Recover a .co domain from a serial cybersquatter: what panels actuall…

Recover a .co domain from a serial cybersquatter: what panels actuall. UDRP and ccTLD domain recovery and defense across .co. Email the firm to assess your cas…

A brand owner searches for its own name and finds a .co domain registered by a stranger. The WHOIS record shows that same stranger holds dozens of similar names across multiple zones. The parking page carries pay-per-click links aimed squarely at the brand's customers. This is the serial cybersquatter pattern – and recovering a .co domain from it is one of the cleaner cases in the UDRP playbook, provided the evidence is assembled correctly.

The .co country-code zone operates under the UDRP, administered principally by WIPO, which means the standard three-element test under Paragraph 4(a) of the Policy governs every complaint. A complainant must show that the domain is confusingly similar to a mark it holds, that the registrant has no legitimate interest in it, and that it was registered and is being used in bad faith. Serial-registration conduct – a documented pattern of abusive registrations across multiple marks or zones – satisfies the third element under Paragraph 4(b) of the Policy and routinely produces a transfer order. The WIPO filing fee for a single-domain complaint starts at USD 1,500 for a single-member panel, and a standard case concludes in roughly two months.

This analysis covers the governing procedure for .co, the doctrine panels apply to serial cybersquatters, the evidence that decides outcomes, the minority views worth knowing, and the realistic cost and timeline picture for a brand owner weighing the decision to file.

Why does the UDRP apply to .co, and how does the procedure work?

The .co registry – Colombia's country-code extension – has adopted the UDRP as its governing dispute-resolution policy, which means the three-element test and the procedural rules of the UDRP apply in full. This is not universal among ccTLDs; .de, for example, has no equivalent arbitral path, and .uk uses a distinct procedure with its own test. But .co operates precisely like a gTLD in the dispute context, which is good news for brand owners: the same complaint mechanics, the same forum options, and the same two-month timeline that govern a .com complaint apply equally here.

The procedure has five stages: complaint filing, formal compliance review, the 20-day response window after commencement, panel appointment, and the decision followed by registrar implementation. WIPO is the dominant forum for .co disputes, handling the vast majority of filings at its Geneva facility. The Forum is also an accredited provider. If the complainant requests a single-member panel, the fee at WIPO is USD 1,500; a three-member panel costs USD 4,000. The only remedies available under the UDRP are transfer or cancellation – there are no damages, no cost awards, and no injunctions. A brand owner who also wants compensation must pursue parallel court action, handled with local litigation counsel in the relevant jurisdiction.

One procedural point matters when the serial squatter holds the same brand across multiple zones simultaneously. A single UDRP complaint can cover multiple domains only where all domains are registered to the same holder. Where the .co and a companion .com are held under different registrant identities – a common evasion tactic – separate complaints are required. Consolidation of multiple complaints against a single respondent who uses variant registrant details is possible but turns on whether the panel is satisfied the domains are under common control; that determination is fact-specific.

If you have identified a pattern of registrations across zones and need to map the consolidation options, contact us at info@cognomenlaw.com for an initial assessment of the three elements and the forum strategy.

How do panels analyze the three UDRP elements against a serial cybersquatter?

Serial-registration conduct strengthens each UDRP element differently, and understanding where it adds the most force helps in assembling the right evidence record.

Element one – confusing similarity is routinely the least contested element in a serial-squatter case. Where the domain incorporates the complainant's mark in full, with only a generic suffix or no modification at all, panels treat the comparison as straightforward. The .co extension itself is disregarded as a technical necessity. A domain that matches a registered mark letter-for-letter clears element one without controversy. The real question is what the mark record looks like: panels expect evidence of registration or at minimum strong common-law use predating the domain's creation date. The creation date comparison matters – a domain registered before any trademark rights existed cannot be found abusive at the registration stage, regardless of subsequent bad conduct.

