TDRP vs UDRP: stolen domain or cybersquatting?
Your domain stopped resolving overnight. The registration record now shows a different owner, a different registrar, and a nameserver you have never seen. This is not a trademark dispute. It is a theft – and the procedure for recovering a stolen domain is entirely different from the one that handles cybersquatting.
The Transfer Dispute Resolution Policy (TDRP) and the Uniform Domain Name Dispute Resolution Policy (UDRP) address two distinct wrongs. The TDRP corrects unauthorized inter-registrar transfers that violate ICANN's transfer rules – it does not require a trademark. The UDRP adjudicates cybersquatting – a registration made in bad faith by someone exploiting a trademark. Choosing the wrong procedure does not merely lose the case; it may consume the time a thief needs to move the domain again.
This page diagnoses which situation you face, maps the rules and remedies for each route, and closes with a decision matrix covering the four most common patterns we see in practice.
What is the TDRP, and when does it apply?
The TDRP is ICANN's mechanism for reversing an inter-registrar transfer that breached the transfer-authorization rules – not a trademark rule, and not a bad-faith standard. If a domain moved from registrar A to registrar B without a valid authorization code, without the registrant's consent, or in violation of the transfer lock period, the TDRP is the designed channel for demanding a retransfer. The registrant does not need a trademark. The registrant needs evidence that the transfer was procedurally unauthorized.
In practice, the TDRP is rarely used in isolation. Most stolen-domain recoveries begin with a registrar escalation – a direct report of unauthorized access, a request to reinstate the losing registrar's record, and a simultaneous request for a registrar lock to prevent the domain moving again while the matter is resolved. Where the registrar cooperates, a retransfer can follow within days. Where it does not, or where the domain has already moved to a second or third registrar, a formal TDRP complaint or – more commonly – a court order become necessary.
If your registration record changed without your authorization, the clock matters more than the procedure. Contact info@cognomenlaw.com for an immediate assessment of which recovery route applies to your domain.
What is the UDRP, and when does it apply?
The UDRP was adopted by ICANN in 1999 and applies to all accredited registrars for generic top-level domains. It adjudicates cybersquatting: a third party registers a domain that is identical or confusingly similar to your trademark, has no legitimate interest in it, and registered and is using it in bad faith. All three elements of Paragraph 4(a) must be satisfied simultaneously. A complainant who cannot show a trademark right – registered or unregistered – cannot use the UDRP at all.
The UDRP offers only two remedies: transfer or cancellation of the domain. No monetary damages, no costs award, and no injunction. The standard case resolves in about two months, with the respondent given 20 days to file a response once the case commences. WIPO's filing fee starts at USD 1,500 for a single-member panel covering one to five domains. Since March 2026, WIPO also offers an expedited option delivering a decision in about one month, at a filing fee of USD 4,000.
The UDRP is the right tool when a stranger registered the domain. It is the wrong tool when the registrant was you, and someone took it.
How do the two procedures compare across the key decision factors?
The table below maps the dimensions that matter when you are deciding which route – or which combination – to pursue.
| Factor | TDRP (unauthorized transfer) | UDRP (cybersquatting) |
|---|---|---|
| Core wrong addressed | Breach of ICANN transfer rules; no trademark required | Bad-faith registration exploiting a trademark |
| Who initiates | Prior registrant or losing registrar | Trademark owner (complainant) |
| Trademark required? | No | Yes – registered or unregistered |
| Forum | ICANN-designated TDRP provider; also registrar escalation or court | WIPO, the Forum, CAC, ADNDRC |
| Remedy | Retransfer to prior registrar | Transfer to complainant, or cancellation |
| Monetary damages | No (TDRP itself); possible in court | No |
| Typical timeline | Days (registrar route) to weeks (formal complaint) | Approximately two months; one month via WIPO expedited |
| WIPO/forum filing fee | Varies; confirm with the provider | USD 1,500 (WIPO, single panel, 1–5 domains) |
| Key evidence | Transfer authorization records, account-access logs | Trademark registration, registrant's conduct, bad-faith indicators |
| Where it does NOT apply | Domain registered by a third party from the outset | Domain taken from you without your consent |
Why diagnosing the problem first is the decision that matters most
The single most consequential step is characterizing the wrong correctly. Panels deciding UDRP complaints have no jurisdiction over an unauthorized transfer; they adjudicate whether the registrant's conduct is abusive toward a trademark. A UDRP complaint filed against a domain thief will fail at the first element if the registrant – formally – is now a bona fide commercial entity that acquired the name at a reseller market, unaware of the theft. The underlying fraud becomes a matter for the registrar or a court, not the UDRP panel.
