FAQ: recover a hijacked .online domain after account compromise

When can I recover a hijacked .online domain after account compromise?

You can pursue recovery the moment you have documented evidence that the transfer from your account was unauthorized – which in practice means the moment you can show that the account credentials were compromised, that you did not authorize the transfer request, and that the domain left your control as a result of that compromise rather than a genuine arms-length transaction.

Speed matters here. Registrars maintain transfer logs and, in some cases, hold recently transferred domains in a reversible window. The applicable registry rules for .online – a gTLD zone governed by ICANN-standard policies – require accredited registrars to implement certain security controls and to maintain transfer records. Acting within hours, not days, of discovering the compromise maximizes the chance that a registrar-level reversal is still possible.

The distinction between a hijacking and a voluntary transfer gone wrong is critical. Panels and courts draw a bright line: if you authorized the transfer in any form – even under misrepresentation – the legal posture shifts. Document the unauthorized nature of the access event as the first act.

What evidence decides whether recovery succeeds?

The core evidence package for recovering a hijacked .online domain is: proof of prior ownership (registration records, RDDS/WHOIS history, registrar account records), proof of account compromise (login anomaly logs, IP addresses, timestamps from the registrar, phishing evidence, or a device-compromise report), and a chain demonstrating that the outbound transfer request was not initiated by you.

In our practice, the evidence that most reliably moves a registrar or a panel is registrar-side access logs showing a login from an unexpected IP address or geography, combined with a contemporaneous police or cybercrime report and a screenshot of the RDDS change timestamp. A police report alone rarely suffices. Registrar logs alone are helpful but incomplete without something that ties the anomalous access to the transfer instruction.

Equally important is what you do not have: a gap in evidence – for instance, no record of any complaint to the registrar at the time, combined with a long delay before acting – can be read as acquiescence. We regularly advise clients that acting quickly and generating a contemporaneous record is itself a form of evidence preservation.

For the UDRP route specifically, a hijacking case does not fit the standard three-element bad-faith template in the same way a cybersquatting case does. The relevant analytical path focuses on the registrant's lack of any legitimate interest and the absence of good-faith acquisition – but you still need to demonstrate trademark rights or, at a minimum, a legal basis for the claim beyond mere possession.

Does WIPO or a court decide a .online dispute?

.online is a generic top-level domain and is subject to UDRP jurisdiction; WIPO, the Forum, and the Czech Arbitration Court (CAC) all accept complaints in this zone, with WIPO handling the large majority of gTLD cases alongside the Forum.

The right path depends on what you need. WIPO and the Forum can order transfer or cancellation only – no money, no injunction, no contempt mechanism. If the domain has been used to redirect customers, generate fraudulent revenue, or damage your brand, and you want compensation, the UDRP cannot help with that portion of the relief. A court action in the relevant jurisdiction is required for damages.

The choice between WIPO and the Forum is primarily strategic. WIPO has a deep case record for hijacking-adjacent scenarios and offers an expedited single-panel option delivering a decision in roughly one month for cases involving up to five domains. The Forum's filing fees begin around USD 1,300 for one to two domains. CAC fees start lower still – roughly USD 500–800 – though it handles a smaller share of cases overall.

Where the hijacker is in a jurisdiction where the courts can reach assets, a parallel court action alongside the UDRP is sometimes the better-constructed strategy. We have defended and pursued matters where the UDRP secured a fast transfer while the court action addressed the financial harm separately. The two routes are not mutually exclusive.

For a read on whether the three UDRP elements are met in your specific situation, reach us at info@cognomenlaw.com.

How does the registrar-lock and transfer-reversal process work?

The registrar-lock is the fastest administrative lever available: you contact the registrar of record (or the losing registrar if the domain has moved) and request an immediate lock pending investigation of the unauthorized transfer. A lock prevents any further transfer, deletion, or DNS change while the investigation proceeds.

Transfer reversal under ICANN's Transfer Policy is available in defined circumstances – specifically, if the transfer was made without proper authorization or in breach of the registrar's verification obligations. The process requires submitting evidence of the compromise to the gaining registrar and requesting a reversal within the applicable window. What is that window? It varies by registrar and is not indefinitely open; acting within 24–72 hours of discovering the transfer puts you in the strongest position.

