Step-by-step: escalate a registrar lock to secure a .shop domain

Your .shop domain is gone. The registrar account shows a transfer you never authorized, or the domain is locked under a hold you did not request, and the registrant credentials no longer respond to your recovery email. Every hour the domain resolves to someone else's content, customer trust erodes. The question is not whether to act – it is which lever to pull first, and in what order.

Escalating a registrar lock to secure a .shop domain means working through a defined sequence: document the compromise, request an immediate registrar hold, escalate to the registry operator for .shop (GMO Registry), and – where the account takeover is confirmed – pursue transfer reversal through ICANN's procedures or a UDRP complaint before WIPO. The 20-day response window under the UDRP applies once a complaint commences, so speed at the registrar stage is the difference between a recoverable position and a decided dispute. This guide walks each step, names the trap inside it, and explains when a court route becomes necessary.

The sections below follow the decision sequence a domain theft recovery actually requires, from the first call to the registrar through to a formal filing.

What governs .shop domain disputes – and why the zone matters

.shop operates under the UDRP and ICANN's standard Registrar Transfer Dispute Resolution Policy, meaning the full three-element UDRP test applies to any abuse claim. GMO Registry operates the .shop registry, and all accredited registrars for .shop are bound by ICANN's Transfer Policy and the Registrar Accreditation Agreement. That structure creates two distinct tracks: the dispute track (UDRP, transfer dispute) and the account-compromise track (registrar escalation, registry hold).

Why does the zone matter here? Because .shop is a new gTLD, not a legacy zone like .com. That distinction has two practical consequences. First, the URS – the Uniform Rapid Suspension system – is available for .shop domains in addition to the UDRP, offering a faster suspension remedy at a lower filing fee when the criteria for "clear and convincing" evidence of abuse are met. Second, the registry operator (GMO Registry) maintains published escalation channels that go beyond those of a legacy registry. Knowing the zone means knowing which channel to use before drafting a single letter.

A third consequence matters for registrants on the wrong side of a dispute: because .shop is a new gTLD, Paragraph 4(c) safe harbors under the UDRP apply in full, including the bona-fide-offering defense and legitimate-noncommercial-use defense. A registrant who held the domain for a genuine business purpose before any notice of the dispute has real defenses – and should preserve evidence of them immediately.

Step 1: Document the compromise before you touch anything

The single most damaging mistake in a domain theft recovery is acting before documenting. Before calling the registrar, before resetting a password, before sending any notice: capture the current state of the domain in a form that can be submitted to a panel or a court.

What to capture, and why each item is necessary:

• RDDS (WHOIS) record as it stands now – print or screenshot the current registrant name, registrar of record, nameservers, and expiry date. If the domain has been transferred out, the new registrar will appear here. Do not wait; RDDS records change faster than a panel would expect.
• DNS resolution – document where the domain currently resolves. A parking page, a phishing clone, a redirect to a competitor's site: each matters to the bad-faith analysis if a UDRP complaint follows.
• Account access log – most registrar portals allow you to download recent login activity. Export it immediately. Unauthorized IP addresses, unusual geographies, and the exact time of the transfer authorization are critical evidence of account compromise.
• Email notifications – ICANN's Transfer Policy requires the registrar to send a transfer authorization notification to the registrant's email of record. Locate that email (or document that it never arrived). Its presence or absence decides whether the registrar followed ICANN's rules.
• Any communication from the apparent new holder – a demand for money, an offer to sell the domain back, or silence are all probative. Save them with full headers intact.

The trap in Step 1: many domain owners begin by resetting their email account password or switching hosting before capturing the RDDS record. Resetting the email can destroy the timestamp on the compromise notification. Take the screenshots first.

Step 2: Request an immediate registrar hold – and know its limits

Once the compromise is documented, contact the losing registrar (the registrar from whose account the domain was transferred) by the fastest channel available – typically a priority or abuse ticket, not a standard support form. The request has two objectives: a registrar lock on any further outbound transfers, and a formal complaint number that creates a paper trail for the escalation that follows.

A registrar lock under ICANN's Transfer Policy places the domain in a status that prevents transfer to another registrar for a minimum period. The registrar is also obliged under the Registrar Accreditation Agreement to investigate a reported unauthorized transfer. State the following in the initial ticket:

1. The domain name in full (including the .shop extension).
2. The date and approximate time of the unauthorized transfer or account change.
3. Your account credentials (do NOT send the password itself – send the account username and the registration confirmation from the original registration date).
4. A statement that you did not authorize the transfer and did not receive, or did not act on, any transfer authorization notification.
5. A request for the domain to be placed under a registrar lock or equivalent hold pending investigation, and a request for the identity and contact of the gaining registrar.

The trap in Step 2: registrar support teams are high-volume operations. A generic "my domain was stolen" ticket will be triaged slowly. A specific, documented claim – referencing ICANN's Transfer Policy, naming the relevant sections generically, and attaching your RDDS screenshot and account log – moves faster. Ask for the complaint to be escalated to the registrar's abuse or compliance team, not standard customer support.