Conversely, the TDRP is useless when the domain was never yours. If a third party registered a domain matching your mark before you could, or recently, a UDRP complaint is the right instrument – not a theft report. We regularly see brand owners submit abuse reports to registrars for domains that were simply registered by a cybersquatter. Registrars correctly decline to act on those: no transfer rule was broken, so there is nothing for a transfer-policy mechanism to reverse.
The diagnostic question is simple: was the domain in your account, and did it leave without your authorization? If yes, the TDRP and registrar-escalation route is primary. If no – if a third party registered it independently – the UDRP is the starting point.
What evidence does each route require, and who holds it?
For a TDRP or registrar-escalation claim, the critical evidence is procedural: authorization codes (EPP auth codes), WHOIS/RDAP snapshots showing the before-and-after record, account-access logs if available from the registrar, and any phishing or social-engineering communications that preceded the transfer. This evidence lives with the registrar and with the registrant's own systems. Timing is acute – the longer after the event, the more difficult it becomes to obtain complete access logs, and some registrars retain them for limited periods.
For a UDRP complaint, the evidence is substantive: trademark registrations or evidence of acquired distinctiveness, the registration date and the registrant's conduct (parking pages, pay-per-click links, direct offers to sell, confusion-creating content), and any communications with the registrant. This evidence is largely in the complainant's control and can be assembled methodically over a period of weeks without the urgency that a theft situation demands.
In our practice, the stolen-domain scenario almost always requires immediate action in the first 48 to 72 hours: a hold request to the current registrar, documentation of the RDAP record before it changes again, and parallel notification to ICANN if the registrar is unresponsive. We have seen domains transferred a second time while a registrant waited for a single escalation ticket to resolve.
Where does a court action fit, and when is it the only option?
Neither the TDRP nor the UDRP awards monetary damages, and neither reaches a registrant who holds the domain in a jurisdiction that does not participate in ICANN's policy framework. Court action – anticybersquatting litigation in the relevant jurisdiction, handled with local litigation counsel – is the route that reaches both money and recalcitrant registrars. In the US context, this typically means anticybersquatting litigation of a kind that allows a court to order the domain's transfer and, where the conduct supports it, statutory damages.
Court is also the primary route for .de domains and any ccTLD whose registry has not adopted the UDRP or a close equivalent. DENIC (.de) offers a DISPUTE entry – a registration block that prevents the domain moving while a court claim is pursued – but the dispute itself is decided by the German courts, not by ICANN. For most stolen-domain situations involving a .de, the registrant must litigate.
How do you choose? The question is remedy and reach. If you need speed and the domain is a gTLD that moved through ICANN-accredited registrars, registrar escalation plus TDRP is faster than court. If you need money, or the domain is in a jurisdiction with no equivalent UDRP, court is the only mechanism that delivers. And if the wrong is cybersquatting rather than theft – a third party, not a thief – the UDRP is usually the fastest route to a transfer.
For a read on whether the TDRP, UDRP, or court action fits your specific situation, email info@cognomenlaw.com.
The common mistakes: where people choose wrong
Myth: a court is always faster than arbitration. For most domain disputes, the opposite is true. A UDRP at WIPO resolves in about two months. A court action – even an expedited one – typically takes far longer and costs substantially more. Opting for litigation when the UDRP is available usually means paying a larger fee for a slower decision with the same ultimate remedy: a transfer order.
The reverse error is equally costly. A brand owner whose domain was stolen sometimes files a UDRP complaint because the UDRP is the procedure they know. That complaint fails – not because the complainant lacks a trademark, but because the panel has no jurisdiction over what is, substantively, a transfer-rule violation. The months spent in UDRP proceedings are months during which the domain may move again, rank in search results under different content, or be monetized against the brand.
