Step-by-step: escalate a registrar lock to secure a .global domain

Step-by-step: escalate a registrar lock to secure a .global domain. UDRP and ccTLD domain recovery and defense across .global. Email the firm to assess your ca…

You log in one morning to find your .global domain pointing at a competitor's storefront, or worse, gone from your account entirely. A stranger controls the name you built your brand around. The question is not whether to act – it is how fast you can lock the domain before it moves again, and which escalation path forces the registrar to hold it in place.

To escalate a registrar lock to secure a .global domain, you work through three parallel tracks: an emergency registrar escalation to freeze the domain, a WIPO UDRP complaint (the .global registry has adopted the UDRP) to recover ownership, and – where the registrar stalls or a court order is faster – a local litigation route that compels the freeze by judicial authority. The 20-day response window under the UDRP and the registrar's own abuse-response SLA both begin ticking the moment a complaint is filed. Acting within hours, not days, determines whether the domain is still recoverable.

This guide walks each step in sequence, flags the trap inside it, and identifies the evidence that decides the outcome.

What governs a .global dispute, and why it matters for your escalation

.global is a generic top-level domain (gTLD) operated under ICANN's new-gTLD program, which means it is governed by the same accredited-registrar framework as .com. The UDRP applies in full. That is important: unlike some country-code domains that use a national procedure, a .global dispute can be filed at WIPO, the Forum, CAC, or ADNDRC using the standard three-element test under Paragraph 4(a) of the UDRP.

Why does this matter for a lock escalation? Because the registrar that holds your .global is ICANN-accredited and contractually bound to implement UDRP interim measures and verified transfer-freeze requests. That contract gives you a lever that does not exist at a national registry operating outside ICANN's framework. Use it early.

The trap in Step 0: many brand owners assume that because the domain is "just a new gTLD," the registrar will resolve it informally. They email support and wait. Every hour the domain sits unlocked is an hour it can be transferred to a new registrar, changed to a privacy proxy, or pointed at a phishing page that begins collecting your customers' data.

Step 1: Document the compromise before you touch anything

Before you call the registrar or change a password, screenshot and preserve every piece of evidence available to you. This sounds counterintuitive – the instinct is to act – but a panel or court evaluating account compromise will need a clear chain of custody showing what changed, when, and how.

Collect the following immediately:

• A full WHOIS/RDDS record for the domain, timestamped, showing the current registrant name, registrar, and nameservers.
• Screenshots of your registrar account dashboard showing the domain listed (or missing).
• Any transfer-authorization emails – look in spam, in your inbox, and in deleted folders.
• Timestamps on any recent password-reset requests, unfamiliar login events, or MFA bypass notifications.
• Evidence of your original registration: the confirmation email when you first registered the domain, renewal receipts, and any prior WHOIS snapshots from a third-party archiving service.
• Business records showing use: invoices, email headers carrying the domain, website analytics exports, trademark certificates if available.

The trap in Step 1: waiting to collect evidence until after you have called the registrar. Support calls frequently reset the session state in ways that destroy your audit trail. Preserve first, escalate second.

In our practice, the registrants we advise who have the strongest recovery positions are those who captured timestamped WHOIS data within the first two hours of discovering the compromise. A WIPO panel evaluating whether a transfer was unauthorized will rely heavily on that early record.

Step 2: File the registrar abuse complaint and request an immediate transfer lock

Contact the registrar through its official abuse or legal channel – not general support. Every ICANN-accredited registrar maintains a designated abuse contact, required by its ICANN agreement. Request, in writing, three specific actions:

1. Immediate domain lock – a registry-level "clientTransferProhibited" status preventing any transfer while the dispute is resolved.
2. Preservation of all account-access logs, transfer-authorization tokens, and email records associated with the domain.
3. A written acknowledgment confirming the domain's current status and the registrar's abuse-response process.

Be precise. A vague "I think my domain was stolen" email produces a vague response. State clearly that you are the original registrant, that you believe an unauthorized transfer or account compromise has occurred, that you are preserving your rights under the UDRP and applicable law, and that you require an immediate lock pending formal proceedings.

The trap in Step 2: the registrar's abuse team often responds with a form response directing you back to general support. Do not accept it. Escalate to the registrar's legal or compliance department. Reference the registrar's obligations under its ICANN Registrar Accreditation Agreement specifically. If the registrar is unresponsive within 24–48 hours, note that failure in writing – you will need it later.

