FAQ: recover a stolen .co domain under the applicable domain rules

When can I recover a stolen .co domain?

Recovery is available through two distinct routes, and the right one depends on what actually happened. If a third party registered or obtained the .co by exploiting your trademark – buying it before you, typosquatting, or acquiring it abusively – a UDRP complaint is the standard path. If the domain was already yours and was taken through an unauthorized transfer – account hijacking, fraudulent registrar instruction, or social engineering – the primary route is a registrar escalation to reverse the transfer, supported by evidence of compromise. A UDRP can also follow if the registrar escalation stalls or if the current holder uses the domain in bad faith.

The distinction matters because the UDRP requires you to prove all three elements of Paragraph 4(a): that the domain is confusingly similar to a mark you hold, that the registrant lacks any legitimate interest, and that it was registered and is being used in bad faith. In a pure theft case, bad faith is usually straightforward to demonstrate. The harder element is often the second – showing the thief has no conceivable legitimate interest – which the surrounding facts of the unauthorized transfer will typically support.

We regularly advise registrants who discover the problem days or weeks after the unauthorized transfer. Speed matters. The longer a fraudulent transfer chain extends, the harder it becomes to reverse at the registrar level alone.

Does WIPO or a court decide a .co dispute?

.co has adopted the UDRP, so WIPO and the other ICANN-accredited providers – including the Forum, CAC, and ADNDRC – have jurisdiction over .co domain disputes involving trademark-based abuse. The vast majority of .co cases are resolved through WIPO arbitration, not courts. However, the UDRP is not the only available tool. Where the dispute involves outright fraud, where the registrant has evaded the arbitration process, or where monetary damages are sought, a court action is the appropriate supplement.

Courts also matter when a UDRP panel's transfer order requires enforcement beyond what the registrar will voluntarily implement. That is rare for .co, because registrars for .co domains are ICANN-accredited and contractually bound to implement UDRP decisions. But where a registrar is slow, unresponsive, or disputes the panel's authority in a particular procedural posture, local court intervention – handled with local litigation counsel in the relevant jurisdiction – may be the only way to compel compliance.

In our practice, we advise complainants to assess both routes before filing. The UDRP is faster and cheaper. A court action is broader in remedy but longer and more expensive. The right choice turns on what was taken, how it was taken, and what the registrant has done with it since.

For a read on whether the three UDRP elements are met for your .co domain, reach us at info@cognomenlaw.com.

What registrar-lock and transfer-reversal steps apply to a stolen .co domain?

The first action after discovering an unauthorized transfer is to contact the losing registrar – the registrar that held the domain before the transfer – and request an immediate lock and a dispute hold. Most ICANN-accredited registrars have a documented escalation procedure for account-compromise claims. You will need to supply proof of your prior registrant status: archived WHOIS records, billing invoices, renewal confirmation emails, or any registrar-issued credential showing the account was yours.

A registrar lock prevents further transfer while the dispute is investigated. The transfer-reversal window is typically short. ICANN's transfer policy sets procedural requirements on gaining and losing registrars, and a transfer completed through fraud or without proper authorization is subject to challenge within that window. Act fast. Once the domain moves to a second or third downstream holder, the registrar's ability and willingness to reverse the chain diminishes significantly.

If the registrar does not act within a few days of your escalation, the next step is a formal complaint to ICANN's registrar compliance team, which has authority to require registrars to comply with their accreditation obligations. That pressure, combined with a parallel UDRP filing, is often sufficient to restore the registrar lock while the formal proceeding runs.

Evidence of the compromise itself – login anomaly logs, phishing emails, unauthorized registrar-communication intercepts – should be preserved immediately and will be central to any UDRP filing or court action.

What evidence decides the outcome of a .co domain theft case?

In a UDRP over a stolen .co domain, the panel evaluates three categories of evidence: your trademark rights, the absence of any legitimate interest on the registrant's side, and the bad faith of the current holder. For theft cases specifically, the evidence of the unauthorized transfer itself – the method, the timeline, the account from which the instruction originated – is often the most decisive fact.

