Assess my case

How to recover a hijacked .com domain after account compromise

By Adrian Harland, Court anticybersquatting & domain-theft recovery ·

You open your registrar dashboard and the domain is gone. The WHOIS record shows a stranger's contact details. Your site is redirecting customers to a phishing page or a competitor's offer. Account compromise – credential theft, SIM swapping, social-engineering of registrar support – is the fastest route a bad actor can use to strip a registered .com from its rightful owner, and the clock starts the moment the transfer clears.

To recover a hijacked .com domain after account compromise, the owner must act on two parallel tracks: immediate registrar escalation to freeze the outgoing transfer, and a formal legal proceeding – either a UDRP complaint before WIPO or a US anticybersquatting court action – to compel the return of the domain. The right route turns on how the theft was executed, where the domain now sits, and how quickly the unauthorized transfer was detected. Speed and documented evidence of the compromise are the two factors that decide whether recovery is possible at all.

This page covers the registrar mechanics, the legal test under the UDRP, when a court action outperforms arbitration, the evidence that panels and courts require, and the realistic cost and timeline for each path.

What is domain hijacking and why does account compromise matter for .com?

Domain hijacking is the unauthorized transfer of a registered domain from its lawful registrant to a third party – without the registrant's consent and typically by exploiting the registrar's authentication layer. For .com domains specifically, the transfer process runs through an ICANN-accredited registrar under a five-day lock window. That window is the first and often only opportunity to reverse the transfer before it becomes permanent.

Account compromise means the attacker did not need to defeat the legal title to the domain. They defeated the password, the two-factor authentication, or the registrar's identity-verification procedure. Panels and courts treat that distinction as critical. A UDRP complaint asks whether the registrant registered and used the domain in bad faith. A hijacking dispute asks something different: whether the current holder obtained the domain by means that are fraudulent as against the original owner, making the current registration a nullity or a conversion at law.

That structural difference explains why the UDRP, though available and often useful, is not always the primary tool for hijacking cases. The UDRP was designed for cybersquatters, not for thieves. When the fact pattern is pure theft, a court action may reach further and faster.

What are the first steps to recover a hijacked .com domain after account compromise?

The first 24 to 72 hours are decisive. The registrar's transfer-reversal process, where it exists, is available only during the post-transfer period specified in ICANN's transfer policy – and that window closes. These are the steps we work through with clients from the moment they contact us.

  1. Secure all accounts immediately. Change passwords for the registrar account, the associated email account, and any linked billing methods. If the attacker still has access, any recovery action can be undone in minutes.
  2. Document the compromise. Screenshot the current WHOIS/RDDS record. Download or print the registrar's account activity log showing the unauthorized transfer request, any IP addresses logged, and any email change or authentication bypass. This log is evidence. Do not wait for the registrar to preserve it.
  3. File an urgent registrar complaint. Most ICANN-accredited registrars have a domain theft or unauthorized-transfer report process. File it now, with the account log and any phishing emails or credential-theft evidence attached. Ask the registrar to place a registrar lock on the domain pending investigation.
  4. Contact the gaining registrar. If the domain has moved to a different registrar, contact that registrar's abuse desk. Under ICANN's transfer policy, a registrar that received a domain in an unauthorized transfer has obligations to cooperate in reversal.
  5. Preserve chain-of-title evidence. Gather the original domain registration confirmation, all renewal invoices, trademark registrations or prior WHOIS records showing your name, and any business or contractual records tying you to the domain. A panel or court will require proof that you were the registrant before the hijacking.
  6. Engage legal counsel. The registrar process and the formal legal proceeding run in parallel. Waiting for the registrar to resolve the issue before filing a legal action costs weeks you do not have.

If a .com was taken from your account without your consent, every hour the domain sits with a stranger increases the harm. For an assessment of your domain dispute, contact info@cognomenlaw.com.

Does the UDRP apply to a stolen .com, and what must you prove?

The UDRP applies to all gTLD domains including .com, and panels have accepted hijacking disputes under the Policy – but the fit is imperfect. The three elements of Paragraph 4(a) still govern: (1) the domain is identical or confusingly similar to a trademark in which the complainant has rights; (2) the respondent has no rights or legitimate interests in the domain; and (3) the domain was registered and is being used in bad faith.

In a hijacking case, elements two and three are usually straightforward. A thief has no rights or legitimate interests in a domain stolen through account compromise. Registration obtained by fraud is bad faith by definition. Element one is where brand owners hold an advantage: if the .com corresponds to a registered trademark, the confusing similarity test is almost automatically satisfied. If the domain predates any trademark and was registered purely as a commercial asset, the complainant must show some other mark right – a common-law mark, a registered trade name, or equivalent rights recognized in the applicable jurisdiction.

Panels have also addressed a procedural wrinkle specific to hijacking: some panels hold that the relevant date for the "registered in bad faith" analysis is the date of the unauthorized transfer, not the original registration date. That interpretation helps complainants in hijacking cases, because the fraudulent actor plainly registered the domain in bad faith on the transfer date. Not all panels agree, but the majority view treats an unauthorized transfer as a new "registration" for UDRP purposes.

