FAQ: recover a hijacked .app domain after account compromise

What does it mean to recover a hijacked .app domain after account compromise?

Domain hijacking is the unauthorized transfer or control of a domain name following breach of the registrant's account, most often through credential theft, phishing, SIM-swapping, or social-engineering of registrar support staff. Account compromise is the mechanism; domain loss is the consequence. Recovery means reversing the transfer or restoring the original registrant's administrative control.

For a .app domain, the registrar holds the authoritative record. The first objective is to prevent further movement – specifically, a transfer to a second registrar – because once the domain leaves the original registrar's system, the path back is substantially longer. ICANN's Inter-Registrar Transfer Policy imposes a 60-day lock after any registrar-to-registrar transfer, which an attacker can exploit to harden their position. That is why registrar escalation and an immediate lock request come before any formal filing.

Recovery after that point typically involves one or more of the following: a registrar dispute or chargeback mechanism (where the registrar has an internal process for fraudulent transfers); a formal UDRP complaint at WIPO if the hijacker has begun using the domain abusively; or in more complex cases, court action to compel the registrar or registry to restore the original registration. The right path depends on whether the domain has moved registrars, who now controls the WHOIS/RDDS record, and how quickly the compromise was detected.

In our practice, we see the most recoverable cases where the registrant can document the pre-compromise account history – billing records, WHOIS change logs, email correspondence – within the first 48 to 72 hours. Speed matters more here than in almost any other domain dispute.

What evidence is needed to recover a hijacked .app domain after account compromise?

The strength of a hijacking claim rests on a coherent chain of custody: evidence that you were the legitimate registrant, evidence of the unauthorized access event, and evidence that any post-compromise use of the domain was not authorized by you.

Specific documents that typically decide the outcome include:

• Registration history: the original confirmation email from the registrar, renewal invoices, and any WHOIS/RDDS records showing your name or organization as the prior registrant.
• Account access logs: registrar login records, IP addresses associated with the unauthorized access, and any anomalous change-of-email or change-of-password notifications.
• Authentication events: records of multi-factor authentication bypass, SIM-swap confirmations from the mobile carrier, or phishing email headers showing the credential-theft mechanism.
• Domain use: screenshots or archived records of the domain as you operated it – your application's landing page, app store links resolving through the .app, or developer console entries associating the domain with your project.
• Post-compromise activity: evidence of what the hijacker did with the domain after taking control – redirection destinations, DNS record changes, WHOIS substitution – which becomes relevant if a UDRP is necessary.

Panels and registrars alike apply a form of credibility assessment: can the claimant establish, on the balance of available evidence, that they were the registrant before the event and that the transfer was not authorized? Gaps in documentation do not automatically defeat a claim, but they extend the timeline and often require supplemental evidence requests.

One practical note: preserve all registrar notifications – including those you believe to be phishing – because the header data from those emails can establish the attack vector, which is relevant both to the registrar's internal review and to any subsequent court or arbitration proceeding.

How long does it take to recover a hijacked .app domain after account compromise?

Timeline varies significantly by route, but a realistic range can be set by the procedures in APPENDIX A. A registrar-level emergency lock request, if granted, can freeze the domain within hours to a few days. Formal proceedings take longer.

If a UDRP at WIPO is required – typically where the hijacker has begun using the domain abusively and the registrar's internal process has not resolved the matter – a standard case runs approximately 45 to 60 days from commencement to decision. WIPO offers an expedited option that can deliver a decision in roughly one month for single-panel cases covering up to five domains, which is often the relevant option where time pressure is acute. The respondent has 20 days to file a response once the case commences; if the hijacker ignores the proceeding, a default decision can follow the response deadline without further delay.

Where court action is required – for example because the registrar refuses to act without a court order, or because the domain has been moved to a jurisdiction where arbitration is unavailable – the timeline extends to months. US anticybersquatting litigation or an application for preliminary injunctive relief can produce interim orders faster than a full trial, but they require engagement of local litigation counsel in the relevant jurisdiction and carry correspondingly higher costs.

Our consistent advice is to treat the first 24 hours as the period in which the registrar route is pursued in parallel with evidence preservation. Filing a UDRP or court action while the registrar is still reviewing an emergency lock request is not premature – the two tracks can run simultaneously.

What does it cost to recover a hijacked .app domain after account compromise at WIPO?

WIPO's published filing fee for a single-member panel covering one to five domains is USD 1,500; a three-member panel for the same range costs USD 4,000. These are the forum filing fees only. Legal fees for preparing and filing a UDRP complaint – assembling the evidence record, drafting the complaint, managing the proceeding – are separate and typically fall in a market range of roughly USD 3,000 to USD 7,000 for a single-domain, straightforward matter, depending on complexity.

Where the case is strong on the papers and the hijacker is unlikely to contest the proceeding, a single-member panel at WIPO is usually the cost-efficient choice. If the hijacker retains counsel and files a substantive response, a three-member panel may be appropriate to reduce the risk of a split decision – but the choice adds cost, and the parties generally split the higher three-member fee if the respondent requests it.

