Step-by-step: recover a .io domain through a UDRP complaint

Step-by-step: recover a .io domain through a UDRP complaint. UDRP and ccTLD domain recovery and defense across .io. Email the firm to assess your case.

A technology company discovers its brand name registered as a .io by a stranger who has no connection to the product, the team, or the market. The domain resolves to a parking page. A buy-back demand follows. The question – can a UDRP complaint get it back? – has a direct answer for .io.

The .io ccTLD operates under the UDRP, meaning the same three-element test that governs .com disputes applies here. To recover a .io domain you must prove all three elements of Paragraph 4(a): confusing similarity to a mark you hold, no rights or legitimate interests in the registrant, and registration and use in bad faith. A standard WIPO case runs approximately two months from filing to decision, with the WIPO single-panel filing fee starting at USD 1,500. Transfer or cancellation are the only remedies the panel can order.

This guide walks each step in sequence, flags the trap inside it, and shows what evidence decides the outcome for .io disputes specifically.

Does the UDRP actually apply to .io domains?

Yes – .io is among the country-code zones that have adopted WIPO as their dispute-resolution provider, meaning the UDRP applies directly to .io registrations. The registrar for any accredited .io domain is contractually bound to implement a UDRP transfer or cancellation order. That makes .io one of the more accessible ccTLDs for trademark holders: you do not need to satisfy a separate national-nexus eligibility test, as you would for .ca or .eu, and you do not need to litigate in an English-speaking national court to secure a transfer.

The practical consequence is significant. A brand owner with a registered trademark – or even a sufficiently strong common-law mark – can file at WIPO without engaging local litigation counsel in the British Indian Ocean Territory or elsewhere. The process runs in English, follows the standard UDRP Rules and Supplemental Rules, and produces a decision binding on the registrar. That said, the ccTLD wrapper does not change the burden: every element of Paragraph 4(a) must still be satisfied. A cursory complaint that works in a brand-on-brand .com case may still fail at the .io level if bad faith is not clearly established.

To assess whether your mark and evidence meet the three-element threshold for a .io complaint, contact info@cognomenlaw.com.

Step 1: Confirm you hold rights in a relevant name

The first element of Paragraph 4(a) requires that the domain be identical or confusingly similar to a trademark or service mark in which the complainant has rights. That inquiry comes before everything else – and it conceals the most commonly underestimated trap.

The trap: panels assess confusing similarity by comparing the textual string of the domain (minus the .io extension, which is typically disregarded) against the trademark. A domain that adds a generic word to your mark – "yourbrand-app.io", "getyourbrand.io" – usually still clears the similarity threshold. But a domain that merely describes a product category your brand competes in, with no reference to the actual trademark string, will not. So the first step is not just checking whether you own a registration – it is confirming that the specific string in the .io domain is sufficiently similar to the mark as registered or as used.

Pending trademark applications are not rights for Paragraph 4(a)(i) purposes. Common-law rights can qualify, but they require substantial evidence: sales volume, advertising spend, press coverage, and a clear territorial nexus. In our practice, we see complainants underestimate this last requirement most often when the mark is well-known in one region but unregistered in the jurisdiction where the registrant is located. For .io disputes, where the registrant is often a technology entrepreneur rather than a traditional cybersquatter, the similarity element is usually met – but the rights question sometimes is not.

Step 2: Build the case that the registrant has no rights or legitimate interests

Paragraph 4(a)(ii) – no rights or legitimate interests – carries the most strategic complexity of the three elements. The consensus approach in UDRP practice is that a complainant need only make a prima facie showing; the burden then shifts to the registrant to produce evidence of a legitimate interest. But "prima facie" is not effortless.

Paragraph 4(c) sets out the safe harbors a respondent can invoke: a bona fide offering of goods or services before any notice of the dispute, being commonly known by the name, or legitimate noncommercial or fair use without intent to mislead. For .io domains – where the zone is strongly associated with the technology startup world – panels sometimes encounter respondents who claim they were building a competing product under a name that happened to mirror the complainant's mark. That claim rarely succeeds when the respondent cannot produce contemporaneous evidence of development activity predating the complaint. But it does create a contested record that lengthens the case and, if the complainant's evidence is thin, can tip the result.

The trap at this step: do not wait for the complaint to assemble evidence of absence of legitimate interest. Before filing, search for the registrant's business registration, website archive (via the Wayback Machine), LinkedIn presence, and any prior offers to sell the domain. A registrant who has publicly offered the .io for sale to anyone in the market demonstrates, in a single screenshot, both the absence of genuine use and a classic bad-faith indicator.

