Step-by-step: file a UDRP complaint for a .co domain

Step-by-step: file a UDRP complaint for a .co domain. UDRP and ccTLD domain recovery and defense across .co. Email the firm to assess your case.

A brand owner discovers that a stranger registered the .co version of its mark. The domain resolves to a parking page crowded with competitor links – or to nothing at all. A five-figure buy-back demand arrives shortly after. The question is whether a UDRP complaint is the right move, and how to run one correctly from the first document to the transfer order.

The .co registry has adopted the UDRP, which means you can file a UDRP complaint for a .co domain at WIPO, the Forum, or another accredited provider in exactly the same way you would for a .com. To succeed, you must satisfy all three elements of Paragraph 4(a): confusing similarity to a mark you hold, absence of any legitimate interest in the registrant, and registration plus use in bad faith. A standard case runs approximately two months; the only remedies available are transfer or cancellation of the domain.

This guide walks each step in sequence, flags the trap hidden inside it, and shows where the evidence either makes or breaks the case.

Step 1: Confirm that the UDRP applies to your .co domain

The .co registry – operated under Colombian country-code authority but marketed globally – has contractually adopted the UDRP, placing it alongside .com, .net, and the other gTLDs where the Policy runs. That means WIPO, the Forum, CAC, and ADNDRC are all available as providers. You do not need to file in a Colombian court or engage a Colombian administrative procedure merely because the zone is .co.

The trap at this step is assuming the .co rules are identical to a pure gTLD in every respect. They are functionally identical for UDRP purposes – the three-element test, the remedies, and the timelines all apply – but the registry's own policies on eligibility and transfer mechanics may impose conditions on the inbound transfer once a decision issues. Confirm with the registrar that the domain is not subject to a registry-level lock or a local eligibility restriction before you file. Finding a procedural block after winning costs time and money.

Also check the WHOIS record. Is the registrant using a privacy or proxy service? That does not bar the complaint, but it affects how the commencement notice is served and may require the provider to de-anonymize the record as the first procedural step. In our practice, privacy-masked .co registrations account for a meaningful share of the cases we assess; the practical answer is to proceed, because the UDRP provider's commencement procedures are designed for exactly this situation.

To confirm whether the UDRP applies to your specific .co situation, contact info@cognomenlaw.com for an assessment before drafting begins.

Step 2: Map all three UDRP elements before you draft

Every complaint that fails does so because the complainant entered the drafting phase without a clear-eyed reading of each element. The three-element test of Paragraph 4(a) is conjunctive – all three must be met, and a weakness in any one is fatal.

Element 1 – Confusing similarity. You need rights in a mark. A registered trademark is the strongest foundation; unregistered common-law rights are accepted by panels but require evidence of secondary meaning and market use. The domain's second-level string is compared to your mark, the .co extension is typically disregarded, and the test is whether an ordinary observer would find confusing similarity. A domain that adds a generic term to your exact mark – "buymybrandname.co" – generally clears this element. A domain that uses only a descriptive word you also happen to use as a mark will not.

Element 2 – No rights or legitimate interests. You cannot prove a negative directly; the consensus approach is to make a prima-facie showing that shifts the burden to the respondent. Panels look at whether the registrant was commonly known by the domain name before the dispute, whether it made a bona-fide offering of goods or services under that name, or whether the use is a legitimate noncommercial or fair use. The Paragraph 4(c) safe harbors are the respondent's best defenses. Mapping this element means identifying every piece of evidence that refutes each safe harbor in turn.

Element 3 – Registered and used in bad faith. The word "and" is not accidental. Panels apply a cumulative test: both registration and use must be in bad faith. A registrant who registers a domain before your mark exists cannot be found to have registered in bad faith, even if later conduct is predatory. Paragraph 4(b) lists non-exhaustive bad-faith indicators – an offer to sell to the mark owner at a price exceeding out-of-pocket costs, a pattern of abusive registrations, registration to disrupt a competitor's business, or intentional confusion for commercial gain. Passive holding of a domain can also satisfy this element if the surrounding circumstances rule out any good-faith purpose.

How does the evidence make or break a .co UDRP case?

Evidence is where the theoretical mapping of Step 2 either becomes a winning record or exposes a gap that the respondent will exploit. Panels decide on written submissions alone; there is no oral hearing, no cross-examination, and no discovery. What you submit in the complaint is, largely, what the panel sees.

