Step-by-step: prove bad faith registration of a .io domain

A startup discovers its exact product name registered as a .io domain – pointing at a parked page with a "buy this domain" banner. The registrant is anonymous. The domain is yours by reputation, if not by title. What does it actually take to get it back?

To prove bad faith registration of a .io domain, you must satisfy all three elements of Paragraph 4(a) of the UDRP: confusing similarity to a trademark you hold, the registrant's lack of legitimate interest, and that the domain was registered and is being used in bad faith. .io operates under WIPO's dispute-resolution procedures, so a standard complaint proceeds in about two months, with the filing fee starting at USD 1,500. The only remedies are transfer or cancellation – no damages, no costs.

This guide walks each step in order, flags the trap inside each one, and sets out what evidence actually decides the outcome.

Does the UDRP apply to .io domains?

Yes – .io has adopted WIPO as its dispute-resolution provider, which means the Uniform Domain Name Dispute Resolution Policy governs .io just as it governs .com, .net, and .org. That is the starting point every complainant must confirm before investing in a filing.

The practical effect is significant. A brand owner pursuing a .io registration does not need to locate a local administrative court or translate filings. The same three-element test, the same evidence standards, and the same WIPO procedure apply as for a gTLD dispute. The panel language is English by default. WIPO administers the case from filing to decision.

One nuance worth noting: .io carries a distinct market character. It is the country-code for the British Indian Ocean Territory, but the tech startup community adopted it broadly as a generic zone. Panels have addressed .io disputes under the full UDRP framework, treating .io with the same analytical rigor applied to .com complaints. There is no local "abusive registration" test – the three cumulative UDRP elements control.

The trap here is assumption. Not every ccTLD uses the UDRP or a close variant. For any ccTLD not confirmed through WIPO's list, the governing national procedure applies – and that is a materially different filing. For .io, WIPO is the right forum. Confirm this against current registry rules before filing, because registry policy can change.

Step 1: Establish that you hold trademark rights

The first element of Paragraph 4(a) asks whether the disputed domain is identical or confusingly similar to a trademark in which the complainant has rights – and panels read the similarity question narrowly and objectively. The trap is thinking that reputation alone, or a pending application, is enough.

Registered trademark rights are the clearest basis. A registration predating the domain – in any jurisdiction, for any class – is generally sufficient to satisfy the threshold similarity question. Panels are not asking whether your mark is famous or whether the registrant knew of it; they are asking whether the domain string is the same as, or confusingly similar to, the mark text.

Unregistered (common law) marks can also satisfy the element, but they require more work. The complainant must show that the mark had acquired distinctiveness through use before the domain was registered. Evidence for that claim includes sales figures, press coverage, advertising spend, and third-party references to the brand by name. The burden is on you to prove it, and panels are skeptical of thin records.

Generic or descriptive terms create a particular problem. If your mark is a common word or phrase – even one registered with a design element – panels will examine whether the domain registrant could plausibly claim an independent connection to that word. A string that is purely descriptive of a product category raises the legitimate interest question at the first element stage, not just the third.

What does the similarity test actually measure? Panels compare the alphanumeric text of the domain (ignoring the zone suffix) against the text of the mark. Identical: obvious. Confusingly similar: the domain incorporates the mark in full, or misspells it by one character, or adds a generic word ("app", "io", "get"). A domain that includes your complete mark plus a generic suffix almost always satisfies element one.

The evidence you need at this step: a copy of the trademark registration certificate, the registration number and jurisdiction, the filing date, and the goods or services listed. If you rely on unregistered rights, compile a dated evidence bundle – invoices, media coverage, and product documentation, all predating the domain registration date.

Step 2: Show the registrant has no legitimate interest

Element two asks whether the registrant has rights or legitimate interests in the domain. Panels have consistently recognized that a complainant cannot prove a negative with direct evidence – so the accepted approach is to make a prima facie showing that no such interest exists, and then shift the burden to the registrant to produce evidence in rebuttal. If the registrant defaults and files no response, panels typically proceed on the record before them.

Paragraph 4(c) of the UDRP identifies three safe harbors the registrant may invoke: a bona fide offering of goods or services before notice of the dispute; being commonly known by the domain name; or a legitimate noncommercial or fair use without intent to mislead. Anticipating each of these and why they do not apply is the complainant's job.

