Step-by-step: recover a .io domain after a failed buy-back negotiation

Step-by-step: recover a .io domain after a failed buy-back negotiation. UDRP and ccTLD domain recovery and defense across .io. Email the firm to assess your ca…

The seller named a price you could not accept. Negotiations stalled, then broke down. Now the domain still sits in someone else's account, pointed at a parked page or a competing site, and every day it stays there costs you brand equity and customer trust. You want to recover a .io domain after a failed buy-back negotiation – and you want to know whether a formal dispute procedure can get it back.

The .io zone uses the UDRP, administered through WIPO and other accredited forums. To prevail, you must satisfy all three elements of Paragraph 4(a) of the Policy: the domain is confusingly similar to a trademark you hold, the registrant lacks any rights or legitimate interests, and the domain was registered and is being used in bad faith. A standard case runs roughly two months from filing to decision, and the only available remedies are transfer or cancellation – not monetary damages.

This guide walks each step in sequence, flags the trap concealed in each one, and shows how a collapsed buy-back changes – and sometimes improves – the evidence picture.

Why a failed negotiation changes the dispute picture

A collapsed buy-back is not merely background color. It reshapes the evidentiary record in ways that can be decisive. When a registrant demands a price that is, on its face, out of proportion to registration costs, that demand is a textbook indicator of the bad-faith circumstance listed in Paragraph 4(b)(i): registration primarily for the purpose of selling to the mark owner for valuable consideration in excess of documented out-of-pocket costs.

That is the first trap. Many brand owners delete the negotiation thread before filing, assuming it is irrelevant once talks fail. It is not. A documented demand – even an informal one by email or through a broker – often supplies the single clearest piece of bad-faith evidence. Preserve every message, screenshot, and broker communication in its original format, with metadata intact. Do not reply to the other side once you decide to file; any new communication can muddy the record.

The second trap is subtler. Initiating a negotiation can, in rare cases, be used by a creative respondent to argue that you effectively acknowledged the registrant's ownership interest. Panels have consistently rejected this argument where the mark predates the domain registration, but the argument exists. Brief your filing counsel on the full negotiation history before anything is sent.

Step 1: Confirm that the UDRP applies to your .io domain

The .io zone – the country-code top-level domain for the British Indian Ocean Territory – has elected to use the UDRP, making it one of more than 87 ccTLDs administered under WIPO's dispute-resolution service. That means the same three-element test and the same procedural rules that govern .com disputes apply here.

The confirmation check matters because not every ccTLD works this way. The .de zone, for example, has no UDRP equivalent; disputes go through the German courts, with a DENIC dispute entry as an interim measure. The .uk zone uses Nominet's own DRS, with its distinct "abusive registration" test and a free mediation stage. For .io, none of those detours apply – you file at WIPO, the Forum, the Czech Arbitration Court (CAC), or the ADNDRC under the standard Policy.

The practical check: confirm that the registrar to which the domain is currently accredited accepts UDRP proceedings. Most major accredited registrars do, and the ICANN-accredited registrar list is public. If the registrant has moved the domain to a less cooperative registrar, note this before filing – the panel still has jurisdiction, but implementation of any transfer order may require follow-up with ICANN.

Step 2: Audit your trademark rights before filing

Paragraph 4(a)(i) requires that you hold rights in a mark to which the disputed domain is identical or confusingly similar. This step hides its own trap: the threshold is lower than most brand owners expect, but it must be met precisely.

You do not need a registered trademark, though registration in any jurisdiction substantially strengthens the case. Panels have consistently recognized unregistered (common law) trademark rights where the claimant can document sustained use of the name in commerce, associated goodwill, and recognition in the relevant market. For a .io domain – heavily associated with technology and startup sectors – common law rights in a software product name or a SaaS brand name are routinely accepted where use is well evidenced.

Gather the following before filing: registration certificates and their priority dates; evidence of use (product launch records, press coverage, advertising spend records, customer correspondence, invoices); and documentation showing the domain registrant's registration date relative to your earliest mark use. If the registrant registered the domain before your mark rights arose, the first element may still be met, but the third element (bad faith at the time of registration) becomes markedly harder. That date gap is a structural problem that no filing strategy fully cures.

One further sub-trap: if you filed a trademark application after the buy-back negotiation broke down and specifically to support a UDRP, panels scrutinize that sequence carefully. Such a filing does not automatically defeat the complaint, but it weakens the rights narrative and may support an RDNH finding if the respondent raises it.

For a read on whether your trademark position satisfies the first element of the UDRP, reach us at info@cognomenlaw.com.

