Recover a hijacked .it domain after account compromise: what panels actually decide

A domain registrant opens a Monday morning email to find their .it domain has been transferred – without authorization – to a stranger in a different jurisdiction. The registrar's WHOIS record now shows an unknown name. The company's Italian e-commerce traffic is already redirecting to a phishing page. This is account compromise followed by domain hijacking, and for .it it is a distinct legal emergency with a specific procedural map.

To recover a hijacked .it domain after account compromise, the legitimate registrant must move on two parallel tracks: an emergency escalation through the registrar and, where that fails, a proceeding before the Italian Registry authority (Registro.it) or the Italian courts. Unlike a standard cybersquatting dispute, account-compromise hijacking is not primarily a trademark contest – it is an unauthorized transfer of a registered asset, and the legal test turns on proof of fraud, forgery, or unauthorized account access rather than on the three UDRP bad-faith elements. Acting within the first 48 to 72 hours of discovery materially improves the chance of reversal.

This analysis covers the governing procedure for .it, the registrar-lock and transfer-reversal mechanics, the evidence that decides these cases, the choice between the registry procedure and the Italian courts, and the realistic outcome scenarios a registrant should weigh before the first filing.

Why .it hijacking cases follow a different playbook

The .it zone does not operate under the UDRP. Registro.it – the Italian national registry administered by the National Research Council (CNR) – has its own assignment rules and a dispute procedure known as the Reassignment Procedure. Where a domain has been obtained through fraudulent or unauthorized means, the Reassignment Procedure allows the rightful registrant to request reassignment without the three-element test that governs gTLD disputes. The governing question is not whether the holder registered in bad faith in the trademark sense; it is whether the transfer itself was lawful.

That structural difference matters for how evidence is assembled. A UDRP complainant must prove trademark rights and then build a bad-faith narrative around the registrant's conduct. A victim of account compromise before Registro.it must prove that a prior, legitimate registration existed and that it was lost through an unauthorized act – account credential theft, a forged identity document, social engineering of registrar staff, or abuse of a registrar's internal transfer process. The doctrinal frame is closer to property law than to trademark law.

We regularly advise Italian brand owners and foreign businesses with .it presence who discover their registrar credentials have been compromised. The pattern is consistent: the attacker first harvests login credentials (often through phishing the registrant's email account), then initiates a registrar-level change of registrant or an outbound transfer, using the victim's own authentication tokens to pass the registrar's checks. Speed is not incidental – the attacker relies on the delay between the fraudulent transfer and the victim's discovery to entrench the new registration before any lock can be applied.

Registrar-lock and transfer-reversal mechanics: the first 72 hours

The fastest available relief after discovering a hijacking is a registrar-level freeze, not a formal proceeding. Most registrars maintain an internal abuse or domain-security channel separate from ordinary customer support, and Registro.it's own escalation path accepts reports from registrars about unauthorized transfers. The sequence a registrant should run immediately is: (1) document the current WHOIS state; (2) notify the losing registrar in writing, citing unauthorized transfer; (3) request an emergency registrar lock on the domain; (4) report the incident to Registro.it simultaneously.

What decides whether a registrar reverses the transfer without formal proceedings? Registrars vary, but the factors that consistently move them are the age of the original registration, the documented gap between the registrant's identity and the post-transfer registrant data, and contemporaneous evidence of the account compromise. An account that was registered for a decade and transferred within 24 hours of a credential-reset event is a strong factual picture. A registrar that completed a transfer in apparent compliance with its own authentication protocol will still reverse if presented with clear evidence of upstream fraud. Contested reversals – where the current holder resists and the registrar declines to act unilaterally – go to the formal procedure.

One practical complication: if the hijacker has already onward-transferred the domain to a second registrar (sometimes to a jurisdiction where the original registrar has no enforcement relationship), the lock window closes faster. Registro.it's rules do not make a second transfer automatically void, but a contemporaneous formal complaint creates a chain-of-events record that courts and the registry procedure will both consider. Filing that record early – even before the full evidence package is assembled – is more valuable than waiting to file a polished submission.

For an assessment of your domain dispute, contact info@cognomenlaw.com.

