What to do in the first 24 hours after your domain is stolen
Your domain stopped resolving overnight. The WHOIS record – or the RDAP lookup that replaced it as the standard since January 2025 – shows a registrant you do not recognize. The registrar's control panel no longer responds to your credentials. Every minute that passes makes the next step harder, because a thief's first move after a successful transfer is to push the domain to a second registrar, lock it, and monetize or ransom it from behind a privacy screen.
When a domain is stolen – meaning transferred without the holder's consent through account compromise, social engineering of the registrar's support team, or unauthorized use of transfer credentials – the recovery window is narrow. Act within the first 24 hours to maximize the chance of a registrar-level reversal before the chain of custody fragments across registrars and jurisdictions. The legal track runs in parallel, not after. This page gives the sequence.
Below is the emergency protocol we follow at COGNOMEN when a client calls with a domain theft: the technical steps, the evidence steps, and the legal steps, in the order they must happen.
Step 1: Lock everything you still control
Before you contact anyone, go to every account that touches the domain and change the passwords and authentication factors. This is not optional housekeeping. A thief who still has access to your email, your registrar account, or your DNS panel can undo every recovery step as fast as you take it.
Change the primary email on your registrar account. Enable hardware or authenticator-app two-factor authentication if you have not already. Do the same for the email address linked to the registrar – that inbox is the master key to the account, and if it was compromised, the theft may be ongoing. Check your email provider's login history for unfamiliar sessions and revoke them. Then check the registrar's access log if the panel exposes one.
Only when the attacker's route back in is closed should you pick up the phone.
Step 2: Contact the losing registrar's abuse or security team immediately
Call the registrar that held the domain before the transfer – the one you were a customer of. Do not use the standard support queue. Look for the registrar's abuse contact or domain-theft security line; most accredited registrars maintain a dedicated escalation path. Ask, by name, for the domain transfer dispute process and a hold or lock on any further outbound transfer while the dispute is open.
Under ICANN's transfer policy, a registrar has an obligation to suspend an unauthorized transfer within a defined escalation window. The shorter that window is kept, the less likely the domain reaches a second registrar beyond the losing registrar's reach. State clearly that the transfer was unauthorized, that you are the documented holder, and that you are requesting an emergency transfer lock pending investigation.
Follow the phone call immediately with a written notice – email, with a read receipt or a ticket number – that sets out: the domain name, your account reference, the approximate time you first noticed the loss, and the words "unauthorized transfer" or "account compromise." Get a ticket or case number. That number is the thread that ties the registrar's internal investigation to every later legal step.
If you are in this position right now, contact info@cognomenlaw.com. We can advise on the registrar escalation language in the first call and assess the legal track in parallel.
How do you document the theft while the record is still fresh?
Evidence captured in the first 24 hours is evidence captured before the thief can scrub or modify it. The RDAP lookup is your first tool. RDAP – the Registration Data Access Protocol that replaced the WHOIS service as the standard on 28 January 2025 – returns the current registration record in a machine-readable format. Run an RDAP query for your domain immediately and save the full output with a timestamp. Note the registrar name, the creation and expiry dates, and the updated-date field: an updated-date of today, or of the last few days, is the footprint of the unauthorized transfer.
Then take screenshots. Capture the domain's DNS resolution – run a command-line lookup and screenshot the output. Capture the current website or parking page visible at the domain. Capture any ransoming communications you have received. If the thief has contacted you by email, message, or a posted page, save those with full headers. Do not reply to ransom demands without legal advice; a reply can complicate both the registrar dispute and any later legal proceeding.
Gather your own ownership documentation in parallel: the original registration confirmation email, any billing receipts, and your trademark registration if the domain incorporates a mark you own. These are what a registrar, a panel, or a court will ask for first.
Step 3: Report to ICANN and flag the gaining registrar
If the domain has already moved to a second registrar – visible on the RDAP record – notify that gaining registrar's abuse team at the same time you escalate to the losing registrar. Use ICANN's online form to submit a transfer complaint to ICANN's Contractual Compliance team. This does not immediately recover the domain, but it creates a formal record with ICANN and, when patterns appear across cases, it triggers registry-level scrutiny.
State in your ICANN complaint: the domain name, the losing and gaining registrars by name, the date of the unauthorized transfer, and the ticket number from the losing registrar if you have one. ICANN's Contractual Compliance response is not fast – expect days, not hours – but the filing is a prerequisite for certain escalation paths and it establishes the public record of your claim.
Which legal route fits a stolen domain?
The answer depends on where the domain sits and what remedy you need. Here is the decision matrix that applies in most stolen-domain situations.
If the domain is a .com, .net, .org, or another gTLD, and the thief is holding or monetizing it rather than simply having resold it to an innocent buyer, a UDRP complaint before WIPO or the Forum can deliver a transfer order in roughly two months and for a forum filing fee that begins at USD 1,500 at WIPO for a single-member panel. The legal test is the three-element standard of Paragraph 4(a) of the UDRP: confusing similarity to your mark, no legitimate interest, and registration and use in bad faith. Domain theft by account compromise typically satisfies all three, because the registrant has no legitimate basis and the acquisition itself was fraudulent. The UDRP process runs on the record; it does not pause for the thief's cooperation.
If you need the domain back faster – say, within a month – WIPO's expedited procedure (available since 9 March 2026 for single-panel cases of up to five domains) delivers a decision in about one month at a forum filing fee of USD 4,000. That premium is often rational when the domain is revenue-critical.
