Step-by-step: recover a stolen .me domain

Step-by-step: recover a stolen .me domain. UDRP and ccTLD domain recovery and defense across .me. Email the firm to assess your case. Transparent fees, respond…

A registrar alert arrives at midnight. Your .me domain – the one anchoring your brand, your email, your customer portal – has transferred to a stranger. The WHOIS record shows a name you do not recognize. The domain now resolves somewhere else, or nowhere at all. You have a short window to act before the trail goes cold or the domain changes hands again.

Recovering a stolen .me domain requires moving on two tracks simultaneously: an emergency registrar escalation to lock the domain and document the account compromise, and a formal dispute proceeding – typically a UDRP complaint before WIPO, which administers .me disputes under the Policy – to compel transfer back to the legitimate holder. The UDRP's 20-day response window for the other side and a standard case timeline of roughly two months mean delay is the primary risk. The WIPO filing fee for a single-domain, single-member panel case is USD 1,500, separate from legal fees.

This guide walks each step in order, names the trap concealed in each one, and explains when a court route becomes necessary alongside or instead of arbitration.

Step 1: Why .me uses the UDRP – and what that means for you

.me is Montenegro's country-code zone, but its registry has adopted the UDRP, meaning a stolen or abusively registered .me domain can be challenged before WIPO using the same three-element framework that governs .com disputes. That is good news for speed. It is also a source of confusion: many registrants assume that a ccTLD requires a local Montenegrin court proceeding, which it does not.

The practical implication is significant. WIPO's published rules, timelines, and fee schedule apply directly. A complainant does not need to demonstrate EU eligibility, Canadian presence, or any zone-specific registration criteria beyond holding trademark rights in the relevant name. Where a .eu dispute might require eligibility proof or a .de dispute demands German court proceedings, the .me zone keeps you on familiar UDRP ground.

There is, however, a critical distinction between a theft situation and a standard cybersquatting complaint. In a cybersquatting case, the registrant registered the domain intentionally in bad faith – the UDRP's three elements (confusing similarity, no legitimate interest, registration and use in bad faith) line up cleanly against the squatter. In a theft situation, you are the original registrant and the question is not whether someone registered in bad faith but whether you can prove an unauthorized transfer occurred and that the current holder has no legitimate claim. That distinction shapes the evidence you need at every step.

If you are unsure whether your situation is a theft, a cybersquatting claim, or a contested transfer, contact info@cognomenlaw.com for an initial read before taking any formal step.

Step 2: How do you lock the domain and document the compromise before anything else?

Before filing any formal proceeding, freeze the domain at the registrar level. This single action – or the failure to take it – determines whether a transfer order, if you win one, can be implemented. A domain that has already been transferred a second or third time to a new registrant can become significantly harder to recover.

Contact the registrar of record immediately. Request an emergency registrar lock, sometimes called a transfer prohibition or "clientTransferProhibited" status. Every accredited ICANN registrar has an abuse-reporting channel. Send a written notice identifying yourself as the prior registrant, specifying the domain, and asserting that the transfer was unauthorized. Keep a timestamped copy of every communication.

Simultaneously, collect and preserve the following evidence:

• Your original registration confirmation email showing you as registrant, with dates.
• Billing or renewal records demonstrating continuous control of the account.
• WHOIS or RDDS historical records showing the registrant change date and any change in nameservers or contact details.
• Any phishing emails, suspicious login alerts, or account-recovery emails you received around the time of the transfer.
• Screenshots of the domain's current DNS resolution, hosting, and any content it displays.
• Evidence of your trademark rights, if any: registration certificates, pending application receipts, or evidence of common-law use in commerce.

The trap in this step is inaction while you consult counsel. Registrars are not obligated to hold a domain indefinitely on a verbal complaint. If the domain is already in a post-transfer "grace period" (the 60-day ICANN inter-registrar transfer lock), that window works in your favor – transfers out are blocked for 60 days after an incoming transfer. Use that time. If the grace period has already passed, the urgency doubles.

In our practice we regularly advise registrants who waited several days before escalating to the registrar, only to find the domain had already moved to a second registrar. That second hop complicates recovery materially: it adds a new registrar whose abuse channel you must engage and may require simultaneous UDRP action naming the current holder.

Step 3: What are the three UDRP elements – and do they fit a theft case?

The UDRP requires a complainant to prove all three elements of Paragraph 4(a) before a panel will order transfer: confusing similarity to a mark, no legitimate interest in the domain by the respondent, and registration and use in bad faith. In a straight theft situation, the analysis of each element is distinctive.

Confusing similarity. If the stolen domain is identical to your registered trademark, this element is typically straightforward. The comparison is the domain string against the mark – the .me ccTLD suffix is generally disregarded in the analysis. If your rights are in common law rather than a registered mark, you will need to demonstrate secondary meaning and prior use in commerce.