Step 3: Establish that the registrant lacks rights or legitimate interests

Paragraph 4(a)(ii) requires proof that the registrant has no rights or legitimate interests in the domain. The burden here is formally on the complainant, but panels apply a practical reversal: once you make a prima facie case, the burden shifts to the registrant to produce evidence of a legitimate interest under Paragraph 4(c).

The three Paragraph 4(c) safe harbors you need to negate are: (1) the registrant was making a bona fide offering of goods or services before notice of the dispute; (2) the registrant is commonly known by the domain name; (3) the registrant is making legitimate noncommercial or fair use without intent to mislead or divert.

For a domain held for resale – the typical posture after a failed buy-back – none of the three safe harbors applies. A parked page monetizing pay-per-click traffic is not a bona fide offering. A registrant who registered a string matching your brand is not "commonly known" by it. And a page offering the domain for sale is neither noncommercial nor fair use. Document the domain's current use by taking dated screenshots, capturing the WHOIS/RDDS record, and archiving any content via an independent web-archive service.

The trap: if the registrant has quietly pivoted the site to something that looks like a genuine business since the buy-back talks collapsed, your element-two narrative weakens. Act with some urgency once negotiations end.

Step 4: Build the bad-faith record from the negotiation evidence

This is the step the negotiation failure most directly shapes. Bad faith under Paragraph 4(a)(iii) must be shown at registration and in current use – the cumulative standard that distinguishes the UDRP from the Nominet DRS, which reads "registered or used" abusively.

For the registration prong, the clearest evidence is typically that your mark was already distinctive or well known in the registrant's territory when the domain was registered. Supporting materials: your earliest trademark filing or first use date, any press or industry coverage predating the registration, and any evidence that the registrant was aware of your mark (for example, the registrant's own business is in the same sector).

For the use prong, the failed buy-back supplies the best evidence you will have. Paragraph 4(b)(i) bad faith includes registration "primarily for the purpose of selling" to the mark owner for excessive consideration. An email chain in which the registrant demanded a sum clearly exceeding registration costs – or cited your brand's commercial value as a pricing basis – is compelling. Panels have consistently held that a pattern of demanding disproportionate sums from the brand owner satisfies this limb, even where no sale ultimately occurred.

In a recent matter (a .io domain in the technology services sector, spring 2025), we built the entire bad-faith case on a three-email thread in which the registrant named a five-figure sum and referenced the brand's recent funding round. The panel found bad faith at registration on that record alone. No special sleuthing was required – only preservation of the negotiation trail that the client had nearly discarded.

The trap at this step: resist the temptation to send one more "settlement" email after deciding to file. Any fresh communication restarts the evidentiary clock and may allow the registrant to craft a response that undermines the thread you already have.

Step 5: Choose the forum and prepare the complaint

For a .io dispute, the main forum choice is WIPO versus the Forum. WIPO is the largest provider – handling, together with the Forum, roughly 97% of all UDRP proceedings – and its published panel decisions set most of the Policy's interpretive precedent. The Forum is a credible alternative and sometimes faster for straightforward cases.

The filing fee at WIPO is USD 1,500 for a single-member panel covering one to five domains. A three-member panel costs USD 4,000 at WIPO for the same domain count. The Forum's entry fee begins at around USD 1,300 for one to two domains with a single-member panel. The CAC offers the lowest entry point but handles a smaller share of total filings.

For most single-domain .io buy-back-to-dispute scenarios, a single-member panel at WIPO is the standard recommendation. A three-member panel may be warranted where the case turns on a genuinely contested factual question or where the registrant is likely to elect a three-member panel themselves – in which case the parties generally split the higher fee.

The complaint itself must cover each element of Paragraph 4(a) with specificity: the trademark rights, the confusing similarity, the absence of legitimate interest, and the bad-faith evidence. Forum rules require annexes to be formatted in a way the panel can navigate quickly. A filing that narrates the negotiation history but never expressly maps it to Paragraph 4(b)(i) is a surprisingly common drafting error – one we see on referrals from cases that received a first decision against the brand owner.

See our overview of the UDRP recovery process at UDRP Recovery Services for the full procedural mechanics, including how the registrar lock operates during the pendency of a complaint.

Step 6: Manage the 20-day response window and default scenarios

Once the forum serves the complaint on the registrant, the respondent has 20 days to file a response. This is a fixed window set by the UDRP Rules – it cannot be extended unilaterally by either party. It can be extended by the forum on showing of good cause, but extensions are the exception.

What happens if the registrant does not respond? A default does not automatically mean you win. The panel still evaluates whether the three elements are met on the evidence in the complaint. However, the practical effect of a default is significant: the registrant produces no Paragraph 4(c) safe-harbor evidence, no challenge to your trademark rights, and no counter-narrative. Panels in default cases routinely draw adverse inferences from the silence.

