Step-by-step: recover a .io domain from a serial cybersquatter

Step-by-step: recover a .io domain from a serial cybersquatter. UDRP and ccTLD domain recovery and defense across .io. Email the firm to assess your case.

Your brand is registered. Someone else holds the matching .io. A quick check of their portfolio reveals a dozen similar registrations – tech-startup names, SaaS acronyms, fintech brands – all parked, all pointing at pay-per-click pages or buy-it-now listings. That is a serial cybersquatter. And .io, the country-code top-level domain for the British Indian Ocean Territory, sits squarely within the UDRP's reach, which means there is a defined procedure to get it back.

To recover a .io domain from a serial cybersquatter, you must satisfy all three elements of Paragraph 4(a) of the UDRP: confusing similarity to your trademark, no legitimate interest held by the registrant, and registration and use in bad faith. A standard case before WIPO runs about two months from filing, the filing fee starts at USD 1,500 for a single-member panel, and the only remedies are transfer or cancellation. A pattern of similar registrations by the same registrant is among the strongest bad-faith indicators the Policy recognizes.

This guide walks each step, names the trap hidden inside it, and explains the decisions you face along the way.

Does the UDRP actually apply to .io domains?

Yes. The .io registry has adopted the UDRP, which means every .io domain registration is subject to the same mandatory dispute-resolution procedure that governs .com, .net, and .org. WIPO administers UDRP cases for .io, and the procedure is substantively identical to a gTLD case. The three Paragraph 4(a) elements apply without modification. The respondent has the same 20-day response window. Transfer or cancellation are the same exclusive remedies.

The practical consequence: if you have won – or could win – a UDRP for your .com, the same case theory works for your .io. The governing rules are not materially different.

One procedural point worth confirming before you file: verify the accredited registrar holding the domain accepts UDRP jurisdiction under its registration agreement. For .io registrations with mainstream accredited registrars, this is standard – but the registry's own policies should always be checked with current counsel before any filing is prepared.

Step 1: Confirm you have trademark rights – and watch the timing trap

The first element of Paragraph 4(a) requires rights in a mark to which the domain is identical or confusingly similar. That mark may be a registered trademark, but panels have also accepted unregistered or common-law trademark rights where the complainant demonstrates sufficient prior use and distinctiveness. The threshold for confusing similarity is generally low: if the domain incorporates your mark in full, the element is met even where a generic term or hyphen has been added.

The trap here is timing. Your mark must predate the registration date of the domain. If the registrant registered the .io before you filed your trademark application, the first element may still be met on confusing similarity grounds, but you face a harder argument on bad faith. Serial cybersquatters often register domains anticipatorily – before a brand publicly launches. Panels have recognized that registering a domain in anticipation of a complainant's likely trademark rights can itself be bad faith, but the evidentiary burden is real.

Gather: your trademark registration certificate (number, classes, filing date, registration date); evidence of any prior use establishing common-law rights; a clear comparison between the mark and the domain string. The stronger your rights record, the less work the similarity element needs to do.

Step 2: Build the legitimate-interest record – and why default is not enough

The second element asks whether the registrant has any rights or legitimate interest in the domain. Paragraph 4(c) of the UDRP sets out three safe harbors the registrant may invoke: a bona fide offering of goods or services before notice of the dispute; being commonly known by the name; and legitimate noncommercial or fair use. A serial cybersquatter will rarely satisfy any of these.

The trap: relying on a default ruling to carry this element for you. When a respondent fails to file a response – which serial cybersquatters frequently do – panels do not automatically accept the complainant's case as proven. They still require the complainant to make a prima facie showing. That means your complaint must affirmatively demonstrate the registrant's lack of any obvious legitimate claim: the domain points to a parking or pay-per-click page, not a genuine business; the registrant is not known by the mark; no license, consent, or authorization was ever granted.

In our practice, the most useful evidence here is a screenshot of the resolving page taken shortly before filing, combined with a WHOIS/RDDS record showing the registrant's name differs entirely from the domain string. Add any buy-it-now listing, brokerage offer, or correspondence in which the registrant quoted a price.

The three elements interact. For a read on whether your specific facts satisfy all three, reach us at info@cognomenlaw.com.

Step 3: Prove bad faith – and how a serial-registration pattern becomes your strongest exhibit

Bad faith under Paragraph 4(a)(iii) must be shown at registration and in use. Paragraph 4(b) lists four non-exhaustive indicators: registration primarily to sell to the mark owner at a profit; registration to disrupt a competitor; attracting users for commercial gain through confusion; and – the one that matters most here – a pattern of conduct registering domains to prevent mark owners from reflecting their marks online.

A serial cybersquatter's portfolio is, in effect, self-proving bad faith on the pattern element. Panels have consistently held that registering multiple domains across different brand owners' marks demonstrates exactly the conduct Paragraph 4(b)(ii) targets. You do not need to identify every registration in the portfolio – a representative sample of five to fifteen similar registrations, with supporting WHOIS records and screenshots, is typically sufficient to establish the pattern.

