Step-by-step: recover a hijacked .biz domain after account compromise
Your .biz domain is gone. The registrar account that held it was accessed without your authorization, the domain was transferred to an unknown party or a distant registrar, and the site now points somewhere else. Every day that passes puts customers at risk and makes the technical trail harder to follow.
To recover a hijacked .biz domain after account compromise, the immediate priority is a registrar lock escalation within the first 24 to 48 hours; after that, the path divides between a UDRP complaint at WIPO (available for .biz as an ICANN-accredited gTLD), a transfer-reversal through the gaining registrar, or, where arbitration cannot reach the hijacker, court action handled with local litigation counsel. The right route turns on who holds the domain now, what evidence of compromise exists, and whether the unauthorized transfer crossed registrar or registry boundaries.
This guide walks each decision in sequence – the trap hidden in every step included.
Step 1: Stop the clock – what to do in the first 48 hours
The single most important action in a domain hijacking is a documented hold request to both the losing registrar and the .biz registry within the first two days. Every hour of delay gives the hijacker time to push the domain to a second, third, or fourth registrar, which multiplies the procedural layers you must unwind. Call, email, and submit a formal abuse ticket simultaneously – a verbal escalation alone leaves no record.
The losing registrar – the one where the account was compromised – has a narrow contractual and ICANN-policy obligation to cooperate in investigating unauthorized transfers. Document the exact timestamp of your compromise discovery, the last legitimate account action you can verify, and any password-reset or authorization-code request emails you did not initiate. That chain of custody becomes exhibit one in every subsequent filing.
One trap here: many registrars require a written theft declaration on a specific internal form before they will escalate to the registry. Submitting only a general support ticket can cost 48 critical hours while the ticket is reclassified. Ask explicitly for the registrar's "unauthorized transfer" or "account compromise" escalation path, and confirm the name of the agent handling it.
At the same time, preserve a full screenshot of the current WHOIS/RDDS record for the domain. Include the registrant name, registrar of record, nameservers, and the domain status codes. If the record already shows a new registrar, note the IANA registrar ID – that number is public and will be needed in every subsequent communication.
For an assessment of your domain dispute, contact info@cognomenlaw.com.
Step 2: How does the gaining-registrar transfer-reversal process work?
A transfer reversal under the ICANN Transfer Policy requires the gaining registrar – the one that accepted the unauthorized push – to cooperate once presented with credible evidence of compromise. The process is not automatic. You must submit a formal dispute to the gaining registrar citing the relevant ICANN transfer rules and provide your evidence package: the account compromise documentation, the WHOIS chain, and any communications showing the authorization code was not legitimately issued.
The gaining registrar has a defined review period, typically measured in days. If it accepts the claim, it initiates a transfer back to your original registrar. If it disputes the claim or does not respond within a reasonable window, the matter escalates to ICANN's compliance process or to a dispute forum. Do not wait passively for a response. A follow-up on day three, in writing, with a copy to ICANN Compliance, signals that you are tracking the timeline and are prepared to escalate.
The trap in this step is assuming that ICANN Compliance will itself order a transfer. It will not. ICANN Compliance investigates registrar conduct and can sanction a registrar for policy violations, but it does not adjudicate domain ownership. Its value here is as pressure: a registrar under a compliance inquiry is more likely to cooperate voluntarily. Treat the ICANN complaint as a parallel track, not a primary remedy.
In a recent matter (a .biz hijacking, spring 2025), we secured a voluntary return of the domain within three weeks by combining a formal gaining-registrar dispute with a simultaneous ICANN Compliance submission. The hijacker had already pointed the domain at a phishing page, which the gaining registrar found sufficient reason to act without waiting for the full review period. Speed in documentation was the deciding factor.
What evidence actually decides whether you get the domain back?
Evidence of account compromise is the fulcrum of every recovery route. The most persuasive package contains: authentication logs from the registrar showing a login from an IP address or device not in your history; any phishing email or social-engineering artifact that led to credential theft; the authorization code (EPP code) generation log confirming the code was issued after the suspicious login; and a consistent record of your prior ownership – invoices for registration renewals, hosting invoices tied to the domain, trademark or business registrations referencing the name, and screenshots of your prior web presence.
