Update: changes affecting how to recover a stolen .uk domain

Update: changes affecting how to recover a stolen .uk domain. UDRP and ccTLD domain recovery and defense across .uk. Email the firm to assess your case.

A domain disappears from your registrar account overnight. The WHOIS record changes. Someone else controls your .uk name – and your email, your website, and potentially your customers' trust go with it. If you are trying to recover a stolen .uk domain, the procedural landscape shifted in ways that affect which route you take and how fast you must move.

Recovering a stolen .uk domain turns on three concurrent tracks: a registrar escalation to trigger a transfer lock, a Nominet DRS complaint where the abusive registration meets the DRS test, and – where account compromise is proven and speed is critical – an urgent court application. The Nominet DRS reads "registered or used" abusively, a lower bar than the UDRP's cumulative standard, but it does not deliver the emergency suspension a court injunction can. Acting within the first 48 to 72 hours of discovering the theft preserves the most options.

Below: what changed, who is affected, and what to do now.

What Changed and Why It Matters for .uk Domain Theft

Nominet has clarified its internal escalation policy on unauthorized transfers within the .uk registry. Where a registrant can show clear evidence of account compromise – access logs, unauthorized auth-code generation, or a registrar transfer that the account holder never authorized – Nominet now expects registrars to engage a transfer-reversal request before the DRS queue reaches an expert. That shift is procedurally small but practically significant. It means the first call after discovering a stolen domain should be to the registrar's abuse team, not a DRS filing.

At the same time, courts in England and Wales have shown increasing willingness to grant interim injunctions freezing domain transfers where an applicant can demonstrate a strong prima facie case of unauthorized access. That court route does not replace the Nominet DRS; it runs beside it. The combination – registrar lock plus court freeze plus DRS complaint – is now the standard triple-track response for .uk domain theft involving an active business.

Who Is Affected by These Updates?

Any .uk registrant who holds a domain through a Nominet-accredited registrar is potentially affected. The most exposed are registrants whose domain is tied to active email infrastructure or an e-commerce site. Hijackers target those names because the leverage is immediate: redirect the MX records, intercept password-reset emails, and the original registrant loses access to every service that relied on that address.

Brand owners with pending or registered UK trademarks have an additional route: a Nominet DRS complaint alleging abusive registration. The DRS test – rights in a name plus registration or use that takes unfair advantage of, or is unfairly detrimental to, those rights – is fact-driven. Evidence of the compromise itself (timestamps, access logs, any ransom demand) goes directly to the abusive-use limb of that test. Where no trademark exists, the court route or registrar escalation carries more weight.

What to Do Now: The Three-Track Response

Speed matters more than sequence, but the order below reflects the practical reality of where leverage accumulates fastest.

Track 1 – Registrar escalation. Contact the losing registrar's abuse team immediately. Request a transfer lock and, where the gaining registrar is different, send a parallel notice to that registrar. Document every communication with a timestamp. Registrars have obligations under Nominet's Registrar Agreement; invoking those obligations on record creates a paper trail for both the DRS and any court application.

Track 2 – Nominet DRS complaint. The Nominet DRS includes a free mediation stage before an expert is appointed. Where the other side is a hijacker rather than a legitimate registrant with competing rights, mediation is unlikely to resolve the dispute, but the mediation step does not slow the process materially. If the registrant defaults, the complainant pays a GBP 200 + VAT summary decision fee. A defended case costs GBP 750 + VAT for a full expert decision. The process typically runs 8 to 12 weeks from filing to decision.

Track 3 – Court action. Where a business faces immediate revenue loss or reputational harm from a hijacked .uk domain, an interim injunction application to the High Court can freeze the domain pending trial. This route involves local litigation counsel and is costlier than the DRS, but it is the only path that can act in days rather than weeks. We coordinate directly with local litigation counsel in England and Wales for clients who need this track.

For an assessment of your domain dispute, contact info@cognomenlaw.com.

Related at COGNOMEN

• Court action and domain theft recovery – when arbitration cannot reach
• Reversing an unauthorized domain transfer: how the analysis works
• How to recover a lapsed domain: a step-by-step guide