Court Action & Domain Theft: a complete guide

Court Action & Domain Theft: how it works, what it costs, and the realistic outcomes. UDRP, ccTLD and court routes. Email the firm to assess your domain.

A domain name can be stolen from its rightful owner overnight. An account compromise, a fraudulent transfer request, a social-engineering attack on a registrar's support desk – and a domain that took years to build disappears from the WHOIS record before the owner notices. For brand owners and investors alike, domain theft recovery court action sits at the intersection of registrar mechanics, arbitration rules, and civil litigation. The route that works depends on the zone, the fact pattern, and whether the name has already moved to a new registrar or jurisdiction.

Court action and domain theft recovery encompasses every legal and procedural mechanism available to reclaim a stolen, hijacked, or abusively registered domain: registrar escalation, UDRP complaints before WIPO or the Forum, ccTLD-specific procedures such as the Nominet DRS or EURid ADR, URS suspension for new gTLDs, and civil litigation including US anticybersquatting court action. A standard UDRP proceeding typically concludes in about two months, with WIPO filing fees starting at USD 1,500. Court action takes longer and costs more but can reach monetary damages and address situations where arbitration cannot compel result.

This guide maps every sub-scenario – cybersquatting, domain theft, typosquatting, brand-name hijacking, and abusive registration – to the route most likely to succeed, explains the legal tests and timelines, and explains when and why court action is the right choice over arbitration.

What Does "Court Action & Domain Theft" Actually Cover?

The term covers two overlapping categories of dispute that share a common remedy goal – getting a domain back – but differ sharply in how they arise and which law applies. Panels, registrars, and courts treat them differently, and conflating the two is one of the most costly mistakes a brand owner can make at the outset.

The first category is cybersquatting and abusive registration: someone deliberately registers a domain that is confusingly similar to a mark they have no rights in, intending to profit by selling it, diverting traffic, or disrupting the mark owner's business. The registrant typically has lawful access to the registrar but unlawfully targets a third-party mark. The UDRP was designed precisely for this pattern.

The second category is domain theft or hijacking: the domain's legitimate owner is the victim of unauthorized account access, forged transfer authorizations, a registrar-side social-engineering attack, or a fraudulent WHOIS update. The domain leaves one registrar for another without the owner's consent. The Policy was not designed for this. Here the remedies are registrar escalation, ICANN-level complaint, and – where those fail – civil litigation. The legal theory is often conversion or unauthorized transfer rather than trademark infringement.

Real disputes often blend both: a domain is first stolen, then used for cybersquatting, and the identity of the current registrant may be concealed by privacy services. In our practice, we regularly encounter hybrid fact patterns that require sequencing the remedies – begin with registrar lock escalation to freeze movement, then pursue the UDRP or court action once the domain is stable.

A third category deserves separate mention: reverse domain name hijacking (RDNH). This is the abuse that runs in the other direction – a brand owner files a UDRP complaint not to address genuine cybersquatting but to deprive a legitimate registrant of a name the brand owner simply wants. RDNH findings carry no monetary penalty, but the reputational and procedural consequences are real. COGNOMEN handles both sides: we pursue legitimate complaints and defend legitimate registrants against overreaching ones.

The Legal Tests: What You Must Prove in Each Forum

Every forum that decides domain disputes applies a formal legal test. Knowing which test applies – and whether your facts can satisfy it – is the threshold question before any filing.

The UDRP Three-Element Test

Under Paragraph 4(a) of the UDRP, a complainant must establish all three elements: (1) the disputed domain is identical or confusingly similar to a trademark or service mark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain was registered and is being used in bad faith. The third element is cumulative – both registration in bad faith and use in bad faith must be shown. Panels apply a consensus view on each element, though minority positions exist on edge cases, particularly on the meaning of "use" under element three.

Paragraph 4(b) lists non-exhaustive circumstances that evidence bad faith. Paragraph 4(c) lists safe harbors for the registrant: a bona fide offering of goods or services before notice of the dispute, being commonly known by the domain name, and legitimate noncommercial or fair use. The UDRP's only remedies are transfer or cancellation – no damages, no injunction, no costs award.

