate interest in the domain. That conclusion is near-universal in UDRP decisions. Phishing is not a bona fide offering of goods or services. It is not a noncommercial or fair use. And it is plainly inconsistent with being "commonly known by" the domain name. All three of the Paragraph 4(c) safe harbors fail for the same underlying reason: the registrant's purpose is deception, not legitimate use of the name.

What the complainant must do procedurally is establish a prima facie case – enough evidence to shift the burden to the registrant. In practice, that means demonstrating: (a) the complainant has trademark rights predating the registration; (b) it has not licensed or authorized the registrant; and (c) the registrant's use of the domain is not consistent with any recognized legitimate-use category. A phishing page – even one that has been taken down by the time the complaint is filed – can satisfy point (c) if the record contains contemporaneous screenshots, abuse-report logs, or cybersecurity incident reports documenting the fraudulent purpose.

The complication is timing. If the phishing site was replaced with a parking page or a blank DNS resolution before the complaint was filed, the complainant needs to document what was there. Panels will draw adverse inferences from a registrant's silence (default is common in phishing cases), but an adverse inference is stronger when supported by archived evidence. We have seen complaints fail – not on doctrine but on the record – because a brand's fraud team pulled screenshots for internal purposes without preserving them in a filing-ready format. That gap between the security-operations workflow and the legal-filing workflow is a recurring problem in our practice.

Does phishing always satisfy the bad-faith requirement under the UDRP?

Phishing nearly always satisfies Paragraph 4(a)(iii), and does so under multiple independent bad-faith indicators. The clearest route is Paragraph 4(b)(iv): using the domain to attract users for commercial gain by creating a likelihood of confusion with the complainant's mark. A phishing site designed to harvest banking credentials or payment details is commercially motivated and operates through confusion – it is paradigmatic 4(b)(iv) conduct. Panels have consistently held that there is no need to prove the registrant actually received value from the phishing operation; the setup and targeting are sufficient.

A second route is the pattern-of-conduct factor under Paragraph 4(b)(ii). A registrant who holds multiple lookalike domains across several brands is registering to prevent multiple mark owners from reflecting their marks, and panels treat this as an independent bad-faith ground. In phishing cases where the registrant is operating an industrialized spoofing campaign – registering dozens of bank or fintech lookalikes – the pattern argument reinforces and in some panels effectively substitutes for 4(b)(iv).

Passive holding creates the minority-view tension worth examining. The standard rule for passive holding – a domain pointing at no content – is that bad faith can be inferred from surrounding circumstances even without active use. Where the domain was used for phishing, then the content was taken down, panels have applied the same passive-holding inference framework. The minority position, sometimes seen in older decisions, required the complainant to prove bad faith at the moment of registration separately from bad faith in use. Under that view, a formerly phishing domain sitting at a parked page would need the complainant to prove the registration itself was in bad faith – not just the use. The consensus position in modern panels is that the two limbs are assessed together, and a phishing history at registration is sufficient to satisfy both. A complainant relying on a phishing-followed-by-parking fact pattern should, however, address the registration-intent argument directly rather than treating it as resolved.

If the phishing site is already offline and you are weighing whether the record still supports a complaint, email info@cognomenlaw.com for a read on the evidence.

How do panels treat default – and why phishing cases almost always produce defaults?

Phishing registrants default at a very high rate. The registrant typically used false contact details, the domain was registered through a privacy proxy, and there is no legitimate business that can file a substantive response. The respondent has 20 days from commencement of the case to file a response. When no response arrives, the panel decides on the complaint's submissions and whatever record the complainant built.

Default is not automatic transfer. The panel must still be satisfied that the three elements are met. What default does is remove any contrary narrative from the record. The registrant cannot invoke a Paragraph 4(c) safe harbor it did not raise. The panel can draw reasonable inferences from non-response, particularly where the complainant's evidence of phishing conduct is specific and documented.

In a recent matter – a .co phishing campaign impersonating a financial-services brand, early 2025 – we assembled a complaint record that included archived phishing-page screenshots, a cybersecurity firm's abuse-report log, and bank fraud reports citing the domain. The registrant defaulted. The panel transferred the domain inside the standard two-month window without supplemental proceedings. The outcome followed directly from the quality of the evidentiary record, not from the default itself. Default creates the opportunity; the record delivers the result.

That case illustrates a structural point. When a phishing registrant defaults, the complainant's brief is, in effect, the entire record. Gaps in that brief become gaps in the panel's reasoning. A complainant treating a default as a formality tends to produce a thinner brief; a complainant treating the brief as the evidentiary foundation of an opposed proceeding tends to produce a cleaner transfer order.

What decides the outcome when there is a response? The minority positions

A small proportion of .co phishing disputes produce a substantive response. The response usually raises one of three arguments: (a) the registrant was not responsible for the phishing use, because the domain was "hacked" or misused by a third party; (b) the complainant's trademark rights are insufficient or limited to a different geographic market; or (c) the panel lacks jurisdiction because the registrant disputes the .co registry's UDRP adoption.

Argument (a) – the hacked-domain defense – has had mixed results. Some panels have found it raises a genuine question of fact that defeats the complaint on the bad-faith element, at least where the registrant produces plausible evidence of the compromise. The consensus view, however, is that a registrant bears responsibility for the use of the domain it holds, and that a bare assertion of hacking without corroborating technical evidence does not carry the burden. We advise complainants facing this argument to lead the evidence affirmatively – showing, for instance, that the domain's DNS records were modified to a hosting provider consistent with phishing infrastructure, and that those records were visible in RDDS before the complaint was filed.

