How to prove a registrant has no legitimate interest in a .io domain

How to prove a registrant has no legitimate interest in a .io domain. UDRP and ccTLD domain recovery and defense across .io. Email the firm to assess your case.

A brand owner discovers that a .io domain matching its product name is pointing at a pay-per-click parking page. The registrant is anonymous, has no apparent business connection to the name, and has never responded to outreach. The question is not whether the registration looks opportunistic – it plainly does. The question is how to prove, formally and on the record, that the registrant has no legitimate interest in a .io domain.

Under the UDRP, which applies to .io domains through WIPO's administration, a complainant must satisfy all three elements of Paragraph 4(a): confusing similarity to a mark, absence of rights or legitimate interests in the registrant, and bad-faith registration and use. The second element – legitimate interest – cannot be proven affirmatively by a complainant who has no access to the registrant's intentions, so the Policy uses a burden-shifting mechanism. Once the complainant makes a prima facie case that no legitimate interest exists, the burden of production shifts to the registrant to rebut it. Standard WIPO proceedings run to approximately two months, with the WIPO filing fee starting at USD 1,500 for a single-member panel on one to five domains.

This page explains the legal mechanism, the evidence that builds the prima facie case, what the registrant can say in response, and how to start a recovery action for a .io domain.

Why .io domains fall under the UDRP

.io is the country-code top-level domain assigned to the British Indian Ocean Territory, but it is operated commercially as a generic-style TLD popular with technology companies. WIPO serves as the dispute-resolution provider for .io, and the applicable rules are the standard UDRP and UDRP Rules. That matters because it means the same three-element test, the same filing fees, and the same panel pool that applies to .com disputes also applies to .io. A complainant pursuing a .io domain does not face a separate national procedure or an unfamiliar evidentiary framework.

The practical consequence is significant. A brand owner with a registered trademark – or even, in the right circumstances, an unregistered common-law mark – can file a UDRP complaint at WIPO targeting a .io domain and obtain a transfer or cancellation order without going to court. There is no eligibility restriction tied to British Indian Ocean Territory residency, no requirement that the complainant have any geographic connection to the zone. The UDRP's rules apply as written.

One nuance worth noting: because .io carries a technology-sector connotation, panelists sometimes assess legitimate-interest arguments in light of that context. A registrant claiming to operate a technology startup that happens to use the domain may receive slightly more scrutiny of whether any actual business activity exists. We advise complainants to document the registrant's lack of any genuine commercial presence with particular care in .io cases.

What does "no legitimate interest" mean under Paragraph 4(a)?

The second UDRP element asks whether the registrant – the respondent in the proceeding – has rights or legitimate interests in the disputed domain name. Paragraph 4(c) of the UDRP sets out three safe harbors that the registrant may invoke to show a legitimate interest: (1) before notice of the dispute, the registrant used or made demonstrable preparations to use the domain in connection with a bona fide offering of goods or services; (2) the registrant has been commonly known by the domain name, even without a trademark; or (3) the registrant is making a legitimate noncommercial or fair use of the domain, without intent for commercial gain to mislead or divert consumers or to tarnish the mark.

If none of those safe harbors applies, the registrant has no legitimate interest – and the complainant's task is to demonstrate, through the evidence it controls, that each safe harbor is unavailable. That is what the prima facie burden means in practice. The complainant does not prove the negative directly. It shows, from what is publicly observable, that no bona fide use is occurring, that the registrant is not known by the name, and that the use is commercial and deceptive rather than fair.

Panels have consistently held that passive holding of a domain – pointing it at a parking page or leaving it dormant – does not constitute a bona fide offering. A registrant who does nothing with a domain that reproduces a third party's mark cannot claim safe harbor under Paragraph 4(c)(i). Similarly, a registrant whose WHOIS/RDDS record shows a name unrelated to the disputed domain cannot credibly claim to be commonly known by that name. These are the gaps the complainant exploits.

How does the burden-shifting mechanism work?

The burden-shifting structure is the most misunderstood feature of the second UDRP element. A complainant that expects to carry the full burden of proving the registrant's subjective state of mind will draft an inadequate complaint. The correct understanding is this: once the complainant presents a coherent prima facie case – typically by showing it has trademark rights, the domain is confusingly similar, and there is no publicly apparent basis for the registrant's use – the burden of production shifts to the registrant.

