Recover a stolen .shop domain: what panels actually decide

A domain theft does not announce itself. One morning the .shop domain that drives your e-commerce traffic is gone — redirected, listed for sale, or simply dark. The account credentials were changed overnight, the registrar's WHOIS record now shows a stranger, and the orders that should have landed in your inbox are going somewhere else. The question is not whether a remedy exists. The question is which remedy, in which forum, and how fast.

Recovering a stolen .shop domain typically proceeds through the UDRP at WIPO, because .shop is a generic top-level domain operated by GMO Registry and bound by ICANN's mandatory dispute-resolution rules. The complainant must prove all three Paragraph 4(a) elements — confusing similarity to a mark, no legitimate interest in the registrant, and registration and use in bad faith — but where account compromise is the theft mechanism, panels have consistently applied an additional doctrine: a domain transferred without the original registrant's authorization was not legitimately "registered" by the thief at all. A standard case closes in approximately two months; the WIPO filing fee starts at USD 1,500 for a single-member panel.

This analysis covers the governing procedure for .shop, the registrar-lock and transfer-reversal mechanics that run in parallel, what evidence actually moves panels, where a court route overtakes arbitration, and the contrary view that sometimes surfaces against domain-theft complainants.

Why .shop follows the UDRP — and what that means for you

Every domain under .shop is subject to the UDRP as a condition of the registry agreement between GMO Registry and ICANN. That means the remedy, the forum, the timeline, and the evidentiary standard are all set by ICANN's Policy — not by the laws of the country where the theft occurred, not by the registrar's terms, and not by a private contract. The .shop zone is not a ccTLD; no national dispute body governs it. WIPO and the Forum are the available UDRP providers, and WIPO handles the substantial majority of contested gTLD proceedings.

What does the UDRP actually offer? The only remedies are transfer or cancellation. No damages, no injunction, no cost award against the thief. That constraint shapes strategy. If your goal is to hold the name — and for most e-commerce operators, it is — you want transfer, and you want it before the domain is resold to a third party who may have a colorable claim to bona-fide purchase. Speed matters more in a theft case than in a conventional cybersquatting complaint.

The UDRP's three-element test was designed for cybersquatting, not for identity theft and unauthorized transfers. Panels have adapted. The consensus view, as reflected in many proceedings over the years, is that a domain "registered" through account compromise or social engineering cannot satisfy the UDRP's implicit requirement of a legitimate act of registration. The thief has no rights or legitimate interests by definition, and use of a fraudulently acquired domain in any commercial way — redirecting traffic, phishing, listing the domain for ransom — satisfies the bad-faith limb without difficulty.

The minority view, and it does appear, questions whether the UDRP is the right instrument for a theft claim at all. Some panels have noted that a domain theft is, at its core, a crime, and that the Policy was not written to adjudicate crimes. Those panels do not dismiss the complaint; they simply apply the elements more narrowly and require the complainant to demonstrate trademark rights with particular precision. A generic store name, a descriptive phrase, or an unregistered mark supported only by sales figures requires more careful assembly than a registered, distinctive brand.

Registrar-lock and transfer-reversal: the parallel track you must run immediately

A UDRP complaint takes approximately two months from filing to decision. Two months is a long time for a stolen domain. The parallel track — registrar escalation — can act faster, and in our practice it is almost always the first call we make on behalf of a client who has just discovered a theft.

The mechanics work like this. Every ICANN-accredited registrar must maintain a transfer lock on a domain for 60 days following any registrar-to-registrar transfer. If the theft involved a push or outbound transfer to a second registrar, and you move within that window, you can ask the receiving registrar to hold the domain in place while the claim is investigated. The registrar has an interest in cooperating: facilitating a fraudulent transfer creates its own exposure. Supplying a law enforcement report, a notarized declaration of original registration, account-history evidence, and a clear timeline of the compromise generally produces a voluntary lock within days.

What if the 60-day window has closed, or the domain has moved to a second or third registrar? The answer shifts to registrar policy and ICANN's own escalation path. ICANN's Transfer Dispute Resolution Policy (TDRP) provides a formal route to challenge an unauthorized registrar-to-registrar transfer. That procedure is narrow — it addresses transfer mechanics, not ownership — but it can halt a second move while the UDRP proceeding runs.

The combined strategy is: registrar lock today, UDRP complaint this week. Neither track waits for the other. The registrar lock does not decide ownership; the UDRP does. But a domain that is locked in place while the complaint is pending is a domain that cannot be resold into the hands of a subsequent transferee who could complicate your recovery.

To plan the registrar-lock escalation and the UDRP filing in parallel for a stolen .shop domain, contact info@cognomenlaw.com.

What evidence do panels actually use to decide theft cases?

Evidence in a domain-theft UDRP is different from evidence in a conventional cybersquatting complaint. In a standard complaint the complainant's evidence concerns the registrant's conduct — pay-per-click pages, ransom demands, competitive diversion. In a theft case the complainant must first establish the threshold fact that a theft occurred, and then establish that the post-theft registrant (the thief, or the party who received the domain from the thief) cannot claim legitimate interest.

