What is Domain theft? Definition and meaning
Domain theft is the unauthorized transfer of a domain name's registration from its rightful owner to another party, achieved by exploiting a registrar's account systems, forging authorization credentials, or social-engineering registrar staff.
Domain theft occurs when an attacker gains control of a domain name without the registrant's consent – typically by compromising the account at the registrar, submitting fraudulent transfer authorization codes, or manipulating registrar support channels. The result is a changed registration record, lost DNS control, and a domain that may resolve to entirely different infrastructure. It is not the same as cybersquatting, and it is not remedied by the UDRP.
If your domain stopped resolving overnight and the registration record now shows a different owner or registrar, the issue is almost certainly theft, not a policy dispute. The distinction matters enormously for what you do next.
What domain theft is – and what it is not
Domain theft is a security event, not a trademark dispute. The attacker does not register a new name that looks like yours; the attacker takes your name. That is the operative difference from cybersquatting, where a third party independently registers a confusingly similar string. Cybersquatting is handled under the UDRP or a comparable ccTLD procedure. Domain theft is not – because the UDRP only addresses disputes about rights in a name, not the integrity of the registration itself.
The term readers most often confuse with domain theft is cybersquatting. Both result in a domain being in someone else's hands. The mechanism, however, is entirely different. Cybersquatting is a voluntary registration by a third party. Theft involves an unauthorized act against your existing account. Confusing the two leads to filing the wrong procedure and losing weeks – or the domain permanently.
A related but distinct term is domain hijacking. The two phrases are often used interchangeably in the industry, and the practical consequences are the same. Some practitioners use "theft" when ownership is transferred to an unrelated third party and "hijacking" when DNS records are altered without a full transfer. For legal purposes the distinction rarely matters; both require registrar escalation and, where that fails, formal legal action.
Where domain theft sits in the rules
No single international treaty governs domain theft. The applicable rules come from three overlapping sources: the registrar's own transfer policies (shaped by ICANN's Inter-Registrar Transfer Policy), the terms of service between registrant and registrar, and general civil or criminal law in the relevant jurisdiction.
ICANN's Inter-Registrar Transfer Policy establishes a transfer-authorization framework requiring an Auth-Info code (sometimes called an EPP code) and registrant confirmation before a transfer completes. That process exists precisely to prevent unauthorized transfers. When a thief obtains the code through compromise or fraud, the formal authorization appears valid even though consent is absent – and that is what makes reversal complicated.
The UDRP cannot help here. Paragraph 4(a) of the UDRP requires the complainant to have trademark rights and frames the dispute around registration and use in bad faith. A stolen domain is not a bad-faith registration by a third party; it is a corrupted transfer of an existing registration. ICANN has no mechanism to order a registrar to reverse a completed transfer outside of its own escalation procedures and, ultimately, a court order.
A registrar lock – sometimes called a transfer lock or clientTransferProhibited status – is the single most effective preventive measure. When active, it blocks any outbound transfer request at the registry level. If yours was not set, that is the first conversation to have with counsel about prevention going forward. You can read more about how locking works in our related glossary entry on What is Registry lock? Definition and meaning.
Three recognizable patterns of domain theft
Domain theft follows a small number of well-worn patterns. Recognizing yours helps identify the recovery route.
Account compromise via credential theft. The attacker obtains the registrant's login credentials – through a phishing email, a data breach at an unrelated service where the same password was reused, or malware. Once inside the account, the attacker changes the email address associated with it, disables two-factor authentication, requests the Auth-Info code, and initiates an outbound transfer. By the time the registrant notices, the domain is with a new registrar and a new nominal owner. This is the most common pattern in our practice. The transfer window means time is the critical variable.
Social engineering of registrar support. Some registrars allow account recovery through identity verification conducted by support staff over chat or email. An attacker who knows enough about the registrant – company name, billing email, recent invoices – can sometimes persuade support to reset access or unlock a transfer. The fault lies with the registrar's verification process, which is a relevant fact in any subsequent recovery or damages action.
Insider or third-party access abuse. A registrant grants account access to an agency, a web developer, or a departing employee. When the relationship ends, access is not revoked. The former accessor transfers the domain, sometimes to a shell entity, sometimes to a buyer who may not know the provenance. The recovery here involves both the registrar and, frequently, the courts – because the third party may argue the transfer was authorized.
Why domain theft matters to brand owners and investors
A stolen domain is immediately weaponizable. The attacker can redirect your web traffic, intercept email, issue fraudulent invoices under your brand, or simply hold the name for ransom. For a business domain, even a few hours of downtime or redirection can cause commercial harm that is impossible to quantify precisely and difficult to remediate even after the domain is returned.