The Registro.it Reassignment Procedure: scope, test, and timeline

The Registro.it Reassignment Procedure is the primary administrative route for recovering a .it domain that has been improperly transferred or registered. The procedure is not a court action; it is an expert determination administered through a designated dispute-resolution service provider authorized by Registro.it. The standard test asks whether the current registration was obtained through unauthorized means or violates the rightful registrant's established rights over the name.

Account-compromise hijacking fits the procedure because the unauthorized transfer is itself the wrong – no trademark comparison is required if the claimant can establish that they held a valid, unencumbered registration immediately before the fraudulent transfer. The claimant submits: proof of the prior registration (historical WHOIS records, registration confirmation emails, invoices from the prior registrar); evidence of the unauthorized event (server logs, credential-reset confirmation emails, phishing evidence, or a police report); and a declaration that they did not authorize the transfer.

Timing matters for the procedure as well. Registro.it rules have historically imposed filing windows for certain complaint types; any registrant who has discovered a hijacking should confirm the current applicable deadline with counsel without delay. We have seen cases where a registrant waited months before filing, believing the matter would resolve through the registrar, and found the procedural window had narrowed significantly.

What is the realistic timeline for a Reassignment Procedure determination? The process typically involves an initial review of admissibility, a response period for the current registrant, and a determination by the appointed expert. The overall duration is typically measured in weeks to a few months, depending on whether the respondent contests the claim. An uncontested case resolves faster; a contested case with supplemental submissions takes longer. No administrative fee equivalent to the WIPO filing fee schedule applies here in the same way – the applicable fees are set by Registro.it's authorized providers and should be confirmed at the time of filing.

When Italian court action beats the administrative procedure

The Reassignment Procedure is adequate for the typical account-compromise case where the facts are clear and the hijacker has no legitimate counter-argument. It is not always the right route. Three situations push the matter toward the Italian courts.

First, where the hijacker has already monetized the domain – redirected it to a commercial site, sold advertising, or used it to collect payments from the legitimate owner's customers – the administrative procedure cannot award damages. Only a court can. The Italian courts have jurisdiction over civil wrongs committed through the misuse of a domain, and a claimant who has suffered quantifiable commercial loss (lost orders, diverted payments, reputational damage from a phishing page) should be considering a court action alongside or instead of the administrative route.

Second, where a criminal complaint is warranted – and account compromise frequently involves the criminal offenses of unauthorized computer access and fraud under the applicable Italian criminal statutes – a parallel criminal report creates an additional evidentiary track. Criminal proceedings can compel disclosure of attacker identity data from the registrar and from the hosting provider, evidence that an administrative procedure has no power to obtain. We coordinate with local litigation counsel in the relevant jurisdiction for criminal filings of this kind.

Third, where the hijacker has quickly resold the domain to a third party who now claims bona fide purchaser status, the administrative procedure's ability to unwind the chain is limited. A court action is better positioned to address multi-party chains of title and to issue interim injunctions against all parties in the chain simultaneously. Italian procedural law provides for urgent interim relief (provvedimenti d'urgenza) that can freeze a domain's operation and registrant data pending a full hearing; this is the court-only mechanism that the administrative procedure simply cannot replicate.

In a recent matter (a .it e-commerce domain, spring 2025), we worked alongside local litigation counsel to secure an interim injunction freezing a domain that had already been onward-transferred twice after the original hijacking event. The administrative procedure would have addressed only the first transfer; the court order reached all three registrant changes in a single application. The domain was restored to the legitimate registrant approximately six weeks after the initial filing.

What evidence decides the outcome – and what the contrary view looks like

The consensus across Registro.it expert determinations and Italian court decisions on unauthorized transfers is that the claimant carries the burden of establishing the prior legitimate registration and the unauthorized nature of the transfer by a preponderance of the evidence. That is a lower standard than the criminal burden, but it requires affirmative documentation – a bare assertion that the transfer was unauthorized will not satisfy an expert or a court.

The evidence that consistently supports recovery includes: (1) historical WHOIS printouts or registry records showing the claimant as registrant immediately before the transfer; (2) the original registration confirmation email and any renewal invoices; (3) technical indicators of the account compromise – access logs showing logins from unfamiliar IP addresses, password-reset emails the registrant did not initiate, or changes to the registrant's email address made without authorization; (4) contemporaneous communications with the registrar documenting the objection; and (5) a formal police report (denuncia), which serves both as admissible evidence and as the trigger for the criminal channel.

