Step-by-step: bring a court action when UDRP cannot reach a .co domain

Step-by-step: bring a court action when UDRP cannot reach a .co domain. UDRP and ccTLD domain recovery and defense across .co. Email the firm to assess your ca…

A brand owner finds its name registered as a .co – points at a pay-per-click page, or worse, a site that impersonates the genuine company. The UDRP is the obvious first thought. But the .co registry, administered by Colombia's Internet governance authority, operates under rules that make the arbitration path both available and, at times, insufficient. When arbitration falls short, a court action becomes the only route to the remedy that actually fits.

The .co zone sits in a position that surprises many brand owners: WIPO administers a UDRP-based dispute procedure for .co, giving complainants access to the standard three-element test and a decision timeline of roughly two months at a WIPO filing fee starting at USD 1,500 for a single-member panel. But transfer, cancellation, and injunctive relief do not always exhaust the remedies a brand needs. When the registrant's conduct involves fraud, account compromise, or damages that exceed the arbitration remedy, court action – handled with local litigation counsel in the relevant jurisdiction – is the route that reaches further.

This guide walks each step of the court route for .co cybersquatting disputes, flags the trap hidden in each one, and explains how to decide whether to go to court at all.

Does the UDRP actually apply to .co, and what does it give you?

Yes: .co operates under the UDRP administered by WIPO, meaning the standard Paragraph 4(a) three-element test applies – confusing similarity to a mark you hold, no legitimate interest by the registrant, and registration and use in bad faith. The UDRP's remedies for .co are transfer or cancellation of the domain. Nothing more.

That limitation matters. If you need the registrant's profits, if you want damages for losses caused by a fraudulent site using your brand, or if the domain was taken from your own account through a compromise – none of those remedies are available inside the UDRP. The Policy says so plainly: no monetary damages, no costs award, no injunction. A UDRP win hands you the domain string. The harm already done remains unaddressed.

A second limitation is equally practical. The UDRP requires that the domain was registered and is being used in bad faith – both prongs, cumulatively. Where the registration was arguably legitimate at the outset and bad-faith use only developed later, panels have sometimes denied transfer even when the current use looks plainly abusive. In those cases, court action under the applicable national anticybersquatting or unfair competition rules lets you argue the full factual history without being confined to the binary yes/no of the Policy.

A third situation goes beyond what "insufficient" means: domain theft. If someone compromised your registrar account and transferred a .co you owned to a new registrant, you are not the complainant in a UDRP – you are the rightful owner seeking return of property. That is a court matter, or a registrar escalation followed by a court matter, not an arbitration.

For an assessment of whether your .co situation warrants the UDRP, court action, or both, contact info@cognomenlaw.com.

Step 1: Determine whether court action is the right route before you file anything

Before filing a court action – or a UDRP complaint – map the remedies you actually need against what each forum provides. This is the decision that saves money and avoids a procedural dead end.

The UDRP at WIPO is usually faster and cheaper for one goal: getting the domain name transferred. If transfer alone solves the problem, the UDRP is almost always the right first move. The trap in Step 1 is filing a court action as a reflex when arbitration would have been both adequate and quicker.

Court action is the right route – or a necessary parallel route – in four situations:

• You need monetary damages or an account of profits from a party that used your brand to divert revenue.
• The domain was stolen from your registrar account through compromise, unauthorized transfer, or identity fraud, and you need a court order compelling the registrar or new registrant to reverse the transfer.
• The registrant is using the .co to commit fraud – impersonating your company in invoices, emails, or payments – and you need injunctive relief to stop the harm immediately, not in two months.
• The UDRP panel denied your complaint on a close element (a finding that the registrant had a plausible legitimate interest, for instance), and re-filing would face a near-identical record.

In our practice, the most common reason brand owners come to us for the court route on .co is the third category: a fraudulent site is actively causing customer-facing harm, and a UDRP timeline – even an expedited one – is not fast enough.