What is the registrant actually doing with the .io domain? Check the live site and retrieve historical screenshots through a web archiving service. A parking page with pay-per-click links that trade on the complainant's mark undercuts any bona fide-use claim. A site that has been blank since registration is also probative. A site with competitive content, or one that redirects to a competitor, points toward bad faith under Paragraph 4(b).

Is the registrant known by the domain name? Run a WHOIS or RDDS query on the domain and check whether the registrant's name, organization, or prior online presence has any connection to the domain string. If the registrant is a privacy service and the underlying identity has no obvious link to the mark, that absence of connection supports your prima facie showing.

The trap in this step is underestimating the registrant's rebuttal. In our experience advising complainants, the cases that fail at element two often fail because the complainant presented a thin prima facie showing and the registrant produced an invoice, a trademark application, or a dated business registration – even a weak one – that the panel treated as raising a triable legitimate interest. The remedy is to research the registrant's background before filing and address every plausible safe harbor in the complaint.

If you are working through whether the registrant's conduct defeats a legitimate-interest claim, contact us at info@cognomenlaw.com for a preliminary assessment of the three UDRP elements and the evidence you will need.

Step 3: Prove the domain was registered and is being used in bad faith

This is the hardest step – and the one where most .io complaints are won or lost. Paragraph 4(a)(iii) requires a showing that the domain was both registered in bad faith and is being used in bad faith. The requirement is cumulative. A domain registered innocently and later used abusively, or registered badly but since redirected to an innocuous site, may not satisfy both limbs.

Paragraph 4(b) provides non-exhaustive examples of bad-faith circumstances that a panel may take into account:

• Registration primarily to sell the domain to the mark owner or a competitor for an amount exceeding the registrant's out-of-pocket costs – the classic "buy-back" scenario.
• Registration to prevent the mark owner from reflecting its mark in the domain, combined with a pattern of such conduct.
• Registration primarily to disrupt the business of a competitor.
• Use of the domain to attract users to the registrant's site by creating a likelihood of confusion with the complainant's mark for commercial gain.

None of these examples is exhaustive. Panels have also recognized bad faith in less obvious forms: passive holding of a domain with no plausible use (particularly when the complainant's mark is well known), warehousing a domain within a portfolio of trademark-matching names, or offering it on a domain marketplace at an inflated price.

The evidence that panels find most persuasive includes: the date of the domain registration relative to the trademark's first use and the registrant's awareness of the brand; any direct communications in which the registrant demanded a purchase price; historical screenshots of the domain showing parking, pay-per-click links using the complainant's branded terms, or competitive redirection; WHOIS records showing the same registrant holding other trademark-matching domains; and records of other UDRP proceedings involving the same registrant.

The registration timing matters acutely for .io. If a registrant took the domain on the same day your product launched or your funding round was announced, the proximity in time is strong circumstantial evidence of targeting. If the domain predates your mark, the reverse is true – and the panel may find that the complainant simply could not prove registration in bad faith.

In a recent matter (a .io domain, spring 2025), we assembled a complaint for a technology company whose product name had been registered by an overseas party within days of a public launch announcement. We documented the registration date against the launch date, retrieved parking-page screenshots, and produced prior communications in which the registrant quoted a five-figure sale price. The panel transferred the domain approximately eight weeks after filing. No damages were available – the UDRP does not reach money – but the brand was restored to its owner.

How do you pick the right forum and panel configuration?

WIPO is the dominant forum for .io disputes and handles the overwhelming majority of UDRP proceedings globally alongside the Forum. For a .io complaint involving one to five domains and a single-member panel, the WIPO filing fee is USD 1,500; a three-member panel costs USD 4,000. The Forum is a viable alternative at a slightly different fee structure, starting around USD 1,300.

When should you choose a three-member panel? The calculus turns on complexity and stakes. A three-member panel costs more and typically takes somewhat longer, but it carries more persuasive weight on points of genuine legal uncertainty – for example, where the legitimate-interest question is close, or where the complainant's mark is descriptive and the bad-faith case depends on circumstantial timing evidence rather than a direct "buy-back" email. For a straightforward case with a clear registration-in-bad-faith record, a single-member panel is efficient and sufficient.

If the registrant requests a three-member panel but you filed for a single member, the parties generally split the higher three-member fee. Build that possibility into your cost estimate before filing.

