How to run due diligence before buying a .co domain

How to run due diligence before buying a .co domain. UDRP and ccTLD domain recovery and defense across .co. Email the firm to assess your case.

A .co domain reaches the closing table. The price looks right, the name is memorable, and the broker says the seller has held it for years. What the broker does not mention – and what the seller may not know – is that the name was once the subject of a UDRP complaint, that the prior registrant lost a dispute and re-registered the domain under a shell entity, or that a trademark holder in the United States or Colombia is watching the registration with a monitor alert. You buy without checking. The problem follows you home.

To run due diligence before buying a .co domain you must verify chain of title, prior dispute history, existing trademark conflicts, escrow mechanics, and the eligibility of the transfer under the .co registry rules administered through WIPO – the dispute-resolution provider for .co. The process protects the acquisition price, the brand value, and the operational continuity of a name that may already be in a third party's legal crosshairs. COGNOMEN structures this review before a contract is signed.

This page sets out the specific checks, the legal risks that surface without them, the realistic cost of a post-acquisition dispute, and the next steps for buyers who are ready to proceed.

Why .co sits in a distinct risk category for domain buyers

Colombia's country-code top-level domain operates as a globally traded asset under UDRP governance, which places it in a different risk profile than most ccTLDs. Because WIPO serves as the official dispute-resolution provider for .co, a successful complainant can force a transfer or cancellation of a .co domain using exactly the same three-element UDRP test that applies to .com. That means every trademark owner worldwide, not just Colombian rights holders, can file against a .co registration.

That eligibility breadth is the first thing a buyer needs to internalize. A brand owner in Germany, Australia, or the United States with a registered mark that is confusingly similar to the target domain can file at WIPO the day after your purchase closes. The transfer you just paid for does not reset the clock or eliminate prior bad-faith conduct by the seller. If the domain was originally registered by someone acting in bad faith, that taint can survive the transfer.

In our practice, we regularly advise buyers who assumed the UDRP applied only to .com. It does not. Roughly the same evidentiary questions – prior trademark registrations, the original registrant's intent, commercial use before and after the transfer – will be placed in front of a panel in exactly the same way. Understanding that before the deal closes is the point of the exercise.

The .co zone also carries a secondary risk. Because .co has for years been marketed as the abbreviation for "company" and because it is phonetically identical to the .com suffix in many markets, it has attracted both legitimate premium registrations and opportunistic speculative registrations aimed at brand confusion. That dual character makes the dispute-risk population higher than in many purely national ccTLD zones.

What does a complete chain-of-title check cover?

Chain of title in a domain context means tracing the complete ownership history of the registration from its creation date to the present, identifying every transfer, every registrant of record, and every period of expiry or lapse. For a .co domain, the check has four components that must be run together.

The first is historical WHOIS and RDDS data. Current registration data shows only the present registrant. Historical WHOIS records – obtained through archival databases – show every prior registrant of record, including any period during which the domain was held under privacy or proxy services. A domain that shows clean current ownership may have passed through two or three prior hands, one of whom may have been the subject of a complaint or a cease-and-desist letter.

The second is the dispute history search. WIPO maintains a publicly searchable database of all UDRP decisions. A search against the exact domain name – and against any near-exact variant registered by the same seller – will reveal whether a complaint was ever filed, whether it was decided, and what the outcome was. A prior transfer order is a red flag even if the current registrant was not the losing respondent. A prior finding of bad faith can inform a future panel's view of whether the domain's use history is tainted.

The third is the trademark conflict analysis. This means searching major trademark registers – the United States Patent and Trademark Office, EUIPO, WIPO's own Madrid Monitor, and the Colombian Superintendence of Industry and Commerce, among others – for marks that are identical or confusingly similar to the target domain. The search should return not only registered marks but also applications filed after the domain's creation date, because a complainant can establish rights in a mark predating a UDRP complaint even through common-law or acquired-distinctiveness evidence. A domain that is clear of registered conflicts today may not be clear of a senior common-law mark.

