How to recover a hijacked .app domain after account compromise
Your .app domain is gone. Someone has accessed the registrar account, changed the registrant details, and – in the worst cases – already pushed the domain to a new registrar. Every hour that passes cements the transfer and misdirects your users, your application traffic, and your revenue. The question is not whether to act. The question is which route to trigger first, and how fast each one moves.
To recover a hijacked .app domain after account compromise, you typically pursue three concurrent tracks: an emergency registrar escalation to freeze the current registration, a UDRP complaint before WIPO (because .app domains are gTLDs governed by ICANN and subject to the full Uniform Domain-Name Dispute-Resolution Policy), and – where the transfer chain or the damages warrant it – court action for cybersquatting or unauthorized transfer. A standard WIPO case runs about two months; the single-member filing fee is USD 1,500. Speed and evidence govern everything.
This page covers the registrar mechanics, the UDRP route for .app, the court option when arbitration is insufficient, the evidence you must gather now, the realistic cost structure, and how to sequence the steps so nothing is waived.
Why .app is a gTLD – and what that means for recovery
.app is a generic top-level domain operated under ICANN's registry system, which means all three UDRP elements of Paragraph 4(a) apply if you ultimately proceed to arbitration. It does not operate under any national ccTLD procedure. Every .app registrar is ICANN-accredited and bound by the Registrar Accreditation Agreement – a point that matters enormously in the first 24 to 48 hours, because the RAA imposes a registrar-lock obligation on unauthorized transfer complaints.
In our practice, brand owners and developers sometimes assume that because .app was launched as a specialty gTLD (originally for applications), it carries a different dispute mechanism. It does not. The same UDRP Paragraph 4(a) test that governs .com governs .app. The same WIPO and Forum filing procedures apply. The same 20-day response window runs once the case commences. Understanding that .app is a standard gTLD – not an operator-specific or country-code zone – is the first step in building the right recovery plan.
There is, however, one practical difference from a legacy gTLD like .com: .app requires HTTPS across the entire domain, enforced at the registry level. This means a hijacker who points the domain anywhere must present a valid certificate. That creates a forensic trail – certificate issuance logs are publicly queryable – that can help establish when unauthorized use began.
How does the registrar-lock and transfer-reversal process work?
Registrar escalation is the fastest first move after an account compromise. The goal is a registrar lock – a status flag that blocks any further transfer, deletion, or WHOIS update – before the domain moves to a second registrar or a second registrant. Once a domain is pushed out, every step becomes harder.
Practically, this means filing an emergency abuse report with the losing registrar, supported by evidence of the compromise: account access logs, multi-factor authentication bypass records, fraudulent WHOIS update timestamps, and any communication from the attacker. ICANN's transfer dispute resolution policy gives registrars a defined procedure for responding to claims of unauthorized transfer. Registrars are required to cooperate. But they will not act on an unsubstantiated report. The strength and speed of your documented evidence package determine whether you get a lock within hours or days.
If the domain has already transferred to a new registrar – a gaining registrar – the process escalates. You file with both the losing and the gaining registrar, you send an ICANN complaint through the official channel, and you document the full transfer chain. In a recent matter (a .app domain hijacked through a SIM-swap attack, spring 2025), we secured a registrar-initiated lock within 72 hours by presenting a complete evidence package to both registrars simultaneously and invoking the RAA obligations expressly. The domain was returned before any UDRP filing was necessary. That outcome is not guaranteed in every case, but speed and documentation are the variables that make it possible.
If your .app domain has been hijacked or your registrar account has been compromised, every hour matters. Contact info@cognomenlaw.com for an assessment of your recovery options.
What does the UDRP process cover for a .app hijack?
When registrar escalation does not resolve the matter – or when the domain is already in the hands of a third party who is making use of it – a UDRP complaint before WIPO or the Forum is the primary arbitral route. To prevail, you must satisfy all three elements of Paragraph 4(a): the domain is identical or confusingly similar to a trademark you hold; the registrant has no rights or legitimate interests; and the domain was registered and is being used in bad faith.
In a hijack scenario, element three presents a specific argument: the original registration was yours and was in good faith; the bad-faith registration is the unauthorized transfer itself, executed by someone with no rights. Panels have consistently held that a fraudulent account takeover and unauthorized transfer constitutes registration in bad faith – the bad-faith actor is the hijacker, not the original registrant-turned-complainant. Element two is typically straightforward when you can document original ownership. Element one requires a trademark or, in some panels' readings, a strong secondary-meaning argument tied to the domain itself.
