For IT and security teams: when a domain problem is a security incident

Your domain stopped resolving at 2 a.m. The registration record shows a name you don't recognize. Your CISO is on a call with the registrar. This is not a branding problem – it is a security incident with a parallel legal track that your counsel needs to be on immediately.

A security team domain incident – unauthorized transfer, account compromise, or DNS hijacking – requires simultaneous technical containment and legal escalation. The legal route runs through registrar lock procedures, emergency escalation under ICANN's inter-registrar transfer policy, and, where those fail, court action or a domain-dispute proceeding. Speed is the deciding factor: every hour the registrant record is wrong, the attacker controls your zone.

This page covers the intersection of account compromise, unauthorized transfer, and DNS abuse – and the legal procedures that run in parallel with your incident response.

What domain problems do IT and security teams actually face?

Security teams encounter four distinct domain-level threats, each with a different legal pathway. Understanding which category applies changes the first call you make.

The first is account compromise leading to unauthorized transfer. A registrar account is accessed – through credential theft, SIM-swap, or social engineering – and the domain is transferred to another registrar or to a different registrant. The registration data changes. Your zone goes with it.

The second is DNS hijacking without a registrar-level transfer. The nameserver records are altered inside your existing registrar account, redirecting traffic – email, web, authentication endpoints – while the registration record still shows your organization as the owner. The legal analysis differs substantially from a full transfer.

The third is domain squatting and lookalike registration: a third party registers a confusingly similar string – a typosquat, a homoglyph, or a brand name in a ccTLD you did not register – and uses it for phishing, credential harvesting, or business email compromise. This is the threat category ICANN's DNS Abuse obligations, which took effect on 5 April 2024, are most directly aimed at, though those obligations are a mitigation duty on registrars and registries, not a mechanism for transferring title to you.

The fourth is the combination: an attacker registers an abusive domain, uses it to phish credentials, and then uses those credentials to compromise the legitimate registrar account. The two events are causally linked, and the legal remedies must address both.

In our practice, we regularly advise IT and legal teams who discover the problem at stage three or four – after the initial abuse has already produced a secondary compromise. Early escalation to legal counsel, alongside your technical containment work, compresses the timeline for recovery.

Why the legal track runs in parallel with technical containment

Technical containment – revoking stolen credentials, resetting MFA, isolating affected systems – addresses what happened inside your network. It does not address the domain record itself. That record sits with a registrar and, above it, a registry. Changing it back requires either the registrar's cooperation or an external order that compels that cooperation.

Registrars act on documented proof of authorization. A compromised account transfer looks, to the registrar's systems, entirely legitimate. The registrar will often not reverse it unilaterally without a court order or a formal dispute-resolution determination. That is the gap the legal track fills.

The first legal step is a registrar escalation: a formal written demand, supported by evidence of authorization and compromise, requesting an immediate lock and a transfer reversal. Registrars handle this through abuse and security teams, not through standard support channels. The response time varies – days in the best cases, weeks where escalation is unresponsive. Where the registrar does not cooperate, the next step depends on the zone.

ICANN's 2024 DNS Abuse amendments oblige contracted parties to take "prompt, reasonable and appropriate action" against abuse – but this is a technical mitigation duty. It does not authorize a registrar to transfer a domain to you on abuse grounds alone. A UDRP or court proceeding remains the mechanism for resolving title disputes.

For an assessment of where your incident sits in this framework – and which legal route to activate – contact info@cognomenlaw.com.

Which legal route fits a domain security incident?

The right route depends on what happened to the domain, which zone it sits in, and what remedy you need. These decisions should be made within hours of discovery, not days.

Unauthorized transfer of a gTLD domain (.com, .net, .org, and others): The primary route is registrar escalation, as above, combined with a complaint to ICANN where the transfer violated the inter-registrar transfer policy. If the registrant record has already changed to an adversarial party who then operates the domain abusively, a UDRP complaint at WIPO or the Forum runs alongside the technical track. A standard UDRP case is decided in roughly two months; the WIPO filing fee starts at USD 1,500 for a single-member panel. Where the transfer occurred within the last days and the domain has not yet been used, emergency registrar escalation and an ICANN complaint may move faster than any arbitration.

