Assess my case

Step-by-step: verify chain of title for a .co domain

By Cordelia Roe, Domain transactions, diligence & brand monitoring ·

A buyer transfers five figures to escrow, the domain is pushed to a new account, and six months later a prior claimant surfaces – one who disputes the seller's right to have conveyed the domain at all. That scenario is not rare in the .co market. Colombia's country-code extension attracts global brand registrations precisely because it reads as a shorthand for "company" or "commerce," which means motivated buyers, motivated sellers, and motivated cybersquatters, all trading in the same space.

To verify chain of title for a .co domain, a buyer must confirm current registrant identity through RDDS, trace ownership history, run a UDRP and ccTLD dispute search, check active registrar locks, and review any prior trademark conflicts before funds move to escrow. The .co registry is operated by .CO Internet SAS under ICANN accreditation; most .co domains are subject to UDRP jurisdiction, so a past dispute or pending complaint can survive a sale and bind the new registrant. Skipping any single step creates a gap that a future claimant – or panel – can exploit.

This guide walks each step in sequence, names the trap hiding inside it, and explains how the transaction structure responds to what the checks reveal.

What governs .co domain ownership and why chain of title matters

.co is Colombia's country-code top-level domain, yet it operates under a fully internationalized policy framework. The registry applies UDRP jurisdiction to all .co registrations, meaning the same three-element test that governs .com disputes – confusing similarity to a trademark, no legitimate interest, registration and use in bad faith – applies here. A buyer who acquires a domain with a tainted history inherits that history. Panels have consistently held that a transfer made to escape a pending or imminent complaint does not cleanse the registration; the bad-faith analysis follows the domain, not the individual holder.

Why does chain of title matter specifically for .co? Several reasons converge. First, the extension's commercial appeal has made it a target for both legitimate brand registration and opportunistic squatting. Second, a seller who registered the domain in bad faith has an impaired title – and conveying an impaired title in a domain purchase does not cure the defect. Third, the .co registry's WHOIS/RDDS data, like most ccTLDs, may be subject to GDPR-adjacent privacy rules that mask current registrant identity, making it harder to confirm you are actually buying from the legal registrant. Each of those factors heightens the due-diligence burden before any escrow instruction is issued.

In our practice advising buyers on pre-acquisition checks, the domains that generate post-closing disputes almost always share one trait: the chain-of-title review was abbreviated because the timeline felt urgent.

For an assessment of your domain transaction and the chain-of-title risks it presents, contact info@cognomenlaw.com.

Step 1: Confirm current registrant identity through RDDS and registrar records

The first step is straightforward in principle and genuinely difficult in practice. Pull the current RDDS (WHOIS) record for the .co domain and compare the registrant name and organization to the entity you are contracting with. Where privacy proxy service is in place – which is common following GDPR-consistent policies – the nominal registrant will be the proxy provider, not the actual owner. That gap requires a direct disclosure obligation in the purchase agreement: the seller must represent, in writing, that it is the beneficial owner and must cause the registrar to update or confirm the underlying registrant data as a condition of escrow release.

The trap here is assuming a matching email domain or a single ID-verification document is sufficient. It is not. Registrar accounts are compromised, names are misspelled at registration, and sellers occasionally do not realize they registered through an entity that has since dissolved. Confirm:

A serverTransferProhibited status typically signals a registry-level hold. That can mean an active legal dispute, a court order, or a registry enforcement action. Do not proceed to escrow until the source of that status is identified and resolved.

Step 2: Trace ownership history and identify prior registrants

RDDS gives you the current snapshot. Chain of title requires the historical record. Prior registrant data is available from several sources: domain history aggregators, registration history reports from the registrar (available on request in many dispute and transaction contexts), and archive records of prior ownership. The question you are answering is whether the domain has changed hands before – and if so, under what circumstances.

Why does a prior registrant matter? A past holder who registered in bad faith may have entered into a settlement agreement that restricts the domain's use or requires disclosure to any subsequent buyer. More acutely, a prior holder who lost a UDRP proceeding retains no standing to complain again – but a complainant whose prior case was denied may refile if the domain is used differently, or if new bad-faith evidence arises. Either scenario touches the current buyer. We regularly advise purchasers who discovered, after closing, that a prior registrant had entered into a binding agreement with a brand owner limiting what the domain could be used for.

Track each prior registrant by name, jurisdiction if available, and approximate tenure. A domain that has changed hands three times in two years – each time at arm's length – warrants more scrutiny than one held by a single entity for a decade.

Step 3: Search for prior and pending UDRP proceedings

This is the step most buyers skip. Both WIPO and the Forum maintain searchable case databases. A .co domain that has been the subject of a UDRP complaint – even a complaint that was denied or withdrawn – carries information a buyer needs. A denial on the merits in favor of a prior registrant may support the current holder's legitimate-interest argument. A denial based on procedural deficiency, or a withdrawal before decision, provides no such protection and may signal an unresolved dispute.

