How to recover a lapsed .io domain that was re-registered
How to recover a lapsed .io domain that was re-registered. UDRP and ccTLD domain recovery and defense across .io. Email the firm to assess your case.
Your startup built its product on a .io domain. The renewal slipped – an expired card, a lapsed registrar account, a missed automated email – and within days a stranger held the name you had put on pitch decks and press releases. Now the domain either parks ads, redirects visitors elsewhere, or carries a buy-it-now price that reads like a ransom note. You want it back. The question is whether you have a route.
To recover a lapsed .io domain that was re-registered by a third party, a trademark holder typically files a UDRP complaint before WIPO, which administers disputes for .io alongside its gTLD caseload. The complainant must satisfy all three elements of Paragraph 4(a) of the UDRP: confusing similarity to a mark, no legitimate interest in the registrant, and registration and use in bad faith. The WIPO filing fee starts at USD 1,500 for a single-member panel. The fact that you previously held the name is relevant evidence – it is not, by itself, a guarantee of transfer.
This page covers the applicable procedure for .io, the chain-of-title checks that precede any action, what evidence moves a panel, the realistic timeline and cost, and how to weigh UDRP against a negotiated purchase or court route.
Why .io follows WIPO rules – and what that means for your case
.io is the country-code top-level domain for the British Indian Ocean Territory, but it functions commercially as a generic tech-sector domain. WIPO administers dispute resolution for .io under a procedure that closely tracks the UDRP. That alignment is significant: the three-element test, the evidence standards, the remedies, and the timeline familiar from .com disputes all apply here.
The remedy available under that procedure is transfer or cancellation. No monetary damages are awarded, and no injunction issues. If all you want is the domain back, that is fine. If you also want compensation for diverted traffic or reputational harm, UDRP cannot reach money – that requires a separate court action, handled with local litigation counsel in the relevant jurisdiction.
One procedural point matters immediately. The lapse itself creates complexity. A UDRP panel does not simply restore a prior registrant's "ownership." The panel applies the three elements as of the date of the new registration. Your prior use of the name becomes evidence of your trademark rights and, often, of the registrant's awareness of those rights. But it does not bypass the test. A panel still needs to find bad faith in the re-registration, not merely opportunistic timing.
That distinction – prior holder versus current bad-faith registrant – is where these cases are won or lost. Panels have consistently held that a registrant who acquires a lapsed domain with knowledge of the prior holder's trademark rights, and who then monetizes or holds the name passively, satisfies the bad-faith element. The key phrase is "with knowledge." Establishing that knowledge is the central evidentiary task.
For a read on whether the three UDRP elements are met in your .io situation, reach us at info@cognomenlaw.com.
What chain-of-title checks reveal before you file
Chain-of-title due diligence runs before any UDRP complaint, before any purchase negotiation, and certainly before you pay a broker to acquire a domain that might carry hidden legal exposure. For a re-registered lapsed .io domain, four inquiries are non-negotiable.
First, prior dispute history. WIPO and the Forum publish their decisions. If the domain was the subject of a prior UDRP complaint – filed by you or by anyone else – that record matters. A prior transfer order that was never implemented, or a prior complaint that was denied, shapes what a new panel will see. We review that history before advising on the strength of a current filing.
Second, trademark status and date. Your trademark rights must predate the re-registration. If your mark was applied for after the lapse, a panel may find that the new registrant could not have known of the mark at the time of registration – undermining bad faith. Rights based on unregistered or common-law marks are recognized under the UDRP, but the evidence threshold is higher and the analysis is more nuanced.
Third, the re-registration timeline. When did the domain lapse? When was it re-registered, and by whom? A registration that occurred within hours of expiry – often called a "drop-catch" – is strong circumstantial evidence of targeting. A re-registration that happened months later, through a standard registry auction, is more ambiguous. The interval matters.
Fourth, current use. Is the domain parked with ads that relate to your industry? Does it redirect to a competitor? Does it display a buy-it-now price aimed at you or others in your sector? Each pattern maps to a different Paragraph 4(b) bad-faith ground. A domain pointed at a competitor's products most directly invokes the disruption-of-business ground. A domain with a buy-it-now price implicates registration primarily to sell to the mark owner.