Argument (b) – geographic limitation of trademark rights – is more viable when the complainant's trademark is registered in a narrow territory and the registrant is apparently based elsewhere. The UDRP does not require the mark to be registered in the registrant's home jurisdiction, but complainants with geographically limited registrations should address the global reach of their brand's reputation in the complaint. Evidence of international use, online presence, and cross-border customer base strengthens the first element in a way that a single-country registration certificate alone does not.

Argument (c) – jurisdictional denial – has not succeeded in .co disputes before WIPO. The .co registry's UDRP adoption is documented and recognized. A respondent raising this argument purely to delay the proceeding risks drawing an adverse inference from what the panel may characterize as a procedural bad-faith tactic.

How does .co compare with other UDRP zones and the court route for phishing cases?

The right route for a phishing dispute depends on the zone, the available evidence, and what outcome you need.

If the domain is a .co and you want it transferred, the UDRP at WIPO or the Forum is the direct path. WIPO charges USD 1,500 for a single-member panel on one to five domains; the Forum starts around USD 1,300 for one to two domains. Both reach the same result – transfer or cancellation – in roughly the same standard two-month window. The choice between them in a phishing case often turns on the complainant's preference for WIPO's more developed cybersquatting jurisprudential record or the Forum's slightly lower entry cost. We tend to recommend WIPO for phishing matters where the bad-faith analysis requires detailed reasoning, because the decision record is larger and better indexed.

If the same phishing campaign spans multiple zones – a .co and a .com registered by the same holder, for instance – a single UDRP complaint can cover both provided the registrant of record is the same. A complaint covering multiple domains under the same registrant is procedurally sound and does not increase the difficulty of the three-element analysis; it increases the filing fee to the next tier but not proportionately. In a multi-domain phishing campaign, consolidating domains saves time and produces a cleaner outcome than sequential single-domain filings.

For new-gTLD phishing domains, the URS (Uniform Rapid Suspension System) offers a faster suspension at lower cost, but the remedy is suspension for the registration term – not transfer of ownership. A brand owner who wants the domain placed in its own portfolio rather than simply taken offline will find URS insufficient. The UDRP remains the right tool where transfer is the goal.

If the phishing is part of a larger fraud scheme and you need monetary relief against the operator – damages, account disgorgement, or attribution to a named individual – the UDRP cannot reach that. No damages, no costs awards, no injunctions issue from a UDRP panel. For financial remedies, US anticybersquatting litigation or the applicable national court route is the path, coordinated with local litigation counsel in the relevant jurisdiction. The practical sequence is often UDRP first (to transfer the domain quickly and stop active phishing) followed by a court action targeting the operator's financial exposure. The two proceedings are not mutually exclusive, and the UDRP complaint's evidentiary record is often directly useful in the subsequent court proceeding.

For .de phishing, there is no UDRP equivalent – disputes proceed through the German courts, with a DENIC DISPUTE entry blocking transfer while the claim is pursued. For .uk phishing, Nominet's DRS applies an "abusive registration" test that – critically – reads "registered or used" abusively, a lower bar than the UDRP's cumulative "registered and used in bad faith." A phishing domain that was registered with an apparently innocent purpose but subsequently weaponized may succeed under the Nominet DRS more readily than under the UDRP. That distinction matters in cross-border campaigns that include a .uk component alongside a .co.

What evidence should a complainant build before filing?

Evidence decides phishing cases more than doctrine does. The legal framework is well settled. What varies is the record.

The core evidentiary package for a .co phishing UDRP should include: screenshots of the phishing page (with URL, timestamp, and archived-page reference where available); the domain's RDDS/WHOIS record at the time the phishing was discovered; a cybersecurity or threat-intelligence report identifying the domain as phishing infrastructure; any abuse reports filed with the registrar, WIPO, or national CERTs; bank or payment-processor fraud alerts referencing the domain; and any customer complaints or fraud-team reports that document the harm. If the phishing content was taken down before screenshots were preserved, the next best source is an archived page from a public web-archive service or a private threat-intelligence platform's historical data. Complainants should not assume the panel will accept verbal descriptions of content that no longer resolves.

The trademark-rights element requires the complainant's trademark registration certificate, the filing date, and (for unregistered rights) evidence of use predating the domain registration. The registration date of the domain relative to the trademark's priority date is a critical data point. A panel seeing a domain registered after the complainant's mark reached public recognition reads the timeline as consistent with bad faith. A domain that predates any trademark rights creates a much harder first-element problem and may not be recoverable under the UDRP at all, regardless of the subsequent phishing use.

In a second matter worth describing – a .co domain impersonating a payments-technology company, summer 2025 – the complainant had screenshots from its own security operations center but no archived page and no third-party abuse report. We advised obtaining threat-intelligence data and a bank-issued fraud alert before filing. With those added, the record was sufficient. Without them, the complaint would have rested on internal screenshots alone, which panels treat with appropriate caution because the complainant controls the capture process. Third-party corroboration – a cybersecurity firm, a financial institution, or a national CERT – materially strengthens a phishing record.

Related at COGNOMEN

• UDRP domain recovery: the full process for brand owners seeking transfer of infringing domains
• Proving bad faith under the UDRP: evidence, doctrine, and the fact patterns that decide cases
• Proving legitimate interest: respondent defense and RDNH across UDRP and ccTLD procedures

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.