The Nominet DRS "Abusive Registration" Test

For .uk domains, the Nominet DRS applies a different and in some respects lower threshold. The complainant must show rights in a name or mark and an "abusive registration." Critically, the DRS test reads "registered or used" abusively – a meaningful departure from the UDRP's conjunctive "registered and used." A domain registered innocently but subsequently weaponized can therefore fail the UDRP yet succeed under the DRS. The DRS also begins with a free mediation stage before any expert decision is issued.

The EURid/ADR.eu Procedure for .eu

The .eu dispute procedure is administered through the Czech Arbitration Court's ADR.eu platform. The complainant must demonstrate rights – which the rules construe broadly, not limited to registered trademarks – and establish that the registration is speculative or abusive. Eligibility is also a factor: .eu domains require an EU or EEA nexus, and a domain registered to an ineligible holder can be revoked on that ground alone, separate from any abuse argument.

The URS Suspension Standard for New gTLDs

The Uniform Rapid Suspension system applies to new gTLDs (such as .shop, .online, .app, and hundreds of others). The URS standard is higher than the UDRP – "clear and convincing evidence" – and the remedy is suspension for the registration term, not transfer. That makes it faster and cheaper but less powerful. Where transfer of ownership matters, the UDRP remains the route even for new gTLDs that are also accredited for URS.

Court Action: Anticybersquatting Litigation and Conversion Claims

Court proceedings follow substantive national law, not the UDRP. In the United States, US anticybersquatting litigation allows a mark owner to sue for statutory damages, injunctive relief, and transfer of the domain. It is the only route that reaches money. Other jurisdictions have analogous frameworks under their national trademark or civil codes; COGNOMEN coordinates with local litigation counsel in the relevant jurisdiction for proceedings outside the US. Court action also addresses theft claims – conversion, unauthorized transfer, breach of contract with the registrar – where the UDRP and ccTLD procedures simply have no jurisdiction.

For a read on whether the three UDRP elements are met for your specific domain, reach us at info@cognomenlaw.com.

Mapping the Scenarios: Which Route Fits Which Fact Pattern?

Choosing the right route is not a preference – it is a legal requirement. The UDRP has no jurisdiction over a domain theft that does not involve trademark infringement. A court has no jurisdiction over a Nominet-registered .uk name in the same way a DRS panel does. Getting the mapping right at the outset saves months and thousands of dollars.

The following analysis addresses the most common scenarios we encounter across gTLDs and ccTLDs worldwide.

Scenario A: Cybersquatting on a gTLD (.com, .net, .org, and accredited new gTLDs)

If the domain is a .com, .net, .org, or any ICANN-accredited gTLD, and the registrant registered it to target your mark, the UDRP is the standard first option. It is faster than court, cheaper than court, and its track record over more than 25 years means evidentiary standards are well-established. WIPO and the Forum together handle roughly 97% of all UDRP proceedings. WIPO's filing fee for a single domain, single-member panel, is USD 1,500; the Forum's entry-level fee begins around USD 1,300.

Select WIPO if your complainant is a large brand with strong international recognition or if nuanced legal analysis is likely to matter – WIPO panelists are drawn from a deep and experienced pool. Select the Forum if cost is a priority in a straightforward case and the US-based registry mechanics are uncomplicated. The Czech Arbitration Court (CAC) offers the lowest entry-level fees – approximately USD 500–800 – and is appropriate for budget-constrained single-domain cases with clear-cut facts.

One complication arises when the registrant requests a three-member panel after the complainant filed for a single member. In that case, the parties generally split the higher three-member WIPO fee of USD 4,000. The complainant pays the difference between what they already paid and half the three-member fee.

Scenario B: Cybersquatting on a .uk Domain

A .uk or .co.uk dispute goes to Nominet's DRS. The process is distinct from the UDRP and in some ways more accessible. Nominet offers a free mediation stage first. If the registrant defaults or mediation fails, the complainant pays an expert fee: GBP 750 plus VAT for a full expert decision, or GBP 200 plus VAT for a summary decision in an undefended case. A reasoned case runs approximately 8 to 12 weeks. An appeal to a three-expert panel costs GBP 3,000 plus VAT.