The fourth is the registrar and transfer eligibility check. The .co registry (operated by .CO Internet, now part of the Neustar/GoDaddy infrastructure) has specific transfer procedures. Confirming that no transfer lock, UDRP lock, or registrar hold is active on the domain at the time of purchase is essential. A domain subject to an active UDRP proceeding is locked from transfer; a buyer who is not advised of a pending complaint may close a transaction that cannot legally complete.

We run all four components as a coordinated review before our clients sign a purchase agreement. To discuss due diligence on a .co domain you are considering, contact info@cognomenlaw.com.

How does prior dispute history affect what you are buying?

A prior UDRP complaint – even a dismissed one – changes what you are acquiring. The key question is why the complaint was dismissed. Panels dismiss complaints on at least three distinct grounds: the complainant lacked trademark rights; the respondent demonstrated a legitimate interest; or the complainant failed to show bad faith. Each outcome carries a different implication for a buyer.

If the complaint was dismissed because the prior registrant had a legitimate interest – a bona fide business use, a personal name, a descriptive use – that prior finding supports the legitimacy of the registration. A buyer who continues the same type of use inherits a defensible position. That is relatively clean due diligence, provided the buyer's own intended use matches the prior registrant's demonstrated purpose.

If the complaint was dismissed solely because the complainant lacked trademark rights that existed at the time of registration, the trademark holder may have since obtained registration. A pending trademark application at the time of a prior dismissal may now be a live registration – and the complainant, or a new one, can file again on stronger footing. We search for that gap between the prior dismissal date and the present.

If the domain was once transferred by UDRP order and then re-registered by a third party, the situation is materially more complicated. Panels have addressed the re-registration-after-UDRP-transfer scenario and have generally found that a third party who registers a domain after a transfer order – especially shortly after – takes on the full dispute risk of that history. Buying from a post-transfer re-registrant without knowing that history is one of the more costly mistakes we see in practice.

A prior RDNH finding in a complainant's favor – meaning the panel found the complaint was brought in bad faith to take the domain from a legitimate registrant – tells the buyer something different. The domain has a record of being targeted abusively, and the prior registrant prevailed. That is generally favorable due diligence for a buyer who intends a similar legitimate use.

What are the escrow and contract mechanics for a .co acquisition?

Domain acquisitions are not real-estate closings, but they share one structural requirement: the exchange of payment and the exchange of the asset must be simultaneous, or the parties must use a trusted intermediary to stage both. For a .co domain of any meaningful value, escrow is not optional.

The standard practice is to use a recognized domain escrow service. The buyer deposits funds, the seller initiates the domain transfer, and the escrow agent releases payment only after the buyer's registrar confirms the domain has been received in the buyer's account. The registrar confirmation step is where many undocumented deals collapse: the seller claims to have initiated the transfer, but the transfer fails because the domain is locked, the authorization code is invalid, or the receiving registrar has not confirmed eligibility.

For high-value .co acquisitions, we recommend an additional layer: a formal purchase agreement executed before the escrow opens. The agreement should specify the domain name exactly, the purchase price, the transfer timeline, the seller's representations about absence of encumbrances (no active UDRP proceeding, no third-party claim of which the seller is aware, no registrar lock), and the consequences of a failed transfer. Representations and warranties in domain purchase agreements are routinely overlooked in broker-led transactions, where the deal is often documented only by a brief email exchange.

The cross-border dimension matters here. A .co domain seller may be domiciled in Colombia, in the United States, in Europe, or anywhere else. If the seller's representations prove false – if there was an undisclosed active dispute, for example – the buyer's remedy depends on the governing law clause in the agreement and the seller's jurisdiction. Without a written agreement, a buyer's recourse is limited and expensive to pursue. We assist buyers in structuring these agreements with local litigation counsel in the relevant jurisdiction where a cross-border enforcement question arises.