What panels and registrars look for is a clear break in the chain. Your evidence must show that the registrant of record immediately before the transfer was you, that the authorization was not given by you or anyone with authority to act for you, and that the domain was transferred without your consent. The stronger and more contemporaneous that record, the harder it is for the hijacker or a complicit gaining registrar to resist the reversal.
A common evidence gap: owners who can document ownership but cannot document authorization – or the absence of it. If your registrar account had shared credentials, or if a third party (a former employee, a web agency) had access, the compromise narrative becomes murkier. Address that ambiguity proactively in your submission, with a declaration and any corroborating communications, rather than leaving it for the other side to exploit.
One further point on the .biz zone specifically: because .biz is a gTLD, the WHOIS/RDDS record is relatively transparent compared to some ccTLDs, and the registrar data trail tends to be more accessible. That is an advantage. Use it.
Step 3: Should you file a UDRP complaint at WIPO or pursue court action?
The decision between a WIPO UDRP complaint and court action is not binary – sometimes you run them in parallel. But the starting point is what you need and whether the UDRP can deliver it.
The UDRP applies to .biz as an ICANN-accredited gTLD, and WIPO is available as a filing forum. The WIPO filing fee for a single-member panel covering one to five domains is USD 1,500, and a standard case resolves in approximately two months. The only UDRP remedies are transfer or cancellation – no damages, no monetary recovery. To win a UDRP on a hijacking, you must still satisfy all three Paragraph 4(a) elements: confusing similarity to a mark you hold, absence of legitimate interest on the hijacker's side, and bad-faith registration and use. A pure account-compromise scenario where the hijacker has no arguable interest in the domain will usually satisfy elements two and three comfortably. Element one requires that you hold trademark rights in the domain string – if the name is purely descriptive and you have no registration, that element can be harder.
Where does a court route fit? If the hijacker is jurisdiction-accessible – operating in a country where you can obtain an injunction and where local counsel can act quickly – court action gives you remedies the UDRP cannot: a temporary restraining order freezing the domain in place, discovery of the hijacker's identity and assets, and the possibility of damages. For a .biz domain used in a commercial fraud or phishing campaign, US anticybersquatting litigation handled with local litigation counsel can reach consequences that a WIPO panel cannot.
The decision matrix in practice: if the gaining registrar voluntarily cooperated and you just need a clean transfer confirmed, neither forum may be necessary. If the registrar refused and the hijacker is anonymous but your trademark rights are clear, WIPO at USD 1,500 (single panel) is usually the faster and more cost-efficient path. If you know who the hijacker is, the harm is ongoing, and damages matter, supplement the UDRP with court action or replace it entirely if the UDRP's two-month window is too slow for the commercial risk.
To weigh UDRP against a court action for your case, email info@cognomenlaw.com.
Step 4: How do you file a UDRP complaint for a hijacked .biz domain?
Filing at WIPO follows a defined sequence. The complaint is submitted online through the WIPO electronic filing system, accompanied by the filing fee and an evidence package. WIPO conducts an administrative review within a few days; deficiencies are flagged and must be cured quickly. Once the complaint is formally commenced, the respondent – the current registrant of record – has 20 days to file a response.
A UDRP complaint in a hijacking matter must be framed carefully. The argument under element three (bad faith) will center on the registrant's knowledge: did the hijacker know the domain belonged to another when the transfer was effected? Panels have consistently found that a party who acquires a domain through unauthorized account access cannot claim good faith, because the means of acquisition is itself the bad-faith act. That reasoning is well-settled in the consensus view under the Policy.
One procedural trap: if the hijacker has already pushed the domain to a second or third registrar, the complaint must name the correct current registrant of record. A complaint filed against a prior holder will be administratively rejected or dismissed. Verify the current WHOIS record on the day of filing and update your complaint accordingly.