In one matter we handled (a .io domain, spring 2025), the chain-of-title check revealed that the re-registrant had acquired four other lapsed tech-sector domains in the same window – a pattern of conduct that constitutes an independent bad-faith indicator under the UDRP. That finding materially strengthened the complaint. The single-domain analysis, in isolation, would have been narrower.
If you are considering a purchase rather than a complaint, the same checks apply. Acquiring a domain that was itself the subject of prior cybersquatting, or that was transferred under unclear circumstances, can expose the buyer to a future UDRP complaint or, in some jurisdictions, to liability under applicable anticybersquatting legislation. Pre-acquisition due diligence is not optional. For a full discussion of what that process involves across tech-adjacent zones, see our guide on domain due diligence for .tv and similar zones.
To assess the chain of title and prior dispute history for your .io domain, email info@cognomenlaw.com.
How do the three UDRP elements work for a re-registered lapsed .io domain?
Each element has a specific application when the underlying fact pattern involves a lapse. Understanding where each one creates risk – and where it creates opportunity – is the foundation of a well-built complaint.
Element one: confusing similarity. This is usually the easiest element to satisfy. If the domain is identical or nearly identical to a registered trademark you hold, the similarity test is met. Descriptive additions ("get," "app," "io") do not usually break the analysis. The extension itself – .io – is generally disregarded for similarity purposes, consistent with settled UDRP panel practice.
Element two: no legitimate interest. The complainant bears the initial burden of making a prima facie showing that the respondent lacks rights or legitimate interests. That showing then shifts the burden to the respondent to come forward with evidence of legitimate interest. What counts? The Paragraph 4(c) safe harbors include: a bona fide offering of goods or services before notice of the dispute, being commonly known by the domain name, and legitimate noncommercial or fair use. A drop-catcher who parks ads has essentially none of those arguments available. The risk, in practice, is a respondent who has begun to build a site or business under the domain during the period between lapse and your complaint. The longer you wait, the stronger that argument becomes.
Element three: bad faith registration and use. This is the contested ground in most lapsed-domain cases. Panels apply the "registered AND used in bad faith" standard cumulatively – both sub-elements must be met. On the registration side, the key question is whether the re-registrant knew of your mark at the time of re-registration. Evidence of that knowledge includes: the mark's fame or distinctiveness at the date of re-registration; the registrant's own conduct (bidding for a drop-catch suggests awareness); the registrant's portfolio of similar names; and the content displayed on the domain immediately after re-registration. On the use side, parking pages with pay-per-click ads in your sector, a high buy-it-now price directed at mark owners, and passive holding of a distinctive name all satisfy the use element under well-established panel consensus.
There is a minority view in UDRP panels that re-registration of a lapsed domain cannot constitute bad faith because the original trademark holder "abandoned" the name by allowing it to lapse. The consensus position firmly rejects that view: lapse is not legal abandonment of trademark rights, and a party who knowingly acquires a lapsed domain to exploit an incumbent mark's goodwill acts in bad faith. We regularly brief this issue in complaints where respondents are likely to raise it.
What does the UDRP process look like from filing to transfer?
A standard WIPO proceeding for a single .io domain involves five stages, and the entire process is normally concluded within about two months absent procedural complications.
The complaint is filed with WIPO, accompanied by the filing fee. WIPO performs a formal compliance review. On commencement, the registrar locks the domain – preventing any transfer or deletion during the proceeding. The respondent then has 20 days to file a response. If no response is filed, the panel decides on the complaint alone; a default does not mean automatic transfer, but it eliminates any affirmative defense the respondent might have raised. After any response (or the expiry of the response window), WIPO appoints a panel. A single-member panel is standard unless one party requests three members and pays the higher fee. The panel issues a decision, WIPO notifies the parties and the registrar, and the registrar implements the transfer if the complaint succeeds.
The five-stage sequence looks straightforward. In practice, the pressure points are at the complaint-drafting stage and the panel-appointment stage. A complaint that omits key evidence, misstates the trademark date, or fails to address an obvious legitimate-interest argument invites denial. We have seen complaints fail on .io domains where the trademark rights were real and the bad faith was evident, simply because the evidence was not assembled in a form that moved the panel.
