FAQ: recover a hijacked .group domain after account compromise

What does it mean to recover a hijacked .group domain after account compromise?

Domain hijacking through account compromise is the unauthorized transfer of a domain out of its legitimate registrant's control by exploiting stolen or socially-engineered registrar credentials. For a .group domain specifically, "recovering" it means reversing that unauthorized transfer — restoring administrative control to the original registrant — through one or more of: an emergency registrar lock, a registrar-initiated transfer reversal, a UDRP proceeding before WIPO, a URS suspension (available for new gTLDs including .group), or civil court action in the relevant jurisdiction. Hijacking differs from ordinary cybersquatting: the registrant originally had full rights to the name, and the wrongdoing is the credential theft and unauthorized transfer, not the original registration. That distinction shapes the evidence you will need and the forum that is most effective.

Because .group is a new generic top-level domain, it operates under ICANN's standard accreditation rules. WIPO and the Forum accept UDRP complaints for .group domains. The URS — the Uniform Rapid Suspension mechanism designed for new gTLDs — is also available, though its remedy is suspension rather than transfer. In a hijacking scenario, transfer is almost always the goal, which makes the UDRP or a court order the stronger route once the registrar-level escalation path is exhausted.

What evidence is needed to recover a hijacked .group domain after account compromise?

Evidence of account compromise and the unauthorized transfer is the foundation of every recovery route, and assembling it within hours of discovery materially improves the outcome. The categories that consistently decide cases are set out below.

Proof of original registration and ownership. Registration confirmation emails, historic WHOIS or RDDS records showing the registrant's name and email address, invoice or payment records from the registrar, and any prior renewal receipts. Panels and registrars want to see a clean chain of title demonstrating continuous control up to the moment of the compromise.

Evidence of the compromise itself. This includes security logs or breach notifications from the registrar or email provider, records of unauthorized password-reset requests, phishing emails received, and any two-factor-authentication bypass events. If your registrar's support system issued a ticket in response to suspicious activity, that ticket number and the associated communications belong in the record.

The unauthorized transfer chain. A timestamped screenshot of the WHOIS or RDDS record showing the new registrant and gaining registrar. Any auto-confirmation emails sent by the registry or transferring registrar should be preserved — even if you did not authorize them, they document the mechanics of the transfer. Check whether the gaining registrar's lock period is still running; if it is, that is the first intervention point.

Trademark or brand-rights documentation. In a UDRP, the complainant must satisfy Paragraph 4(a)(i): the domain must be identical or confusingly similar to a mark in which the complainant has rights. For a hijacking complainant, that is usually easy — the complainant registered the domain because the name matched their mark or trading name. Registered trademark certificates, unregistered-rights evidence (continuous commercial use, marketing spend, recognition by third parties), and any prior dispute history all belong in the file.

Communications with the current holder. If the hijacker has contacted you demanding a ransom or threatening to sell the domain, preserve every message. Ransom demands are powerful bad-faith evidence under Paragraph 4(b) of the UDRP.

We regularly advise registrants to document this material before contacting anyone else — because a disorganized escalation to the registrar often results in internal tickets that later become the only contemporaneous record.

Can I recover a hijacked .group domain after account compromise for more than one domain at once?

Under UDRP rules, a single complaint may cover multiple domains only where all domains are registered to the same registrant. In a hijacking scenario, where the unauthorized transfer moved several of your .group domains to the same gaining account, a consolidated filing is possible and often more efficient — both logistically and in terms of filing fees at WIPO. The USD 1,500 single-member filing fee at WIPO covers up to five domains, provided the registrant across all of them is the same entity after the unauthorized transfer.

If the hijacker further transferred different domains to different registrants — or if your portfolio was split across multiple unauthorized transactions — consolidation may not be available, and separate filings or a court action covering the full portfolio may be required. Court actions, coordinated with local litigation counsel in the relevant jurisdiction, can address multiple defendants and multiple domains in a single proceeding, and can also seek provisional measures (such as a temporary restraining order on further transfer) that the UDRP cannot provide.

The URS is also worth considering for new gTLD domains where the immediate priority is stopping the domain from resolving to harmful content. URS suspension can be obtained quickly and at lower cost than a full UDRP, but it does not restore ownership. In our practice, we typically use a URS as a holding measure while a parallel UDRP or court action proceeds on the ownership question.

How long does it take to recover a hijacked .group domain after account compromise?

The honest answer is that timeline depends on which route you pursue and how quickly evidence is assembled. A standard UDRP proceeding at WIPO is normally completed within about two months: the respondent has 20 days to file a response after commencement, and a single-member panel then decides the case. WIPO offers an expedited option for single-panel cases of up to five domains that targets a decision in about one month. The expedited option is worth requesting in hijacking cases because the harm — loss of a live domain, disruption of services, reputational damage from hostile content — is ongoing through the proceeding.