DNS hijacking without a transfer: Here the registrant record still shows your organization. The legal question is whether the registrar's failure to secure the account constitutes a breach of its terms of service or applicable law. Court action against the registrar, or a demand grounded in the registrar's own security obligations, is the appropriate route. Arbitration under the UDRP does not apply – you are already the registrant of record.

Lookalike or phishing domain in a gTLD: A UDRP complaint meets all three elements where you hold a trademark matching the targeted string – confusing similarity, no legitimate interest, and bad-faith registration and use. The bad-faith analysis in a phishing-domain case is among the clearest in the Policy; panels have consistently held that registration for credential harvesting satisfies Paragraph 4(b). Filing at WIPO or the Forum is appropriate; a case completes in roughly two months.

Incident spanning a gTLD and a ccTLD simultaneously: Attackers who conduct a coordinated campaign frequently register both. A UDRP complaint covers the gTLD string. The ccTLD requires a parallel filing under the relevant national procedure – the Nominet DRS for a .uk string (now administered by WIPO since 7 July 2026), the ADR.eu procedure for .eu, or the German courts for .de, where there is no equivalent arbitration and a DENIC DISPUTE entry can block transfer while litigation proceeds. We coordinate both tracks in parallel.

Where arbitration cannot reach – court action: If the domain has been used to cause quantifiable harm (business email compromise losses, diverted payments, fraudulent invoices paid to the attacker's account), damages lie only in court. US anticybersquatting litigation is the route for a .com where the registrant is identified and damages are sought alongside transfer. For non-US zones or registrants, local litigation counsel in the relevant jurisdiction handles the court track.

How does the ICANN DNS Abuse framework affect your incident?

As of 5 April 2024, amendments to ICANN's Registrar Accreditation Agreement and Registry Agreement oblige contracted parties to act on well-evidenced DNS abuse. The defined categories are malware, botnets, phishing, pharming, and spam where spam is a delivery mechanism for those threats.

This matters to your incident response in two ways. First, a phishing domain clearly falls within the defined abuse categories. A well-documented abuse report – with evidence of the phishing campaign targeting your organization – can trigger a registrar's mitigation obligation faster than a dispute-resolution timeline. That report should be prepared by legal counsel alongside your technical team to ensure it meets the evidentiary standard registrars expect.

Second – and this is the point most often misunderstood – a DNS abuse determination by a registrar does not resolve title to the domain. The registrar may suspend or restrict the domain; it will not transfer it to you on abuse grounds alone. To get the domain into your name, you need a UDRP transfer order or a court order. The abuse report and the UDRP complaint are complementary, not substitutes for each other.

In a recent matter involving a coordinated phishing campaign (a .com lookalike registered in autumn 2025), we submitted a concurrent abuse report and UDRP complaint. The registrar's abuse team suspended the domain within days; the WIPO transfer order followed approximately seven weeks after filing. The suspension stopped the active harm while the legal route secured permanent title.

What evidence does the legal track require – and who holds it?

Domain-dispute and court proceedings are evidence-driven. The factual record your legal team needs overlaps substantially with your incident-response documentation – but the framing differs. Your IR team documents what happened to your systems. Your legal team documents what the domain did, what the registrant record shows, and what authority your organization has over the name.

The evidence set for a stolen or hijacked domain typically includes: the original registration confirmation and all renewal records; WHOIS/RDAP records showing the registrant before and after the incident; authentication logs showing the unauthorized access event; screenshots of the domain in abusive use (parking page, phishing content, redirect target); and the trademark registration or other rights documentation your organization holds in the name.

Since 28 January 2025, ICANN no longer requires registrars to operate a WHOIS service; RDAP is now the standard. Registration data for individuals is redacted by default under applicable data-protection law. Identifying a bad-faith registrant now typically requires an RDAP lookup followed by a disclosure request through ICANN's Registration Data Request Service (RDRS) – and the registrar's response is not guaranteed or automatic. Legal counsel coordinates this request as part of the pre-filing process.

For your IT team, the practical implication is: preserve logs and screenshots at the point of discovery, before the attacker rotates infrastructure. DNS resolution logs, mail delivery records, and authentication event logs are all potentially relevant. Chain of custody matters if a court proceeding follows.