For domain investors, the asset value is the domain itself. A high-value name can command six or seven figures. The theft is therefore a direct financial loss, not a reputational one – and the recovery calculus includes the question of whether a buyer downstream acquired the name in good faith, which can complicate a claim.
Some assume a court action is always slower and more expensive than an arbitration procedure. For domain theft, that assumption is often wrong in the other direction. There is no arbitration for theft. The registrar escalation path – locking the domain, submitting a formal dispute to the registrar, escalating to ICANN Compliance if the registrar is unresponsive – can produce interim relief within days if the registrar cooperates. When it does not, a court order is the remaining option. The route is described in more detail in our guide registrar lock escalation fr.
Speed matters above all else. Once a domain is transferred onward to a second or third registrar – or resolves back to a buyer claiming clean hands – the practical difficulty of recovery increases substantially. Early escalation, ideally within hours of discovering the theft, gives the registrar a live transfer to intercept.
How recovery works in practice
Recovery from domain theft runs through several stages, and which stages you reach depends on how quickly the registrar acts. The process is not analogous to a UDRP domain dispute; it is a security-and-contract dispute, not a trademark proceeding.
The first step is registrar escalation: a formal written complaint to the losing registrar (the one that processed the outbound transfer), with evidence of your prior ownership and the unauthorized nature of the transfer. Registrars have internal procedures for this, and ICANN Compliance is an escalation path when the registrar fails to act within a reasonable period.
If the domain has moved to a second registrar, both registrars must be engaged. ICANN's procedures contemplate a Registrar of Record dispute; in practice, getting two registrars in different jurisdictions to coordinate is slow without legal pressure.
When registrar-level escalation fails, court action for cybersquatting – or, more accurately, for theft of property, breach of contract, or conversion depending on the jurisdiction – is the remaining route. In the United States, federal courts can issue orders that ICANN and registrars recognize. In other jurisdictions, equivalent civil proceedings apply. We engage court recovery procedures when the registrar track has stalled or when the domain has been transferred beyond what registrar-level intervention can reach.
If you discovered unauthorized changes to your domain's registration record today, contact info@cognomenlaw.com immediately. Early escalation is the single factor that most reliably separates recoverable situations from those that require protracted litigation.
Domain theft compared to related terms
Three terms cluster around this concept, and precision matters when you are choosing a remedy.
Domain theft – as defined above: an unauthorized transfer of registration. The remedy is registrar escalation and, if that fails, court action.
Cybersquatting – a third party independently registers a confusingly similar domain in bad faith. The remedy is a UDRP complaint (or the applicable ccTLD procedure), which can produce a transfer order within about two months at a WIPO filing fee starting at USD 1,500 for a single-member panel.
DNS hijacking – an attacker alters DNS records without transferring the registration. Your WHOIS record may still show you as owner while your traffic resolves elsewhere. The remedy is account recovery, DNS record restoration, and registrar escalation; in severe cases, a court order compelling the registrar to restore records.
Getting these straight before you engage counsel saves time and prevents a misfiled UDRP that delays the real remedy. If the WHOIS record still shows you as registrant but your DNS points elsewhere, that is DNS hijacking, not domain theft. If the WHOIS record shows a stranger, that is theft or an unauthorized transfer.
COGNOMEN handles domain disputes exclusively – recovery, defense, and transactions across gTLDs and ccTLDs. For an assessment of your domain theft situation, contact info@cognomenlaw.com.
Related at COGNOMEN
Frequently asked questions
What is domain theft?
Domain theft is the unauthorized transfer of a domain name's registration away from its rightful owner, typically achieved by compromising the registrant's registrar account, obtaining the transfer authorization code through fraud, or social-engineering registrar support staff. The result is a changed WHOIS record, lost DNS control, and an asset the original owner no longer controls. It is distinct from cybersquatting, which involves a third party independently registering a similar name.
How is domain theft proven or established?
Proof centers on demonstrating prior ownership and the absence of consent. Relevant evidence includes historical WHOIS or RDAP records showing the complainant as registrant, registration invoices and renewal receipts, correspondence with the registrar, and logs showing no authorized transfer request was submitted by the account holder. Where a registrar's own security failure enabled the theft, the registrar's support transcript and authentication records become central. No panel decides these cases; a court or the registrar's internal process does.
Why does domain theft matter to my domain?
A stolen domain can be redirected to intercept your email, deceive your customers, or be sold to a third party who may claim innocent acquisition. The longer the domain remains outside your control, the harder recovery becomes – each onward transfer adds a new party whose claim must be addressed. Acting within hours, not days, is the single most important factor in a successful recovery. If your domain has changed hands without your authorization, escalate to the registrar immediately and seek legal advice the same day.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.