Step-by-step: choose between WIPO and the Forum for a .io dispute

Step-by-step: choose between WIPO and the Forum for a .io dispute. UDRP and ccTLD domain recovery and defense across .io. Email the firm to assess your case.

A brand owner discovers that a .io domain matching its product name is pointing at a competitor's landing page. The registrant is not responding to outreach. The clock on customer confusion is running. The question is not only whether to file a UDRP complaint — it is which forum to file it with, and why that choice matters for a .io domain specifically.

To choose between WIPO and the Forum for a .io dispute, confirm first that .io operates under the UDRP — it does, because the .io registry has adopted the Policy — then weigh filing fees, panel pools, decision speed, and procedural defaults against your evidence and timeline. The WIPO filing fee starts at USD 1,500 for a single-member panel on one to five domains; the Forum's entry point is approximately USD 1,300 for one to two domains. Both forums apply the identical three-element UDRP test and offer the same remedies: transfer or cancellation only.

This guide walks the decision step by step — what applies in .io, the three elements, the evidence standard, and the forum-specific factors that tilt the choice.

Does the UDRP actually apply to .io domains?

Yes — the .io registry has adopted the UDRP, which means every accredited registrar offering .io registrations is bound by the Policy. A complainant can file before WIPO, the Forum, CAC, or ADNDRC, just as with a .com dispute. This is the first trap: some brand owners assume that a ccTLD with country-code history — .io was originally designated for the British Indian Ocean Territory — sits outside the UDRP system. It does not. For practical purposes, a .io dispute proceeds under exactly the same Policy, Rules, and Supplemental Rules as a .com complaint.

That said, .io carries one nuance worth noting. Because the zone is heavily used by technology companies, registrants frequently hold established brand histories, prior use as developers, and genuine trademark claims of their own. The "legitimate interests" element tends to be more actively contested in .io disputes than in many other zones. We regularly advise complainants to treat .io as a mid-difficulty zone: the legal framework is familiar, but the respondent's record often deserves early scrutiny.

What are the three UDRP elements, and where does each one become a problem in .io?

A complainant must satisfy all three elements of Paragraph 4(a) of the UDRP to obtain a transfer or cancellation order — all three, not merely the strongest one. Missing any single element results in denial, regardless of how clearly the others are established. The elements are: (1) the disputed domain is identical or confusingly similar to a trademark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in respect of the domain; and (3) the domain was registered and is being used in bad faith.

Element one is almost always the easiest to establish if you hold a registered trademark. Identity or confusing similarity is measured against the second-level label; the .io suffix is disregarded, as panels treat it the same way they treat .com in this comparison. Element two — legitimate interests — is where .io disputes frequently stall. A developer who registered a domain as a project handle three years before your brand launched in the same technology vertical may well satisfy one of the Paragraph 4(c) safe harbors. Element three requires that the domain was registered and used in bad faith — both limbs must be satisfied on the specific facts. Passive holding can sometimes satisfy the use requirement, but a panel will look closely at when you acquired your trademark rights relative to when the domain was registered.

If you are uncertain whether your evidence meets all three elements, an early read saves time and filing fees. Contact info@cognomenlaw.com to assess your .io dispute before choosing a forum.

How does the .io UDRP timeline work end to end?

A standard .io UDRP case runs approximately two months from filing to a registrar-implemented result, assuming a single-member panel and no procedural detours. The five stages are: (1) filing and formal compliance review; (2) commencement, which triggers the 20-day response window for the registrant; (3) panel appointment; (4) the decision itself; and (5) the registrar's implementation of any transfer or cancellation order.

Where does time actually go? The compliance review can add a few days if the complaint has technical deficiencies. The response window is fixed at 20 days regardless of whether the respondent intends to participate. After the response period closes — or after a default — the forum appoints a panelist, typically within one to two weeks. The decision period then follows, commonly 14 days. Implementation takes a further few days once the registrar receives the order. The total is rarely under six weeks and rarely over twelve in a clean, uncontested case.