Element two – no legitimate interest places the initial burden on the complainant to make a prima facie showing, after which the burden shifts to the respondent to rebut with evidence of one of the Paragraph 4(c) safe harbors: a bona fide offering of goods or services before notice of the dispute, being commonly known by the disputed name, or legitimate noncommercial or fair use. A serial cybersquatter rarely offers any such rebuttal. The respondent either defaults entirely – which is common in these cases – or offers a conclusory denial. Panels treat a documented history of similar registrations as corroborating the absence of legitimate interest: a registrant who assembles dozens of names corresponding to well-known marks is not engaged in bona fide commercial activity. In our practice, we advise brand owners to document not only the .co registration but any companion registrations, parking-page monetization, and offer-to-sell communications as part of the element-two record.

Element three – bad faith is where the serial pattern does the most evidentiary work. Paragraph 4(b) of the Policy provides a non-exhaustive list of bad-faith circumstances. Registration to sell the domain to the mark owner for a profit above documented out-of-pocket costs is explicitly listed. So is a pattern of conduct preventing mark owners from reflecting their marks in corresponding domains. Both factors are regularly present when the respondent holds a portfolio of third-party brand names. Panels have consistently held that a prior record of abusive UDRP decisions against a respondent – or a clear portfolio of mark-targeting registrations even without prior decisions – constitutes a pattern under Paragraph 4(b) and satisfies element three independently. Pay-per-click parking pages that serve ads targeting the complainant's industry compound the finding: they evidence both commercial gain through user confusion and continued use in bad faith.

What does passive holding mean for a .co serial-squatter case?

Not every serial squatter parks an ad-filled page on the domain. Some hold the domain passively – no website, no active use, no visible monetization. This raises the question of whether passive holding satisfies the "is being used in bad faith" language of element three.

The consensus view is that passive holding can constitute bad faith use where the circumstances surrounding the registration make innocent use implausible. Panels look at the totality of the record: the distinctiveness of the complainant's mark, the absence of any conceivable good-faith use, the respondent's overall registration history, and the failure to offer any explanation for holding the domain. Where the respondent is a documented serial squatter with a portfolio of brand-targeting registrations, passive holding of a .co matching a well-known mark satisfies the usage element on these factors alone. The logic is that no plausible good-faith use exists; the respondent is warehousing the name.

The contrary view – a narrower reading held by a minority of panels – requires at least some evidence of active bad-faith deployment before element three is complete. Under this approach, a purely dormant .co with no prior offer to sell and no parking page may not satisfy element three without more. Brand owners relying on passive holding alone should be aware that forum and panel selection can affect the outcome; the consensus position is dominant but not universal. For a detailed treatment of passive holding doctrine and what evidence bridges the gap, see our analysis at UDRP passive holding recovery.

What evidence actually decides the outcome in these cases?

Evidence of a serial-registration pattern is the single most powerful factor available to a complainant against a known squatter. It should be assembled before the complaint is filed, not improvised during the proceeding.

The minimum evidence record for a serial-squatter .co complaint should include the following:

• A current RDDS (WHOIS) printout showing the registrant's name, organization, and contact details for the disputed .co.
• RDDS records for companion domains held by the same registrant or a common alias, showing the pattern of mark-targeting across multiple names and zones.
• Prior UDRP decisions against the same respondent, if any exist. These are publicly searchable in the WIPO and Forum databases. Even a single prior adverse decision is compelling; multiple decisions establish the pattern conclusively.
• Screenshots of any website resolving from the domain: pay-per-click parking pages, any offer-to-sell language, redirects to competitor sites, or the plain fact of an inactive holding with no development.
• Any communications from the respondent offering to sell the domain, whether initiated or responsive. An unsolicited offer-to-sell email, especially one naming a sum well above registration cost, is direct evidence of Paragraph 4(b) bad faith.
• Trademark registration certificates or, for common-law marks, documentation of use in commerce predating the domain's creation date.
• A creation-date comparison showing the mark predates the registration. This is foundational; panels will note any gap that suggests the registrant could not have targeted the mark.