The "registered or used" abusively standard often gives UK brand owners a stronger footing than the UDRP would in borderline timing cases – particularly where a domain was originally registered before a mark became distinctive but has since been turned into a traffic-diversion vehicle.

Scenario C: Cybersquatting on a .eu Domain

For .eu domains, the ADR.eu procedure is the governing route. Eligibility matters here more than in any other procedure: the registrant's EU or EEA nexus is a substantive requirement, and a domain held by an ineligible party can be revoked independently of any abuse finding. Where the complainant itself has an EU/EEA connection, a transfer is available. Where revocation is the only remedy, the domain may return to the pool rather than to the complainant – a distinction that matters for recovery strategy.

Scenario D: Domain Theft – Account Compromise or Fraudulent Transfer

If the domain was taken without the owner's authorization – through a stolen registrar account, a social-engineering call to the registrar's support desk, or a forged transfer authorization code – the UDRP is the wrong instrument. The UDRP presupposes that the registrant registered the domain: it was designed to address abusive registrations, not theft from an existing registrant. A stolen domain therefore requires a different sequencing.

The first step is registrar escalation: an urgent request to the gaining registrar to place a hold on the domain, citing unauthorized transfer. If the gaining registrar is ICANN-accredited, there are post-transfer dispute resolution rights that can be invoked within a defined window. Parallel escalation to the losing registrar and to ICANN's Contractual Compliance division is often necessary. If those channels stall, court action – seeking an emergency injunction or a temporary restraining order against the gaining registrant – may be the only way to prevent the domain from being resold or monetized while recovery proceedings continue.

In a recent matter (a .com hijacking, spring 2025), we escalated a registrar lock request within 24 hours of the unauthorized transfer being detected, coordinated with ICANN Contractual Compliance, and secured a hold on the domain before it was relisted for sale. The owner had the domain back within a matter of weeks without needing to file a UDRP complaint.

See our detailed guidance on registrar lock escalation for the step-by-step process and the critical time windows involved.

Scenario E: The Domain Has Left the Jurisdiction – Cross-Border Theft

A domain that was stolen and then transferred to a registrar in a different jurisdiction presents the hardest recovery problem. ICANN's contractual framework reaches all accredited registrars regardless of location, but enforcement of that framework depends on Contractual Compliance proceedings and, ultimately, on registrars cooperating. Where the gaining registrar is in a jurisdiction with weak enforcement, civil litigation in the US (where ICANN is incorporated) or in the registrant's home jurisdiction may be the only viable path. This is the scenario where coordination with local litigation counsel in the relevant jurisdiction becomes essential.

Scenario F: A Court Has Already Issued an Order – Enforcement Against a Registrar

A UDRP decision or a court order directing transfer does not implement itself. The registrar must act on it, and the mechanics for compelling that action vary by registrar and jurisdiction. Where a registrar delays or disputes the order, enforcement proceedings – a separate court action or ICANN escalation – may be necessary. Our spoke page on enforcing a UDRP decision addresses the mechanics of registrar compliance and what to do when a transfer order is not implemented within the standard window.

To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

Process and Timeline: End to End

The timeline of a domain dispute is one of the factors that most affects strategy, especially when a stolen or squatted domain is generating revenue or damaging the brand in real time.

UDRP End-to-End Timeline

A UDRP complaint follows five stages: complaint filing and administrative review, commencement and the response window, panel appointment, the decision, and registrar implementation. The respondent has 20 days to file a response after commencement. A standard single-panel case typically resolves in about two months absent procedural complications. WIPO offers an expedited option delivering a decision within about one month for single-panel cases involving up to five domains.

Extensions are possible but discouraged. A respondent request for a three-member panel adds time. A supplemental filing by either party requires panel permission. Settlement or withdrawal at any stage halts the clock. WIPO offers a partial refund of approximately USD 1,000 of the USD 1,500 filing fee if a case is withdrawn before panel appointment.