Panels have consistently looked to the following categories of evidence.

• Original registration records. A WHOIS history showing the complainant as original registrant, ideally from an independent WHOIS archive, is the foundation. If the WHOIS history shows continuous ownership by the complainant followed by a sudden change to an unrelated party, that pattern speaks for itself.
• Account-compromise documentation. Email logs showing unauthorized access attempts, password-reset notifications the complainant did not initiate, or unusual login events from foreign IP addresses all corroborate the theft narrative. Screenshots are evidence; logs produced by the registrar under a preservation request are stronger.
• Law enforcement filings. A police or cybercrime-unit report does not guarantee success, but it shifts the tone of the proceeding. Panels treat a contemporaneous law enforcement filing as an indicator of good faith by the complainant and an indicator that the complainant is the real victim, not a sophisticated operator trying to reverse a legitimate sale.
• Trademark rights — registered and unregistered. Even in a theft case, Paragraph 4(a)(i) requires a mark. A registered trademark in any jurisdiction is sufficient. An unregistered mark requires evidence of secondary meaning: documented sales, advertising spend, media coverage, or customer recognition. For a .shop domain tied to an e-commerce operation, invoices, payment-processor records, and Google Analytics screenshots showing the domain's commercial history are all useful.
• The absence of any plausible legitimate purpose for the new registrant. Panels ask why a legitimate actor would hold this domain. Where the name is a distinctive brand and not a generic word, the answer is almost always that no legitimate purpose exists.

In a recent matter — a .shop domain theft, autumn 2025, with the domain having served an established retail brand for several years — we assembled WHOIS history, email-header evidence of account takeover, a notarized ownership declaration, and law enforcement correspondence. The panel transferred the domain on the standard timeline without a supplemental-filing detour. The key was preparation: all the evidence was filed with the complaint, not submitted piecemeal.

When does a court action beat arbitration for a stolen .shop domain?

The UDRP is fast, cost-controlled, and forum-specific. It is not always sufficient. Three situations push a .shop domain recovery toward court action rather than, or in addition to, arbitration.

Situation one: the domain has been transferred to a subsequent acquirer in good faith. The UDRP binds the registrant of record at the time of the complaint. If a thief sold the domain to a third party who paid market value without knowledge of the theft, that third party may have a colorable defense to a UDRP complaint — not a winning one necessarily, but enough to create uncertainty. A US anticybersquatting action in court, by contrast, allows in rem jurisdiction against the domain itself and can reach a transfer even in those circumstances. The trade-off is cost and time: court litigation runs substantially longer and at hourly rates that dwarf the UDRP filing fee.

Situation two: you need monetary recovery, not just the domain back. The UDRP cannot award damages. If the theft caused measurable business loss — diverted sales, customer fraud, reputational harm — the only forum that can attach a monetary remedy to the domain recovery is a court. In the US, anticybersquatting legislation permits statutory damages as well as actual damages and attorneys' fees in certain circumstances. Outside the US, the applicable national law governs; local litigation counsel in the relevant jurisdiction should assess the damages angle before any filing.

Situation three: the identity of the thief is known and criminal accountability is a goal. A UDRP panel cannot name a party as a criminal. A court record can. Where the theft is part of a broader fraud scheme and referral to law enforcement is a strategic objective, court proceedings produce a record that a UDRP decision does not.

The practical decision matrix: if the domain is in the hands of a clearly illegitimate actor, the WHOIS shows no color of legitimate interest, and the primary goal is to get the domain back before further commercial damage, start with the UDRP. If any of the three situations above applies, open a parallel consultation on the court route before filing anything — the choice of initial forum can affect what evidence is preserved and how it is used.

If a prior UDRP filing produced an adverse decision, or if the theft involved a subsequent sale that complicated the UDRP posture, email info@cognomenlaw.com for a focused second read.

The contrary view: when panels push back on theft claimants

Not every claimed theft succeeds under the UDRP, and the reasons panels give for denying transfer are instructive.

The most common basis for denial in a claimed-theft case is failure to prove the mark. A panel cannot transfer a domain on the basis of sympathy alone. Where the complainant holds a .shop domain anchored to a descriptive term — think a word like "fast delivery" or a geographic modifier — and presents no registered trademark and thin evidence of secondary meaning, the Paragraph 4(a)(i) element fails. The domain may have been stolen. But if the complainant cannot show trademark rights, the UDRP provides no relief.

The second failure mode is evidentiary: the complainant asserts theft but provides no corroborating documentation. Bare allegations of account compromise, without access logs, email records, or contemporaneous evidence, leave a panel with nothing to weigh against the registrant's default. Default is not automatic loss for the respondent; panels still require affirmative evidence from the complainant.

A subtler contrary view appears in decisions where the panel questions the UDRP's jurisdictional fit. These decisions do not deny transfer outright; they transfer the domain but note that the better remedy for the underlying conduct was a criminal proceeding or a civil court action, not an arbitral panel applying the UDRP. The practical effect is the same — the domain moves — but the reasoning signals that a particular fact pattern is closer to the edge of the Policy's coverage than the complainant may have appreciated.