For Element 1, the core evidence is the trademark certificate or, for common-law rights, a bundle of use: advertising invoices, press coverage, web-traffic data, and dated product records. The earlier the first use and the broader the geographic reach, the stronger the case that the registrant knew about your mark when they registered the .co.

For Element 2, gather every public record that shows the registrant has no connection to your name – no business registration, no trademark filing of their own, no prior use of the string in any documented context. Screenshot the resolving page and archive it with a timestamped tool. If the domain parks with pay-per-click links on competitor products, that is evidence the registrant is not using the name legitimately.

For Element 3, the registration date relative to your first trademark use is critical. Pull the registrar's RDDS or WHOIS record showing the creation date. Then show the panel a coherent story: your mark was well-known in the market, the registrant registered the .co months or years after your mark became recognizable, and the domain resolves in a way that exploits the association. Circumstantial evidence matters here. A registrant who holds dozens of typosquats has a different profile from one who registered a single dictionary word that happens to resemble your brand.

The trap in evidence collection is over-relying on the strength of Element 1 and underbuilding Elements 2 and 3. We regularly advise complainants who have rock-solid trademark registrations but thin records on the registrant's conduct and intent. Panels are not rubber stamps; a weak bad-faith record loses even a strong-mark case.

Step 3: Choose your filing forum

For a .co UDRP, WIPO and the Forum handle the overwhelming majority of cases. The choice matters for cost, timeline, and the procedural culture around supplemental filings and three-member requests.

WIPO charges a filing fee of USD 1,500 for a single-member panel covering one to five domains, and USD 4,000 for a three-member panel over the same range. The Forum's entry-level fee for one or two domains starts at around USD 1,300 for a single-member panel. WIPO also offers an expedited procedure for single-panel cases of up to five domains, delivering a decision in approximately one month – useful when the .co domain is actively redirecting traffic or harming a product launch. CAC offers the lowest entry price point among the four providers, beginning around USD 500–800, though it is the least commonly used.

Which forum fits your situation? If speed is paramount – the domain is actively damaging a campaign and you have a tight evidentiary record – WIPO's expedited path is worth the modest premium over the standard track. If you anticipate that the respondent is sophisticated and may request a three-member panel, budget for the higher fee from the outset. If the respondent requests a three-member panel after you filed for a single-member panel, the parties typically split the higher three-member fee, so the complainant's portion rises to approximately USD 2,000 at WIPO for a one-to-five-domain case.

In our practice, we file the majority of straightforward .co cases at WIPO for its established jurisprudence, its global panel roster, and the predictability of its procedural rules. For budget-sensitive matters where the factual record is clear, CAC or the Forum are legitimate alternatives.

To weigh WIPO against the Forum for your .co complaint, email info@cognomenlaw.com.

Step 4: Draft and file the complaint

The complaint is the single most consequential document in the proceeding. It must meet the formal requirements of the UDRP Rules and the chosen forum's supplemental rules, and it must tell a coherent story that maps each element to specific, documented evidence.

Structure the complaint element by element. Open with the trademark rights – the registration certificate or the common-law evidence. Move to the confusing-similarity analysis: place the domain string and the mark side by side, note the .co extension, and explain why the ordinary observer sees confusion. Then dismantle each Paragraph 4(c) safe harbor. Close with the bad-faith analysis, anchored to the specific Paragraph 4(b) factors that fit your fact pattern.

The trap here is narrative bloat. Panels read many complaints. A 40-page complaint that repeats the trademark history three times dilutes the key points. A focused 12–15 page argument, with annexes holding the evidence, reads more cleanly and signals command of the material. The annexes do the evidentiary heavy lifting; the body text directs the panel's attention to them.

Formal requirements include: a certification by the complainant, the domain(s) at issue, the respondent's identity as best known, the forum of choice, the requested remedy (transfer or cancellation), and the mutual jurisdiction clause. Omitting the certification or misidentifying the forum's supplemental rules version is the kind of procedural error that delays commencement – not a fatal error, but an avoidable one.

Once submitted and the filing fee is paid, the provider reviews the complaint for administrative compliance. Deficiencies trigger a short cure period. After compliance is confirmed, the case commences formally and the 20-day response window begins to run for the registrant.

