FAQ: recover a stolen .dev domain under the applicable domain rules

What does it mean to recover a stolen .dev domain?

Domain theft occurs when a registrant loses control of a domain through unauthorized means — account compromise, social engineering of a registrar's support team, credential phishing, or fraudulent transfer authorization. Recovery means reversing that transfer and restoring the rightful holder as registrant of record. Under the UDRP, a complainant must still satisfy all three elements of Paragraph 4(a): the domain is identical or confusingly similar to a mark in which the complainant has rights; the current holder has no rights or legitimate interests; and the domain was registered and is being used in bad faith. In a theft scenario the bad-faith limb is typically straightforward — the unauthorized transferee has no credible claim to legitimate use — but the trademark-rights limb requires that you hold a registered or common-law mark, a business name, or sufficient identity in the string to anchor the complaint. Pure personal names or purely descriptive strings can complicate element one. A domain investor without a corresponding mark faces a harder path under the UDRP and may need to consider alternative routes, including registrar escalation or, where available, court action.

How long does it take to recover a stolen .dev domain?

A standard UDRP proceeding before WIPO runs roughly two months from filing to a panel decision, assuming no procedural detours. The respondent receives 20 days to file a response after the case commences. Panel appointment follows, and the decision is then sent to the registrar for implementation — typically a transfer order. In theft cases where the unauthorized holder does not respond, the timeline can be compressed somewhat, but the formal process still applies. Registrar-level escalation runs on a parallel track. If you report the compromise within days of the incident, some registrars will voluntarily freeze the domain pending investigation under their internal policies. That freeze does not substitute for a formal proceeding, but it prevents a second transfer while the legal route is pursued. Where the theft involves a chain of rapid re-registrations across multiple registrars, coordination with each registrar's abuse desk becomes part of the immediate response strategy before the formal filing is even prepared.

What does it cost to recover a stolen .dev domain at WIPO?

WIPO's published filing fee for a UDRP complaint covering one to five domains is USD 1,500 for a single-member panel. A three-member panel costs USD 4,000. For six to ten domains on a single complaint, the fees rise to USD 2,000 (single-member) and USD 5,000 (three-member). Legal fees are separate from the forum filing fee. Market rates for a straightforward single-domain UDRP complaint run approximately USD 3,000 – 7,000 in legal fees, depending on the complexity of the record and the registrant's conduct. If you withdraw or the matter settles before a panel is appointed, WIPO typically refunds a portion of the filing fee — commonly around USD 1,000 of the standard USD 1,500 fee. Court action, where applicable, carries substantially higher costs and runs on an hourly fee basis; it is generally reserved for situations where the UDRP is unavailable, where damages are sought, or where the factual record is too complex for a paper proceeding.

What evidence is needed to recover a stolen .dev domain?

Evidence falls into two categories: proof of your prior rights and proof of the unauthorized transfer. For prior rights, you need documentation establishing your connection to the domain string — a trademark registration, a business registration, records showing the domain was registered in your own name, invoices or communications referencing the domain, and historical WHOIS or RDDS records showing you as the former registrant of record. Screenshots and web archives from before the compromise are particularly useful. For the transfer itself, you need documentation of the compromise event — registrar logs or abuse tickets, phishing emails or social-engineering correspondence, account access records, and any communications from the new "holder" attempting to sell the domain back or demanding payment. Panels in theft cases look closely at the timeline: was the domain transferred immediately after a credential event? Did the new holder take steps to monetize it quickly? A coherent chronology, supported by time-stamped records, is often the decisive factor. Evidence that is missing from the record cannot ordinarily be supplied after the panel is appointed without a specific procedural application, so assembling the file before filing is critical.

Can I recover a stolen .dev domain for more than one domain at once?

A single UDRP complaint may cover multiple domains, but only where the registrant of record is the same across all of them. If a theft resulted in several .dev domains being transferred to a single unauthorized holder, one complaint can address them all — and the WIPO fee structure reflects that: the single-member fee for six to ten domains is USD 2,000, compared with USD 1,500 for one to five. Where the domains ended up with different registrants — whether through re-sale or a coordinated attack — separate complaints are generally required for each registrant. In a theft scenario spanning multiple zones (for example, both a .dev and a corresponding .com were taken), the most efficient path is often parallel filings coordinated so the evidence record is consistent across proceedings. We regularly advise on multi-domain, multi-zone theft recoveries where the complainant holds marks and domain registrations across gTLDs and country-code zones simultaneously.

What are the possible outcomes when you recover a stolen .dev domain?

The UDRP offers two remedies only: transfer of the domain to the complainant, or cancellation of the registration. There are no monetary damages, no cost awards, and no injunctions under the Policy. In a theft case, transfer is almost always the goal — cancellation would leave the string unregistered and available for re-registration by anyone. A panel may also find, in appropriate circumstances, that the complaint itself was brought in bad faith (Reverse Domain Name Hijacking, or RDNH), though this finding is the exception rather than the rule and carries no financial penalty. If the UDRP is unavailable — for instance, because the domain was already transferred to a jurisdiction where the registrant contests the proceeding aggressively and the arbitration route cannot reach them — court action remains an option. US anticybersquatting litigation, handled with local litigation counsel in the relevant jurisdiction, is one route that can reach damages and a transfer order through the courts. The right outcome depends on the facts: which route reaches the domain fastest, and which route reaches it permanently.

When does a court route beat arbitration to recover a stolen .dev domain?

Arbitration under the UDRP is faster and cheaper than court action, and it should be the first route assessed for most .dev theft recoveries. Court action becomes the more appropriate route in several situations. First, where the complainant cannot satisfy the trademark-rights element of the UDRP — for example, a domain investor whose claim rests on the domain's value alone rather than a corresponding mark. Second, where the UDRP's limited remedies are insufficient: if you need damages, an accounting, or an injunction against ongoing conduct, only a court can grant those. Third, where the bad-faith registrant is transferring the domain rapidly through multiple registrars to frustrate enforcement, a court's interim injunction can freeze the chain in a way that a UDRP panel cannot. We have advised registrants in theft cases where a parallel court application secured an emergency asset freeze within days, while the UDRP proceeding ran its course to produce the permanent transfer order. The two routes are not mutually exclusive, though filing both simultaneously carries procedural implications that require careful coordination.