The registrant then has 20 days after formal commencement of the proceeding to file a response. That response must affirmatively invoke one of the Paragraph 4(c) safe harbors and support it with evidence: a business registration, a website screenshot showing commercial activity predating notice, a license agreement, evidence of being commonly known by the name. If the registrant files no response – which happens in a meaningful share of cases – the panel decides on the complaint alone. Default does not mean automatic transfer, but a well-evidenced complaint that goes unanswered typically succeeds on the second element.

In our practice, the quality of the prima facie case determines how much work the panel does on the second element. A complaint that merely states "the registrant has no legitimate interest" without walking through the three Paragraph 4(c) factors invites a panel to do its own analysis – and panels vary in how generous they are to an underdeveloped record. We build the prima facie case expressly, factor by factor, so the path to transfer on the second element is clear even before the registrant has a chance to respond.

To have the three UDRP elements assessed for your .io domain, reach us at info@cognomenlaw.com.

What evidence builds the strongest prima facie case?

Evidence for the second UDRP element falls into two categories: evidence of what the registrant is not doing (no bona fide use, no commercial presence, no association with the name), and evidence of what the registrant is doing (parking, pay-per-click links in the complainant's industry, offer to sell at a premium). Both categories matter, because the second reinforces the prima facie case on the third element – bad faith – as well.

The following evidence is most probative:

• WHOIS/RDDS records – A registrant name that bears no relation to the disputed domain supports the inference that the registrant is not commonly known by that name. Capture and exhibit the RDDS output as of the filing date.
• Website screenshots – A parking page, a pay-per-click directory, a "domain for sale" landing page, or a blank server all undercut any claim of bona fide use. Archive screenshots with date-stamps using a recognized web-archival service.
• Internet Archive records – Historical screenshots show what the domain displayed over time. A site that has never shown any genuine commercial activity is powerful evidence against bona fide use under Paragraph 4(c)(i).
• Business registration searches – A search of commercial registries in the registrant's listed jurisdiction, showing no entity known by the disputed name, supports the "not commonly known" prong of Paragraph 4(c)(ii).
• Trademark database searches – A search showing the registrant holds no trademark in the disputed term, in any jurisdiction, removes one route to legitimate interest.
• PPC link analysis – Where the parking page displays links in the complainant's industry sector, this simultaneously evidences lack of legitimate interest and bad faith under Paragraph 4(b)(iv).
• Correspondence records – Any offer by the registrant to sell the domain for a price exceeding documented out-of-pocket costs is a Paragraph 4(b)(i) bad-faith indicator that also forecloses a legitimate-interest claim.

Is documentary evidence from a private investigator or third-party monitoring service admissible? WIPO panels generally accept properly authenticated electronic records. What they do not accept is speculation or bare assertion. Every factual claim in a complaint should be accompanied by a dated exhibit.

How does a registrant defeat the second-element case?

Understanding the registrant's options helps the complainant anticipate and pre-empt them in the complaint itself. Three defenses recur with regularity.

First, the registrant may claim it was using the domain for a bona fide business before it received notice of the dispute. "Before notice" is the key phrase. Paragraph 4(c)(i) is only available if genuine use – or concrete preparatory steps – predated the complainant's assertion of rights. A few screenshots of a rudimentary website created days before a cease-and-desist letter will not satisfy this standard. Panels look for evidence of investment: registered company, employees, product development records, payment infrastructure.

Second, the registrant may claim it is known by the name. This defense works where the registrant's legal name, trade name, or nickname actually corresponds to the domain. It fails where there is no documented association between the registrant's identity and the disputed term prior to the dispute.

Third, a registrant may invoke fair use – criticism sites, fan sites, commentary. Fair use under Paragraph 4(c)(iii) requires that the use be noncommercial and that the domain not be used in a way designed to mislead consumers. A domain that is genuinely a criticism site operated at a loss is defensible. A domain that carries advertising revenue from links to competitors is not.

In a recent matter (a .io domain, spring 2025), a registrant claimed a startup business connected to the disputed name and filed a response with a business plan and a prototype website. We had anticipated this and included in the complaint both the absence of any pre-notice filing records and archived screenshots showing the domain had been parked for over a year before the complainant's outreach. The panel found the startup evidence insufficiently contemporaneous and ordered transfer.

What is the full UDRP process for a .io domain?

A UDRP complaint targeting a .io domain proceeds through five stages: complaint drafting and filing at WIPO, formal commencement and notification to the registrant, the 20-day response window, panel appointment and deliberation, and the decision followed by registrar implementation. In a straightforward single-panel case with no supplemental filings and no procedural detours, the full cycle runs to approximately two months.