After the response window closes – whether a response was filed or not – a panelist is appointed. A single-member panel appointment at WIPO typically follows shortly after the response deadline. The panel then issues a written decision. If the complaint succeeds, WIPO notifies the registrar of record, which implements the transfer after a short waiting period to allow for court challenge. In our experience handling recovery matters across gTLD zones, the implementation step is rarely contested once a panel decision is issued.
Step 5: What if the registrar or the hijacker does not cooperate?
Non-cooperation is the scenario that makes a court route essential. A registrar that does not respond to an unauthorized-transfer escalation, a hijacker who has routed the domain through multiple jurisdictions to obscure the trail, or a current registrant located in a jurisdiction where UDRP implementation is resisted – all of these situations push the recovery path toward litigation.
Court action in this context typically involves two distinct filings: an application for emergency interim relief (a temporary domain freeze, often called a TRO or equivalent in the relevant jurisdiction) and a substantive claim for title to the domain and, where available, damages. Interim relief is critical because a court case takes months; without a freeze order, the domain can be transferred again while the case proceeds. This work is handled with local litigation counsel in the relevant jurisdiction.
Where the hijacker is anonymous – as is common in organized domain theft – the court route may also require a subpoena or equivalent order directed at the registrar or registry to reveal the current registrant's identity. Most common-law jurisdictions have a procedure for this. The registrar, once served, is typically required to freeze the domain pending the outcome.
In a second recent matter (a .biz domain used in a credential-harvesting scheme, summer 2025), the gaining registrar failed to respond to three escalations over ten days. We coordinated with local litigation counsel to obtain an emergency freeze order in the relevant jurisdiction within a week of that deadline passing. The domain was locked within 48 hours of the court order being served on the registrar. The UDRP complaint ran concurrently and produced a transfer order six weeks later.
Is a UDRP complaint the right route if I have no registered trademark?
Trademark rights under the UDRP include common-law or unregistered rights, which panels have long recognized. If you have used a distinctive name continuously in trade, with evidence of that use – invoices, domain registration history, press coverage, customer correspondence – you may establish unregistered rights sufficient for element one. The threshold is that the name must function as a mark: it must identify your goods or services to a defined audience. Purely descriptive or generic terms do not qualify.
For a hijacking claim specifically, the rights question is usually secondary to the consent question. What matters most is whether the transfer was authorized. A thin trademark position will not defeat a clear account-compromise claim before a panel that applies the consensus view sensibly. But it can complicate the filing and increase the risk of a panel finding element one unsatisfied – which would mean dismissal without a transfer, even if the hijacking is obvious.
Where trademark rights are genuinely weak or absent, the court route may be the more reliable option. Anticybersquatting legislation in the relevant jurisdiction may require proof of a mark, but property-law and contract-law claims for unauthorized transfer do not necessarily require one. Discuss that question with counsel before choosing a forum.
Related at COGNOMEN
Frequently asked questions
When should I recover a hijacked .biz domain after account compromise?
Immediately. The first 24 to 48 hours are critical: a registrar lock request made within that window can prevent the hijacker from pushing the domain to a second registrar, which compounds every subsequent step. Even if the transfer has already occurred, beginning the escalation process promptly preserves the evidence trail and satisfies the procedural timelines that registrars and WIPO require. Delay is the one factor most likely to reduce your options.
What happens if the other side ignores the case?
A default in a UDRP proceeding – where the respondent files no response – does not mean automatic success for the complainant. The panel still reviews the complaint on its merits and must be satisfied that all three Paragraph 4(a) elements are established. In practice, panels treat a default as something that prevents the respondent from introducing facts that might rebut the complainant's evidence. A well-documented hijacking complaint typically fares well in a default scenario, but the complaint must still be properly argued and evidenced.
How is WIPO different from a national court for .biz?
WIPO administers the UDRP and can order transfer or cancellation of a .biz domain within approximately two months for a standard single-panel case, at a filing fee of USD 1,500. A national court can do things WIPO cannot: grant emergency interim relief to freeze the domain before a final decision, order disclosure of the hijacker's identity, and award monetary damages. The tradeoff is time and cost – court proceedings take longer and carry substantially higher legal fees. Many hijacking matters use both in parallel.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.