How do you know when a UDRP complaint is the right next move for a .global domain?

A WIPO UDRP complaint is appropriate where the .global domain has moved to a third-party registrant who appears to be using it in bad faith – parked with pay-per-click ads, pointed at a competing site, or held for ransom. Under Paragraph 4(a) you must show all three elements: confusing similarity to a mark you hold, the registrant's lack of legitimate interest, and bad-faith registration and use.

The registrar-lock track and the UDRP track run simultaneously, not in sequence. Filing a UDRP complaint does not stop the registrar escalation, and the registrar lock does not make the UDRP unnecessary. Once a UDRP complaint is filed and accepted by WIPO, the domain is placed under a registrar hold that prevents transfer while the case proceeds – that hold is distinct from, and stronger than, the voluntary lock you requested in Step 2.

The right route depends on the facts. Consider this:

If the domain sits with a third party who clearly registered or acquired it to extract payment, a WIPO complaint is typically the fastest route. The WIPO filing fee for a single domain on a single-member panel is USD 1,500, and a standard case is decided in roughly two months. If the domain was taken from your account by credential theft or social engineering – not sold or transferred to an adversarial squatter – the better primary route may be the registrar escalation combined with court action, because the UDRP is a trademark-based remedy and does not squarely address unauthorized account access.

For an assessment of whether the UDRP, the registrar-escalation track, or a court route best fits your .global dispute, contact info@cognomenlaw.com.

Step 3: Decide whether to file at WIPO or pursue the court route

Most .global recovery matters that involve a clear third-party squatter belong in a WIPO UDRP proceeding. WIPO accepts .global complaints under the UDRP because the registry is an ICANN-contracted gTLD. The process is well-documented, panel precedent is deep, and the timeline is predictable.

Court action becomes the stronger choice in three scenarios. First, where the registrar refuses to cooperate with a lock even after a formal demand – a court injunction can compel compliance in ways a UDRP complaint cannot. Second, where the compromise involved fraud or identity theft and you want a remedy beyond transfer: the UDRP awards only transfer or cancellation, never damages. Third, where the domain has already been transferred to a registrar in a jurisdiction where an ICANN-administered proceeding would be difficult to implement – local litigation counsel in the relevant jurisdiction can seek judicial relief directly.

In a recent matter (a .global account-compromise, spring 2025), we coordinated a registrar lock request, a WIPO complaint, and a parallel court application in the same 72-hour window. The registrar implemented the lock within 36 hours of the court application being served on it. The UDRP proceeding then proceeded against the third-party registrant who had received the unauthorized transfer.

The trap in Step 3: treating court action and arbitration as mutually exclusive. They are not. Filing a UDRP does not prevent court action, though a court order may affect the arbitral proceeding. We regularly advise clients to run both tracks in the early days, then narrow to whichever produces the faster interim relief.

Step 4: Assemble the UDRP complaint evidence package

A WIPO panel deciding a .global dispute evaluates the same three UDRP elements as any gTLD case. Your complaint's strength turns on the quality of the evidence file, not on the strength of your narrative.

For the first element – confusing similarity – you need: trademark registration certificates or, if you rely on common-law rights, a volume of evidence showing prior and consistent use of the mark in commerce. The domain must reproduce or closely mimic the mark; with .global, panels often focus on whether the registrant combined your mark with a generic descriptive term in the second level.

For the second element – lack of legitimate interest – you need to show the registrant has no plausible claim to the name independent of your rights. This is almost always shown by absence: no business by that name, no corresponding trademark, no prior use. A registrant who defaulted and offers no explanation will have a difficult time invoking the Paragraph 4(c) safe harbors.

For the third element – bad-faith registration and use – the Paragraph 4(b) factors are the checklist. Was the domain registered to sell it back to you? Does it redirect your customers for commercial gain? Is this registrant part of a pattern of abusive registrations? Document each one you can support. Passive holding – keeping the domain parked without active use – has been treated as bad faith by panels where the registrant clearly knew of your mark and had no plausible legitimate purpose.

The trap in Step 4: underestimating the second element. Many complainants build a strong case on confusing similarity and bad faith but present thin evidence on the absence of legitimate interest. The panel must find all three elements. We have seen cases lost on Element Two alone.