One procedural trap: if either party requests a three-member panel, the timeline extends by the time needed to appoint two additional panelists. Plan for an extra two to three weeks. Additionally, if the respondent files a late supplemental submission — which forums handle differently — the decision date can slip further. WIPO tends to be more permissive about supplemental filings than the Forum, a point that cuts both ways depending on whether you expect new evidence to emerge.

Step 1 — Confirm eligibility and map your trademark rights

Before choosing a forum, confirm the UDRP elements on paper. Pull the current WHOIS/RDDS record to identify the registrant of record, the registrar, and the registration date. Then map your trademark rights: registered mark or unregistered (common law) rights, the jurisdiction, the date of first use, and the date of registration. The registration date on the .io domain should be compared directly against your trademark's first use or filing date. If the domain predates your trademark by a meaningful margin, element three becomes difficult — panels are reluctant to find bad faith in a registration that preceded the mark's existence in commerce.

The trap in Step 1 is assuming a registered trademark automatically satisfies element one without checking the precise overlap. If your mark is stylized, device-only, or registered in a highly geographically specific form, the confusing similarity analysis is not automatic. A word mark registered in standard characters is the strongest foundation. If you hold only an unregistered mark, expect heightened scrutiny of the evidence of acquired distinctiveness — secondary meaning, continuous use, geographic reach — before element one is fully secured.

Step 2 — Evaluate which forum fits the specific .io dispute

With the elements mapped, choose the forum. WIPO and the Forum are the two dominant providers, accounting for roughly 97% of all UDRP proceedings. The choice turns on four variables: filing fee, panel pool, decision speed, and supplemental-filing rules.

Filing fees: WIPO charges USD 1,500 for a single-member panel on one to five .io domains, rising to USD 4,000 for a three-member panel on the same count. The Forum's entry point is approximately USD 1,300 for one to two domains, single panel. The difference is modest for a single domain. For a multi-domain complaint — say, five .io variants — the Forum may cost slightly less at the single-panel tier, but run the math at the current published rates, because fee schedules are updated periodically. The Czech Arbitration Court (CAC) offers a lower entry point still, beginning around USD 500–800, though it is the least used of the four providers and carries a smaller panel pool.

Panel pool and depth: WIPO maintains the largest panel pool and the deepest published record of .io-related decisions. If the facts of your dispute have a technology-sector flavor — developer branding, open-source project names, startup vocabulary — WIPO's panel depth is a meaningful advantage. The Forum's pool is also experienced, but the published selection tends to skew toward more conventional consumer-goods or retail-brand disputes.

Decision speed: WIPO offers an expedited option delivering a decision within approximately one month for single-panel cases of up to five domains. If reputational harm is active — the .io domain is redirecting customers now — that expedited path at WIPO is worth the additional cost and administrative effort. The Forum does not publish an equivalent expedited track for .io.

Supplemental filings: WIPO's supplemental filing practice is more flexible, which benefits a complainant who anticipates new evidence post-filing. If you expect the respondent to raise a technical argument about the trademark record that you can rebut with additional evidence, WIPO's procedure gives you more room to do so. The Forum's rules are tighter, which tends to produce a cleaner, faster record — but at the cost of flexibility if something unexpected surfaces.

In a recent matter involving five .io domains registered by a serial cybersquatter (early 2025), we filed at WIPO specifically because the respondent had a pattern of registrations across new gTLDs and the additional depth of the WIPO panel pool was expected to be persuasive on the Paragraph 4(b) pattern-of-conduct factor. The transfer order followed roughly nine weeks after commencement.

If you have already mapped the three elements and want a forum recommendation for your specific .io situation, email info@cognomenlaw.com with the domain and your trademark registration details.

Step 3 — Assemble the evidence before you file

The evidentiary burden falls on the complainant for elements one and three; element two shifts to the respondent once the complainant makes a prima facie showing of no legitimate interest. Assemble evidence in three layers before filing, regardless of which forum you select.

For element one, collect your trademark registration certificates, USPTO or EPO records, the registration and renewal dates, and any evidence of the mark's use in commerce in the .io zone's likely audience (often global technology consumers). For element three, document what the .io domain is currently doing: screenshots of the current resolving page with dates and timestamps, archive captures of prior uses if the domain has changed configuration, evidence of a prior demand for payment if one was made, and any evidence that the registrant knew of your mark at the time of registration — industry coverage, press releases, or registration timing relative to a product launch.