Step 2: Lock the domain before the registrant moves it

A registrar lock – technically a status code that prevents transfers, updates, and deletions – is the first protective measure and the most time-sensitive one. If the registrant learns that proceedings are coming, the domain may be transferred to a different registrar or a privacy-screened third party before you can stop it. Once that happens, the chain of custody becomes harder to establish and enforcement of any order requires a second round of proceedings against a new holder.

For .co domains, the registry authority can in certain circumstances place a hold on a domain when legal proceedings are formally notified. The mechanics vary. The trap in Step 2 is assuming the lock will happen automatically when you instruct counsel. It does not. Someone must actively contact the registry or the registrar – or both – with formal notice of the pending or intended proceedings, supported by documentation.

If the domain was stolen from your own account, the registrar has its own dispute and reversal procedures triggered by evidence of account compromise. In our experience handling domain recovery after hijacking, registrar escalation and a registry hold are the first two actions, run in parallel, on the day the compromise is identified. A court application for interim relief follows as the third action if the registrar does not act within its own published timeframe.

The realistic timeline for a registry hold request: days, not weeks – but only if the request is supported with the right documentation. File without a trademark certificate, a declaration, or a filed court complaint, and the request may sit unresolved.

Step 3: Identify the correct court and the applicable law

This is where the cross-border complexity of .co disputes becomes concrete. The .co domain is administered by Colombia's registry authority, but the registrant may be anywhere in the world, and the plaintiff (you) may be in a third country. Court jurisdiction does not follow the domain's ccTLD.

The applicable court and law depend on three things: where you, the trademark owner, are established; where the registrant is located or incorporated; and where the infringing conduct caused harm. In practice, most brand owners filing against a foreign .co registrant will choose their home jurisdiction – typically the US, the UK, or an EU member state – if their trademark registrations and the bulk of the harm are grounded there.

US anticybersquatting litigation allows a court action against a domain itself (in rem) when the registrant cannot be served or is unknown. That route can reach the .co registration even when the registrant is overseas and unidentifiable. The trap in Step 3 is assuming that only Colombian courts can address a .co dispute. They can – but they are rarely the only option, and for most international brand owners they are not the most practical one.

We assess jurisdiction early and in detail, because the choice of court determines the remedy available, the timeline, and the cost. We then engage local litigation counsel in the relevant jurisdiction to manage the court filing and hearings while we coordinate the domain-specific strategy.

To weigh UDRP against a court action for your .co case, email info@cognomenlaw.com.

Step 4: Assemble the evidence record before filing

The evidence that decides a court action for .co cybersquatting is broader than the evidence you would file in a UDRP – and the evidentiary standard is higher. A UDRP panel decides on the papers alone; a court may require a higher threshold of proof, particularly for interim injunctive relief, where you must typically show a strong case on the merits, irreparable harm, and that the balance of convenience favors relief.

What evidence decides the outcome? In our work on cybersquatting and domain theft matters, the record that carries the most weight includes:

• Trademark ownership and priority: certified copies of trademark registrations covering the relevant classes and territories, plus evidence of use preceding the domain's registration date.
• Registration history of the domain: RDDS/WHOIS snapshots over time, archived pages from the Wayback Machine or equivalent, and the original registration date versus your first trademark use.
• The registrant's conduct: screenshots of the site at the disputed domain, evidence of PPC advertising monetizing your brand, any communications in which the registrant offered to sell the domain at a price above documented registration costs, and – in theft cases – server logs or access logs showing unauthorized account activity.
• Harm evidence: customer complaints, diverted orders, emails received from the fraudulent site, or in the case of invoice fraud, actual payment records showing diversion of funds.
• Expert evidence on damages: where you are seeking monetary relief, a forensic account of revenue impact or a profit analysis of the registrant's monetization income.

The trap in Step 4 is gathering evidence that satisfies a UDRP record but falls short of the court standard. A screenshot of a parking page proves bad use; it does not, standing alone, prove the registrant's identity, their intent at registration, or your financial loss. Each of those additional elements needs its own documentary support.