Do you have a registered trademark in the brand corresponding to your .app domain? If yes, the UDRP complaint is the cleanest path. If no, the analysis is more textured. Panels will weigh evidence of prior use, business investment, and the domain's original purpose. We regularly advise clients in this exact position – developers and app companies who built products around a .app name without formal trademark registration – and the viability of a UDRP complaint turns entirely on the facts assembled before filing.
The WIPO filing fee for a single-member panel covering one domain is USD 1,500. A three-member panel costs USD 4,000. The case normally resolves in about two months from filing. If WIPO's expedited option is available and you file a single-panel case covering five or fewer domains, a decision can arrive in approximately one month. These timelines assume no supplemental filings or unusual procedural detours.
When does a court route beat arbitration for .app domain recovery?
The UDRP's remedies are narrow: transfer or cancellation. No monetary damages, no injunction, no costs award. For many .app hijacks that is enough. For others it is not – and court action becomes the right tool.
Consider the following situations. If the hijacker has profited from the misdirected domain – running competing services, harvesting user credentials through a phishing replica, or collecting affiliate revenue – no UDRP award compensates that harm. US anticybersquatting litigation, handled with local litigation counsel in the relevant jurisdiction, allows a damages claim alongside a transfer order. If the hijacker is beyond the reach of ICANN-accredited registrars (an unlikely but not impossible scenario), a court order directed at the registry or the domain itself may be the only enforceable mechanism. And if the account compromise involved a broader fraud – stolen payment credentials, identity fraud, corporate impersonation – the criminal referral and civil litigation tracks run together, each reinforcing the other.
The choice between UDRP and court is not either/or. They can run concurrently, or a court action can be filed after a UDRP complaint is decided, if the arbitral remedy falls short. What matters is that you do not accidentally waive the court route by delay; applicable statutes of limitations in the relevant jurisdiction govern the window for filing. We identify that window early in the engagement so nothing closes before you decide.
In a recent cross-track matter (a .app developer services brand, late 2024), registrar escalation recovered the domain in the gTLD zone, but the hijacker had also registered a corresponding ccTLD. The UDRP handled the .app; local litigation counsel handled the ccTLD under the governing national procedure. Splitting the tracks by zone and remedy type produced the fastest full resolution across both registrations.
To weigh UDRP against a court action for your .app recovery, email info@cognomenlaw.com with the domain name and a brief description of the compromise.
What evidence of compromise actually decides the outcome?
Evidence is the hinge point of every .app hijack recovery. Panels and registrars do not act on assertion; they act on documented proof. The evidence package you assemble in the first hours after discovering the compromise determines whether the registrar issues a lock, whether the UDRP panel finds bad faith, and whether a court accepts the unauthorized-transfer argument.
The core evidence categories are these. First, account access logs – exported from the registrar's portal or requested from the registrar as part of the abuse complaint – showing the time, IP address, and device fingerprint of the unauthorized login. Second, WHOIS or RDDS historical records showing the registrant details before and after the unauthorized change; snapshots from public RDDS query tools are acceptable if timestamped. Third, multi-factor authentication records, if the attacker bypassed MFA: phone carrier records (for SIM-swap attacks), email access logs, or authenticator app session history. Fourth, certificate transparency logs – publicly queryable through services that index the Certificate Transparency framework – showing when a new TLS certificate was issued for the hijacked domain and by whom. Fifth, any direct communication from the attacker: ransom messages, sale offers, or extortion demands. These are often the clearest evidence of bad faith under Paragraph 4(b) of the UDRP.
Beyond that primary layer, supporting materials strengthen every track: original domain registration confirmation emails, invoices from the original registrar, DNS configuration records pre-compromise showing your authorized use, and any trademark registration or use documentation. We help clients build this package systematically, because a disorganized or incomplete evidence submission is the most common reason a recoverable hijack does not resolve at the registrar level and must escalate to UDRP or court at greater cost and delay.
What is the cost structure for recovering a hijacked .app domain?
Cost breaks into two distinct categories: official forum filing fees and legal fees. They are separate, and conflating them leads to budget surprises.