What this means for practitioners: assemble the trademark evidence and the theft evidence with equal care. The theft is vivid; the trademark may be assumed. Panels will not supply either.

The RDNH risk — and why it is almost always low in genuine theft cases

Reverse Domain Name Hijacking (RDNH) — a finding that the complaint was brought in bad faith to deprive a legitimate registrant of the domain — is a real risk in some UDRP proceedings. In a genuine domain-theft case, the RDNH risk is low but not zero.

Panels have rarely found RDNH where the complainant demonstrated prior registration and good-faith use. The logic is straightforward: a party trying to steal a domain it never owned would have difficulty explaining an independent chain of registration, trademark evidence, and contemporaneous law enforcement activity. RDNH findings cluster in cases where a complainant targets a domain registered years before the complainant's own mark existed, or where the complainant is a sophisticated actor who simply wants to acquire a desirable name and files a UDRP as leverage.

The residual risk arises where the complainant's trademark is weak or unregistered, the complaint was filed without adequate preparation, and the respondent — even a thief — manages to mount a superficially plausible defense. We have seen this pattern in cases where the complainant's counsel did not fully develop the secondary-meaning evidence and the panel was left uncertain about the mark. The result was not an RDNH finding, but the panel's language was a caution.

The defense against RDNH in a theft case is the same as the formula for success: strong mark, detailed theft evidence, law enforcement record, and a complaint drafted to answer every element with specificity.

How the UDRP forum choice affects the .shop recovery

WIPO and the Forum are the two principal UDRP providers for .shop disputes. The Czech Arbitration Court (CAC) is available but handles a smaller caseload. ADNDRC is available and is sometimes preferred where the parties or the theft pattern have an Asia-Pacific dimension.

For most .shop recovery cases, WIPO is the natural first choice. The filing fee for a single domain, single-member panel is USD 1,500, and a standard case closes in approximately two months. WIPO also offers an expedited option for single-panel cases of up to five domains, delivering a decision in approximately one month — a meaningful acceleration when commercial damage is ongoing. The Forum's filing fees begin at around USD 1,300 for one or two domains on a single-member panel, a modest saving that rarely determines the choice.

What actually determines the forum choice in a theft case? Panel quality and predictability matter most. WIPO's published jurisprudential overview reflects decades of panel consensus on the core elements, and panels drawn from WIPO's roster have the most exposure to the theft-specific doctrine discussed above. For a case that turns on nuanced account-compromise evidence, the depth of WIPO's panel pool is the decisive factor.

A three-member panel is worth considering where the domain has significant commercial value, where the theft involved a sophisticated actor who can be expected to mount a defense, or where the trademark evidence is not straightforwardly registered. At WIPO, a three-member panel for a single domain costs USD 4,000. If the domain generates substantial annual revenue, that premium is readily justified by the additional scrutiny a three-member panel applies.

In a recent .shop theft matter (spring 2025), a single-member WIPO panel delivered a transfer order in approximately seven weeks from filing. The registrant did not respond — a common pattern in theft cases — but the complainant filed a complete evidentiary record, including WHOIS history, trademark registration, and account-compromise documentation. The expedited option was not used; the standard timeline proved fast enough given that the registrar lock had been secured within 72 hours of discovery.

Cross-zone considerations: .shop alongside other domains

A theft of a .shop domain often does not stop there. The same actor who compromised the .shop may have also targeted the corresponding .com, or a national ccTLD the brand operated in parallel. Each zone requires its own analysis.

For the .com, the UDRP applies identically — same three elements, same forum, same filing fee structure. A single UDRP complaint can cover multiple domains if the registrant of record is the same holder. If the thief transferred the .com and the .shop to different receiving registrants, two separate proceedings are required. That adds cost but not complexity: the evidence is largely the same, and WIPO allows consolidated proceedings where circumstances justify them.

For national ccTLDs, the governing procedure varies by registry. A .de domain requires German court action; DENIC's DISPUTE entry can block a transfer during litigation. A .uk domain is handled under Nominet's DRS, which applies a different test — "abusive registration or use" — and offers a free mediation stage before an expert decision. A .eu domain goes to ADR.eu under EURid's rules, with eligibility requirements for the complainant that differ from the UDRP's trademark-based test.

The practical point is this: if a theft swept up both a .shop and a ccTLD, the recovery strategy must be designed zone by zone. A single UDRP cannot reach a .de. An ADR.eu complaint cannot reach the .shop. We regularly advise clients whose theft involved a portfolio of domains across two or three zones, and the opening question is always the same — map every zone, then sequence the filings to prevent the thief from using one proceeding's outcome to complicate another.

Related at COGNOMEN

• Court recovery and domain theft services: registrar escalation, TDRP, and anticybersquatting litigation
• Recovering a hijacked .tv domain: the registrar-lock and UDRP strategy explained
• URS and new gTLD claims notices for .io and related zones: what to do when you receive one

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.