In a recent matter (a premium .co acquisition, spring 2025), a buyer engaged us after a broker-led deal transferred a domain with an undisclosed prior UDRP decision that had identified the seller's predecessor in interest as having acted in bad faith. We mapped the complaint history, identified the trademark holder who had filed the original complaint, and structured a defensive posture for the buyer's intended use before the buyer's planned commercial launch. The outcome was a revised business plan for the domain that substantially reduced the exposure to a renewed filing.

Which trademark conflicts are most dangerous for a .co buyer?

Not every trademark overlap is a viable UDRP claim. The analysis turns on three variables: the strength of the trademark, the degree of similarity to the domain, and the plausibility of bad faith on the part of the prior registrant. For a buyer, the concern is whether an existing trademark holder can construct a credible complaint against the domain – and whether the buyer's own intended use would accelerate or mitigate that risk.

The most dangerous conflicts are identical matches: a .co domain that is letter-for-letter the same as a well-known registered trademark in a major jurisdiction. In these cases, the confusing similarity element is almost certainly met, and the panel's attention shifts immediately to rights/legitimate interests and bad faith. A buyer who takes title to such a domain and then uses it commercially – particularly in a way that overlaps with the trademark owner's goods or services – accelerates the bad-faith use question even if the original registration was arguably clean.

Typographical variants are the second category of serious risk. A .co domain that is one character different from a major brand – a transposition, an additional letter, a common misspelling – is a classic typosquat candidate. Panels have consistently found typosquatting to be evidence of bad faith registration where the registrant cannot demonstrate an independent reason for the specific variant chosen.

Geographic combinations are the third risk zone. A trademark plus a city, country, or industry descriptor in a .co domain – especially where .co is widely read as "company" or where the trademark owner operates in Colombia or Latin America – creates a heightened similarity risk. The panel will consider whether the geographic addition reduces or increases confusion in the relevant market.

Where a trademark conflict exists but is not fatal, a buyer may still complete the acquisition if the intended use is genuinely distinct from the trademark owner's field. We have advised buyers who acquired domains with partial mark overlaps and established defensible, clearly differentiated commercial uses. The key is documenting the independent basis for the name choice before the purchase closes, not after a complaint is filed.

If you have identified a trademark overlap and are not sure whether it is a blocking conflict, email us at info@cognomenlaw.com for an assessment of the three UDRP elements as they apply to your target domain.

How does the UDRP test apply to .co domains, and what does that mean for buyers?

Because WIPO operates as the dispute-resolution provider for .co, the standard UDRP three-element test from Paragraph 4(a) governs any post-acquisition complaint. All three elements must be proven by the complainant: confusing similarity to a mark, the registrant's absence of rights or legitimate interests, and registration and use in bad faith. The complainant's burden on bad faith is cumulative – both the original registration and the current use must be shown to be in bad faith.

For a buyer, this creates a specific structural opportunity. If the original registration by the seller was clearly in good faith – the seller had a genuine business purpose, the domain predates any trademark registration that covers the name, or the domain was acquired in a documented arms-length transaction at fair market value – the first bad-faith limb may be unmet even if the buyer's use is commercially aggressive. That is a defensible position, and it is worth documenting before the purchase closes.

Paragraph 4(b) of the UDRP lists non-exhaustive circumstances that evidence bad faith. The most relevant for buyers are registration primarily to sell the domain to the mark owner at a price exceeding out-of-pocket costs, registration to attract users for commercial gain by creating confusion, and a pattern of abusive registrations across multiple similar domains. If the seller's portfolio reveals a pattern – a dozen .co domains tracking a dozen different brand names – a buyer who takes assignment of one of them takes on reputational proximity to that pattern even if the individual domain transaction is clean.

Paragraph 4(c) safe harbors evidence legitimate interest: a bona fide offering of goods or services before notice of the dispute, being commonly known by the domain name, or a legitimate noncommercial or fair use. A buyer who can establish that the intended use falls within one of these safe harbors before the purchase closes is in a substantially stronger defensive position if a complaint is later filed.