WIPO offers a partial refund if the proceeding is withdrawn or terminated before panel appointment – commonly approximately USD 1,000 of a USD 1,500 fee – which is relevant if the registrar resolves the matter through its internal process after a UDRP has already been filed.

Registrar-level escalation and internal dispute processes typically carry no filing fee, though they may require notarization or apostille of identity documents, which carries its own administrative cost.

Court action – whether US anticybersquatting litigation or a foreign court route – is substantially more expensive and is generally reserved for cases where arbitration is unavailable, where the domain has significant commercial value, or where the hijacker's conduct also supports a damages claim that arbitration cannot reach.

Can I recover a hijacked .app domain after account compromise for more than one domain at once?

Yes, where the same registrant controls all the compromised domains. Under the UDRP, a single complaint may cover multiple domains provided they share the same registrant. If an account compromise resulted in the loss of several .app domains – or a mix of .app and other gTLDs – and the unauthorized transferee is the same party, a consolidated complaint is both procedurally permitted and practically efficient. WIPO's filing fee scales by domain count: USD 1,500 for one to five domains under a single-member panel, rising to USD 2,000 for six to ten.

The key constraint is registrant identity on the other side. If the hijacker has re-registered different domains under different WHOIS records – a tactic sometimes used to fragment recovery efforts – consolidation becomes harder to justify to a panel, and separate complaints may be required for each registrant identity.

Where multiple gTLD and ccTLD domains were compromised in the same event, the recovery route diverges by zone. A .app domain and a .eu domain compromised in the same breach cannot be handled in a single UDRP; the .eu requires a separate procedure before ADR.eu under EURid's rules. A .de domain has no UDRP equivalent at all – that route leads to the German courts, with a DENIC DISPUTE entry to block further transfer. We coordinate multi-zone recovery across these procedures routinely, but each zone's forum has its own filing and its own timetable.

When does a court route beat the UDRP for recovering a hijacked .app domain?

The UDRP and court action serve different ends. The UDRP can only transfer or cancel a domain – it cannot award damages, cannot restrain a party's behavior beyond the domain itself, and cannot reach conduct at the registrar level that an arbitration panel has no power to compel. A court action can do all of those things, at greater cost and time.

The court route is typically preferable in four situations. First, where the registrar has refused to act on an emergency lock request and will only respond to a court order – a situation more common with smaller or offshore registrars. Second, where the domain has been sold to a third-party purchaser who may be an innocent buyer, complicating the bad-faith element of a UDRP (courts can adjudicate title questions that panels often decline to reach). Third, where the hijacking was part of a broader fraud – payment diversion, credential resale, or ransomware – and the affected party needs discovery, injunctive relief, or a damages order, none of which a UDRP panel can grant. Fourth, where the .app domain has been moved to a registrar operating in a jurisdiction whose law provides a faster interim remedy than WIPO's standard timeline.

In a recent matter – a .app hijacking incident, autumn 2025 – we coordinated a registrar emergency lock request with a parallel court application for interim relief, securing a transfer freeze within 72 hours while the formal recovery proceeding was filed. The UDRP alone would not have produced that result at that speed.

The decision between the two routes is not binary. They can run simultaneously, and in complex hijacking cases they often should. What the UDRP provides is a faster, cheaper, and more predictable recovery of the domain itself. What court action provides is the reach, the remedial breadth, and the enforcement authority that arbitration cannot match.

What are the possible outcomes when you recover a hijacked .app domain after account compromise?

The available outcomes depend on the route taken, and each route has a defined ceiling of remedies.

A UDRP proceeding at WIPO can result in three outcomes: transfer of the domain to the complainant, cancellation of the registration, or denial of the complaint. Transfer is the most common relief sought in hijacking cases – the original registrant wants the domain returned, not deleted. Cancellation is occasionally the better outcome where the domain has been damaged in the hijacker's hands (used for phishing, malware, or spam) and restoring it to the original registrant's brand would carry reputational or technical baggage. Denial means the panel found the complaint unproven on one or more of the three elements; that result does not preclude a second complaint if new facts emerge, though panels treat re-filings with scrutiny. The UDRP cannot award damages, costs, or injunctions.

A registrar internal process can result in the domain being returned to the original registrant's account – sometimes the fastest outcome where the registrar's fraud team acts on clear evidence. It can also result in a refusal to act without a court order, which is the most common trigger for escalation to court.

Court action can result in a transfer order, a damages award, a permanent injunction against the hijacker, and in some jurisdictions criminal referrals where the compromise involved unauthorized access to computer systems. These remedies are broader, but they require proportionate investment of time and cost.

What none of these routes can guarantee is a specific timeline or a specific result. Outcomes turn on the quality of the evidence, the jurisdiction, the registrar's cooperation, and the panel's or court's assessment of the facts. Our role is to assemble the strongest possible record and select the route most likely to produce a recovery given the specific circumstances of each case.