How to recover a stolen .co domain under the applicable domain rules

How to recover a stolen .co domain under the applicable domain rules. UDRP and ccTLD domain recovery and defense across .co. Email the firm to assess your case.

A domain investor checks her portfolio dashboard one morning and finds the .co she has held for years has been transferred out – without her authorization, to a registrar she has never used, with the WHOIS contact now reflecting a name she does not recognize. The account was likely compromised. The domain is live, pointing elsewhere, and the registrar is slow to respond. Every hour the name stays in the wrong hands, the harder recovery becomes.

To recover a stolen .co domain you typically have two concurrent paths: a registrar-level escalation to trigger an emergency lock and transfer reversal, and – where the registrant now using the domain is identifiable and acting in bad faith – a UDRP complaint before WIPO, which administers .co disputes. A standard UDRP case runs about two months from filing to decision, with a WIPO single-member panel filing fee of USD 1,500. Where the theft involves account fraud or criminal conduct, court action may be the only route that reaches restitution or damages.

This page covers the two recovery routes, the evidence that decides each, the realistic costs, and the next step for a .co holder who has lost control of their name.

Does the UDRP apply to .co domains, and who administers it?

Yes – .co operates under the UDRP, administered by WIPO, making it one of the most accessible ccTLD dispute routes in the world. The .co registry (Colombia's country-code zone, operated commercially under a global registry services arrangement) has adopted the UDRP as its dispute-resolution mechanism. That means a brand owner or domain holder seeking to recover a .co can file a UDRP complaint at WIPO exactly as they would for a .com, subject to the same three-element test under Paragraph 4(a) of the Policy.

What distinguishes a theft-recovery scenario from a conventional brand-owner complaint? In a classic UDRP filing, the complainant is a trademark holder challenging a cybersquatter who registered the domain. In a theft case, the complainant may be the prior registrant – the legitimate holder – challenging the person who received the domain through an unauthorized transfer. The UDRP elements still apply, but the evidence shifts: rather than leading with trademark priority, you lead with proof of prior registration and evidence of the unauthorized transfer.

Panels have consistently recognized that a registrant who obtains a domain through account compromise or fraudulent transfer holds it without any legitimate interest and, by definition, in bad faith. The three UDRP elements are met when the prior holder can show (1) rights or a legitimate interest in the name – whether a registered trademark, a longstanding trade name, or documented prior ownership – (2) absence of any legitimate claim by the current registrant, and (3) registration and use in bad faith, here demonstrated by the unauthorized transfer itself.

For an assessment of whether the UDRP or a registrar-escalation route is the right first move for your .co, contact info@cognomenlaw.com.

What is the registrar-lock and transfer-reversal path, and when does it come first?

Speed matters more in theft recovery than in any other domain dispute. Before any arbitration filing, the first priority is locking the domain at the gaining registrar to prevent a further outbound transfer. A domain that moves a second time – or a third – becomes exponentially harder to recover, both procedurally and practically.

The registrar-escalation path works like this. The legitimate prior holder contacts both the losing registrar (where the domain was originally registered) and the gaining registrar (where it now sits) and requests an emergency transfer lock. Most accredited registrars have a theft or fraud escalation channel, separate from the standard abuse queue. The losing registrar can, in some circumstances, initiate a transfer dispute with the registry. ICANN's inter-registrar transfer policy creates a narrow window during which an unauthorized transfer may be reversed without an arbitration order.

That window is short. In our practice we treat the first 24 to 72 hours after a theft as the critical period for registrar escalation. After that window closes, a panel order – under the UDRP or, where available, a court order – becomes the mechanism for reclaiming the name. If the gaining registrar is uncooperative or offshore and unresponsive, a UDRP complaint filed at WIPO is typically the next most efficient step. It operates independently of registrar cooperation: once a transfer order issues, the registry itself is the implementing party.

In a recent matter – a .co theft resolved in early 2025 – we pursued parallel registrar escalation and a UDRP complaint simultaneously. The registrar lock was achieved within 48 hours, preventing a secondary transfer. The UDRP order followed, providing the formal basis for transfer back to the legitimate holder. The combination ensured that neither path alone became the single point of failure.

