FAQ: recover a stolen .net domain under the applicable domain rules

When can I recover a stolen .net domain?

You can pursue recovery of a stolen .net domain through the UDRP when the domain was registered or taken in bad faith and you hold trademark rights — or through a registrar escalation when the taking was an unauthorized account compromise or transfer fraud. .net is a generic top-level domain governed by ICANN-accredited registrars, and the UDRP applies fully to it. The two triggers are distinct and the evidence differs for each.

Where the other party registered your brand name without authorization — classic cybersquatting — Paragraph 4(a) of the UDRP is the primary route. You must show that the domain is confusingly similar to a mark you hold, that the registrant has no rights or legitimate interest, and that registration and use were in bad faith. All three elements must be proved; a failure on any one defeats the complaint.

Where the taking was a hijack — someone accessed your registrar account, changed the credentials, and transferred the domain out — the UDRP's bad-faith test may not map cleanly onto that fact pattern. Registrar escalation under ICANN's transfer dispute procedures is often faster. If the registrar is unresponsive or the domain has already changed hands through a second registrar, court action may be the only effective remedy. We regularly advise clients at this fork: the available evidence on the day of discovery determines whether a UDRP complaint or a theft-recovery escalation is the right first step.

Who can recover a stolen .net domain?

Any party with enforceable rights in a name corresponding to the stolen domain may bring a UDRP complaint — typically a trademark owner, but panels have also recognized unregistered marks where sufficient secondary meaning is shown. For an account-compromise case there is no trademark requirement: the original registrant of record, the person who can demonstrate prior lawful control over the account, is the proper claimant.

The complainant must be the rights holder, not an agent, licensee, or related entity unless those rights are clearly documented. We have seen complaints fail at the first element not because the mark was weak but because the entity filing the complaint was not the entity that held the registration — a corporate parent, a subsidiary, or an operating brand that had not formally assigned the trademark. That documentation gap is avoidable with preparation.

For a theft recovery via registrar escalation, the claimant is the party who can produce the original registration confirmation, historical WHOIS records, renewal receipts, and account-access logs showing unauthorized entry. No trademark is required, but the chain of custody over the account must be clear and contemporaneous.

What is the deadline once a case starts?

Once a UDRP complaint commences formally, the respondent has 20 days to file a response. Missing that window results in a default; the panel still decides the case on the record, but an unanswered complaint proceeds without the registrant's counterarguments. For the complainant, there is no hard pre-filing deadline under the UDRP itself — the domain may be disputed years after registration — but delay weakens the evidence and can complicate the "registered in bad faith" limb if the registrant acquires apparent legitimacy over time.

For registrar-level theft escalation, speed is genuinely critical. Most registrars operate an internal lock window — a period during which a transfer can be reversed upon verified abuse — that is measured in days, not weeks. Missing that window means the domain may already have moved downstream to a second or third registrar, and the procedural path to recovery becomes significantly harder. Contact the registrar's abuse team immediately; document the time of discovery, the unauthorized access event, and any communications you have received.

Court timelines are set by the jurisdiction and the applicable anticybersquatting statute, not by the UDRP Rules. They are measured in months to years, not days. That said, courts can grant preliminary injunctions freezing a domain pending a full decision — a relief the UDRP cannot provide.

Does WIPO or a court decide a .net dispute?

For cybersquatting against a .net domain, the complainant chooses between WIPO, the Forum, the Czech Arbitration Court (CAC), or the ADNDRC — all ICANN-accredited providers. WIPO and the Forum together handle the substantial majority of all UDRP cases. The panel's decision is binding on the registrar: a successful complainant receives a transfer or cancellation order implemented by the registrar, typically within ten days of the decision absent a mutual jurisdiction challenge.

Court — meaning a national court with anticybersquatting jurisdiction, most often a US court for .com and .net disputes — enters when the UDRP cannot reach the remedy needed. The UDRP provides only transfer or cancellation; it awards no monetary damages, no attorney fees, and no injunctions. If you want damages for losses caused by the hijacking, or if a preliminary freeze is needed before the 20-day response window runs, court action is the only vehicle.

The relationship between the two is not exclusive. A complainant can file a UDRP complaint and, in parallel or subsequently, commence court action in the agreed mutual jurisdiction. A court can also override a UDRP transfer order — the UDRP Rules expressly preserve court rights for both parties — which is why, in cases where the respondent has strong arguments, a UDRP win does not necessarily end the dispute. We address that scenario in more detail in our guide on enforcing a UDRP decision.