No legitimate interest. A thief has none. But the panel expects you to make a prima facie showing – a threshold demonstration – that the current registrant lacks rights. You then effectively shift the burden; the current holder must come forward with evidence of a bona fide offering, legitimate noncommercial use, or a claim that they are commonly known by the name. In theft cases, the current holder typically offers nothing credible, and panels proceed accordingly.

Registration and use in bad faith. This is where theft cases diverge from standard cybersquatting. The current holder did not register the domain in any conventional sense; the domain was moved to their account without your consent. Panels have addressed this situation and have generally treated an unauthorized transfer as equivalent to a bad-faith registration for purposes of Paragraph 4(a)(iii). The bad-faith use element is usually satisfied by the holder's passive retention of a domain to which they have no legitimate claim, or by active redirection to a commercial page.

The trap here is assuming the case is too easy to build carefully. Panels do not issue transfer orders on assertion alone. You need the documentary record assembled in Step 2 to support each element, particularly if the current holder responds and raises a fabricated purchase story.

Step 4: Which forum should you file with – and does the choice matter?

For .me disputes, WIPO is the natural choice, and in our experience the most commonly used forum for this zone. WIPO administers .me under its rules as a designated provider. The Forum and CAC also accept UDRP filings for .me, but WIPO's depth of experience with ccTLD disputes that operate under the UDRP and its expedited option – delivering a decision within roughly one month for single-panel cases of up to five domains – make it the default recommendation for most theft scenarios.

The filing fee at WIPO is USD 1,500 for a single domain with a single-member panel, or USD 4,000 for a three-member panel. A three-member panel costs more but can be appropriate when the factual record is contested or when the current holder is likely to raise a serious defense. If the complainant requests a single panelist but the respondent requests a three-member panel, the parties generally split the higher fee.

The Forum begins at approximately USD 1,300 for one or two domains on a single-member panel. CAC entry-level fees are lower still. Neither of those savings justifies choosing a forum you know less well, or one with less depth in the specific zone, when speed and panel quality matter in a theft matter.

What if the registrant cannot be located, or has hidden behind proxy service? File anyway. Panels regularly decide cases on the documentary record alone when a respondent defaults. A default is not an automatic win – you still prove all three elements – but an unanswered, well-documented complaint has a strong trajectory.

A decision matrix in prose: if the domain is .me and you want it transferred, WIPO UDRP is the fastest route, at the fees above. If you also want monetary damages – for lost business, impersonation fraud, or customer diversion – the UDRP cannot reach money. That path requires court action, generally US anticybersquatting litigation if the perpetrator has US presence or assets, or litigation in the relevant jurisdiction with local litigation counsel. If the domain is simultaneously an issue across zones (a .me and a .com, for instance), a single UDRP complaint can cover multiple domains only if the registrant of record is the same holder across both.

Step 5: How do you build the evidence file that decides the outcome?

The evidence file is the case. A UDRP panel reads a complaint document, a response if filed, and the annexed exhibits. There is no cross-examination, no oral hearing. What you submit at the outset is what the panel decides on.

For a theft case, the core evidence set includes the following components:

• Proof of your trademark rights. Registration certificates with priority dates; for common-law rights, sales figures, advertising spend, media coverage, and continuous use records showing the mark was established before the unauthorized transfer.
• Chain of title for the domain. Registration history, renewal records, and any prior WHOIS data you can obtain showing your name as registrant up to the date of the compromise.
• Evidence of the unauthorized transfer. Account-compromise indicators: phishing emails targeting your registrar login, password-reset notices you did not request, IP-address login anomalies from the registrar's records if obtainable, or a registrar's own incident report.
• Current use by the bad-faith holder. Screenshots of any landing page, parking page, or redirect the domain now displays. If the domain is pointed at a page soliciting your customers or mimicking your brand, that is explicit bad-faith use. Passive DNS resolution to a parking page is sufficient for use under the established consensus view.
• The respondent's lack of any plausible legitimate interest. A WHOIS record under a name wholly unconnected to your mark, no known prior business, no publicly accessible trade presence under the domain name – these all support the prima facie showing.

The trap at this step is over-reliance on the registrar's own investigation. Registrars are not courts; their abuse team may acknowledge a compromise without acting decisively. Their records, however, can be subpoenaed or formally requested if you later pursue court action. Preserve everything they send you – it may matter in a parallel or subsequent proceeding.

In a matter we handled – a .me theft case in spring 2025 – the key evidence was a series of automated registrar notifications the client had received but not opened: a password-change confirmation followed by a contact-detail update, both triggered by a credential-stuffing attack on a recycled email address. Those emails established the exact time of compromise and defeated the current holder's claim of a legitimate purchase. The domain was recovered.