The steps above are the standard opening sequence. Whether the registrar responds adequately – and whether additional filing is necessary – depends on the specific facts of your account and the registrar's conduct. For an assessment of your domain dispute, contact info@cognomenlaw.com.

Step 3: Escalate to ICANN if the registrar does not act within 72 hours

If the registrar fails to acknowledge the complaint, denies a lock, or confirms the transfer was "authorized" without explaining how, the next escalation is to ICANN's Contractual Compliance team. ICANN maintains a formal complaint mechanism for registrar violations of the Registrar Accreditation Agreement and Transfer Policy. This is not a dispute-resolution procedure – it does not result in a transfer order – but it creates a compliance record that strengthens any subsequent filing before WIPO or in court.

Submit to ICANN Contractual Compliance with the following:

• The registrar's name and IANA ID (both are in the RDDS record you captured in Step 1).
• Your complaint number from the registrar's ticket system.
• The specific Transfer Policy obligation you assert was violated (for example, the requirement to send a transfer authorization to the registrant's email of record before executing an outbound transfer).
• Your documentation: RDDS screenshots, account login log, and the presence or absence of the authorization email.

Simultaneously, send a written notice to the gaining registrar. The gaining registrar has no pre-existing relationship with you, but it is also bound by ICANN's rules. Notice that a transfer dispute has been opened and that the domain is subject to a claimed unauthorized transfer creates an obligation on the gaining registrar to cooperate with any subsequent panel order or court directive.

The trap in Step 3: some registrants exhaust weeks on ICANN Contractual Compliance expecting it to function like a dispute-resolution body. It is a compliance mechanism. Use it to create the paper trail, then move immediately to Step 4 if the domain has not been locked.

Step 4: Choose the formal route – UDRP, URS, or court action

After the registrar-level steps are complete – or, in parallel, if urgency demands – the question becomes which formal mechanism to deploy. The right route for a .shop domain depends on what you want, what you can prove, and how fast you need it.

Route A: UDRP at WIPO. If the domain was registered by a third party who is now using or parking it in a way that infringes your trademark, the UDRP is the standard path. A complaint before WIPO requires proof of all three elements of Paragraph 4(a): confusing similarity to a mark you hold, no legitimate interest in the respondent, and registration and use in bad faith. The WIPO filing fee starts at USD 1,500 for a single-member panel covering up to five domains. A standard case resolves in approximately two months. The only remedies are transfer or cancellation – there is no damages award. WIPO also offers an expedited option delivering a decision in roughly one month for single-panel cases covering up to five domains.

Route B: URS. Because .shop is a new gTLD, the URS is available. The URS applies a higher evidentiary standard – "clear and convincing" evidence of abuse – but operates at lower cost and faster timelines than the UDRP. Critically, the URS remedy is suspension, not transfer. The domain is taken offline for the remainder of the registration term, but you do not receive ownership. Choose the URS when you need the domain removed from use quickly and the transfer of ownership can follow through other means, or when the registration is near expiry and suspension effectively ends the dispute.

Route C: Court action. Where the account compromise involved fraud – for example, a social-engineering attack on the registrar's support team, a forged identity document, or a credential-stuffing attack – the dispute may exceed what UDRP panels can address. A UDRP panel can transfer the domain if the bad-faith elements are met, but it cannot award damages, cannot issue an injunction against future conduct, and cannot compel a registrar to produce identity documents under a discovery order. A court can do all three. In matters we handle involving registrar-assisted fraud or jurisdictions where enforcement of a panel order is contested, we work with local litigation counsel in the relevant jurisdiction to pursue an anticybersquatting action alongside or instead of the UDRP.

The decision in practice: if you hold a trademark and the .shop domain is in the hands of a third-party registrant who registered it to exploit your brand, start with the UDRP. If the domain was taken from your own account by unauthorized access and is now in a different registrar's hands, the transfer-reversal route through ICANN procedures and, where necessary, court action is more appropriate – because the "registrant" in the RDDS is you (or should be), and the UDRP was not designed to adjudicate account-compromise disputes. That said, panels will consider account-compromise evidence when the abuse is clear.

In a recent matter (a .shop account compromise, autumn 2025), we pursued parallel registrar escalation and a UDRP filing simultaneously, recovering the domain in approximately eight weeks after the initial unauthorized transfer was confirmed by the registrar's compliance team. The approach was fact-specific; the registrar's acknowledgment of a policy breach created the evidentiary base the panel relied on.

Step 5: Assemble the evidence that decides the outcome

Whichever formal route you choose, the outcome turns on evidence. Panels and courts assess a defined set of items, and the gap between a strong submission and a weak one is almost always in the quality of the documentary record, not the legal argument.