For a read on whether the three UDRP elements are met in your .net case, reach us at info@cognomenlaw.com.

What if the registrant does not respond?

A default does not mean automatic transfer. When a respondent fails to file a response within the 20-day window, the panel is instructed to decide the case on the complaint and the record before it. In practice, panels apply a reasonable inferences standard: uncontested factual allegations in a well-pleaded complaint are generally accepted, but the complainant must still satisfy all three elements of Paragraph 4(a) independently. A weak complaint does not become a strong one because no one answered it.

Where the complaint is well-evidenced — the domain is a near-exact match for a registered trademark, the registrant's use is a pay-per-click parking page monetizing the brand's traffic, and there is no plausible legitimate-interest argument — default cases are resolved relatively quickly. The absence of a response removes the need for the panel to weigh competing evidence, which can accelerate the decision phase within the overall two-month window.

For stolen-domain cases where the "respondent" is an anonymous fraudster, default is common. The panel still examines bad faith under Paragraph 4(b). A pattern of abusive registrations, use of false WHOIS data, or a documented history of the domain resolving to phishing pages all support a bad-faith finding even without the registrant's participation. Assembling that evidence proactively — before filing — is the preparation step that decides outcomes in default proceedings.

Can the decision be appealed or challenged?

The UDRP has no internal appeal mechanism. Once a panel issues a decision ordering transfer or cancellation, the outcome becomes final unless a party commences court proceedings in the mutual jurisdiction specified in the registration agreement. That court challenge window is 10 business days after notification of the decision — within that period the registrar holds the domain. If no court action is filed, the registrar implements the panel's order.

A complainant who wins at UDRP may still face a court action filed by the losing registrant seeking to reverse the transfer. Equally, a respondent who loses may seek a de novo review in the mutual jurisdiction court. In our practice, we see the latter most often in cases where the UDRP panel's reasoning contains a procedural error or where new evidence that could not be submitted in the arbitration becomes available. The court is not bound by the panel's findings; it decides the case on its own assessment.

Reverse Domain Name Hijacking (RDNH) is the UDRP's internal check on abusive complaints. Where a panel finds the complaint was brought in bad faith — to deprive a legitimate registrant of a name the complainant had no genuine trademark right to — the panel may declare RDNH. This carries reputational weight, not a financial penalty. For respondents facing a complaint that appears designed to pressure a sale rather than vindicate a real mark, an RDNH finding is a meaningful outcome. We handle respondent-side defense, and we assess the RDNH argument as a standard part of that analysis. See also our comparison of URS versus UDRP procedures for context on the procedural choices available across generic zones.

To weigh UDRP against a court action for your .net case, email info@cognomenlaw.com.

What evidence decides the outcome of a .net recovery?

Evidence of prior rights, the registrant's conduct, and the circumstances of the original registration collectively decide whether a UDRP complaint succeeds or a registrar theft-reversal proceeds. No single document is sufficient; panels look at the totality.

For a UDRP complaint, the core evidence package includes: a trademark registration certificate (or documentation of unregistered mark rights where applicable); a domain name registration history showing the complainant's earlier use; screenshots of the registrant's current use of the domain — parking pages, pay-per-click links, phishing pages, or competitor redirects all support bad faith under Paragraph 4(b); and, where available, any communications in which the registrant offered to sell the domain to the complainant at a price exceeding documented out-of-pocket costs.

For a theft-recovery escalation, the critical evidence is different. Registrar account logs, email headers from the unauthorized access notification, two-factor authentication change records, and domain transfer confirmation timestamps establish the chain of events. Historical WHOIS records and renewal receipts establish the original registrant's lawful prior control. A gap in that chain — because records were not retained, or the original registrar has since been acquired — complicates the escalation materially.

In a recent matter involving a .net domain (autumn 2025), we assisted a brand owner whose domain had been transferred out through a compromised registrar account. The key evidence was a registrar-generated email log showing the account credentials had been changed from an IP address in a foreign jurisdiction the client had never accessed, combined with two years of renewal receipts in the client's name. The registrar reversed the transfer within days of receiving the documented package. Evidence quality, not volume, was the deciding factor.