Step 6: When does a court route beat arbitration for a stolen .me domain?

The UDRP's remedies are limited to transfer or cancellation. No damages. No injunction. No cost recovery. For most theft scenarios, transfer is the goal and the UDRP is the right tool. But there are four situations where court action is necessary alongside or instead of it.

You need monetary relief. If the theft caused material business loss – fraudulent invoices sent under your domain, customer data exposed, revenue diverted – only a court can award damages. A UDRP win addresses the domain; a court action addresses the harm.

The UDRP decision is ignored or challenged. A registrar can decline to implement a UDRP transfer order in a small number of circumstances, and a respondent can seek de novo review in a competent court within ten business days of the decision. If that happens, the dispute migrates to litigation regardless of your UDRP outcome. We have seen cases where a respondent used a court filing purely to delay implementation of a UDRP transfer order; preparing for that contingency is part of the pre-filing strategy.

The registrant is beyond the UDRP's jurisdictional reach. The UDRP binds registrars, not courts. If the thief's conduct constitutes a criminal offense – as unauthorized computer access and identity fraud often do – criminal referral and civil litigation may run in parallel. In that scenario we coordinate with local litigation counsel in the relevant jurisdiction.

The domain has changed hands multiple times. If the stolen domain was sold to a bona fide purchaser with no knowledge of the theft, that purchaser may raise a genuine legitimate-interest defense under Paragraph 4(c). A panel faced with that defense and a contested factual record may decline to transfer in the absence of clear documentary evidence. A court, with discovery and witness examination, can resolve that credibility contest.

For more on how court and arbitration routes interact after a UDRP filing, see our discussion at FAQ: Enforcing a UDRP Decision. For a view of how this plays out from the respondent's side, our guide at FAQ: Defending a UDRP Complaint covers the arguments a respondent might raise and how to counter them.

To weigh UDRP against a court action for your stolen .me domain, email info@cognomenlaw.com.

Step 7: What happens after the UDRP decision – and what is the registrar's role?

A UDRP panel that finds in the complainant's favor issues a transfer order. WIPO notifies the registrar of record. Unless the respondent files a court challenge within ten business days in a competent jurisdiction, the registrar implements the transfer. For most .me cases this means the domain moves back to the complainant's account at the registrar – or to a nominated account – within a short period following the implementation window.

The trap at this final step is assuming the process is automatic once the panel rules. It is not. You must be prepared with a receiving registrar account in good standing and ensure your registrar credentials are secured before the transfer occurs. If the original account compromise involved a hijacked email address, that address must be recovered and secured, or the domain must transfer to a newly verified account. Receiving a transfer order into a still-compromised account solves nothing.

After recovery, take immediate post-transfer security steps: enable two-factor authentication on the registrar account, update the contact email to a protected address, set a registrar lock ("clientTransferProhibited"), and consider enabling registry lock if the registrar and registry offer it for .me. A domain recovered through litigation is still vulnerable to the same attack vector that caused the original theft unless the underlying account security is addressed.

A partial refund of the WIPO filing fee is available if the case is withdrawn before panel appointment – typically around USD 1,000 of the USD 1,500 fee is returned. That is relevant if the registrar resolves the matter voluntarily after a complaint is filed but before the panel is constituted.

What myths stop brand owners from acting – and why they are wrong

The most common objection we hear is this: "The domain was registered by someone else, so the UDRP requires us to prove bad faith on their part, but they claim they bought it legitimately – so we cannot win." That is a misreading of how panels treat theft situations. The consensus view under the Policy does not require you to prove the current holder's subjective intent at the moment of registration in the way a criminal prosecution would. It requires you to demonstrate that the domain was registered and is being used in bad faith. An unauthorized transfer, documented with account-compromise evidence, satisfies that standard. The current holder's claim of a "purchase" must be supported by credible evidence; absent that, panels do not credit it.

A second myth: "We should wait to see if the registrar fixes it before filing at WIPO." Waiting is the single decision that most frequently converts a recoverable situation into a protracted dispute. Registrars resolve theft complaints voluntarily in some cases – particularly where the compromise is clear and recent – but that resolution is not guaranteed. Filing at WIPO and pursuing registrar escalation in parallel is not conflicting; it is standard practice for a contested situation.

Our practice handles .me and other ccTLD theft cases regularly. We assess the three UDRP elements, assemble the bad-faith evidence, engage the registrar through formal abuse channels, and file the complaint with the appropriate forum. Where a court route is needed, we coordinate with local litigation counsel in the relevant jurisdiction. For a broader view of the court and registrar tools available for domain theft, see our court-recovery service page.

Related at COGNOMEN

• Court action and domain theft recovery – tools beyond UDRP arbitration
• FAQ: what happens when a UDRP decision is resisted or ignored
• FAQ: how to defend a UDRP complaint and what arguments hold up