In a recent matter – a .co impersonation dispute, spring 2025 – a client came to us after a failed UDRP attempt where the panel found the evidence of registration-date bad faith insufficient. We rebuilt the evidence record with trademark priority documents, archived site captures from before the UDRP filing, and a declaration from the registrant's prior communications that the UDRP record had not included. The court accepted the full record for the interim application.

Step 5: File for interim relief first, then the substantive claim

For most .co cybersquatting court actions where active harm is occurring, the filing sequence is: interim application for injunction and domain hold, then the substantive infringement or anticybersquatting claim. This order matters because the domain may continue causing harm – or be transferred away – during the months it takes to reach a full trial or hearing on the merits.

An interim injunction in a cybersquatting case typically requires the applicant to demonstrate a serious question to be tried (or a strong prima facie case, depending on jurisdiction), that damages alone would not be an adequate remedy, and that the balance of convenience favors granting the order. Courts in the US, the UK, and the major EU jurisdictions have all granted interim relief in domain-name cases where active confusion or fraud was ongoing.

The substantive claim follows the interim order and covers the full range of remedies the court can award: a final order for transfer of the domain, an account of profits from the registrant's monetization, damages for trademark infringement or passing off, and costs. The timeline for a substantive case varies significantly by jurisdiction – from several months in a streamlined IP track to over a year in a general commercial list. We set realistic expectations on this at the outset.

The trap in Step 5 is treating the interim application as an afterthought. Some counsel file the substantive claim first and then seek injunctive relief as a secondary motion. In a live-harm situation that sequence wastes the window when courts are most receptive to emergency relief.

Step 6: Enforce the court order against the registrar and the registry

A court order directing transfer of a .co domain must be enforced at the registrar and registry level. Unlike a UDRP decision – where the registrar implements transfer automatically once the Policy's waiting period passes – a court order requires the winning party to present the order to the registrar and formally request implementation. If the registrar or the registry is not a party to the proceedings, a separate enforcement step may be needed.

For a domain that was hijacked and transferred to a new registrar during the dispute, the order may also need to be served on the receiving registrar – which may be in yet another jurisdiction. We coordinate the enforcement step with local litigation counsel in each relevant country, tracking the registrar's implementation obligations and the registry's published transfer procedures for court-ordered changes.

The trap in Step 6 is assuming that winning in court means the domain moves automatically. It does not. A transfer order must be operationalized through the registration system, and delays at the registrar level are common when the order originates from a foreign court. Monitoring the implementation step – and following up formally if it stalls – is part of the service, not an afterthought.

How does this compare to the UDRP, and when should you run both in parallel?

Running a UDRP complaint and a court action in parallel is possible for .co. The UDRP Rules permit a panel to suspend or terminate proceedings if the matter goes to court, but they do not prohibit a complainant from filing both simultaneously. The practical question is whether the expense of parallel tracks is justified.

Parallel proceedings make sense in one specific situation: you need the domain back fast (UDRP timeline) but you also need damages or an injunction (court). Filing both lets the UDRP run toward a transfer order while the court addresses the larger harm. The risk is that if the UDRP is decided first – transferring the domain – the court action loses some of its urgency, and costs increase without proportional benefit.

The alternative decision path: if the harm is active and financial, file for interim injunctive relief in court immediately, and then assess whether to file the UDRP once the interim order is in place. By then the domain is locked; the UDRP can proceed without the urgency that drives the parallel-filing cost.

For a .co dispute where the only goal is transfer and the registrant is clearly a cybersquatter, the UDRP alone – at WIPO, with a UDRP filing fee starting at USD 1,500 – is typically faster and less expensive than court. For a .co dispute involving impersonation, theft, or revenue diversion, court is the route that reaches the full remedy. The choice is fact-specific, and it is the first question we work through with every client who contacts us about a .co matter.

Related at COGNOMEN

• Court recovery and anticybersquatting litigation – service overview and how COGNOMEN approaches court-route matters
• Court action for cybersquatting in .eu zones – analysis of when court beats arbitration in European disputes
• Recovering a passively held domain in the finance sector – step-by-step guide to passive-holding UDRP strategy