WIPO also offers an expedited option delivering a decision within about one month, available for single-panel cases of up to five domains. For .io disputes where the domain is actively diverting customers or is being used in a rapidly evolving competitor context, that option is worth considering.
When is a negotiated purchase better than a complaint – and when does the decision matrix flip?
The right route depends on the registrant's conduct, the strength of your trademark evidence, and how quickly you need the name. No two .io recovery matters are identical. Here is how we think through the decision.
If the re-registrant is a drop-catch service or a domain investor with no connection to your industry, and if your trademark registration predates the re-registration, the UDRP route is usually faster and cheaper than a court action. Filing cost – forum fee plus legal preparation – is typically a fraction of litigation. The process is entirely remote. And if the case is strong, a negotiated purchase during the UDRP period may produce a lower sale price than a direct approach before filing, because the registrant now faces a credible legal threat.
If, however, the registrant appears to have built a business under the domain, or if your trademark rights are based solely on common-law use and are not clearly established, the UDRP is a higher-risk path. A denial strengthens the registrant's position. In that scenario, a pre-complaint purchase negotiation – structured with a proper escrow to protect both parties – may produce a cleaner result without creating an adverse UDRP record.
A third scenario arises where the domain is hosted in a jurisdiction where the re-registrant has identifiable assets and your harm is demonstrable: a US anticybersquatting court action opens the possibility of damages alongside transfer, though it is substantially more expensive and slower. For most .io recovery matters that do not involve US-based parties, the UDRP is the primary route.
In a second matter we handled (a .io domain, autumn 2025), the registrant was a known portfolio investor with no industry connection. We filed the UDRP complaint, and the registrant approached us within the response window offering to sell at a price several times lower than the original demand. We advised the client on escrow structure and completed the transfer through a formal escrow arrangement – a cleaner outcome than a contested panel decision, and faster than continuing through the full process.
For questions about how ccTLD eligibility affects recovery strategy across other national zones, our guide on how to check ccTLD eligibility walks the same analytical framework applied to a different registry environment.
What evidence actually moves a UDRP panel in a .io lapse case?
Evidence selection is the practitioner's core task. A panel deciding a lapsed-.io dispute looks for a coherent narrative: here is the mark, here is the prior use, here is the registrant's awareness, and here is the conduct that exploits that awareness. Every piece of evidence either advances or complicates that narrative.
The evidence that consistently moves panels includes the following. Trademark registration certificates with dates clearly predating the re-registration – this is the foundation. WHOIS or RDDS history showing the complainant as the prior registrant of the same domain – this is powerful because it makes the "prior awareness" argument almost self-proving; a drop-catch service that acquires a domain once held by a recognizable tech brand cannot credibly claim ignorance. Screenshots of the domain as the complainant used it before lapse – archived pages, product listings, press coverage – establish the accumulated goodwill. Screenshots of current use – parking pages, buy-it-now listings, competitor redirects – establish the bad-faith use element. And, where available, evidence of the registrant's pattern of conduct across other domains establishes the Paragraph 4(b)(ii) bad-faith indicator.
What weakens a complaint? Long delays between lapse and filing. Changes to the domain's content after the complaint is filed (which can make the bad-faith-use element harder to document cleanly). A trademark that covers a broad, descriptive, or generic term. And, critically, evidence that the registrant has begun to develop a legitimate business under the domain during the lapse period.
One evidence-gathering step that counsel often overlooks is the registrant's own historical registrations. Public RDDS data, combined with published UDRP decision databases, often reveals whether a registrant has previously been found to have acted in bad faith across other domains. That history is admissible and, in our experience, is among the most persuasive material in front of a single-member panel.
How do costs and timelines compare across the recovery routes?
Transparency on cost is a point of principle at COGNOMEN. Here is a clear breakdown for .io domain recovery.
Forum filing fees are fixed and published. WIPO charges USD 1,500 for a single-member panel covering one to five domains. A three-member panel – sometimes requested where the case is high-value or where the respondent is likely to be aggressive – costs USD 4,000 at WIPO. If the respondent requests a three-member panel when the complainant selected a single panelist, the parties generally split the higher fee. Legal preparation fees for a UDRP complaint on a single .io domain in a straightforward case fall in a market range typically between USD 3,000 and USD 7,000, separate from the forum filing fee. Complex cases – multiple domains, contested trademark dates, active-use arguments by the respondent – sit toward the higher end of that range and sometimes above it.
