FAQ: recover a stolen .xyz domain under the applicable domain rules

What does it mean to recover a stolen .xyz domain?

Domain theft covers two distinct situations: (1) an unauthorized outbound transfer of a domain you already held – typically following account compromise – and (2) a bad-faith registration by someone who never had your authorization to hold the name. Recovery routes differ sharply between them.

In the first scenario the registrant of record changes without your consent. This is account-compromise theft. The remedy lies in registrar escalation – requesting an emergency lock, documenting the unauthorized transfer, and, where the registrar's own procedures fail, escalating to ICANN's transfer-dispute mechanisms or to court.

In the second scenario someone else registered your brand as a .xyz domain and is using it abusively. That is cybersquatting. The correct instrument is a UDRP complaint at WIPO or another accredited provider, because .xyz operates under the UDRP rules that ICANN mandates for all accredited gTLD registrars.

Why does the distinction matter? Because the evidence you need, the timeline you face, and the cost you pay all turn on which situation you are in. We regularly advise registrants who arrive thinking they have one problem and discover they have the other – or both simultaneously, where a stolen account was then used to transfer the domain to a third-party cybersquatter.

What does it cost to recover a stolen .xyz domain at WIPO?

WIPO's official filing fee for a single-member panel covering one to five domains is USD 1,500; a three-member panel covering the same range costs USD 4,000. Those are forum fees only – legal preparation fees are separate.

For the UDRP track, the total outlay has two components. WIPO's published filing fee applies regardless of outcome. Legal fees for a straightforward single-domain complaint typically fall in a market range of roughly USD 3,000 to USD 7,000, depending on the complexity of the bad-faith evidence and whether the respondent files a substantive defense.

If you want a decision in roughly one month rather than the standard two-month window, WIPO offers an expedited procedure for single-member cases covering up to five domains. The filing fee structure remains the same; the panel is appointed on an accelerated schedule.

For the unauthorized-transfer track, forum fees may not apply at all if the registrar processes the reversal internally. Where registrar escalation fails and you need court intervention – for instance, to freeze a domain held by a party abroad or to seek damages – legal costs rise substantially and are billed on an hourly basis. That route is handled with local litigation counsel in the relevant jurisdiction.

One cost variable worth noting: if you filed a single-panel complaint and the respondent requests a three-member panel, the parties typically split the higher fee. On a USD 4,000 three-member proceeding, that means each side contributes roughly half.

How long does it take to recover a stolen .xyz domain?

A standard UDRP case at WIPO is normally completed within about two months of filing; the respondent has 20 days to respond once the case formally commences. The expedited option delivers a decision in roughly one month for eligible cases.

The timeline is dictated by the UDRP Rules, not by the parties. Filing triggers a formal commencement notice; the 20-day response window runs from that date. After the response period closes – or after a default – a panel is appointed, deliberates, and issues a decision. The registrar then implements a transfer order, typically within days.

Procedural detours add time. A respondent's request for a three-member panel, a consensual suspension for settlement talks, or a supplemental filing can each extend the process by days to weeks. In our experience, most straightforwardly contested .xyz cases resolve within ten to twelve weeks of the initial filing.

The unauthorized-transfer route can move faster or slower. Registrar escalations sometimes produce an emergency lock within hours of a documented account compromise. Full reversal, however, depends on the registrar's own investigation timeline and any regulatory review ICANN may require – a process that can stretch to several months where the domain has passed through multiple registrars.

What evidence is needed to recover a stolen .xyz domain?

For a UDRP complaint the evidence must address all three Paragraph 4(a) elements: proof of trademark rights, proof that the respondent lacks a legitimate interest, and proof of bad-faith registration and use. For an unauthorized-transfer claim the evidence centers on the account-compromise record and the registrar's transfer-authorization log.

Trademark rights can be established through a registered mark, a pending application with acquired use, or – in some panels' view – longstanding common-law use evidenced by commercial activity. The domain's similarity to the mark is assessed visually and phonetically; the .xyz extension is generally disregarded in that comparison.

Legitimate-interest evidence for the respondent side includes a bona fide offering of goods or services before notice of the dispute, widespread recognition under the disputed name, or documented noncommercial fair use. The absence of any such evidence, combined with a parking page or pay-per-click site built around your trademark terms, supports the complainant's second-element case.

Bad-faith indicators that panels have consistently recognized include registration shortly after a trademark announcement, a pattern of registering third-party marks across multiple domains, an offer to sell at a price far exceeding registration cost, and the use of privacy or proxy services to conceal the registrant's identity while the domain is pointed at a competing or misleading site.