When does court action beat arbitration for a stolen .co domain?

The UDRP delivers only two remedies: transfer or cancellation of the domain. It cannot award damages, enjoin conduct, or compel a third party such as a payment processor or hosting provider. Where the theft involved identifiable criminal conduct – phishing, account fraud, unauthorized access to systems – and the legitimate holder has suffered losses beyond the domain itself, court action is often the only route that reaches full relief.

The decision matrix here is not complicated. If the goal is to get the domain back quickly and the three UDRP elements are provable on the evidence, the UDRP is faster and cheaper. A standard .co UDRP at WIPO runs about two months and costs USD 1,500 in filing fees plus legal fees. If the goal also includes damages, the recovery of stolen proceeds, or injunctive relief against ongoing impersonation, court action – typically US anticybersquatting litigation where the parties and registry have a US nexus, or proceedings in the relevant national jurisdiction through local litigation counsel – is the route that can reach those outcomes. The two are not mutually exclusive: a UDRP complaint can run concurrently with court proceedings, though a court can suspend the UDRP proceeding if it chooses.

A second scenario where courts are necessary: the domain has been transferred to a privacy-protected registrant whose identity the UDRP process cannot readily surface. Court subpoena or discovery tools – available in US federal proceedings and in some national courts – can unmask the registrant, identify the fraud network, and create a record that then supports a UDRP complaint or direct restitution. In our experience, brand owners and domain investors who skip this step often find that an anonymous respondent simply defaults in the UDRP, gets a transfer order, and then re-registers variants of the domain that require additional proceedings.

What evidence decides the outcome of a .co theft recovery?

Evidence is the asset. Every recovery – whether through registrar escalation, UDRP, or court – turns on whether the prior holder can document legitimate ownership and the mechanics of the compromise. Panels and courts do not take allegations of theft at face value; they assess what the record shows.

The core evidence package in a .co theft recovery typically includes the following categories.

• Registration history: WHOIS or RDDS records showing prior registration in the claimant's name, ideally with a continuous history of renewal. Screenshots, archived RDDS data, and registrar account records all serve this purpose.
• Trademark or trade-name rights: A registered trademark that matches or substantially corresponds to the domain strengthens the UDRP case materially. Where no trademark exists, documented prior use – business records, invoices, press coverage – can establish the common-law rights that Paragraph 4(a)(i) of the UDRP recognizes.
• Evidence of compromise: Login alerts, phishing emails received, password reset notifications, and registrar account access logs establish the unauthorized nature of the transfer. Where the registrar has documented the transfer as unauthorized, that registrar record is powerful.
• The gaining registrant's conduct: Is the domain now live, redirecting to a competing site, or being offered for sale? Each of those uses maps onto a Paragraph 4(b) bad-faith factor. Passive holding – a domain parked with no active content – is also recognized as bad faith in the right fact pattern, particularly where the prior owner is clearly identifiable.
• Chain-of-title anomalies: A domain that transferred twice in rapid succession, or was immediately locked to a privacy proxy after transfer, tells a story that panels recognize. Document the sequence with timestamped screenshots and RDDS snapshots.

One common mistake: waiting to gather evidence while the registrar escalation is pending. The two exercises should run in parallel. A UDRP complaint must be ready to file the moment registrar escalation fails or stalls, and the stronger the evidence package on day one, the less time is lost to procedural back-and-forth.

If you are gathering evidence of a .co theft now, reach us at info@cognomenlaw.com before filing anything – the order of steps matters.

How does the UDRP process work at WIPO for a .co recovery, and how long does it take?

A WIPO UDRP complaint for a .co domain follows the same five-stage procedure as any other UDRP filing: complaint → response → panel appointment → decision → registrar implementation. The respondent has 20 days to file a response after the case commences. A standard single-panel case resolves in about two months absent complications. WIPO also offers an expedited option, delivering a decision in about one month for single-panel cases covering up to five domains.