In a recent matter – a .co domain targeting a technology brand, spring 2025 – we documented that the respondent held approximately forty similar registrations across .com, .net, and several ccTLDs, including prior adverse UDRP decisions under a slightly modified registrant identity. The panel found both a Paragraph 4(b)(ii) pattern and a Paragraph 4(b)(iv) commercial-gain-by-confusion finding on the parking page evidence, and ordered transfer. The case was resolved within the standard two-month window with a single-member panel at WIPO.

What evidence does not help? A complainant's subjective belief that the registrant is a squatter, without documentary corroboration, does not advance the complaint. General statements about the domain's commercial value or the brand's fame, without trademark registration evidence or documented use, leave element one vulnerable. And a complaint that fails to explain the registrant's identity across variant contact details – a common tactic serial squatters use to obscure the pattern – may lose the consolidation argument. We regularly advise clients to invest two to three days of pre-filing research into the respondent's portfolio before any complaint is drafted.

What is the consensus view on a serial squatter's default, and what does a panel do with it?

Serial cybersquatters default – file no response – at a high rate. Default does not mean automatic transfer. Panels consistently hold that the complainant must still make out all three UDRP elements on the record before a transfer order issues. The difference in a default case is that the respondent offers no rebuttal, which means the complainant's unrebutted evidence carries the full field.

What the panel does with a default: it proceeds to the merits, treating the complainant's submissions as the only record. Where element-one confusing similarity is clear and the bad-faith evidence is documented – parking pages, a prior adverse decision, an offer-to-sell communication – panels routinely transfer on the papers. Where the bad-faith record is thin, a default will not save a weak complaint. Panels do not infer bad faith from silence alone; they require at least some affirmative evidence pointing toward one of the Paragraph 4(b) circumstances or the passive-holding doctrine's cumulative factors.

A related point: a complainant that files a weak case against a serial squatter who does happen to respond faces the risk of a Reverse Domain Name Hijacking finding. RDNH – a panel determination that the complaint was brought in bad faith to deprive a legitimate registrant – is available even against a respondent with an otherwise poor reputation. The reputational consequence falls on the complainant. We have defended registrants against overreaching complaints from brand owners who conflated "we do not like this registration" with "the registration is abusive," and secured RDNH findings in those matters.

How does the .co procedure compare to filing against the same squatter on .com?

The practical difference between a .co and a .com UDRP complaint is minimal at the procedural and legal level. Both use the UDRP, both are filed at WIPO or the Forum, both carry the same three-element test, the same 20-day response window, and the same transfer-or-cancellation remedy range. The filing fee structure at WIPO is identical: USD 1,500 for a single-member panel on one to five domains.

Where the zones diverge is in the pattern-evidence context. A serial squatter who holds both a .com and a .co targeting the same mark gives the complainant a natural opportunity to consolidate – one complaint, one filing fee, one panel, covering both domains – provided the registrant details are consistent. If the .com and .co are held under subtly different names or registrant contacts, the complainant faces a choice: file two separate complaints and build the same record twice, or file only the higher-priority domain and use the companion registration as pattern evidence in that single complaint.

The decision between filing at WIPO and filing at the Forum is worth a brief note. WIPO and the Forum together handle the substantial majority of UDRP proceedings globally, with WIPO dominant for international marks and cross-border disputes. The Forum's fee entry point for a single-domain complaint begins around USD 1,300, marginally below WIPO's published rate. CAC offers an even lower entry point – beginning around USD 500–800 – and is accredited for .co disputes, though it sees far fewer filings and panel precedent there is thinner. For a serial-squatter case where the pattern record involves prior WIPO or Forum decisions, filing at the same institution whose prior decisions are in evidence is often the cleaner argument.

If the serial squatter is also operating in the .uk zone, that route leads to the Nominet DRS, not the UDRP – a distinct procedure with its own test ("abusive registration") and a key textual difference: the DRS reads "registered or used" abusively, a lower bar than the UDRP's cumulative "registered and used in bad faith." A brand owner with exposure across both zones may find the .uk case easier to make on the usage element, particularly where the .co holding is passive. Those two complaints proceed in parallel, under separate rules, before separate bodies.