In practice, registrars vary significantly in responsiveness. Some have dedicated abuse or security teams that respond to hijacking reports within hours. Others require escalating through support queues that can take days. If the registrar does not act promptly, a formal complaint to ICANN's compliance function is an escalation mechanism – slow on its own, but useful as a documented step in a subsequent UDRP or court filing.

One scenario we see regularly: the domain was hijacked, quickly transferred to a new registrar in another jurisdiction, and relisted for sale at a significant markup. The multi-registrar chain makes each step harder. That is exactly the situation where a UDRP complaint – or in some cases a court-ordered registrar freeze – becomes the operative tool, because registrar-level persuasion has run out.

What is the deadline once a case starts?

Once a UDRP complaint is formally commenced, the respondent (the current holder of the domain) has 20 days to file a response. If no response is filed, the case proceeds to panel decision on the record presented by the complainant.

That 20-day window is fixed by the UDRP Rules. It can be extended only in defined circumstances – typically by mutual agreement or for genuine cause shown to the provider. It does not reset based on when the respondent claims to have received notice. Notice is governed by the provider's service rules, and a respondent who ignores or misses the window forfeits the right to be heard.

For the complainant's side, there is no formal statute of limitations in the UDRP itself. However, delay weakens your case in practice. A long gap between discovering the compromise and filing a complaint invites an argument of acquiescence. Courts, for their part, apply the applicable national limitations period – which varies by jurisdiction and cause of action. For US anticybersquatting claims, the window is defined by the applicable national law; confirm the current period with counsel. The UDRP's own timelines once a case is live – response, panel appointment, decision – run roughly to a two-month conclusion for a standard single-panel case.

What if the registrant does not respond?

Default – the registrant's failure to file a response within the 20-day window – does not mean automatic transfer. The panel still reviews the complaint on its merits and may request further clarification from the complainant if the record is thin. Default removes the opposing argument but does not remove the requirement to prove all three UDRP elements.

In practice, default cases are decided more quickly and more often favor the complainant – but "more often" is not "always." Panels have denied transfer in default cases where the complaint failed on the identical/confusing-similarity element or where the bad-faith evidence was too thin to sustain the finding. A well-constructed complaint matters even when no one opposes it.

For a hijacking case specifically, a respondent who obtained the domain through unauthorized means has no legitimate interest to assert and cannot credibly document good-faith registration. That structural weakness means a complete, evidence-backed complaint – one that documents the account compromise, the chain of unauthorized transfer, and your prior rights – is typically very strong in a default posture. We advise filing the most complete record possible from the outset rather than relying on the default to carry the weight.

Can the decision be appealed or challenged?

A UDRP panel decision is not subject to an appeal within the UDRP process itself – there is no internal appellate tier. A losing party's recourse is to take the matter to a court of competent jurisdiction before the registrar implements the transfer, which typically occurs after a short waiting period following the decision.

That waiting period is designed precisely to allow a losing respondent to seek a court stay. If the respondent files a court action in the relevant jurisdiction within that window, the registrar will typically hold the domain pending the court's ruling. This means a UDRP transfer order is not guaranteed to execute quickly if the respondent is willing to litigate. In our practice, we factor this risk into the strategy for cases where the opposing registrant has resources and a plausible argument – because a motivated respondent can use the court filing as delay even if the ultimate outcome remains the same.

From the complainant's side: if the panel denies transfer, you are not barred from court. The UDRP decision does not bind a court, which conducts its own de novo review. A failed UDRP complaint – where the panel denied transfer – can be followed by a court action on the same facts under anticybersquatting law or other applicable causes of action. The two forums are independent.

What about Reverse Domain Name Hijacking? In the context of a genuine theft, RDNH is typically not a live concern for the complainant – but in the unusual situation where you are the registrant defending against a complaint filed by a third party who claims your account compromise was actually a legitimate transfer they arranged, understanding the RDNH defense becomes relevant. A finding of RDNH carries no monetary penalty but is a reputational consequence for the complainant on record.

To plan recovery of a stolen or hijacked domain or to assess which route fits your situation, contact info@cognomenlaw.com.