Nominet DRS Timeline

The Nominet DRS operates on a roughly 8-to-12-week cycle for a fully contested case. The mediation phase is automatic where a response is filed. If mediation fails or the registrant defaults, the expert issues a decision. An appeal must be initiated within 10 working days of the original decision, and the three-expert panel rarely admits new evidence.

Court Action Timeline

Civil litigation moves more slowly. A US anticybersquatting case through the federal courts will typically take a year or more to conclude, though emergency relief – a temporary restraining order or a preliminary injunction – can be obtained in days or weeks where the facts support urgency. In other jurisdictions timelines vary widely; describe any specific jurisdiction-level expectation as "verify with local litigation counsel." The trade-off is capability: court can award damages, can reach defendants who ignore arbitration, and can address theft claims outside the UDRP's scope.

Evidence and What Decides the Outcome

Panel decisions and court outcomes turn on facts, not legal theories alone. Presenting the evidence correctly – in the right sequence, in the right format, at the right stage – is where most cases are won or lost.

What the Complainant Needs

The trademark rights element is usually the easiest to establish if the complainant has a registered mark predating the domain registration. The hard elements are typically the second and third: showing the registrant has no legitimate interest and proving bad faith at the time of registration. What decides close cases?

• The date of the complainant's trademark registration relative to the domain registration date – a mark registered after the domain was registered creates a real obstacle on element one.
• Evidence that the registrant was aware of the complainant's mark at the time of registration – prior correspondence, domain-for-sale listings citing the mark, MX records pointing to the complainant's industry.
• Evidence of bad-faith use: pay-per-click advertising competing with the complainant, phishing pages mimicking the complainant's site, or ransom-style sale offers sent to the mark owner.
• A pattern of similar registrations by the same registrant targeting other brands.
• WHOIS/RDDS history showing identity concealment following a dispute-notice letter.

What the Respondent Needs

Respondents prevail by establishing a Paragraph 4(c) safe harbor or by demonstrating that the complainant cannot satisfy all three UDRP elements. The most powerful defenses are:

• Documented use of the domain in a bona fide commercial offering before any notice of the dispute.
• Evidence that the registrant is commonly known by the domain name – a natural person, a business, or a geographic term with genuine meaning separate from the complainant's mark.
• A prior registration date that predates the complainant's trademark rights.
• Correspondence showing the complainant's demand was the first notice – and that the registrant's use began before that notice.

Where the complaint is abusive – filed against a registrant with a clear legitimate interest and no targeting of the mark – a respondent should affirmatively seek an RDNH finding. Panels award RDNH findings where it is clear the complaint was brought to deprive a legitimate registrant, not to address genuine abuse. The finding is reputational, but it carries weight in the domain community and can deter repeat use of the UDRP as a pressure instrument.

In a recent matter (a .net domain, winter 2025–2026), we defended a registrant against a complaint filed by a brand that had been incorporated after the domain was originally registered, with no evidence of targeting. The panel denied the transfer and issued an RDNH finding on the grounds that the complainant could not have met the bad-faith registration element on the undisputed timeline.

Theft Cases: The Evidence Stack

For a stolen domain, the evidence package is different. The core of the case is chain-of-title documentation: historical WHOIS/RDDS records, registrar account access logs, email headers establishing when a forged transfer confirmation was sent, and any correspondence with the registrar's support desk. Courts and registrars both require this, and assembling it quickly – often in the first 48 to 72 hours – is critical before the digital trail cools.

Cost Structure: Forum Fees vs. Legal Fees

Cost transparency is a principle at COGNOMEN. The market for domain dispute services is characterized by hidden fees and vague scopes; our approach is to separate the official forum filing fee from the legal fee and to provide ranges at the outset.

Official Filing Fees (Forum Costs)

These fees go to the forum, not to counsel, and they vary by forum, panel size, and domain count.