A third mistake is treating the TDRP as the only available lever for a stolen domain. In practice, a well-documented registrar escalation – submitted with clear evidence of account compromise, supported by a request for a registrar lock – often resolves the matter faster than any formal policy procedure. The TDRP exists as a backstop when the registrar does not cooperate or when the domain has already moved to a second registrar. Skipping the registrar step and going directly to a formal complaint wastes time that the escalation route might have saved.
Decision matrix: which route fits which situation?
Working through four concrete patterns helps clarify the choice.
Situation 1 – Domain taken from your account. Your registrar account was compromised, and the domain transferred to an unfamiliar registrar without your authorization. The right route is immediate registrar escalation: a written abuse report to both the losing and gaining registrar, a lock request, and RDAP documentation within hours. If the gaining registrar does not respond or retransfer within a defined period, a TDRP complaint follows. Court action is available as a parallel or fallback where the registrar is unresponsive and the domain is at risk of moving again. A UDRP complaint is not appropriate here – the element of a third party independently registering in bad faith is absent.
Situation 2 – Third party registered the domain matching your mark. A cybersquatter registered your brand name as a .com while you were building the business, or registered it shortly after your product launch. You have a trademark. The route is a UDRP complaint – at WIPO, the Forum, or CAC depending on volume, speed, and cost preference. If you also need a court-backed remedy or if damages are in scope, anticybersquatting litigation is available in the relevant jurisdiction. In a recent matter (a .com typosquat, spring 2026), a UDRP complaint filed promptly after discovery produced a transfer order roughly nine weeks after filing, with no extension sought by either side.
Situation 3 – Domain stolen, then resold to a bona fide purchaser. Your domain was stolen, moved to a new registrar, and then sold to a third party who had no knowledge of the theft. This is the hardest scenario. The TDRP and registrar escalation address the original unauthorized transfer, but the chain of title now involves an innocent buyer. Court action – with local litigation counsel in the relevant jurisdiction – is often the only route that can unwind a completed sale and address the underlying fraud. The UDRP does not resolve chain-of-title disputes of this kind.
Situation 4 – Disputed ccTLD domain. The domain is a .de, .uk, or another national ccTLD, and the registration record changed or was abusively made by a third party. The applicable procedure depends on the zone. For .uk, the Nominet DRS (now administered by WIPO since 7 July 2026) applies if the wrong is cybersquatting – but an unauthorized transfer is still a registrar and court matter. For .de, neither the UDRP nor a DRS applies to cybersquatting; disputes go to the German courts, with a DENIC DISPUTE entry available as a preventive hold. For .eu, the ADR.eu procedure covers cybersquatting-type disputes, but remedies differ from the UDRP and eligibility requirements apply. In every ccTLD scenario, confirming the governing procedure before acting is essential – the rules vary materially by zone.
About COGNOMEN
COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. COGNOMEN focuses only on domain-name disputes – recovery, defense, and transactions – which means every matter, whether a stolen domain or a cybersquatting complaint, is assessed by counsel who work only in this area. To discuss a domain, contact info@cognomenlaw.com.
Related at COGNOMEN
Frequently asked questions
Which option is faster?
For a stolen domain, registrar escalation is the fastest route – a cooperative registrar can effect a retransfer within days. Where the registrar is unresponsive, the TDRP typically resolves faster than a UDRP. For a cybersquatting complaint, the UDRP at WIPO runs approximately two months for a standard case, or roughly one month under the expedited option introduced in March 2026 at a filing fee of USD 4,000. Court action for either wrong is typically slower than either policy-based procedure, though it is sometimes the only option that delivers the full remedy.
Which option costs less overall?
Registrar escalation for a stolen domain carries no forum filing fee – cost is the legal time spent on documentation and correspondence. A UDRP complaint at WIPO costs a minimum of USD 1,500 in forum fees for a single-member panel covering one to five domains, plus legal fees. Court action involves substantially higher total costs. The right comparison is not which option is cheapest but which option produces the correct remedy: filing the wrong procedure costs both money and time without recovering the domain.
Can I pursue both, and in what order?
Yes, in some scenarios both a TDRP or registrar escalation and a court action are appropriate – for example, where the stolen domain has been resold and the registrar is uncooperative. A UDRP and a court action can in principle run in parallel, though most brand owners exhaust the UDRP first given its lower cost and faster resolution. Where a UDRP is pending, some courts will stay a parallel litigation; confirm the position in the relevant jurisdiction with counsel before filing both simultaneously.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.