For unauthorized-transfer cases, the documentary record matters enormously: access logs, password-reset notifications, outbound-transfer confirmation emails you did not initiate, and a timeline of the compromise establish the chain of events. We have built successful registrar-escalation packets from nothing more than email headers and WHOIS history in situations where the registrant had no contemporaneous backup of their account credentials.

Can I recover a stolen .xyz domain for more than one domain at once?

A UDRP complaint may cover multiple domains in a single proceeding, but only where all the domains are registered by the same registrant of record. If the domains are held by different registrants, separate complaints are required.

That "same registrant" requirement is a formal rule under the UDRP. Panels have allowed consolidated complaints covering several .xyz domains where the evidence shows a coordinated pattern – the same registrant, the same bad-faith scheme, multiple variations of the complainant's mark – even where some contact details differ slightly. But the prima facie identity of the registrant across all domains must be shown at the outset.

Where you face a coordinated cybersquatting campaign involving two dozen variations of your brand across .xyz, .com, and other gTLDs, a single complaint can capture all domains held by the same registrant, regardless of zone. The UDRP applies to all accredited gTLD registrars. That means a single well-constructed filing can dismantle an entire portfolio of abusive registrations in one proceeding, provided the registrant is the same across all of them.

If the campaign spans multiple registrants – as is common where typosquat portfolios are sold off or distributed – a different strategy is needed. We routinely advise on sequencing: which domains to prioritize, which registrant identities are likely linked, and whether a court action for a wider injunction makes more sense than a series of individual UDRP filings.

When does a court route beat UDRP arbitration for a stolen .xyz domain?

Court action is the right choice when you need a remedy the UDRP cannot provide: monetary damages, a wider injunction, or recovery from a party who has transferred the domain beyond ICANN's reach. UDRP can only order transfer or cancellation – nothing else.

The UDRP's remedial ceiling is fixed. No monetary damages, no cost awards, no injunctions against future conduct. Where a cybersquatter caused measurable business loss – diverted customers, intercepted invoices, reputational harm – the only route to money is court, typically through US anticybersquatting litigation or an equivalent national action, handled with local litigation counsel in the relevant jurisdiction.

A court route also becomes necessary when the unauthorized transfer has moved the domain through multiple registrars or into a jurisdiction where the registrar will not comply with a UDRP order without a court backstop. In those cases we assess the feasibility of parallel proceedings: a UDRP complaint to establish the abuse on the record, and a court application to freeze the domain or compel registrar compliance.

Conversely, if all you need is the domain transferred and your evidence of bad-faith registration is strong, UDRP is almost always faster and cheaper than litigation. The decision matrix runs roughly like this: strong trademark, clear bad-faith evidence, no damages claim, respondent likely to comply – UDRP at WIPO. Damages needed, registrar non-compliant, or party located in a jurisdiction resistant to UDRP transfer orders – court, coordinated with local counsel.

In a matter from spring 2025 – a .xyz account-compromise case involving a five-figure buy-back demand – we escalated to the registrar, documented the unauthorized outbound transfer with access-log evidence, and secured a full reversal within three weeks, without filing a UDRP complaint.

What are the possible outcomes when you recover a stolen .xyz domain?

Under the UDRP the only remedies are transfer of the domain to the complainant or cancellation of the registration. No monetary award is possible. For unauthorized-transfer claims the outcome depends on the registrar's own process and any court order obtained.

Transfer is the standard remedy sought in most UDRP complaints. The panel orders the registrar to transfer the domain to the complainant's designated account. Cancellation – returning the domain to the pool – is available but less common; it is typically used where the complainant has no interest in holding the domain itself and simply wants it neutralized.

Panels may also issue a Reverse Domain Name Hijacking (RDNH) finding against a complainant who filed in bad faith – for instance, to use the UDRP as a tool to seize a legitimately registered .xyz domain from its rightful owner. An RDNH finding carries no monetary penalty but is a public reputational mark against the brand or their counsel. We defend respondents against abusive complaints and pursue RDNH findings where the record supports them.

For the unauthorized-transfer route, a successful registrar escalation restores the domain to your account. A court order can go further: requiring the registrar to lock, transfer, or return a domain, and potentially awarding damages against the party responsible for the compromise or the subsequent bad-faith use.

What outcome is realistic for your situation? That depends on the quality of your trademark evidence, the conduct of the registrant, and the procedural route you choose. No outcome is guaranteed in domain disputes; panels and courts exercise independent discretion on the facts before them.