Additional exhibits that reinforce bad faith: any automated or template-style buy-it-now listing well above registration cost; pay-per-click advertising on competitor keywords; and any prior UDRP decisions against the same registrant (if the decisions appear in WIPO's published case database, you may reference them by case number and link to the published record – panels treat prior adverse findings as significant corroborating evidence).

One recent matter illustrates the dynamic. In a .io matter we handled in spring 2025, the registrant had amassed approximately fifteen similar domain registrations targeting technology brand names. The respondent defaulted. The panel found bad faith on the pattern element alone, without needing to reach the pay-per-click evidence, and ordered transfer. The entire process ran just over eight weeks from filing to the registrar implementing the transfer.

Step 4: Choose the forum and prepare the complaint – the decision matrix

For a .io domain, WIPO is the natural forum. It administers UDRP cases for .io, has the deepest body of published decisions, and its filing interface is mature. The Forum (formerly the National Arbitration Forum) and CAC also administer UDRP cases and accept .io filings where the registry's rules permit; the Czech Arbitration Court's entry-level filing fee is the lowest of the three, beginning around USD 500–800. In practice, for a serial-cybersquatting case where you may want to cite prior panel decisions for precedential weight, WIPO's well-indexed database makes it the practical choice for most complainants.

Single-member or three-member panel? A single-member panel at WIPO costs USD 1,500 for one to five domains. A three-member panel costs USD 4,000. For a serial cybersquatting case with strong facts, a single-member panel is almost always the right call – it is faster, less expensive, and the bad-faith pattern argument does not require a three-member tribunal to carry weight. If the registrant requests a three-member panel after you have selected single, the cost difference is generally split between the parties.

If the registrant holds both a .io and a matching .com under the same registration, a single complaint may cover both domains – UDRP permits a single filing against a single holder's multiple domains. That consolidation is worth considering before you file, because a second complaint later costs another filing fee.

Court action is rarely the right primary route for a .io recovery. There is no governing national court with clear jurisdiction over the British Indian Ocean Territory's domain registry comparable to the established ccTLD dispute procedures, and US anticybersquatting litigation – the route that can reach monetary damages – requires a separate analysis of US nexus and personal jurisdiction. For most complainants, the UDRP is faster, cheaper, and sufficient.

Step 5: File and manage the response window – the 20-day clock

Once a complaint is formally commenced, the respondent has 20 days to file a response. Serial cybersquatters frequently default – they hold many domains, the economics of defending each case do not favor them, and an RDNH finding (the reputational sanction against abusive complaints) is unavailable to a registrant whose bad faith is clear. A default means the panel decides on the complaint and its exhibits alone.

The trap: treating a default as a guaranteed win. Panels independently assess whether the complaint's evidence meets each element. A thin complaint – one that asserts bad faith but exhibits only a parking page without demonstrating the pattern – can still fail, even against a defaulting serial cybersquatter. File a complete, well-evidenced complaint rather than relying on the respondent's silence to fill the gaps.

If the respondent does file a response and raises a legitimate-interest defense – perhaps claiming the letters in the domain are their initials, or that they operate a genuine service – you will need to assess whether a supplemental filing is warranted. Panels have discretion over whether to accept supplemental materials. In our practice, supplemental filings are most effective when they directly rebut a new factual claim in the response, rather than elaborating on arguments you could have made in the original complaint.

Step 6: The decision and implementation – and what happens after transfer is ordered

After the response window closes and the panel is appointed, the decision typically issues within roughly two months of the original filing. If the panel orders transfer, a ten-business-day waiting period follows during which the registrant may seek a court stay. Serial cybersquatters almost never pursue a stay; the holding cost of litigation far exceeds the speculative value of the domain once a UDRP transfer order has been published. After the waiting period, the registrar implements the transfer to the registrant-of-record designated in your complaint.

Once the domain is in your control, act immediately on three points. First, update the registrar's security settings: enable registry lock and two-factor authentication. Second, redirect the domain to your primary web presence or a landing page, ending any residual pay-per-click revenue for the prior holder. Third, audit the serial cybersquatter's remaining portfolio for any additional registrations that incorporate your marks – in different TLDs or with slight variations. A pattern finding in this case can support a faster outcome if a follow-on complaint becomes necessary.

If the case is already at the response stage or a prior attempt has produced an adverse outcome, a focused review of the element that was missed can identify the path forward. Email info@cognomenlaw.com to start that review.

Related at COGNOMEN

• UDRP Recovery Service – assess the three elements and file a UDRP complaint across gTLDs and ccTLDs
• Proving bad faith in UDRP proceedings – an analysis of the evidence panels find decisive
• UDRP versus national court action – comparing routes when arbitration alone is not enough