If the zone is a national ccTLD, the applicable national procedure governs. For .uk, the Nominet DRS – administered by WIPO since 7 July 2026 – applies an "abusive registration" test that reads "registered or used" abusively, a lower bar than the UDRP's cumulative standard. For .eu, the ADR.eu procedure at the Czech Arbitration Court handles disputes. For .de, there is no UDRP and the dispute generally proceeds through the German courts, with a DENIC DISPUTE entry available to block further transfer while litigation runs.
Where the thief's conduct amounts to cybersquatting actionable under US anticybersquatting legislation, or where you need money damages and not just transfer, court action is the correct route – handled with local litigation counsel in the relevant jurisdiction. Court timelines are longer and costs higher than arbitration, but they reach remedies arbitration cannot: damages, injunctions, and contempt enforcement. The myth that court is always faster is worth addressing directly: for a domain dispute where transfer is the goal, arbitration is almost always faster and less expensive. Court becomes the right tool when arbitration cannot reach the remedy you need.
What does a stolen-domain recovery at COGNOMEN involve and cost?
We handle two phases, and the fees for each are separate. The first phase is the registrar escalation: the written notices, the ICANN complaint, and the coordination with the gaining registrar's abuse team. This work is time-sensitive and often produces the most immediate result if the transfer is very recent. The second phase is the legal filing – UDRP, ccTLD procedure, or court referral – which takes over if registrar escalation does not produce a voluntary reversal.
For hijacked-domain recovery, our indicative legal fee starts at USD 2,500, separate from the forum filing fee. That figure covers the registrar escalation and a UDRP or equivalent filing for a single domain. Cases involving multiple domains, a chain of transfers across registrars, or court action are quoted after a case assessment, as the fact pattern drives the work. Forum filing fees are quoted from APPENDIX A rates: WIPO starts at USD 1,500 (standard) or USD 4,000 (expedited); the Forum starts at around USD 1,300. Every figure is indicative; the exact cost is set after we review the facts. No outcome is guaranteed – domain theft recovery turns on the evidence, the registrar's cooperation, and the applicable procedure.
We publish our full fee structure on the Domain dispute fees: what a UDRP actually costs with us page, where forum and legal fees are set out separately so you can plan the total cost before committing.
In a recent matter – a .com theft by account compromise, spring 2026 – we escalated to the losing registrar within hours of the client's call, secured a transfer hold by the end of the first business day, and later filed a UDRP complaint that resulted in a transfer order. The domain was back under the client's control in under six weeks. In a separate matter – a .org domain held to ransom, autumn 2025 – the thief had already moved the name to a second registrar, making registrar escalation ineffective; we filed an expedited UDRP and the domain was transferred in approximately one month at the expedited WIPO rate.
To plan the recovery of a stolen or hijacked domain, contact info@cognomenlaw.com. We will assess the registrar escalation path and the legal track together.
What if the domain has already been resold to a third party?
This is the hardest scenario. Under the UDRP, a third-party buyer who purchased a stolen domain without knowledge of the theft has a stronger defense than the original thief. Panels weigh whether the current registrant had notice of the dispute or of the complainant's rights at the time of acquisition. An innocent-purchaser defense does not always succeed – the circumstances of the acquisition matter – but it complicates the proceeding.
Where a bona fide purchaser defense is credible, the analysis shifts toward court, where remedies include injunctions against further transfer and, in some jurisdictions, claims against the original thief for damages even after the domain is beyond the court's reach. That work involves local litigation counsel in the relevant jurisdiction. We assess this fact pattern case by case before advising on the route.
One practical point: even where a UDRP or court claim is uncertain, a well-documented theft – evidenced by the RDAP records, the registrar's internal logs, and your ownership documentation – often resolves by negotiated return once the third-party buyer understands the chain of title is compromised and that proceeding to a panel or a court is the alternative.
COGNOMEN focuses only on domain-name disputes – recovery, defense, and transactions. For an assessment of a stolen domain situation, reach us at info@cognomenlaw.com.
Related at COGNOMEN
Frequently asked questions
What exactly is included in COGNOMEN's stolen-domain recovery service?
The service covers registrar escalation – the written notices to the losing and gaining registrar, the ICANN complaint submission, and coordination to secure a transfer hold – followed by the legal filing appropriate to the zone: a UDRP complaint at WIPO or the Forum, a ccTLD procedure, or referral to local litigation counsel for court action. Evidence review and RDAP documentation are part of the initial assessment. Every case is quoted after a fact review; the indicative starting point for hijacked-domain recovery is USD 2,500 in legal fees, separate from forum filing fees.
What could change the cost or the timeline?
The primary variables are: whether the domain has moved to a second registrar (making registrar escalation harder); how many names are involved; whether a third-party purchaser is now in the chain; and which zone and procedure applies. A standard UDRP at WIPO typically concludes in about two months; an expedited UDRP takes about one month but costs more in forum fees. Court action is longer and priced hourly. The thief's cooperation – or the lack of it – does not affect a UDRP timeline, since the process runs on the written record regardless of whether the respondent participates.
How do we start?
Email info@cognomenlaw.com with the domain name, the registrar you used, and the approximate date you noticed the loss. Include any RDAP output or screenshots you have already captured – these accelerate the assessment. We will confirm which procedure fits the facts and provide an indicative cost and timeline before any engagement. There is no obligation at that stage. Speed matters in domain theft; we treat these as priority matters when they arrive.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.