FAQ: recover a lapsed .io domain that was re-registered

What does it mean to recover a lapsed .io domain that was re-registered?

A lapsed domain is one where the prior registrant failed to renew before the registry's expiry and redemption periods closed, at which point the domain became available for public registration. "Re-registered" means a third party then acquired it through normal channels — not through any account compromise or unauthorized transfer.

That distinction matters enormously. A domain that lapsed and was openly re-registered is not a "stolen" domain in the legal sense. The new registrant holds a clean chain of title from the registry's perspective. Recovery therefore depends on demonstrating, under the UDRP or another applicable procedure, that the new registrant's conduct is abusive — not simply that the former holder wants the name back.

Why does the lapse weaken the complainant's position? Because a fresh registration, made after the domain dropped into open availability, is more difficult to characterize as bad-faith targeting than a registration made while a brand's renewal was pending. Panels examine whether the new registrant knew of the trademark and registered specifically to exploit it. That factual burden sits with the complainant.

Does the UDRP apply to .io, and which forum handles these disputes?

Yes. The .io registry has adopted the UDRP, meaning the Policy's three-element test and its procedural rules apply in full. WIPO is the principal provider for .io disputes; the Forum and the CAC also accept .io complaints under the Policy.

That said, .io occupies an interesting position. It is the ccTLD for the British Indian Ocean Territory, but it has long functioned commercially as a gTLD-equivalent, popular with technology companies. The UDRP's application to .io is consistent with the approach taken across more than 87 ccTLDs that have delegated dispute resolution to WIPO.

In our practice, .io disputes follow the same procedural path as a .com complaint before WIPO. The complaint is filed, the registry applies a registrar lock, the respondent has 20 days to submit a response, and a panel then issues a decision. A standard single-panel case typically concludes in roughly two months from filing. WIPO's expedited option, available for single-panel cases covering up to five domains, can deliver a decision in approximately one month.

What evidence is needed to recover a lapsed .io domain that was re-registered?

The complainant needs evidence addressing each UDRP element: proof of trademark rights, evidence that the new registrant lacks any legitimate interest, and facts that establish bad-faith registration and use.

For the similarity element, a registered trademark predating the new registration is the clearest foundation. Unregistered or common-law rights may also qualify, but they require stronger evidentiary support — prior commercial use, market recognition, and secondary meaning.

For the absence-of-legitimate-interest element, the complainant should document that the registrant is not commonly known by the domain name, has no bona fide product or service associated with it, and is not making legitimate noncommercial or fair use of it. A parking page, a pay-per-click landing page monetizing the complainant's brand traffic, or a website mimicking the complainant's services all point toward the absence of legitimacy.

Bad faith is the most contested element in a lapsed-domain scenario. Useful evidence includes screen captures of the current website, RDDS/WHOIS records showing the registration date relative to the lapse, any correspondence in which the registrant demanded payment, evidence of a pattern of abusive registrations across other domains, and any prior dispute history linked to the new registrant. The timing of the registration — particularly if it occurred within hours of the domain dropping — can itself suggest opportunistic targeting.

One caution: panels do not equate lapse with bad faith on the new registrant's part. A registrant who acquired a dropped domain through a legitimate drop-catching service and is using it for unrelated commerce may successfully assert Paragraph 4(c) safe harbors. Evidence must go to this registrant's specific conduct, not the general unfairness of the lapse.

Can I recover a lapsed .io domain that was re-registered for more than one domain at once?

A single UDRP complaint may cover multiple domains, but only where all the disputed names are held by the same registrant. If the .io lapsed alongside a related .com or another variant, and the same party now holds both, consolidating them into one complaint is procedurally efficient and reduces total filing cost.

Where the domains are held by different registrants — a common outcome when multiple domains lapse simultaneously — separate complaints are required. Each complaint then proceeds independently, with its own filing fee and its own panel. Coordinating parallel filings can be worthwhile if the registrants appear linked, but counsel should assess each domain's evidence independently before treating them as a single campaign.

The WIPO filing fee for a single-panel complaint covering one to five domains is USD 1,500. For six to ten domains held by the same registrant, the fee rises to USD 2,000. Beyond ten domains, WIPO quotes separately.

What are the possible outcomes when you recover a lapsed .io domain that was re-registered?

Under the UDRP, the panel may order transfer of the domain to the complainant, order cancellation of the registration, or deny the complaint entirely. There are no monetary damages and no costs awards under the Policy.

Transfer is the outcome most complainants seek. It requires all three elements to be established on a balance of probabilities. Cancellation — returning the domain to the open pool — is ordered less frequently and typically where transfer would be inappropriate (for instance, where a mark is geographically limited and the complainant could not legitimately hold the .io).

Denial leaves the registrant in possession. In a lapsed-domain case, denial is a realistic risk if the panel finds the complainant's trademark rights are weak, arose after the new registration, or if the registrant presents credible evidence of a Paragraph 4(c) safe harbor.

There is also a fourth outcome specific to abusive complaints: a finding of Reverse Domain Name Hijacking (RDNH). If the panel concludes the complaint was brought in bad faith — for instance, to pressure a legitimate registrant into surrendering a valuable dropped domain — an RDNH finding is recorded and made public. This carries reputational consequences for the complainant and its counsel. We regularly advise clients on this risk before filing.

What does it cost to recover a lapsed .io domain that was re-registered at WIPO?

The WIPO filing fee for a single-member panel covering one to five .io domains is USD 1,500; a three-member panel for the same range is USD 4,000. Legal fees are separate and depend on the complexity of the trademark evidence and the registrant's likely defense.

For a straightforward single-domain matter with a clear trademark registration and an obvious parking-page respondent, professional fees in the market commonly range in the USD 3,000 – 7,000 band on top of the filing fee. Complex matters — multiple domains, contested legitimacy, or a well-resourced respondent — tend to run higher.

If the complaint is withdrawn or the case terminates before a panel is appointed, WIPO typically refunds approximately USD 1,000 of the USD 1,500 single-member filing fee. That partial refund structure sometimes influences the timing of settlement discussions.

Should the .io dispute also involve a corresponding .com or other gTLD, consolidating into one complaint (where the same registrant holds all names) avoids a second full filing fee. Where the registrant requests a three-member panel after the complainant filed for a single member, the parties generally split the higher three-member fee.

Are there alternatives to UDRP if the UDRP elements cannot be established?

If the UDRP elements are unlikely to be met — for instance, because the complainant's trademark rights are weak or arose after the registration — a negotiated purchase or a domain broker approach may be the more practical path.

What determines which route fits? The analysis turns on four questions: How strong is the trademark relative to the domain? When did the mark arise relative to the new registration? What is the registrant doing with the domain? And what is the domain's approximate market value?

Where the registrant is clearly acting in bad faith but the evidence is not UDRP-clean, US anticybersquatting litigation may be available if the parties have connections to that jurisdiction. That route allows for monetary damages and a court-ordered transfer but is substantially more expensive and slower. For a .io dispute with no strong US nexus, a purchase negotiation — structured through escrow to protect both sides — is often the most cost-effective resolution.

We handle pre-acquisition due diligence, chain-of-title checks, and escrow structuring as part of our transactions practice. Checking a domain's prior-dispute history before purchase is equally important: a domain that survived an RDNH finding, or one with a pending complaint, carries title risk that a clean RDDS lookup will not reveal.

Related at COGNOMEN

• Domain transactions, purchase, sale, and brand-protection monitoring
• Pre-acquisition due diligence and chain-of-title checks for .co and related zones
• Alert: ccTLD mediation developments and what they mean for registrants