What is the contrary view? A small but consistent minority of determinations – and this is the doctrinal tension the claimant must be prepared to address – find against recovery where the claimant's own security practices contributed to the compromise. If the registrant used a weak or reused password, failed to enable available two-factor authentication on a registrar that offered it, or left recovery credentials (a backup email address or phone number) under attacker control, the expert or court may weigh that against the claimant. This is not a contributory-fault bar to recovery in the full legal sense; it is rather a credibility and urgency signal. A registrant who acted promptly after discovery and maintained reasonable security practices presents a substantially stronger case than one who delayed or who cannot explain how the compromise occurred.

The second area of doctrinal tension concerns the current registrant's good faith. In a small number of cases, the domain has moved through a chain and the current holder claims to have acquired the domain from what appeared to be a legitimate seller, paying value. Expert panels and courts have generally declined to give strong weight to this argument in .it hijacking cases where the unauthorized origin of the chain can be traced – a fraudulent transfer does not automatically confer clean title on downstream purchasers who failed to conduct adequate due diligence – but the argument does add time and cost to the proceeding.

In a second matter (a .it brand domain, autumn 2024), a client had failed to enable two-factor authentication despite the registrar prompting them to do so over several months. The Reassignment Procedure expert noted this in the determination but ultimately ordered reassignment on the strength of the continuous prior registration and the unambiguous account-access logs showing an unauthorized credential reset. The takeaway is not that security failures are disqualifying; it is that they require an affirmative explanation and that the contemporaneous documentation must carry more weight as a result.

To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

How does .it hijacking recovery compare to gTLD and other ccTLD routes?

The comparison matters because a business whose brand name is hijacked as both a .com and a .it faces two different rulebooks at the same time. The .com, if hijacked, is subject to ICANN's registrar transfer procedures – including the Inter-Registrar Transfer Policy and, where cybersquatting is also alleged, the UDRP. The UDRP at WIPO carries a filing fee of USD 1,500 for a single-member panel on a single domain, and a standard case resolves in approximately two months. The three UDRP elements apply: confusing similarity to a trademark, no legitimate interest, and registration and use in bad faith. That test was not designed for account compromise; it was designed for deliberate cybersquatting. Panels have adapted it – finding bad faith in the unauthorized acquisition of a legitimate registrant's domain – but the fit is imperfect, and a domain-theft recovery through ICANN's specific transfer-dispute procedures is often cleaner than a UDRP complaint in a pure hijacking scenario.

The .uk, by contrast, is subject to the Nominet DRS, which uses an "abusive registration" test – notably reading the test as registration or use that is unfairly detrimental, a lower threshold than the UDRP's cumulative bad-faith requirement. Nominet's process also includes a free mediation stage, which the Registro.it procedure does not. The .de zone has no administrative dispute procedure at all; DENIC disputes proceed through the German courts, with a DENIC DISPUTE entry available to block transfer during litigation. Each national zone has its own procedural architecture, and a cross-border brand owner cannot assume that the path that worked for .com will transfer to .it or .de.

For a registrant holding both a .com and a .it that are hijacked in a coordinated attack – which is not uncommon; credential compromise at the registrar account level often exposes all domains in that account – the right approach is to run the .com and .it recoveries on separate parallel tracks, not to assume that a successful UDRP transfer automatically assists the .it Reassignment filing. The evidence overlaps; the procedure does not.

The decision matrix: procedure, timeline, and cost basis for .it recovery

The right route in any specific .it hijacking case depends on three variables: how fast the domain needs to be frozen, whether damages are sought, and whether the chain of title has become complex. Here is how the analysis runs in practice.

Where speed is the priority and the hijacker is still the current registrant with no onward transfer, the registrar-escalation-plus-Reassignment-Procedure path is fastest and least costly. The registrar escalation may resolve the matter in days if the evidence is clear. The Reassignment Procedure adds an administrative layer but typically resolves faster than court proceedings and at a lower cost. No monetary remedy is available, but if the goal is domain return rather than damages, this route is appropriate.