Step 5: Manage the response window and panel phase

After commencement, the registrant has 20 days to file a response. Most respondents in abusive .co registrations default – they file nothing – and a default generally leads to acceptance of the complainant's factual assertions as uncontested. But a default is not an automatic win; the panel still examines the complaint on its merits against the three-element test.

When a response does arrive, it commonly invokes one of the Paragraph 4(c) safe harbors: the registrant claims it was making a bona fide offering before notice of the dispute, or that it is commonly known by the domain name. In a recent matter (a .co brand dispute, spring 2025), a respondent filed a late response with a back-dated business registration document. The panel rejected it as evidence of legitimate interest because the registration predated the domain creation date by only days and the business showed no actual trading activity. A contemporaneous archive of the resolving page – showing a pay-per-click parking layout – sealed the bad-faith finding.

After the response period, the provider appoints the panel. For a single-member appointment, this typically adds one to two weeks to the timeline. The panel then has 14 days to issue its decision under the UDRP Rules. Altogether, a standard single-member .co case runs approximately two months from filing to decision.

Once a transfer decision issues, the registrar and registry are notified. The domain enters a brief implementation period – typically ten business days – during which either party may seek a stay if they intend to file in a court of mutual jurisdiction. Absent a stay, the registrar transfers the domain to the complainant.

What happens if the registrant files a court action to stay the transfer?

A respondent who loses a UDRP decision may file in a court of mutual jurisdiction – identified in the complaint – within ten business days of the decision to stay the transfer. This is the respondent's safety valve and a legitimate procedural right under the Policy. In practice, very few losing respondents exercise it, because litigating a court stay requires resources and, in most abusive-registration cases, the facts are stacked against the respondent in any forum.

The right route when this happens depends on the zone and the goal. If the respondent files a stay in a US court, the matter may escalate to an anticybersquatting action under applicable US legislation – a route that opens the possibility of damages but also substantially higher legal costs on both sides. If the respondent files in Colombia (the .co registry's home jurisdiction), local litigation counsel in the relevant jurisdiction becomes necessary. We coordinate with local litigation counsel in those situations; we do not parachute into foreign court proceedings without appropriate in-country support.

The decision matrix is straightforward. Dispute is a .co with a clear bad-faith record and no legitimate-use argument from the respondent → UDRP at WIPO, single panel, standard track, roughly two months and USD 1,500 in filing fees. Dispute is the same .co but the respondent has a colorable business-use argument and may fight → three-member panel, budget USD 4,000 in filing fees, expect a fuller record exchange. Dispute involves parallel .com and .co registrations by the same registrant → a single complaint can cover both domains if the same holder owns them, which is efficient. Dispute needs damages as well as transfer → court action, substantially higher cost, qualitatively longer timeline.

Can a legitimate registrant be wrongly targeted – and what is RDNH?

Yes. Not every UDRP complaint is well-founded, and panels have a formal mechanism for cases where a complainant uses the Policy in bad faith to deprive a legitimate registrant of a domain: a finding of Reverse Domain Name Hijacking (RDNH). An RDNH finding carries no monetary penalty, but it is a public record of abuse attached to the complainant's name and its counsel.

RDNH is relevant here for two reasons. First, if you are a brand owner who is uncertain whether the three elements are really met – perhaps your mark is weak or the registration predates it – filing anyway is a reputational and procedural risk. Second, if you are a registrant who has received a complaint you believe is abusive, an RDNH finding is the appropriate relief to seek in your response. In our practice, we handle both sides: we pursue RDNH findings for registrants who are clearly within their rights, and we counsel complainants against filing when the facts do not support all three elements.

The trap for brand owners at this step is conflating ownership of a trademark with automatic entitlement to every domain containing that trademark. Panels distinguish between a mark and a descriptive word, between a mark and a geographic or industry term, and between a registrant who targeted your brand and one who independently uses a word that resembles it. A focused pre-filing assessment of all three elements – before drafting begins – is the single most effective protection against an RDNH finding.

Related at COGNOMEN

• UDRP domain recovery services – complainant filings at WIPO, the Forum, CAC, and ADNDRC
• How to prove no legitimate interest in a UDRP – evidence and strategy for .org disputes
• Domain chain-of-title verification – pre-acquisition due diligence for domain purchases