Case study: recover a .io domain used for phishing
A fintech company discovered a .io domain nearly identical to its brand name – one transposed letter – pointing at a replica login page. Customers were receiving emails directing them to it. The fraudulent site was harvesting credentials. The company needed the domain down, and it needed that outcome in weeks, not quarters.
The .io ccTLD accepts UDRP proceedings administered by WIPO, meaning the same three-element test under Paragraph 4(a) of the Policy applies: confusing similarity to a trademark, no legitimate interest on the registrant's part, and registration and use in bad faith. A standard single-panel case runs roughly two months, with the WIPO filing fee at USD 1,500 for up to five domains on a single-member panel. The only available remedies are transfer or cancellation.
This case study traces the situation, the strategy chosen, and the outcome – with all identifying details anonymized.
The situation: a phishing clone in a developer-favored zone
The .io zone has grown well beyond its origins as the British Indian Ocean Territory ccTLD. Technology companies and startups have adopted it widely, which makes it a favored target for actors who register near-identical names to harvest credentials or conduct payment fraud. Because .io has accepted WIPO as a dispute-resolution provider, the full UDRP machinery applies – complainants do not need to resort to the national procedure of a remote territory.
In this matter, the domain incorporated the client's registered trademark with a single-character substitution. The registrant had no disclosed connection to any business. WHOIS data showed a privacy service, and the registrant did not respond to a cease-and-desist. The replica site carried the client's logo, color scheme, and login interface – a classic credential-phishing deployment.
Two questions confronted the company's in-house team: was UDRP the right path, or should they pursue a registrar-level abuse takedown first? And if UDRP, which forum?
The strategy: UDRP at WIPO, supported by phishing evidence
Registrar abuse reports can suspend a site's content, but they rarely produce a domain transfer. The company wanted ownership – or at minimum, permanent cancellation – not a temporary content block that a bad actor could circumvent by pointing the domain elsewhere. UDRP was the correct route.
WIPO was selected over the Forum and CAC for two reasons. First, WIPO's panel pool carries strong authority in technology-sector cybersquatting matters. Second, WIPO's published process for .io cases is well-established; there was no procedural uncertainty about admissibility.
The three UDRP elements were assessed before filing:
- Confusing similarity: the client held a registered trademark predating the domain registration by several years. A one-letter typosquat of a registered mark satisfies this element in settled panel practice.
- No legitimate interest: the registrant had no apparent authorization, no disclosed business, and no prior known use of the name. The replica site, far from constituting a bona fide offering, actively impersonated the brand – an absence of legitimate interest panels have consistently recognized.
- Bad faith: active phishing is one of the clearest bad-faith deployments panels encounter. Paragraph 4(b) of the UDRP lists attracting users for commercial gain through confusion; credential-harvesting for financial fraud amplifies that finding. We assembled URL capture records, dated screenshots, email headers from one reported phishing message, and a WHOIS/RDDS history showing the privacy shield had not been lifted since registration.
The complaint also included evidence that the domain had been registered the day after a press announcement about the client's new product – a timing pattern panels treat as a strong indicator of opportunistic bad-faith registration.
If your brand is being impersonated in the .io zone – or any other gTLD or ccTLD that accepts WIPO proceedings – the first step is an assessment of whether all three UDRP elements are met and what evidence your record currently contains. To get that read, contact info@cognomenlaw.com.
The outcome: transfer ordered, respondent defaulted
The respondent did not file a response within the 20-day window set by the UDRP Rules. Default did not deliver an automatic win – the panel still evaluated the complaint on its merits – but the uncontested evidentiary record was strong. The panel found all three elements satisfied, noted the post-announcement registration timing, and ordered transfer of the domain to the complainant.
The case resolved in approximately eight weeks from filing to transfer implementation at the registrar level. No supplemental filings were required. A three-member panel was not requested by either side, so the single-member fee structure applied throughout.
The phishing site ceased operation when the registrar implemented the transfer lock pending decision, an outcome the company had not achieved through the earlier abuse report alone. Post-transfer, the company pointed the domain to a redirect and enrolled it in their brand-protection monitoring to watch for further typosquats.
In a second, unrelated engagement that same quarter – a .io domain held by a domain investor who had registered the name years before the complainant's mark existed – we represented the registrant respondent. The panel denied the complaint and issued a finding of reverse domain name hijacking. The investment community watching that proceeding noted that RDNH findings are available even in the .io zone, where the UDRP applies in full, including its protections for legitimate registrants.
If you have received a UDRP complaint relating to a .io or other technology-zone domain you hold legitimately, defense and RDNH strategy both merit early analysis. Email info@cognomenlaw.com to discuss your position.
Related at COGNOMEN
Frequently asked questions
Does the UDRP apply to .io domains?
Yes. The .io ccTLD has accepted WIPO as a dispute-resolution provider, meaning the UDRP and its three-element test under Paragraph 4(a) apply in full. The same filing fees, timelines, and remedies – transfer or cancellation only – govern a .io complaint as they do a .com complaint filed at WIPO. No separate national procedure is required.
What evidence is most important in a phishing case?
Panels look for dated URL captures and screenshots of the replica site, WHOIS or RDDS records showing the privacy shield and registration date, email headers from any phishing messages received, and timing evidence linking registration to a brand event. The closer the registration date to a product launch or press release, the stronger the opportunistic bad-faith inference.
How long does a .io UDRP case take at WIPO?
A standard single-member panel case runs roughly two months from filing to registrar implementation. The respondent has 20 days from commencement to file a response. A default – where the respondent does not reply – does not shorten the panel's deliberation period, but the panel will typically proceed on the complaint record alone, which in a well-documented phishing matter is often sufficient for a transfer order.
Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.