Step 3: Establish bad faith – registration and use, both

Paragraph 4(a)(iii) requires that the domain was registered and used in bad faith. That conjunction is cumulative: both limbs must be satisfied. This is the element where .io disputes most often fail for the complainant – not because bad faith is absent, but because the evidence assembled speaks only to one of the two limbs.

Paragraph 4(b) lists non-exhaustive indicators of bad faith: registration primarily to sell to the trademark owner at a profit; registration to disrupt a competitor; use of the domain to attract users for commercial gain by creating confusion with the mark; and a pattern of abusive registrations. For .io domains, the most common fact patterns are (a) a parking page monetized by pay-per-click links on technology or SaaS terms closely related to the complainant's product, and (b) a registrant who acquired the .io shortly after the complainant's public launch or fundraise announcement.

The timing trap is critical. If your brand existed and your mark was registered before the respondent's acquisition of the .io, that sequence strongly supports the bad-faith registration limb. If you launched your brand after the .io was registered – even by a few months – the panel will not infer bad faith in registration, and the complaint will likely fail regardless of what the registrant does with the domain now. We assess registration chronology before advising any client to file.

What about passive holding – a registrant who simply parks the domain and does nothing? Panels have consistently held that passive holding can satisfy the use limb in bad faith, particularly where the complainant's mark is well-known, the registrant provides no plausible explanation for the registration, and there is no conceivable good-faith use to which the domain could be put. The .io zone, as a technology-sector shorthand, makes this argument sharper: a parked .io matching a funded SaaS brand usually cannot be explained innocently.

In a recent matter (a .io typosquat complaint, spring 2025), we secured a WIPO transfer order for a software company whose exact brand name had been registered as a .io two weeks after the company's seed-funding announcement – with the domain parked to a page of competitor links. The timing and the pay-per-click content together provided clear evidence on both limbs of Paragraph 4(a)(iii).

Step 4: Select the forum and file the complaint

For .io disputes, WIPO is the dominant and most practical choice. WIPO's experience with technology-sector marks and .io-specific registrant behavior is well established. The Forum (formerly the National Arbitration Forum) also accepts .io complaints under the UDRP, and for straightforward single-domain cases its fee structure is comparable – filing fees beginning around USD 1,300 for one or two domains on a single-member panel. The Czech Arbitration Court (CAC) offers a lower entry point but is less commonly used for .io disputes. ADNDRC is an option for parties with ties to Asia-Pacific jurisdictions.

The right forum decision depends on three factors: panel depth in technology-trademark issues, procedural speed, and cost. WIPO and the Forum together account for roughly 97% of all UDRP proceedings – that concentration reflects the practical reality that their procedural rules and panelist pools are the most developed.

Once you select the forum, the complaint must be drafted, supported by the documentary evidence, and submitted through the forum's online portal. WIPO will conduct a formal compliance review – checking word counts, exhibit formats, and fee payment – before commencing the case. That review can add a few days if corrections are needed. The 20-day response window for the registrant begins from the date of formal commencement, not from the date you submit.

The trap here: a deficient complaint – missing exhibits, an incorrect registrar contact, a mark that is not formally evidenced – may not be corrected once the case is running. A respondent who spots a gap in the complaint's evidence can exploit it in the response. We regularly advise clients to treat the complaint as a litigation brief, not a form submission.

For a review of whether your evidence supports all three UDRP elements before you file at WIPO, email info@cognomenlaw.com.

Step 5: Manage the response window and panel appointment

Once the case commences, the registrant has 20 days to file a response. Many registrants in .io disputes do not respond – particularly where the domain is parked and there is no active commercial use. Default does not guarantee a transfer: the panel will still assess each element on the complaint's own evidence. But a default removes the contested record and typically narrows the issues.

If the respondent does file a response, it will usually argue one of three positions: that the complainant's mark does not cover the domain's string (element one); that the respondent had a legitimate project or use predating notice of the dispute (element two); or that the domain was registered before the mark existed (element three). Occasionally a respondent will invoke all three and request a three-member panel.

A three-member panel request by the respondent – where the complainant originally chose a single-member panel – triggers a fee-sharing arrangement: the parties generally split the higher three-member fee, so the complainant's cost increases. At WIPO, a three-member panel runs USD 4,000 compared to USD 1,500 for a single-member panel on one to five domains. Factor this contingency into your budget before filing.