The right route for a .co dispute, when one arises, depends on the situation. A complainant seeking transfer files a UDRP complaint at WIPO – the WIPO filing fee starts at USD 1,500 for a single-member panel – and a standard case is normally decided within about two months. If the domain is a new-gTLD counterpart (for example, a parallel registration in a new gTLD that .co Internet also operates), a URS suspension may be available at lower cost and faster timeline. Court action may be relevant where damages are sought alongside the domain, but that is a separate proceeding with separate cost implications and local litigation counsel in the relevant jurisdiction.

What is the realistic cost of skipping due diligence on a .co domain?

The cost of not running due diligence has two components: the direct cost of the dispute that follows, and the indirect cost of the business disruption while the domain is locked or contested.

On the direct side, a UDRP respondent faces a proceeding that is inexpensive to file against them and not free to defend. Respondent-side representation in a UDRP – assembling the legitimate-interest record, filing the response, and where warranted pursuing an RDNH finding – runs in a range comparable to complainant-side work, typically in the low-to-mid thousands of dollars at market rates, separate from any forum fee. That cost is incurred in addition to whatever purchase price was paid for the domain.

A loss at the UDRP level means the domain is transferred or cancelled. A cancellation destroys the investment entirely. A transfer to the complainant does the same, unless the buyer has independent leverage – for example, an independent trademark registration of their own, or a documented use predating the complainant's mark – that warrants a court challenge. Court challenges to UDRP outcomes are available but substantially more expensive than the UDRP itself.

On the indirect side, a domain subject to an active UDRP proceeding is locked from transfer and cannot be meaningfully sold or developed during the pendency of the case – typically two months, longer if complications arise. A buyer who purchased the domain to launch a commercial project faces a complete stop on that project while the case runs.

Pre-acquisition due diligence typically costs a fraction of the domain purchase price and a small fraction of the cost of a post-acquisition dispute. We have seen buyers pay five-figure acquisition prices and then face five-figure defense costs that, with a prior chain-of-title check, would have been avoided entirely. The calculus is straightforward. The question is whether it is run before or after the problem appears.

What does the cross-zone picture look like for .co buyers?

A .co acquisition rarely exists in isolation. Buyers of premium .co domains typically also hold – or want to hold – the .com equivalent, and sometimes regional ccTLDs relevant to their market. The cross-zone picture affects due diligence in two directions.

First, a trademark owner who wants to file against a .co registration may also file against the .com simultaneously, or may have already won the .com and is now pursuing .co as the next target. A chain-of-title search that does not look at parallel registrations in .com, .net, and relevant ccTLDs misses the full threat picture. We routinely run the search across zones for buyers of any commercially significant name.

Second, a .co buyer who also wants the .com equivalent should understand that the prior ownership history of the .com – including any prior UDRP complaint against it – can inform a panel's view of the .co situation. If the .com was once transferred by UDRP order against a registrant affiliated with the .co seller, that history is directly relevant to whether the .co registration carries the same taint.

In a second matter we handled (a cross-zone .co and .com acquisition review, autumn 2024), we identified a prior UDRP complaint against the .com counterpart that had been dismissed on a technicality rather than on the merits – the complainant had misidentified the registrant. The trademark holder retained the ability to refile and did not signal any intent to abandon the claim. The buyer adjusted the acquisition structure to prioritize the .com component, where the prior registration history was cleaner, and deferred the .co component pending a design-around analysis of the brand.

For buyers operating in multiple zones, the due diligence scope should mirror the acquisition scope. A narrow review covering only the target .co domain leaves unchecked risk in any parallel registration the seller also holds or previously held.

Related at COGNOMEN

• Domain transactions, escrow, and pre-acquisition due diligence across zones
• Recovering a lapsed domain registration under the .tv zone procedure
• New gTLD launch protection strategies for .co and related zones