Trademark rights are established by registration certificates, first-use evidence, or both. Priority matters: a trademark predating the current registrant's acquisition of the domain supports the first element. Brand owners who lack a registered trademark at the filing date can still succeed if they demonstrate acquired common-law rights, though the evidentiary burden is higher.

On bad faith, panels have consistently held that registering a domain corresponding to a known mark – or retaining a domain known to have been transferred without authorization – satisfies the bad-faith element. Passive holding after a fraudulent transfer, with no legitimate use of the domain, has been treated as use in bad faith under the consensus view of the Policy.

Practical evidence types we regularly assemble: prior WHOIS records, trademark registration certificates, the registrar's communication logs, screenshots of any use made of the domain after the unauthorized transfer, and any ransom or buy-back demand from the current holder. A buy-back demand is itself a Paragraph 4(b) bad-faith indicator under the UDRP.

What is the deadline once a case starts?

Once a UDRP complaint commences – meaning the provider has accepted it and notified the respondent – the respondent has 20 days to file a response. That window is fixed by the UDRP Rules and does not vary by forum. If the respondent does not file, the case proceeds on the complaint alone. Missing the deadline is not an automatic loss for the complainant, but default does shift the proceeding: the panel decides on the evidence presented, and an unrebutted complaint supported by solid evidence typically results in transfer.

For the complainant, there is no hard filing deadline imposed by the UDRP itself – the Policy does not prescribe a limitation period. However, delay creates practical problems. Laches has occasionally been raised as a defense in UDRP proceedings, and while panels have generally declined to apply it as a rigid bar, long delays weaken the factual narrative and allow the registrant more time to build a legitimate-use record. File promptly.

After the response period closes, the provider appoints the panel. A single-member panel is the default. Either party may request a three-member panel; the requesting party pays the difference, unless the other side also elects three members, in which case the parties share the higher fee. The full case – from filing to decision – normally concludes in about two months under standard WIPO procedure.

What if the registrant does not respond?

Default – where the current holder of the stolen .co does not file a response within the 20-day window – does not mean automatic transfer. The panel still applies all three UDRP elements to the evidence in the complaint. What default does is remove any rebuttal evidence. The panel cannot make factual findings that favor the registrant based on facts that were never entered into the record.

In practice, a well-evidenced complaint against a defaulting respondent has a strong outcome profile. Panels regularly transfer domains where the complainant's trademark is clear, the bad-faith indicators are documented (a buy-back demand, a pattern of registration, use for a competing or deceptive site), and the respondent offers nothing to explain a legitimate interest.

Default does not, however, relieve the complainant of the burden of proof. Panels have denied transfer even where the respondent did not appear, where the complainant's evidence was insufficient on one of the three elements. The complaint document itself must be complete and internally consistent, because it stands alone.

Can the decision be appealed or challenged?

The UDRP provides no formal appeal mechanism. A panel decision to transfer or cancel is final within the arbitration process. However, Paragraph 4(k) of the UDRP gives both parties a ten-business-day window after the decision to commence a court action – and if a court action is filed in time, the registrar will not implement the transfer until the court proceeding concludes or is dismissed. This is called a "court-ordered stay" of the UDRP decision.

For the losing registrant, the court route is the only way to reverse a transfer order. That court action must be filed in a jurisdiction with authority over the registrar or the domain. For .co registrars, those are typically ICANN-accredited US or other internationally recognized registrars, and the relevant jurisdiction will vary by registrar agreement.

For the losing complainant – one whose complaint was denied – a court action on the underlying trademark or cybersquatting claim is also available and is not barred by the UDRP decision. The UDRP finding is not res judicata in a court proceeding; it is persuasive evidence at most.

A finding of Reverse Domain Name Hijacking (RDNH) – available where a panel concludes the complaint was brought in bad faith to strip a legitimate registrant of a domain – carries no monetary penalty but is a formal reputational finding recorded in the case database. We have defended registrants in proceedings where RDNH was sought and obtained.