The trap in Step 3 is filing too quickly, before the evidentiary record is complete. A panel cannot infer bad faith from an unexplained registration alone. If the .io domain simply resolves to a parking page with pay-per-click links in your industry's keyword set, that is a recognized bad-faith indicator under panel consensus — but it needs to be documented with timestamped, archived screenshots, not described in the complaint narrative without exhibit support.

For element two, the prima facie showing is typically: (a) the complainant has not licensed the registrant to use the mark, and (b) the registrant is not commonly known by the domain name, and (c) there is no evident bona fide use before notice of the dispute. Once that showing is made, the burden shifts, and a default respondent provides nothing to rebut it.

What evidence actually decides .io UDRP outcomes?

Panel consensus across UDRP proceedings identifies several recurring bad-faith indicators that panels treat as decisive. In a .io dispute, the most common winning fact patterns involve: registration shortly after a complainant's mark became publicly visible (a product launch, a press release, a trademark publication); a parking page with pay-per-click links in the complainant's industry sector; a prior offer to sell the domain to the complainant for a sum materially above registration costs; a pattern of registrations targeting other brand owners in similar zones; and WHOIS privacy masking combined with non-responsive conduct after a cease-and-desist.

The most common losing fact patterns are: a trademark registration date that post-dates the domain registration by a significant margin; a complainant's mark that is generic or descriptive in the technology sector (where .io registrations cluster); a respondent who can show contemporaneous legitimate use — even informal or developmental — before any notice of the dispute; and geographic or industry limitations in the trademark that the domain could not plausibly have been targeting.

One .io-specific consideration: the zone's association with technology and developer culture means that some registrants hold prior art in the form of GitHub repositories, developer forum posts, or product documentation predating the complainant's trademark. We have defended respondents in .io disputes precisely because this kind of contemporaneous evidence, if documented, satisfies the Paragraph 4(c) safe harbor for bona fide use. That same evidence, when a respondent cannot produce it, is conspicuous by its absence and strengthens a complainant's case for transfer.

How do you handle a .io dispute that spans multiple forums or zones?

Some .io disputes arise alongside parallel registrations — the same registrant holds the .com, the .io, and perhaps a new-gTLD variant. If the registrant is the same holder across all domains, the UDRP permits a single complaint to cover all of them, filed at one forum. This is administratively efficient, but it raises the filing fee calculation. At WIPO, a complaint covering six to ten domains (single panel) costs USD 2,000; a three-member panel on the same count is USD 5,000. Confirming identical registrant identity across all domains before filing is critical — a multi-domain complaint that cannot establish common registration fails on administrative grounds before reaching the merits.

If the .io domain is accompanied by a .uk or .eu registration, a single UDRP complaint at WIPO or the Forum cannot resolve the ccTLD. The .uk dispute must proceed under Nominet's DRS, which applies a different test — "abusive registration," reading the bad faith limb as registration or use abusively, a lower cumulative bar than the UDRP's "registered and used." The .eu dispute would go to EURid's ADR.eu platform, administered through the Czech Arbitration Court. These are separate proceedings, with separate fees and separate timelines. We manage parallel filings in multiple zones regularly — coordinating the evidentiary record across procedures so that a panel decision in one forum does not create unexpected admissions in another.

Where the .io registrant's conduct rises to the level of deliberate infringement and the complainant wants monetary damages in addition to transfer, neither the UDRP nor any ccTLD procedure can reach money. Only anticybersquatting litigation in the appropriate court can. For US-based brand owners, that generally means US anticybersquatting proceedings. For brand owners in other jurisdictions, we coordinate with local litigation counsel in the relevant jurisdiction to pursue a court route alongside or instead of the UDRP where the facts warrant it.

Related at COGNOMEN

• UDRP domain recovery — full service overview for complainants and respondents
• Serial cybersquatter complaints — strategy for pattern-of-conduct cases
• Reversing an unauthorized domain transfer — step-by-step recovery guide