What about the alternative of waiting and doing nothing? A registrant who holds a domain over time may actually strengthen a later defense: the longer the gap between registration and your complaint, the more the registrant can argue acquiescence or independent development of a connection to the name. Delay is not neutral. If the three elements are met now, filing promptly is generally preferable to waiting for additional bad-faith evidence to accumulate.

Decision matrix in brief: if the domain is a .io and you want it transferred, the UDRP at WIPO is the applicable route – same test as .com, same remedies, same timeline. If the dispute also involves a .com or .net registration by the same registrant, a single UDRP complaint can cover all domains held by that registrant. If it involves a .de by contrast, neither the UDRP nor this guide applies – that dispute belongs in the German courts, with a DENIC DISPUTE entry to block transfer during litigation. If you want damages in addition to transfer, a court action (US anticybersquatting litigation or equivalent) is the only path that reaches money, handled with local litigation counsel in the relevant jurisdiction.

If a prior UDRP filing produced a denial, or if you are unsure which forum fits a multi-zone situation, email info@cognomenlaw.com – a focused second read often finds the element that was missed or the forum choice that changes the outcome.

What evidence should you gather before filing?

Evidence is the lever that moves a panel. UDRP proceedings are document-based; there is no discovery, no oral hearing, and no cross-examination. Everything the panel sees is what you put in the annexes to your complaint. Gaps in the record are gaps in your case.

Build the evidence bundle in four layers, aligned to the three elements:

1. Trademark rights: registration certificate (or equivalent first-use evidence for unregistered marks), dated and jurisdiction-identified.
2. No legitimate interest: WHOIS/RDDS printout of the domain record, dated; historical and current screenshots of the domain's landing page; any business registration search showing the registrant is not known by the domain name; a search of the registrant's other domain holdings.
3. Bad faith – registration: the domain registration date (from WHOIS history or a registrar-confirmed record); your brand's first public use date; any contemporaneous event (product launch, press release, funding announcement) the registrant could have seen; prior UDRP decisions involving this registrant, if any.
4. Bad faith – use: archived screenshots showing parking links, competitive advertising, or a "buy this domain" offer; email threads or marketplace listings in which the registrant stated a sale price; evidence that the page deceives users into believing it is affiliated with your brand.

The trap in evidence gathering is over-relying on a single proof type. A panel that sees only a certificate and a screenshot of a blank page may find the bad-faith showing thin, particularly if the registrant produces a plausible explanation. The strongest complaints layer the evidence: timing, a pattern of conduct, and a communications record that shows the registrant knew exactly what name it was taking.

In our practice advising brand owners, we regularly see complaints undermined because the complainant gathered evidence of current bad use but not of original bad-faith registration. A domain repainted after the complaint was filed does not cure the registration – but the original registration conduct must be evidenced too. Save the earliest available archived screenshots, dated, before the registrant becomes aware of the dispute and alters the site.

What happens after filing, and what are the risks?

Once WIPO receives the complaint and confirms it is formally compliant, the case commences. The registrant then has 20 days to file a response. If no response is filed, the case proceeds to panel appointment on the record as submitted.

A single-member panel case is normally decided within about two months of filing. After the decision, the registrar implements any transfer order, typically within a short implementation window set by WIPO's procedures. If the decision orders transfer and the registrant does not seek a stay through a court action within that window, the domain moves to the complainant.

What are the realistic risks? Four stand out. First, a finding that the registrant has a legitimate interest – often because the complainant's mark is generic or the registrant produced a business connection the complainant did not anticipate. Second, a finding that the registration predates the mark and therefore cannot have been in bad faith at the time of registration – the panel cannot rewrite history. Third, a denial on the bad-faith use limb, where the domain is dormant and the complainant cannot show affirmative bad-faith conduct. Fourth – and most reputationally damaging – a finding of Reverse Domain Name Hijacking, available where the panel concludes the complaint was brought to deprive a legitimate registrant of its domain. An RDNH finding carries no monetary penalty, but it is published and can affect credibility in future proceedings.

We defend registrants against abusive UDRP complaints, including in .io disputes, and we seek RDNH findings where the evidence warrants. A complainant who is not certain of the three elements should get a candid assessment before filing – not after receiving a denial with an RDNH finding attached.

Related at COGNOMEN

• UDRP Recovery – full service overview for complainants recovering gTLD and ccTLD domains
• Serial cybersquatters under the UDRP – how panels identify a pattern and what the evidence shows
• National dispute procedures beyond the UDRP – when a ccTLD has its own rules

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.