For a broader treatment of how to structure multi-zone recovery across gTLD and ccTLD targets, the UDRP recovery service page at COGNOMEN's UDRP recovery practice sets out the full menu of routes and forum options.

To weigh UDRP against a court action for your case – or to map a multi-zone recovery strategy against the same serial registrant – email info@cognomenlaw.com.

What are the realistic cost and timeline expectations?

Clarity on cost is worth the attention it rarely gets in discussions of UDRP practice. The official forum fee and the legal fee are separate line items, and conflating them leads to budget surprises.

The WIPO filing fee for a .co complaint covering one to five domains is USD 1,500 for a single-member panel. If the complainant requests a single panelist and the respondent requests three members, the parties generally split the higher three-member fee of USD 4,000. Market legal fees for a straightforward single-domain UDRP complaint – assembling the record, drafting the complaint, managing the proceeding – typically fall in the USD 3,000–7,000 range, separate from the forum fee. That range is fact-dependent; a serial-squatter case with extensive portfolio research at the pre-filing stage and a prior-decision cross-reference will sit higher in that range than a clean, single-issue cybersquatting complaint.

Timeline: the standard UDRP proceeding at WIPO completes in roughly two months from filing, absent extensions. The respondent's 20-day window is the longest fixed stage. Panel appointment and the decision itself follow within weeks. Registrar implementation of a transfer order adds a short administrative period after the decision. WIPO also offers an expedited option, which targets a decision within approximately one month for single-panel cases of up to five domains – a useful tool where the brand owner faces active customer confusion from a live parking page.

In a second recent matter – a .co targeting a consumer brand in the fashion sector, autumn 2025 – we filed under the expedited track, the respondent defaulted, and the transfer order issued in under five weeks from commencement. The respondent had twelve prior adverse decisions in the public WIPO database. The expedited option added no additional risk and materially reduced the period of active customer harm.

What is the contrary view, and when does it matter?

The consensus described above – that documented serial-registration patterns satisfy element three and that passive holding by an identified serial squatter clears the usage requirement – is well settled across WIPO and Forum decisions. But a minority of panels apply stricter standards, and understanding where those stricter standards appear helps a brand owner manage risk before filing.

First, on the "registered in bad faith" prong of element three: a handful of panels have required evidence that the respondent specifically knew of the complainant's mark at the moment of registration, rather than inferring that knowledge from a mark's general prominence. Where the complainant's mark is well-known in its industry but not a household name, the inference of knowledge at registration is easier to challenge. Pre-filing research into the domain creation date and any contemporaneous marketing materials or press coverage of the brand around that date is the answer to this problem – not a legal argument but a factual one.

Second, on consolidation: where the complainant argues that multiple domain registrations under variant identities are under common control, a minority of panels have declined to consolidate absent clear technical evidence (common IP addresses, identical nameserver clusters, registration patterns by date). A consolidation argument that relies entirely on the similarity of the registrant's first name or a shared privacy service is fragile. Technical evidence should accompany the pattern evidence wherever possible.

Third, on forum choice and the composition of three-member panels: three-member panels – convened either at a party's request or on a panel's own motion in especially complex cases – produce more detailed reasoning and a more formal record of the prior-decision evidence. Where the serial-squatter record is strong, a single-member panel is efficient and economical. Where the pattern evidence involves disputed registrant identity or a novel consolidation argument, the more deliberate three-member process may reduce the risk of a fragmented or incomplete decision.

RDNH risk in a serial-squatter complaint is low where the bad-faith record is solid. It is not zero. A brand owner who files against a registrant whose portfolio turns out not to include the brand in question – a misidentification in the pre-filing research – faces a credible RDNH argument from the respondent. Double-checking the registrant identity chain before filing is not procedural caution; it is litigation risk management.

Related at COGNOMEN

• UDRP Domain Recovery – full service overview across gTLD and ccTLD zones
• Passive Holding Recovery – doctrine and evidence for dormant-domain complaints
• URS Suspension for New gTLDs – a step-by-step guide for rapid takedown