For an assessment of your evidence and which forum fits your facts, contact info@cognomenlaw.com.

Is a court always faster than arbitration? Addressing the common assumption

A persistent assumption among security teams – understandably, given how courts handle injunctions in other contexts – is that a court order is the fastest remedy for a domain incident. For most domain disputes, the opposite is true.

A UDRP proceeding at WIPO is decided in roughly two months under the standard track, with a filing fee of USD 1,500 for a single-member panel. WIPO's expedited option, available since 9 March 2026 for single-panel cases of up to five domains, targets a decision in about one month; the complainant's fee for that track is USD 4,000. Both timelines assume no procedural complications.

A court action – even where a temporary restraining order is sought on day one – involves service of process on the registrant (which requires identifying the registrant first), preliminary injunction briefing, and, where the registrant is outside the jurisdiction, international service. The timeline stretches to months in most cases, and the cost scales accordingly.

Where court action is unavoidable – because the zone has no arbitration mechanism, because damages are sought, or because the registrant is running a sophisticated operation that requires broader injunctive relief – we coordinate with local litigation counsel in the relevant jurisdiction. But in the large majority of incidents involving gTLD domains, arbitration reaches a decision faster than any court will.

In a recent matter (a .com unauthorized transfer, winter 2025), a client's legal team initially sought a court order, having assumed it would be faster. We redirected to a parallel registrar escalation and UDRP filing. The domain was transferred back within approximately eight weeks of the incident – faster than the court would have issued even a preliminary order.

Cost and timeline: what to plan for

Security incidents involving domains are not budgeted events. The cost structure is worth understanding before you are in one.

For registrar escalation and an ICANN complaint, the legal work is typically billed at an hourly rate or as a flat engagement, depending on complexity. There is no forum filing fee for this route, but registrar non-response is common and the escalation may need to be repeated or escalated to ICANN oversight – both of which extend the timeline and the engagement.

For a UDRP complaint at WIPO, the filing fee is USD 1,500 for a single-member panel covering one to five domains. COGNOMEN's legal fee for a turnkey UDRP recovery is indicative at USD 2,500–4,000, set after a case assessment; this is separate from the forum fee and may vary with complexity. The expedited WIPO track (about one month) carries a WIPO fee of USD 4,000 for the expedited option and a corresponding legal fee component.

For a ccTLD parallel filing, the forum fees vary by zone: GBP 200–750 for a .uk DRS expert decision, EUR 250–1,500 for .eu and related procedures. Legal fees scale similarly to the UDRP track.

For court action – US anticybersquatting litigation or equivalent proceedings in another jurisdiction – fees are hourly and the matter is substantially more involved. This route is reserved for incidents where arbitration cannot reach (no applicable procedure, or the zone has no mechanism), where the identity of the bad actor makes a broader injunction necessary, or where documented financial losses justify the pursuit of damages.

Every cost figure above is indicative. The exact engagement is set after an assessment of your incident, your zone, and the evidence available. No outcome is guaranteed – domain disputes turn on facts and, in arbitration, panel discretion.

COGNOMEN's approach to domain security incidents

COGNOMEN handles domain-name disputes exclusively – recovery, defense, and transactions across gTLDs and ccTLDs, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, registrants, and organizations whose operational infrastructure depends on domain continuity.

For security teams, we integrate directly into your incident-response workflow. We assess the three UDRP elements, coordinate abuse reports with the formal legal filing, submit RDRS disclosure requests, and – where court action is warranted – instruct local litigation counsel in the relevant jurisdiction. We handle domain theft recovery from USD 2,500 (indicative, set after assessment), and we maintain COGNOMEN's published fee ranges at cognomenlaw.com/fees.html so your procurement team is not working blind.

To plan recovery of a stolen or hijacked domain, or to assess which legal route fits your incident, contact info@cognomenlaw.com.

Related at COGNOMEN

• court recovery – court action and registrar escalation for domain theft matters
• Luxury and fashion brand domain enforcement – domain enforcement strategy for high-value brand portfolios
• reverse unauthorized transfer sg – reversing unauthorized registrar transfers across gTLD zones

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.