Search both databases by the domain name and by any variant spellings. Also search by the prior registrant's name if known – a pattern of multiple registrations tied to the same entity is itself a bad-faith factor under Paragraph 4(b) of the UDRP, and a buyer who takes a domain from a pattern registrant may face a complainant who argues the taint persists. Panels have considered the prior registrant's conduct in cases where a rapid transfer was made after a complaint was threatened but before it was filed. The consensus view is that a transfer to avoid a proceeding does not reset the clock.

The search should also cover WIPO's ccTLD case database. More than 87 ccTLDs have appointed WIPO as their dispute-resolution provider, and .co is among them. A .co proceeding filed at WIPO appears in the same database as .com proceedings and is equally searchable.

How does prior dispute history affect a .co transaction?

A clean UDRP history does not guarantee a clean title, but a troubled history changes the deal terms. When a prior complaint was filed and resulted in a transfer order that was then reversed through a court action – or was never implemented because the then-registrant transferred the domain to a third party before implementation – the ownership chain is contested in a way the standard RDDS record will not reveal. That scenario requires a registrar inquiry, a review of any court filings the seller can produce, and, where necessary, a title representation and indemnity in the purchase agreement.

Where the prior dispute history reveals a pending complaint – one filed before the sale contract is signed but not yet decided – the buyer faces a material risk. A panel that issues a transfer order is directing the registrar to transfer the domain to the complainant, not to any subsequent purchaser. ICANN's rules address this: once a complaint is filed, the registrar places a registrar lock, and any transfer during the proceeding is generally void unless the registrar receives authorization from the provider. The practical effect is that a pending UDRP complaint freezes the asset.

In a recent matter involving a .co domain with an undisclosed prior dispute (spring 2025), we identified a WIPO case that had been withdrawn by the complainant without prejudice eight months before the proposed sale. The complainant had preserved its right to refile. The buyer revised the purchase price and required a representation from the seller that no further claim had been communicated by that complainant. The deal closed – but on materially different terms than originally negotiated.

To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

Step 4: Check for trademark conflicts that could trigger a future UDRP

Chain-of-title verification does not end with the historical record. A buyer acquiring a .co domain for use in commerce needs to confirm that the intended use will not itself constitute registration and use in bad faith under the UDRP – because that standard applies to the new registrant's conduct after the transfer, not only to the original registration. If the domain is confusingly similar to a registered trademark and the buyer intends to use it in a way that could attract users for commercial gain by confusion, the buyer becomes the respondent in any future complaint, not the seller.

The trademark check should cover at minimum:

The point is not to avoid acquiring any domain that resembles a mark. Many legitimate domain transactions involve domains that happen to resemble marks – the analysis is whether the similarity creates a genuine future liability given the buyer's intended use. A buyer acquiring a .co version of a well-known global brand name, intending to redirect traffic to a competitor, is acquiring a UDRP complaint as a liability alongside the asset. A buyer acquiring the same domain for a distinct non-competing use, with documented evidence of a good-faith plan, is in a very different position.

Step 5: Structure the escrow and the transfer to protect the buyer

The due-diligence steps above feed directly into the transaction structure. A properly structured .co domain sale uses a regulated escrow provider, a domain purchase agreement with specific representations, and a defined transfer protocol. Each of those elements responds to the risks the prior steps identified.

The escrow instruction should specify:

  1. The domain name and registrar of record confirmed at the time of signing.
  2. A representation and warranty by the seller that no UDRP or other dispute proceeding is pending or threatened as of the closing date, and that the seller has not received any demand letter from a third party asserting trademark rights in the domain within a defined lookback period.
  3. A requirement that the seller remove any registrar privacy proxy and confirm the underlying registrant identity before funds are released.
  4. A transfer mechanism – typically an authorization code (EPP auth-info code) push – with a defined window for the buyer to confirm receipt and initiation of the transfer.
  5. A post-closing holdback or indemnification clause covering any UDRP complaint filed within a defined period after transfer that arises from conduct or history predating the closing date.

The trap in this step is treating the escrow as a payment rail and neglecting the representations. Escrow protects the money. It does not protect the buyer from a title defect or a pending complaint. The representations in the purchase agreement are what create a legal claim against the seller if a defect surfaces after closing.

In a .co transaction we handled in autumn 2024, the seller had registered the domain through a corporate entity that had been wound up. The domain had not been formally transferred to the seller's successor entity. Funds were held in escrow while the seller cured the defect – a process that took several weeks and nearly triggered the agreement's termination clause. The check that flagged the issue was a corporate registry search on the selling entity, not the RDDS record alone.