Registrar-level escalation can be faster. If the gaining registrar's internal transfer-lock period has not expired, a registrar-to-registrar reversal coordinated through ICANN's Transfer Dispute Resolution Policy (TDRP) process can sometimes restore control without any formal arbitration. That process moves in days, not months — but it requires the original registrar and gaining registrar to cooperate, and it requires your evidence of unauthorized transfer to be unambiguous.

Court action is typically the slowest route on its own but can include emergency interim relief — a temporary injunction freezing further transfer — that arbitration cannot grant. Where a hijacked domain is actively being used to defraud your customers or redirect your invoice payments, that interim relief may be worth the additional cost and the coordination with local litigation counsel in the relevant jurisdiction.

To assess the fastest available route for your .group domain, contact info@cognomenlaw.com as early as possible — the registrar-lock window closes quickly.

What does it cost to recover a hijacked .group domain after account compromise at WIPO?

The WIPO filing fee for a single-member panel covering one to five domains is USD 1,500. A three-member panel costs USD 4,000. These are the official forum fees; legal fees for preparing and filing the complaint are separate and additional. In a hijacking matter with clear evidence of account compromise, a single-member panel is usually sufficient: the facts are typically less contested on the identity of the original registrant than in a standard cybersquatting case.

For the WIPO expedited option — useful in hijacking cases — the fee structure mirrors the standard procedure; the difference is the compressed timeline, not a higher fee. If the case is withdrawn or settled before a panel is appointed, WIPO offers a partial refund of approximately USD 1,000 of the standard USD 1,500 fee.

If a registrar-level transfer reversal resolves the matter before any UDRP is filed, there may be no forum filing fee at all — though legal fees for managing the escalation apply. Court costs depend entirely on the jurisdiction and counsel arrangement; describe that route qualitatively as substantially higher and hourly, appropriate where UDRP remedies are insufficient or where damages are sought.

A word on cost allocation: the UDRP provides for no costs award — there is no mechanism to recover filing fees from the hijacker, even on a clear case. That absence of fee-shifting is a reason to resolve the matter at the registrar level when that route is open, and to weigh the UDRP cost against the domain's commercial value before filing.

What are the possible outcomes when you recover a hijacked .group domain after account compromise?

The UDRP offers exactly two remedies: transfer of the domain to the complainant, or cancellation of the registration. In a hijacking case, transfer is almost always sought, because cancellation would leave the domain available for re-registration — potentially by the same bad actor. A UDRP panel deciding a hijacking complaint that meets all three elements of Paragraph 4(a) will order transfer; it has no authority to order damages, impose a penalty, or prevent the hijacker from registering a similar name in the future.

A registrar-level transfer reversal, if successful, restores the domain to the original registrant's account directly. It is the cleanest outcome when it is available, because it does not require a panel decision and does not leave the domain in the hijacker's hands during a proceeding. The risk is that the registrar or ICANN dispute mechanism declines to act, or that the gaining registrar disputes the unauthorized-transfer characterization.

Court action can produce a wider range of outcomes: a transfer order, a permanent injunction, damages (in jurisdictions that provide them), and an order against a specific person rather than just a specific domain. Those broader remedies are the reason court action is sometimes the right primary route — particularly where the hijacker is identifiable and has caused quantifiable commercial harm.

One outcome worth noting is the URS suspension: useful for stopping harmful content quickly, but it is a temporary measure for the registration term, not a permanent ownership restoration. We treat it as a bridge measure, not an end state.

In every route, outcomes depend on the specific facts, the quality of the evidence, and the conduct of the current holder. No procedure guarantees recovery.

When does a court route beat arbitration for a hijacked .group domain?

Arbitration — whether UDRP or URS — is usually the faster and cheaper primary route for .group hijacking cases. But there are situations where court action is the better or only effective path. Four scenarios recur in our practice.

The hijacker is identifiable and has funds worth pursuing. If the account compromise is linked to an identifiable individual or entity, and commercial harm is quantifiable — lost revenue from invoice fraud, costs of business interruption — a court can award damages. The UDRP cannot. Court action coordinated with local litigation counsel in the relevant jurisdiction is the route to money, not just domain recovery.

The UDRP three-element test is genuinely difficult to satisfy. In a hijacking case, Paragraph 4(a)(ii) asks whether the current holder has no legitimate interest. A panel that knows the registrant is a hijacker will answer no — but if the domain has already been transferred twice and the current WHOIS record shows a seemingly unrelated third party, the facts may be harder to establish without court-ordered discovery that arbitration cannot compel.

Emergency interim relief is required immediately. If the domain is being used to redirect payments, impersonate your organization to customers, or distribute malware, an arbitral panel cannot freeze that activity pending the proceeding. A court can issue a temporary restraining order within hours of filing. That speed advantage can outweigh the cost differential.

The domain has been further transferred across multiple registrants. A UDRP complaint names one respondent. If the hijacker transferred the domain through a chain of accounts — a pattern sometimes used to obscure the original theft — tracing through that chain may require court tools: subpoenas, discovery orders, or civil actions against the registrar to compel disclosure.

To weigh UDRP against a court action for your hijacked .group domain, email info@cognomenlaw.com.