The WIPO filing fee for one to five domains before a single-member panel is USD 1,500. If either party requests a three-member panel, the fee rises to USD 4,000, and the parties generally split the difference between the single- and three-member fees when the respondent triggers the upgrade. Legal fees for drafting and filing a complaint are separate from the forum filing fee; in the market, a straightforward single-domain complaint typically runs in the USD 3,000 – USD 7,000 range, depending on complexity and the extent of evidence assembly required.

The only remedies available under the UDRP are transfer of the domain to the complainant or cancellation. There are no monetary damages, no costs award, and no injunction. If the goal is damages, US anticybersquatting litigation – a court route – is the only path that reaches money, though it carries substantially higher cost and a longer timeline. For most brand owners with a .io domain dispute, UDRP transfer is the proportionate remedy and the fastest route to recovery.

One timing factor specific to .io: because the registry processes WIPO transfer orders promptly, a successful decision is implemented quickly once the registrar's lock-period expires. There is no equivalent of a lengthy domestic-court enforcement step.

How does .io compare to other zones when proving no legitimate interest?

The UDRP applies uniformly to .io, so the second-element analysis is governed by the same consensus view that applies to .com, .net, and other gTLD-equivalent zones. That is both an advantage and a limitation.

The advantage: panelists and complainants have decades of accumulated practice on what constitutes a sufficient prima facie case under Paragraph 4(c). The evidentiary playbook is well understood. A complainant who files a thorough complaint against a .io parking page is operating in familiar procedural territory.

The limitation: if the domain is also registered in a national ccTLD – say, a .de or a .fr variant – those disputes require separate national procedures. A UDRP success on the .io domain does not automatically carry over to the .de version. For .de, there is no UDRP; that dispute belongs in the German courts, with a DENIC DISPUTE entry to block transfer during litigation. For .eu domains, the ADR.eu platform administered by the Czech Arbitration Court applies its own rules, and the remedy may be revocation rather than transfer depending on EU eligibility. For .uk domains, the Nominet DRS applies a different standard – "abusive registration" rather than the UDRP three-element test, and the threshold reads "registered or used" abusively, a lower cumulative bar than the UDRP's "registered and used in bad faith."

Where a brand is active across multiple zones and a registrant has taken the .io, a .com, and a .uk variant simultaneously, the appropriate response is typically a coordinated multi-zone filing: UDRP at WIPO for the .io and .com, Nominet DRS for the .uk. We assess those choices on the specific fact pattern – including the registrant's apparent jurisdiction and the complainant's trademark coverage – before recommending a route.

In a second recent matter (a .io and .com double registration by the same registrant, autumn 2024), we filed a single UDRP complaint covering both domains and demonstrated, against a respondent who filed no reply, a clear absence of any legitimate interest in either. The panel transferred both domains in a single order.

To weigh UDRP against a court action for your .io case, or to assess a multi-zone registration, email info@cognomenlaw.com.

What happens after the decision?

Once a panel issues a transfer order, WIPO notifies the registrar and the registry. The registrar locks the domain against further transfers or modifications. There is a short implementation window – typically ten business days – during which the losing registrant may seek a court stay in the relevant jurisdiction if it disagrees with the decision. In practice, court stays of UDRP decisions are uncommon.

If the panel denies the complaint, the complainant has not exhausted its options. A UDRP denial is not res judicata – it does not bar a subsequent court action or a refiled complaint where materially new evidence is available. A denial does, however, carry a reputational cost: if a panel finds the complaint was brought in bad faith to deprive a legitimate registrant, it may make a finding of Reverse Domain Name Hijacking (RDNH). An RDNH finding carries no monetary penalty, but it is published in the decision record and may affect the complainant's credibility in future proceedings.

How should a complainant manage the risk of an RDNH finding? File only when the three elements are genuinely met. Do not use the UDRP as a pressure tactic against a registrant who has a colorable legitimate-interest defense. If the registrant appears to have a real business using the name, assess the evidence honestly before filing. We regularly advise clients who initially want to file a complaint that a negotiated acquisition of the domain is the lower-risk path when the second element is genuinely in doubt.

Related at COGNOMEN

• UDRP domain recovery services – assess the three elements and file at WIPO, the Forum, or CAC
• Guide: proving no legitimate interest in a .info domain – the same UDRP mechanism in a different zone
• Guide: recovering a hijacked or stolen .io domain through registrar escalation