On the forum side: if the matter proceeds to WIPO, the filing fee for a single .app domain, single-member panel, is USD 1,500. A three-member panel costs USD 4,000. If the complainant requested a single panel but the respondent (the hijacker or new registrant) requests a three-member panel, the parties typically split the higher fee. If the case settles or is withdrawn before panel appointment, WIPO commonly refunds approximately USD 1,000 of the USD 1,500 fee. The Forum's filing fee begins around USD 1,300 for one or two domains. These are the only arbitral fees – there is no additional charge from WIPO or the Forum for a decision.
On the legal side: a UDRP complaint for a single domain, in a straightforward case, typically falls in the USD 3,000 to USD 7,000 range for professional fees, separate from the filing fee. A hijack case is rarely straightforward in the early registrar-escalation phase; the evidence assembly and simultaneous registrar communications add scope. Court action is substantially more expensive and billed at hourly rates; describe that track as a strategic reserve, not a first resort, unless the damages picture justifies it from the outset.
Registrar escalation itself carries no official filing fee. That phase costs only the legal time to draft and deliver the abuse complaint – often the most cost-effective step of the entire recovery, and the one most often skipped or done poorly without counsel.
How does .app recovery compare to .io, .cloud, and other developer-zone gTLDs?
The right route depends on the zone and the governing procedure. .app, .io, .cloud, .dev, and .ai are all gTLDs – each carries the full UDRP and the full registrar-lock mechanism. If the domain is a .app and you want it transferred to you, WIPO or the Forum is the arbitral path, at the fees stated above. If it is a new gTLD and you only need suspension pending litigation, URS – the Uniform Rapid Suspension procedure – can act faster but delivers only a suspension, not a transfer, and the evidentiary standard is higher: clear and convincing evidence, rather than the balance-of-probabilities approach most UDRP panels apply.
If the domain is a .de – a country-code zone – neither the UDRP nor URS applies. Disputes there generally proceed through the German courts, with a DENIC DISPUTE entry to block transfer while you litigate. A .uk domain falls under the Nominet DRS, which uses a different test ("abusive registration", registered or used abusively, not the cumulative "registered and used in bad faith" of the UDRP) and includes a free mediation stage before an expert decision. An ICANN-registered .app sits entirely outside those national procedures.
The practical consequence: if you hold a .app and a corresponding .uk or .de, you run parallel but legally distinct recovery tracks. COGNOMEN manages the UDRP and registrar escalation for the gTLD zones; for the ccTLD zones, we work alongside local litigation counsel in the relevant jurisdiction. We have handled exactly that scenario – a .app and a country-code domain compromised in the same attack – and the sequencing of the two tracks matters: moving the gTLD recovery first typically produces a faster result and a stronger factual record that supports the ccTLD proceeding.
Related at COGNOMEN
Frequently asked questions
How do I start to recover a hijacked .app domain after account compromise?
Begin immediately with an emergency abuse report to your current (or last known) registrar, attaching account access logs, WHOIS change records, and any attacker communication. Simultaneously, request a registrar lock to freeze further transfers. If the registrar escalation does not resolve within 24 to 48 hours, or if the domain has already moved, the parallel tracks are a UDRP complaint at WIPO or the Forum and – where damages or cross-border complexity warrant it – a court filing. The registrar escalation costs no official fee; the WIPO single-panel filing fee is USD 1,500 for one domain.
What are the realistic outcomes when you recover a hijacked .app domain after account compromise?
Outcomes depend on the speed of escalation, the completeness of the evidence package, and the conduct of the hijacker. At the registrar level: a lock and voluntary return, sometimes within days. At UDRP: a panel order of transfer or cancellation, typically within two months of filing. At court: a transfer order plus potential damages, but on a longer timeline and at higher cost. No specific result can be promised – panels and registrars decide on the facts of each case – but a well-documented hijack with clear account-compromise evidence gives the recovery argument strong factual footing across all three tracks.
How do fees split if the case escalates?
Registrar escalation carries no official forum fee. If the matter proceeds to WIPO with a single-member panel, the complainant pays USD 1,500; if the respondent requests a three-member panel, the parties typically split the higher USD 4,000 fee. Legal fees for a UDRP complaint in a single-domain case commonly fall in the USD 3,000 to USD 7,000 range, separate from the filing fee. Court action is substantially more expensive; it is treated as a strategic reserve unless the damages picture justifies it from the outset. COGNOMEN provides a clear cost breakdown before any filing.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.