Step 6: Assess .co-specific registry rules and renewal risk

The .co registry's operational rules carry a few transaction-specific details worth confirming before closing. The .co registry is operated by .CO Internet SAS and accredited by ICANN; most second-level .co registrations are managed through standard ICANN-accredited registrars, meaning the transfer process follows the standard EPP protocol with a 60-day transfer lock after creation or prior transfer. A domain transferred to a new registrar within the last 60 days cannot be transferred again until that lock expires – an important constraint on post-closing registrar changes.

Renewal risk is a practical concern. Confirm the expiry date and whether auto-renewal is active. A domain that expires within 30 days of a proposed closing date is at risk of entering a redemption grace period before the buyer can set up auto-renewal at the new registrar. That gap has cost buyers domains they believed they had acquired. Build a minimum expiry buffer into the closing conditions – the seller should renew the domain before closing if the expiry falls within a defined window.

The .co zone does not offer a registry-level dispute-block mechanism analogous to DENIC's DISPUTE entry. If a prior claimant surfaces after closing, the options are UDRP (if the three elements are met from the complainant's perspective), or court action in the relevant jurisdiction. There is no administrative hold available at the registry level outside an active UDRP proceeding's registrar lock. That absence makes the pre-closing due diligence steps above more consequential, not less.

Choosing between WIPO and the Forum for a .co dispute after a bad acquisition

If the chain-of-title review is done after the fact – because a complaint has already arrived – the buyer now faces a respondent-side decision. The .co registry supports UDRP proceedings at WIPO, the Forum, CAC, and ADNDRC. The choice of provider in a respondent defense matters in several respects. WIPO's published decision record is the most searchable and most frequently cited by practitioners, which can matter for how analogous cases are found and cited. The Forum has a comparably large case volume. CAC starts at a lower fee point – around USD 500–800 – which matters more to a complainant than a respondent, since the complainant pays the filing fee. The respondent's exposure does not vary by forum in financial terms; the risk is the domain itself.

What does vary is the decision-matrix choice between UDRP and a national court. For a .co domain used in commerce, a UDRP proceeding is almost always faster – typically about two months to a decision – and its only remedy is transfer or cancellation. A court action can produce damages and an injunction, but the timeline is substantially longer and the cost substantially higher. A buyer who acquired a .co domain and is now a respondent in a UDRP should weigh whether the domain value justifies a parallel or subsequent court action if the UDRP goes against them, particularly in jurisdictions where US anticybersquatting litigation might reach damages. That analysis is fact-specific and cannot be resolved generically.

We have defended .co UDRP respondents who had clean acquisition records – purchase agreements, escrow records, trademark clearances – and where those records formed the core of the legitimate-interest and good-faith defense. The documentation built at the transaction stage is the evidence record at the dispute stage. Those are not two separate exercises.

Related at COGNOMEN

Frequently asked questions: verifying chain of title for a .co domain

When should I verify chain of title for a .co domain?

Before any funds move to escrow. Chain-of-title verification is pre-closing due diligence, not a post-closing exercise. A UDRP complaint filed after transfer still applies to the new registrant if the complainant can show that the acquisition itself was made with knowledge of a trademark conflict. Completing the checks after a deal is signed but before closing is the minimum; starting before the letter of intent is the better practice, because the findings affect price and representations, not just risk awareness.

What happens if the other side ignores the case?

In a UDRP proceeding, a registrant who fails to file a response defaults. Default does not mean automatic transfer – the panel still evaluates the complaint on its merits – but panels commonly treat a respondent's silence as an absence of evidence of legitimate interest. For a buyer who acquired a domain and is now a UDRP respondent, defaulting is the worst strategic choice: the transaction records, trademark clearances, and escrow documentation that establish good faith are forfeited if they are never submitted. A response deadline is 20 days from commencement; missing it eliminates the evidentiary record the acquisition created.

How is WIPO different from a national court for .co?

WIPO administers the UDRP for .co domains; its only remedies are transfer or cancellation of the domain. A national court – in Colombia or another jurisdiction with a connection to the parties – can award damages, issue injunctions, and address claims outside the UDRP's scope. WIPO proceedings are typically resolved within about two months at a fraction of court litigation costs. Courts can reach more outcomes but take substantially longer and cost more. For a contested .co acquisition where the buyer wants to retain the domain, a UDRP response at WIPO is the first line; court action is a supplemental or alternative route where the domain value and the dispute facts justify it.

About COGNOMEN

COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking defense. Our domain transactions practice covers pre-acquisition due diligence, chain-of-title verification across .com, .co, .eu, .uk, and other zones, escrow structuring, and portfolio brand-protection monitoring. To discuss a .co acquisition or dispute, contact info@cognomenlaw.com.

Author: — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.