Evidence that consistently moves the outcome in account-compromise and domain-theft disputes:

• Proof of original registration – the confirmation email from the initial registration, ideally with the registration date, the registrant details as they stood, and the payment receipt. This establishes your prior chain of title. For an analysis of how prior chain of title is assessed, see our guide to verifying chain of title in domain disputes.
• Proof of continuous use – hosting invoices, SSL certificate records, website archive captures, and analytics showing traffic to the .shop domain under your control. Continuous use defeats any claim that the domain was abandoned.
• Proof of the compromise mechanism – the account access log (Step 1), the registrar's response to your complaint, any phishing or social-engineering communication used to obtain credentials, and the ICANN Contractual Compliance filing (Step 3). The compromise mechanism is the factual core of the case.
• Current conduct of the apparent holder – if the domain now resolves to a site competing with your business, a pay-per-click parking page monetizing your brand, or a phishing page, each is evidence of bad faith under Paragraph 4(b) of the UDRP.
• Your trademark record – a registered trademark simplifies the first UDRP element. An unregistered mark can still satisfy the element, but requires additional evidence of acquired secondary meaning. State the registration number, jurisdiction, and classes – do not rely on the panel to search the registry.

The trap in Step 5: registrants frequently submit evidence that proves their identity but not the mechanism of the transfer. Knowing that you owned the domain is not the same as proving you did not authorize the transfer. The panel needs both halves: your prior right and the specific defect in the transfer process.

If a prior registrar complaint produced no result, a focused review of the evidence record can identify what is missing before a formal filing. To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

Step 6: File the complaint and manage the timeline

Once the evidence is assembled and the route is selected, filing is straightforward – but the mechanics carry traps of their own.

For a UDRP complaint at WIPO:

1. Complete the WIPO online filing form. The complaint must identify the domain, the registrar, the trademark basis, and each of the three elements with supporting evidence annexed.
2. Pay the filing fee (USD 1,500 for a single-member panel, one to five domains). The case does not formally commence until the fee is received and formal compliance is confirmed by WIPO.
3. Commencement triggers the respondent's 20-day response window. If the respondent defaults – common in account-compromise cases where the "respondent" is a fraudster with no legitimate defense – the panel decides on the complaint alone. Default does not mean automatic transfer; the elements still must be established.
4. Panel appointment follows. WIPO then issues a decision, typically completing the full proceeding in about two months. The registrar implements any transfer order within the mandatory waiting period.

For a URS filing, the process is broadly similar but is administered by a designated URS provider, the proceeding is faster, and the remedy, as noted above, is suspension rather than transfer.

A separate but overlapping matter: in cases of confirmed unauthorized transfer, ICANN's Transfer Dispute Resolution Policy (TDRP) allows the losing registrar to initiate a process that can reverse the transfer at the registrar level without a UDRP proceeding. We regularly advise registrants on whether the TDRP route is faster and more reliable than the UDRP for their specific facts – particularly where the gaining registrar is cooperative and the documentation of the unauthorized transfer is clean. See also our case analysis on reversing an unauthorized transfer for a worked example of how these facts interact in practice.

In a matter we handled in summer 2025, a .shop domain owner had lost access to both the domain and the associated email account after a credential-stuffing attack. We advised a three-track approach: ICANN Contractual Compliance, a TDRP filing by the losing registrar, and a parallel UDRP complaint. The TDRP track resolved the registration reversal in approximately six weeks; the UDRP, filed as insurance, was suspended once the transfer reversed. The decisive evidence was the account login log showing the unauthorized access IP address in a jurisdiction inconsistent with the client's operating history.

When a court route beats arbitration for .shop

Four situations make court action the better primary route, even for a domain governed by the UDRP:

You need damages. The UDRP cannot award money. If the unauthorized use of your .shop domain caused quantifiable business harm – diverted sales, compromised customer data, counterfeit-goods traffic – only a court can value and award those losses. The UDRP and the court route are not mutually exclusive, but the UDRP does not substitute for damages claims.

You need disclosure. A UDRP proceeding does not compel discovery. If the identity behind the compromised account is unknown – a fraudster using stolen credentials – a court order in the relevant jurisdiction can compel the registrar to disclose records. That identity, once established, may also support a criminal complaint.

The registrar itself is implicated. Where the account compromise was facilitated by a failure in the registrar's authentication process – for example, a social-engineering attack that succeeded because the registrar's verification procedure fell below its own published standard – the dispute is partly against the registrar. The UDRP does not name or adjudicate registrar conduct. A court can.

The UDRP decision would be unenforceable. Panel orders run through ICANN-accredited registrars. If the domain has been transferred to a registrar operating outside effective ICANN oversight, or where the registrar is unresponsive to ICANN compliance demands, enforcement may require a court order in the registrar's home jurisdiction. We work with local litigation counsel in the relevant jurisdiction to pursue that enforcement where necessary.

None of these situations makes the UDRP irrelevant. In many cases the correct strategy is to file the UDRP as a parallel track while court proceedings develop – the UDRP creates a documented evidentiary record, and a transfer order in hand simplifies the court's task.

Related at COGNOMEN

• Court recovery and domain theft services – when arbitration reaches its limit and litigation is the right call.
• Case study: reversing an unauthorized .biz transfer – the evidence, the strategy, and the outcome.
• Verifying chain of title in domain acquisitions – how prior dispute history and ownership records are assessed.

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.