A negotiated purchase adds escrow fees and broker fees where a broker is used, but avoids the legal preparation cost of a contested complaint. If the registrant accepts a reasonable price, the total cost is often lower than a full UDRP proceeding. The risk is paying above value or receiving no response.
US anticybersquatting court litigation is substantially more expensive and measured in months or years rather than weeks. It remains the route of choice when damages are required, when the UDRP is unavailable for the zone, or when the registrant's identity and assets are in the US and the harm is severe. For most .io disputes, it is not the first consideration.
For a broader view of how COGNOMEN structures domain transactions, due diligence, and recovery matters, see our domain transactions and brand protection services.
What are the common myths about recovering a previously owned domain?
The most persistent myth is this: "I registered it first, so I have priority." Under the UDRP, prior registration is evidence – strong evidence – but it is not a property right that travels with you automatically. The domain lapsed. A new registration occurred. The panel applies the three-element test to that new registration. Prior ownership is most valuable as proof of trademark rights and as proof of the registrant's knowledge of your mark. It does not replace the analysis.
A second myth: "If they don't respond, I win automatically." A default by the respondent removes the affirmative defenses, but the panel still verifies that all three elements are met on the evidence before it. Panels have declined to transfer in default cases where the complainant failed to establish bad faith. The complaint must stand on its own.
A third myth: "UDRP only works for famous marks." The Policy requires trademark rights, not fame. A registered trademark for a niche SaaS product qualifies. Common-law rights can qualify. The similarity element is mechanical – it does not require that the public knows the brand. The harder element in a niche-brand case is usually bad faith, because the registrant can argue they did not know of the mark at re-registration. That is why the chain-of-title evidence – showing the registrant acquired the exact domain that your brand previously held – matters so much. It makes the "I didn't know" argument implausible.
Related at COGNOMEN
Frequently asked questions: recovering a lapsed .io domain that was re-registered
When should I recover a lapsed .io domain that was re-registered?
Act as soon as the re-registration comes to your attention. Delay weakens a UDRP complaint in two ways: it gives the re-registrant time to build a legitimate-use argument on the domain, and it can complicate the bad-faith evidence timeline. If the re-registrant is actively using the domain to divert your customers or is holding it with a buy-it-now price, the harm is ongoing. The UDRP does not impose a strict limitation period, but panels have taken prolonged delay into account when weighing equitable factors. Earlier filing preserves the evidentiary record and reduces the risk that the registrant develops a defense.
What happens if the other side ignores the case?
If the respondent files no response within the 20-day window, the case proceeds to panel on the complaint alone. The panel does not treat silence as an admission; it evaluates whether the evidence in the complaint satisfies all three UDRP elements. In practice, default cases are decided faster because there is no response to assess. If the complaint is well-built – with clear trademark evidence, clear bad-faith conduct, and no obvious legitimate-interest argument left unaddressed – a default outcome is often a clean transfer. The registrar lock, imposed at commencement, remains in place throughout and prevents any defensive transfer or deletion of the domain.
How is WIPO different from a national court for .io?
WIPO decides only whether to transfer or cancel the domain; a national court can award damages, issue injunctions, and reach a broader range of remedies. WIPO's UDRP proceeding for .io is conducted entirely in writing, is usually concluded in about two months, and costs a fraction of litigation. A court action in the relevant jurisdiction – handled with local litigation counsel – is the route when damages are required or when the registrant's conduct falls outside what the UDRP can reach. For most .io recovery matters where the only goal is the domain name itself, WIPO is the faster and less expensive path.
About COGNOMEN
COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. Our practice covers .io and the full range of gTLD and ccTLD zones. We handle complainant and respondent work across the same procedures, giving us a rounded view of how panels decide contested cases. To discuss a domain, contact info@cognomenlaw.com.
For an assessment of your .io domain recovery matter, contact info@cognomenlaw.com.
Disclaimer: This article is general information about domain-name dispute procedures and does not constitute legal advice. Outcomes depend on the specific facts, the zone, and panel or court discretion. For advice on your domain, contact info@cognomenlaw.com.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
Related
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.