Forum	Domains	Single Panel	Three-Member Panel
WIPO	1–5	USD 1,500	USD 4,000
WIPO	6–10	USD 2,000	USD 5,000
The Forum	1–2	~USD 1,300	Higher
CAC	1 domain	~USD 500–800	Higher
ADNDRC	1–2	~USD 1,300	Higher
Nominet DRS	1 (.uk)	GBP 750 + VAT (full)	GBP 3,000 + VAT (appeal)

Over 10 domains at WIPO: pricing is by quote. For a WIPO single-panel case, a partial refund of approximately USD 1,000 is available if the case is withdrawn before panel appointment.

Legal Fees

Legal fees depend on complexity, not just on forum choice. For a straightforward UDRP complaint involving a single domain with a clean trademark registration and clear bad-faith evidence, market rates for competent counsel commonly fall in the USD 3,000–7,000 range, separate from the filing fee. Respondent defense runs in a comparable range, though fact-intensive defenses with large evidence records will sit toward the higher end. Court anticybersquatting litigation involves substantially higher fees and is typically billed hourly; describe that route qualitatively without a ceiling unless the matter is assessed in detail.

COGNOMEN publishes its approach to fees transparently, in a market where that is not the norm. We discuss scope, range, and structure at the outset of every engagement.

Cross-Border and Multi-Zone Considerations

A brand dispute rarely lives in one zone. A registrant who squats on a .com often also holds the .net, .org, and a national ccTLD variant. A domain thief may move the stolen name across registrars and across jurisdictions within 48 hours. Multi-zone strategy requires sequencing remedies so that each filing complements the others without triggering procedural complications in a parallel proceeding.

The gTLD-vs.-ccTLD Decision

If the same registrant holds the .com and the .co.uk, two different procedures apply. The UDRP at WIPO handles the .com; the Nominet DRS handles the .co.uk. They can be filed contemporaneously, and evidence assembled for one is largely usable in the other. The key difference: the Nominet DRS "registered or used" standard may allow recovery of the .co.uk even where the UDRP claim on the .com fails on the bad-faith-at-registration element.

If the registrant also holds a .de domain, neither the UDRP nor the Nominet DRS applies. Germany's .de disputes generally proceed through the German courts, with a DENIC DISPUTE entry available to block the domain from transferring while litigation proceeds. COGNOMEN works with local litigation counsel in Germany for court proceedings; we handle the strategic coordination and the parallel UDRP and DRS filings directly.

New gTLDs: URS or UDRP?

Where the domain is a new gTLD and the goal is to stop active consumer harm immediately – a phishing site on .bank or a counterfeit storefront on .store – URS suspension is faster and cheaper. But it does not transfer ownership; the domain returns to the registrant at the end of the registration period unless the UDRP is filed as a follow-on. For most brand-recovery situations, the UDRP is the right choice even for new gTLDs, because transfer is the durable solution.

When Court Is the Only Option

Court action is not a last resort – it is sometimes the first and only option. Four fact patterns specifically require it:

1. Domain theft where the UDRP has no jurisdiction because there is no cybersquatting involved, only unauthorized transfer.
2. A respondent who defaults on a UDRP but the registrar resists or delays implementing the transfer order – enforcement in court may be necessary.
3. A dispute requiring monetary damages – only a court can award those.
4. A dispute involving a ccTLD with no UDRP-equivalent procedure and no administrative mechanism for transfer (for example, .de where DENIC does not itself adjudicate ownership).

Our spoke page on registrar lock escalation covers the specific mechanics for securing a hold in cross-border registrar transfers, including the time windows that determine whether an emergency lock request can succeed.

The Respondent's Perspective: Defending Against an Overreaching Complaint

Not every domain dispute is brought in good faith. Brand owners, competitors, and speculative complainants sometimes use the UDRP – or a national procedure – to attempt to recover a domain they have no legitimate claim to. The asymmetry of the process (the complainant drafts the complaint; the respondent must respond in 20 days) can intimidate registrants into abandoning legitimate rights.