At the complaint stage, the filing must identify the domain, assert the three Paragraph 4(a) elements with supporting evidence, and choose the panel composition (one member or three) and the forum. For a straightforward theft recovery where the facts are strong and the respondent is likely to default, a single-member panel at the standard rate is usually the right call. A three-member panel – at USD 4,000 for the WIPO filing fee – makes sense where the respondent is sophisticated, the bad-faith case requires nuanced analysis, or there is a material risk of an adverse finding that could affect the broader portfolio.

If the respondent requests a three-member panel but the complainant filed for a single member, the parties typically split the higher three-member fee. That contingency should be budgeted. Once the panel is appointed, the decision issues on the record as filed; there is no oral hearing. The panel's order – transfer or cancellation – is then implemented by the registrar, usually within a few business days of the order becoming final.

One procedural nuance specific to theft cases: if the registrant has transferred the domain again during the UDRP proceeding, the complainant should notify WIPO promptly. A mid-proceeding transfer to a new registrant does not necessarily terminate the case, but it complicates panel jurisdiction and may require an amendment to the complaint. Catching this early – through registrar-lock requests filed at commencement – avoids that complication entirely.

What are the realistic costs when you recover a stolen .co domain?

Costs fall into two separate categories: the official forum filing fee and legal fees. They are different in character and scale, and conflating them is a mistake that leads to budget surprises.

The WIPO filing fee for a single .co domain, single-member panel, is USD 1,500. That fee covers the forum's administrative costs and the panelist's fee. It is payable at filing and is non-refundable if the case proceeds to a decision. If the complaint is withdrawn before panel appointment, WIPO typically refunds approximately USD 1,000 of the USD 1,500 fee. For a three-member panel, the WIPO fee rises to USD 4,000.

Legal fees are separate from the forum fee and depend on the complexity of the matter, the strength of the evidence package, and whether court action runs in parallel. Market rates for a straightforward UDRP complaint on a single domain – complaint drafting, evidence assembly, and filing – are commonly in the range of USD 3,000 to USD 7,000, separate from the forum fee. A theft case that involves registrar escalation, court-side work, or a three-member UDRP proceeding will sit at the upper end of that range or beyond it. We discuss fee structures in plain terms at the outset; we do not obscure costs in vague retainer language.

If the matter escalates to court – US anticybersquatting litigation or proceedings in another jurisdiction coordinated with local litigation counsel – costs increase substantially and shift to an hourly model. That path is appropriate when the damages are large enough to justify the investment, or when the identity of the perpetrator must be established through discovery that only courts can compel.

How does recovering a stolen .co domain differ from a .com or ccTLD without UDRP?

The good news about .co is that it operates under the UDRP, which means the procedure is familiar, the timeline is predictable, and WIPO – the dominant forum, handling roughly 97% of filings together with the Forum – is the natural provider. That distinguishes .co from ccTLDs such as .de, where there is no UDRP at all and disputes belong in the German courts, with a DENIC DISPUTE entry used to block transfer while the case proceeds. It also distinguishes .co from .uk, where the Nominet DRS applies a different standard ("abusive registration") and includes a mandatory free mediation stage before any expert decision.

Against a .com, the practical differences are minor: same UDRP, same WIPO process, same filing fees. The .co registry's agreement to administer UDRP disputes through WIPO means the recovery path is essentially identical to a .com recovery. The main variable is the losing-registrar – .co domains are sometimes registered through registrars with more variable response times to fraud escalation – but the UDRP operates independently of that cooperation once the complaint is filed.

Where a brand holds both a .com and a .co and both have been targeted – a pattern we see in sophisticated phishing and cybersquatting campaigns – a single UDRP complaint can cover both domains if the registrant is the same holder. That consolidation holds down the filing fee and ensures consistency in the panel's fact-finding. Where the registrants differ, two separate filings are required, and the forum choice for each should be considered separately based on the evidence available for each domain.

In our practice, we regularly advise registrants and brand owners whose exposure spans both generic and country-code zones. The cross-zone complexity is often where the most critical decisions sit – and where the wrong sequencing can prejudice the stronger claim.

Related at COGNOMEN

• Court action and domain theft recovery – the full service overview
• Step-by-step guide to recovering a stolen domain across any zone
• How to verify chain of title before acquiring or recovering a domain