Where damages are sought or where the hijacker has used the domain commercially – pointing it at a phishing site, selling goods under the legitimate owner's brand, or renting it to a third party – a court action is necessary alongside or instead of the administrative procedure. Italian civil procedure supports interim injunctions that can freeze the domain and its commercial use pending a final judgment. The cost basis is substantially higher than the administrative route, and coordination with local litigation counsel in the relevant jurisdiction adds to both timeline and budget. The trade-off is access to compensatory relief and the compulsory disclosure tools that no administrative procedure offers.

Where the chain of title has become complex – multiple transfers, a current holder claiming purchaser status – a court action is strongly preferred because only a court can reach all parties in the chain and adjudicate competing claims to the domain in a single proceeding. The interim injunction tool is particularly valuable here; without it, the domain may continue to change hands while the proceeding is pending.

For foreign registrants – a US or UK company whose Italian distributor's .it was hijacked – the procedural question also includes jurisdictional standing before Registro.it. The Reassignment Procedure is available to non-Italian registrants, but the supporting declarations and evidence must meet Registro.it's formal requirements, which differ from those of WIPO. We have managed Reassignment filings for registrants in multiple jurisdictions; the procedural requirements are manageable but benefit from preparation by counsel familiar with the specific registry rules.

Myth, reality, and the objection the registrant always raises

The most common objection we encounter from registrants who have just discovered a hijacking is this: "The registrar must be responsible – they let the transfer happen." It is understandable. But under Registro.it's rules and under Italian contract law, a registrar that followed its own authentication protocol in good faith when processing the transfer is not automatically liable for the resulting hijacking. If the registrant's own credentials were compromised, the registrar may have had no reason to flag the transfer as fraudulent. The registrant's legal claim is against the hijacker, not the registrar, and the practical recovery path runs through the registry procedure and the courts – not through a breach-of-contract claim against the registrar, which is a longer and more uncertain path.

A second objection: "My domain has already been onward-transferred again – it's too late." This is the myth that causes the most damaging delay. An onward transfer complicates the case; it does not close it. The unauthorized origin of a chain of transfers can be pursued through a court action. Italian courts have addressed these multi-transfer chains, and interim relief remains available as long as the proceeding is commenced before the domain has been sitting undisturbed in the hands of a third party for an extended period. Acting promptly is always better. But a registrant who has been sitting on a hijacking for several months should still obtain a case assessment rather than assume recovery is foreclosed.

The third objection is about brand monitoring: "We didn't know the domain was hijacked until our customers told us." Post-hijacking discovery of this kind, while painful, is common. It is also a strong argument for proactive portfolio monitoring – a separate point addressed in the brand protection monitoring guide for Italy – but it does not affect the substantive case for recovery. The evidence of the unauthorized transfer is in the registry history regardless of when the registrant noticed it.

Realistic next steps and what to prepare before contacting counsel

Before a first call or email to dispute counsel, a registrant who has discovered a .it hijacking should assemble the following: (1) a screenshot or printout of the current WHOIS/RDDS record, timestamped; (2) the original registration confirmation email and any renewal receipts; (3) any evidence of the account compromise – password-reset emails, unfamiliar-login alerts, changes to registrar account contact data; (4) a written timeline of when the registrant last had confirmed control of the domain and when the change was first noticed; and (5) any communications already exchanged with the registrar or registry.

That package allows counsel to assess the strength of the Reassignment Procedure claim versus the court option, to identify whether an interim injunction is warranted, and to determine whether the matter should also involve a criminal complaint. It is not necessary to wait until the package is complete before making contact; an initial assessment can be done on partial information, and the clock is running.

The question of which path to take – Reassignment Procedure alone, court action alone, or both in parallel – is a facts-first decision that cannot be answered generically. What can be said with confidence is that the .it zone provides adequate legal tools for hijacking recovery when those tools are used correctly and promptly. The difference between recovery and loss is almost always procedural rather than substantive: the registrant who acts within days of discovery and files a complete, well-documented claim recovers. The registrant who waits for the registrar to resolve it informally, and then waits again to see what the registrar does, faces a materially harder case.

Related at COGNOMEN

• Court action and domain theft recovery: the full COGNOMEN service for stolen and hijacked domains
• Recover a hijacked .nl domain after account compromise: the Dutch procedure explained
• Brand protection monitoring for Italy: detecting unauthorized .it registrations before they become disputes

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.