Panel appointment follows the close of the response window. For a WIPO single-member case, a decision typically issues within about two months of commencement – occasionally closer to six weeks for a straightforward case, occasionally longer if supplemental filings are sought by either party. WIPO also offers an expedited option for single-panel cases of up to five domains, delivering a decision within approximately one month.

Step 6: Understand what the panel decides – and what happens next

The UDRP panel's only available remedies are transfer of the domain to the complainant or cancellation. There are no damages, no costs awards, no injunctions. If the panel orders transfer, WIPO notifies the registrar, which implements the transfer after a brief waiting period absent a court action by the respondent to stay the order.

The respondent can challenge a transfer order in court – a route that is available but rarely used in practice for .io domains, given the cost and the jurisdictional complexity of a domain registered under a ccTLD with parties in multiple countries. Where a respondent does seek a court stay, the registrar typically maintains the lock pending the court's ruling.

What if the panel denies the complaint? The denial is not res judicata in the strict sense – UDRP decisions are not court judgments – but refiling essentially the same complaint at a different forum without materially new facts or changed circumstances is generally treated as bad faith by panels and may itself attract an RDNH finding against the complainant. A failed complaint therefore requires careful post-decision analysis before any next step.

The panel may also find reverse domain name hijacking (RDNH) – a finding that the complaint was brought in bad faith to deprive a legitimate registrant of a valid domain. RDNH carries no monetary penalty but is a reputational finding published in the case record. We have defended registrants against abusive .io complaints and, where warranted, pursued RDNH findings on their behalf.

What evidence actually decides a .io UDRP complaint?

Evidence is the determinant, not argument. Panels assess the record as presented; they do not conduct independent investigation. For .io disputes specifically, the following evidence types carry the most weight.

For the complainant: a trademark registration certificate with a priority date before the domain's creation date; screenshots of the domain's current and historical resolution (parking page, pay-per-click links, competitor content); any correspondence in which the registrant offered to sell the domain, particularly at a price exceeding out-of-pocket registration costs; WHOIS/RDDS history showing when the domain was acquired and by whom; and documentation of the brand's public profile before the domain's registration (press releases, funding announcements, product launches).

For the respondent who legitimately holds the domain: evidence of a business, project, or other use predating any notice of the dispute; evidence that the acronym or string has a meaning independent of the complainant's brand; correspondence showing the complainant contacted the registrant before filing; and any evidence that the complainant filed knowing it lacked a strong mark, which is the RDNH foundation.

In a second matter we handled (a .io complaint, autumn 2024), the complainant's mark had been filed only after the domain was registered. The evidence clearly showed registration predated rights. We successfully defended the registrant, and the panel denied the transfer request in full.

How does a .io UDRP complaint compare to other dispute routes?

The right route depends on the zone, the goal, and the remedy needed. For a .io, the UDRP at WIPO is almost always the starting point: it is faster and cheaper than court action, produces a binding transfer order, and is well-suited to the fact patterns typical of technology-domain disputes.

If the same registrant holds both the .io and a .com version of your mark, a single UDRP complaint can cover both – provided the registrant of record is identical on both domains. That consolidation saves time and filing fees compared to filing separately.

If the domain is a new-gTLD such as .app or .dev rather than .io, the Uniform Rapid Suspension (URS) procedure offers a faster and lower-cost suspension remedy – but suspension is not transfer, and the evidentiary standard is higher ("clear and convincing"). The URS is best suited to clear-cut cases where the primary goal is rapid takedown rather than ownership.

If the registrant's conduct also gives rise to a claim under US anticybersquatting legislation – for example, where the registrant is US-based and monetary damages are a goal – a court action is the only path that reaches money. That route is substantially longer and more expensive than a UDRP proceeding, and it requires engagement of litigation counsel in the relevant jurisdiction. For most .io disputes, the UDRP transfer remedy is the proportionate and efficient choice.

For a deeper analysis of passive-holding bad-faith doctrine – directly relevant to parked .io domains – see our analysis of passive holding in domain recovery. For guidance on what happens after a transfer order issues, see our analysis of enforcing a UDRP decision.

Related at COGNOMEN

• UDRP recovery service – assess, file, and manage your complaint at WIPO or the Forum
• Passive holding and bad faith – when a parked domain still transfers
• Enforcing a UDRP decision – what happens after the panel orders transfer