The trap: some complainants read a default as an invitation to file a thin complaint, assuming the panel will fill the gaps. Panels will not. The complaint must stand on its own evidence regardless of whether the registrant participates. A well-evidenced complaint filed against a defaulting respondent completes a standard case within the normal two-month window. A poorly evidenced one may still fail – and a failed complaint against a registrant who then responds on remand (if any appeal-equivalent procedure were available) creates an even more difficult second round.

If the registrant does respond, the forum appoints the panelist (or three-member panel) promptly. There is no oral hearing; everything is decided on the written record. Supplemental filings are disfavored and generally accepted only where the other party raised genuinely new material the filing party could not have addressed in the original submission.

If a prior filing produced a bad outcome, or if you received a complaint and need to assess the response options, email info@cognomenlaw.com for a focused second read.

Step 7: From decision to transfer – and what can go wrong at implementation

A transfer order in your favor does not automatically place the domain in your registrar account. The panel issues a decision; the forum transmits it to the concerned registrar; ICANN's rules then impose a brief period during which the losing registrant can file a court action in a jurisdiction of mutual submission to challenge the outcome. That period stays the transfer temporarily. If no court action is filed, the registrar implements the transfer.

In the rare event that the registrant commences a court proceeding to block implementation, the matter moves outside the UDRP entirely. You would need to engage local litigation counsel in the relevant jurisdiction. This is uncommon in .io disputes but has occurred where the registrant has a strong economic incentive to delay.

A more common implementation hiccup: the registrar to which the domain is held has been deaccredited or is otherwise unresponsive. In those cases, ICANN's compliance function becomes involved. Document your post-decision communications carefully; a paper trail of unanswered transfer requests strengthens any escalation to ICANN.

Once the transfer completes, conduct an immediate audit of the domain's DNS settings, any associated SSL certificates, and the WHOIS/RDDS record. Domains transferred through a disputed process sometimes carry legacy DNS entries pointing to the prior holder's infrastructure. Treat a successful transfer as the beginning of a brief technical cleanup, not the end of the matter.

For a comparative look at how the same buy-back-to-dispute pattern plays out in the .net zone, see our analysis at Recover a Typosquat .net Domain. For the distinction between a UDRP complaint and a URS suspension for new-gTLD domains, see URS vs. UDRP: which route fits your .com dispute?

What if the respondent claims the negotiation proves you acquiesced?

This is the respondent's strongest available counter-argument in a buy-back-to-UDRP sequence. The argument runs: by engaging in price negotiations, the complainant acknowledged the registrant's legitimate ownership and is now trying to use the Policy to achieve what ordinary commerce did not deliver. Panels have consistently rejected this framing where the complainant holds trademark rights that predate the registration. Negotiating to buy back a domain you believe someone else improperly registered is not the same as conceding the registration was proper.

Where the argument can gain traction is in edge cases: the mark postdates the registration; the complainant made a blanket offer to "buy any domain" in a portfolio acquisition, and this domain happened to be included; or the complainant's own internal correspondence (produced inadvertently) characterizes the domain as belonging to a third party. None of these are common, but each has appeared in the case record. Know your negotiation file fully before filing.

A second respondent tactic in failed buy-back cases: claim the domain was acquired innocently and the inflated asking price simply reflected "fair market value" for a generic or descriptive term. This defense is credible only if the domain string is genuinely generic or descriptive independent of your brand. For coined marks, sector-specific coined terms, or marks with strong secondary meaning, this defense rarely withstands scrutiny. The brand owner's job is to adduce evidence that the string was not generic before the registration – sector usage data, search results, and product launch timelines all contribute.

This section also addresses the myth many registrants hold: that a sky-high asking price is legally defensible as "market pricing." Under the Policy, the test is whether the asking price substantially exceeds the registrant's documented out-of-pocket costs. A price tethered to the brand's commercial value, rather than to the registrant's actual costs, satisfies Paragraph 4(b)(i) on its face.

In a second matter from our files (a .io domain in the fintech space, autumn 2024), the respondent argued exactly this – that the six-figure demand was simply market rate for a premium domain. The panel disagreed, finding that the string was not a generic financial term but a distinctive brand identifier, and that the demand price bore no relation to any cost the registrant had incurred. Transfer was ordered.

Related services at COGNOMEN

Related at COGNOMEN

• UDRP Recovery Services – file a UDRP complaint across gTLD and ccTLD zones
• Recover a .net typosquat – analysis of the bad-faith evidence pattern
• URS vs. UDRP – choosing the right procedure for new-gTLD domains