Step 5: File and manage the WIPO proceeding through to decision

Once the complaint is filed, WIPO conducts a formal compliance check. If the complaint passes, the proceeding commences and the registrar is notified to lock the domain. The respondent – whoever currently holds the .global – has 20 days to file a response. Many do not. A default does not automatically mean the complainant wins; the panel still examines the complaint on its merits.

After the response window closes, WIPO appoints a panelist (or a three-member panel if either party requests one and pays the applicable fee). The panel issues its decision, which is published. If the outcome is transfer, the registrar has a short implementation window before the domain moves to your nominated account.

Managing the proceeding matters. Watch for supplemental filing requests from the panel – these are rare but time-sensitive. If the registrant files a response that raises a new factual argument you could not have anticipated, WIPO's rules allow a limited opportunity to reply, but timing is strict. Missing that window can be case-determinative.

The trap in Step 5: assuming the process is automatic once the complaint is filed. It is not. A defaulting respondent can still surface at the registrar implementation stage with a claim that the transfer was improper. Document the UDRP filing number and the registrar's lock-status confirmation, and keep them together in the same file as your WHOIS preservation evidence from Step 1.

What evidence decides the outcome of a .global domain recovery?

The single most predictive factor in .global recovery matters is the quality of the chain-of-title evidence: proof that you were the original registrant, proof of continuous use of the mark or domain, and a clear timeline showing the unauthorized transfer or registration occurred after your rights were established.

Beyond that, the cases we handle most successfully share three evidentiary features. First, the complainant presents the mark evidence in a form a panel can verify quickly – registration certificates, not just brand guidelines. Second, the account-compromise evidence (login logs, transfer tokens, phishing emails) is assembled in a single exhibit that tells a clear story without requiring the panel to draw inferences across dozens of disconnected documents. Third, the bad-faith argument is grounded in at least one Paragraph 4(b) factor, not only a general assertion that the registration looks suspicious.

What weakens a case? A gap in use – a domain that was registered, left unused for years, and then seized. Panels may find no genuine trademark use in commerce in that period, which then creates doubt about the confusing-similarity element. A mark that was applied for after the registrant registered the domain is also problematic; the UDRP generally requires that your rights predate the registration at issue.

In a .global theft case we advised on in late 2024, the client's strongest evidence was not a trademark certificate – they had none – but a consistent archive of domain-linked business email headers spanning four years. That use history carried the common-law rights argument and the panel found in the client's favor. Not every recovery requires a registered trademark. It does require thorough evidence.

To weigh UDRP against a court action for your .global case, email info@cognomenlaw.com.

What if the registrar stalls or the domain disappears before you file?

A registrar that fails to lock the domain after a formal written demand, or that transfers the domain between receipt of your request and the UDRP lock-notice, has potential ICANN compliance exposure. Document every interaction: date, time, channel, the name of the support agent or ticket number, and the exact response received.

If the domain has already moved to a second downstream registrar, the UDRP proceeding still runs against the current registrant, but you will need to identify that registrant from the current WHOIS record and name them in the complaint. WIPO will notify the registrar of record at the time of filing.

Where a registrar is clearly stalling and the domain is actively causing harm – redirecting your customers, hosting phishing content, or being used in a fraud against third parties – a court injunction is typically faster than waiting for the UDRP cycle to complete. An emergency order requiring the registrar to lock the domain pending trial can be obtained in a matter of days in some jurisdictions. We coordinate this through local litigation counsel in the relevant jurisdiction, holding the UDRP in parallel so that whichever route produces the first protective order can be reinforced by the other.

The myth worth dispelling here: many brand owners believe that once the domain has moved registrars, it is unrecoverable through the UDRP. That is not the case. The UDRP applies to the domain, not to the registrar. Whichever ICANN-accredited registrar holds the domain at the time a UDRP decision is issued is obligated to implement it. The registrar change creates delay and complexity – it does not create immunity.

See also our related guide on recovering a hijacked .org domain for a parallel analysis of how unauthorized account access interacts with UDRP and court routes in another gTLD context.

Related at COGNOMEN

• Court action and domain theft recovery – full service overview for registrants and brand owners
• Recovering a hijacked .org domain – unauthorized transfers, account compromise, and the registrar-escalation path
• UDRP against a serial cybersquatter – evidence strategy and multi-domain complaint mechanics