What does a strong respondent defense look like? It depends on the safe harbor. The most defensible position is documented bona fide use of the domain before notice of the dispute: a website with real content, commercial transactions, indexed pages with early timestamps, third-party references to the domain. The second-strongest is prior rights in the name – a personal name, a company name, a geographic term – with documentation predating the complainant's mark.

Where the complaint is plainly abusive – filed against a domain predating the complainant's mark with no conceivable targeting – we actively pursue an RDNH finding. That requires affirmative argument in the response. Panels do not award RDNH findings automatically even where the complaint fails; the respondent must make the case that the complaint was brought with constructive knowledge of its failure and in bad faith to deprive a legitimate holder.

COGNOMEN is genuinely bilateral. We act for brand owners pursuing legitimate cybersquatting claims and for registrants defending legitimate holdings. That dual practice keeps our understanding of both sides current and prevents the tunnel vision that affects counsel who only see one side of the dispute.

Portfolio and Repeat-Infringement Scenarios

A single UDRP complaint can cover multiple domains if the same registrant holds all of them. That provision is frequently used where a serial cybersquatter has registered a portfolio of typosquats across multiple TLD variants of the same mark. WIPO's fee structure for 6–10 domains (USD 2,000 for a single panel; USD 5,000 for three members) makes the multi-domain complaint substantially more economical per-domain than filing separately.

For brand owners managing ongoing registration monitoring, the question is not only how to recover a stolen or squatted domain but how to prevent the cycle from repeating. Pre-registration trademark clearinghouses for new gTLDs, domain portfolio monitoring, and defensive registrations across critical TLD variants all play a role. COGNOMEN's portfolio monitoring and brand-protection work operates alongside the disputes practice so that filing decisions are informed by the full picture of what the registrant holds and what the brand's exposure is.

What about a pattern of registrations by the same bad actor across different brand owners? Paragraph 4(b)(ii) identifies a pattern of abusive registrations as a bad-faith factor. Evidence that the same registrant has been the subject of prior adverse UDRP decisions – whether against the current complainant or against other mark owners – is admissible and can be decisive in moving a close case across the threshold.

The COGNOMEN Process: From First Contact to Final Transfer

COGNOMEN handles domain disputes exclusively. We do not practice general IP, general litigation, or general corporate law. Every matter that comes in goes to a specialist who works with this fact pattern every week, not every quarter.

When a new matter opens, our process is:

1. Initial assessment: We review the domain, the zone, the registrant's identity (from WHOIS/RDDS and historical records), and the complainant's trademark position. We identify which route applies and whether the elements are likely met.
2. Route and forum selection: We advise on UDRP vs. ccTLD procedure vs. court – not as a default toward the most expensive option but as a strategic match to the facts. If the case is a clear UDRP with clean bad-faith evidence, we say so and give a fee range. If court is necessary, we say that too.
3. Evidence assembly: We work with the client to build the evidence record – trademark registrations, WHOIS history, screenshot captures, correspondence, and any prior dispute history relevant to the registrant. For theft matters, this means acting fast to preserve access logs, account records, and transfer confirmation emails before they are overwritten.
4. Filing and prosecution: We draft the complaint (or response), select the forum, pay the filing fee on the client's behalf, and manage all correspondence with the panel and the forum administrator.
5. Post-decision enforcement: When a transfer order issues, we monitor the registrar's implementation and escalate if the registrar does not act within the standard window. Where a UDRP decision needs to be enforced in court, we handle that or coordinate with local litigation counsel.

For transactional matters – a client who wants to acquire a domain that is legitimately held, rather than reclaim a squatted one – we run pre-acquisition due diligence on chain of title and prior dispute history, and structure escrow to protect both parties in the transfer.

Across all dispute types, we are transparent about the realistic outcomes. Domain disputes turn on facts and panel or court discretion. We do not promise transfers or wins. We assess the three UDRP elements, build the bad-faith evidence, select the forum, and file the complaint on the strongest possible record.

Related at COGNOMEN

• Registrar lock escalation: the step-by-step guide for stolen domains
• Enforcing a UDRP decision when a registrar resists transfer
• Registrar lock escalation in cross-border Swiss-registry transfer scenarios