The forum of choice for a .com UDRP is typically WIPO, where the USD 1,500 filing fee covers a single-member panel for up to five domains, and a standard case resolves in about two months. The Forum is an alternative at comparable entry-level fees. WIPO also offers an expedited procedure delivering a decision within roughly one month for single-panel cases of up to five domains – relevant when the hijacked domain is actively generating harm.

In a recent matter involving a .com hijacking (spring 2025), we assembled the account-compromise log, the prior WHOIS chain, and the trademark certificate, filed a UDRP complaint at WIPO, and secured a transfer order before the attacker had time to move the domain a second time to a privacy-shielded registrar. The expedited track made the difference.

To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

When does a court action outperform UDRP for recovering a stolen .com?

A US court action for anticybersquatting – the statutory route available in the United States for abusive domain registrations – can reach outcomes that the UDRP cannot. The UDRP's only remedies are transfer or cancellation. A court can award monetary damages, issue an injunction, and compel third parties (including registrars and DNS operators) to act. When the hijacking has caused quantifiable business harm, or when the domain has already moved through multiple gaining registrars in a deliberate chain to defeat recovery, a court route may be the only effective path.

Three scenarios where we advise clients to consider or prioritize court action over UDRP for a hijacked .com:

The trade-off is cost and time. Court proceedings are substantially more expensive than UDRP and take months rather than weeks. In our practice, we regularly advise clients to file the UDRP immediately for the interim suspension or transfer, while preserving the option to escalate to court if the arbitration fails or is procedurally blocked. The two routes are not mutually exclusive – a UDRP outcome does not bar a subsequent court action, and vice versa.

For .com domains where the owner is based outside the United States, a US court action requires engaging local litigation counsel in the relevant US jurisdiction. We coordinate that engagement as part of the overall recovery strategy, ensuring the legal and registrar tracks remain synchronized.

What evidence decides the outcome of a hijacked .com recovery?

Evidence is the hinge on which hijacking recoveries turn. A panel or court that cannot distinguish between a legitimate secondary-market purchase and a stolen domain will default to the current holder. The complainant carries the burden of showing that the original registration was theirs and that the transfer was unauthorized.

The core evidence set for a hijacked .com recovery includes:

We have defended clients on the respondent side of hijacking cases where the purported "original owner" could not produce a single renewal invoice or a contemporaneous WHOIS snapshot. Evidence gaps collapse even meritorious claims. The first instruction we give every hijacking client is: preserve everything, immediately, before the registrar's log purge cycle runs.

How does the cost and timeline compare across recovery routes for a stolen .com?

The realistic cost and timeline for recovering a hijacked .com vary significantly by route. Here is how the primary paths compare.

Registrar escalation alone is the fastest and cheapest route – and the first attempt in every case. It costs nothing beyond preparation time. But registrars resolve fewer cases than clients expect unilaterally. If the gaining registrar disputes the claim or the domain has already moved again, registrar escalation stalls.

UDRP at WIPO carries a filing fee of USD 1,500 for a single-member panel on up to five domains. Legal preparation for a hijacking complaint – evidence assembly, the complaint drafting, and liaison with the panel – runs in the market range for a straightforward single-domain matter. A standard case closes in roughly two months; the expedited track at WIPO delivers a decision in approximately one month. The remedy is transfer or cancellation only. No damages.

US anticybersquatting court action involves substantially higher fees: court filing costs, service of process on potentially offshore registrars, and legal time billed at hourly rates over a matter of months. The upside is that the court can issue injunctions, name registrars as parties, and award monetary compensation. For high-value domains or cases where UDRP has failed, the additional cost is frequently justified.

The decision matrix in practice looks like this: if the domain was hijacked recently, the trademark is clear, and the attacker is holding it passively, file a UDRP at WIPO on the expedited track – lowest cost, fastest result, and the relief you need (transfer) is exactly what the UDRP delivers. If the domain has moved twice, there is no mark right, or the attacker is generating real revenue from the hijacked domain, a court action is the primary route, with UDRP as a parallel fallback. If the domain was taken from a US-based registrant and the loss is in six figures or above, we advise opening the court file from day one, with the UDRP running simultaneously for speed.

What cross-border complications arise when recovering a .com hijacked through account compromise?

A .com is a global asset. The original owner may be in one country, the attacker in another, the gaining registrar in a third. That cross-border spread creates complications that a purely domestic legal view misses.

First, the UDRP is forum-agnostic: WIPO handles .com disputes regardless of where the parties are located. The proceeding is entirely online, in English by default, and the gaining registrar – wherever it is accredited – is bound by ICANN's registrar accreditation agreement to implement a UDRP transfer order. The UDRP's cross-border coverage is one of its most important practical features for hijacking victims: the attacker's jurisdiction does not shield them from an ICANN-mandated transfer.

Second, where the attacker has resold the domain to a third-party purchaser who claims to be a good-faith buyer for value, the UDRP panel's analysis becomes more nuanced. Panels treat a WHOIS record showing a subsequent holder differently depending on whether that holder had constructive notice of the dispute or actively participated in the scheme. We have seen cases where a quick resale was specifically intended to insert a facially "innocent" transferee to defeat recovery.

Third, if the attacker is outside US jurisdiction and the complainant wants damages rather than just a transfer, enforcing a US court judgment abroad requires separate proceedings in the foreign jurisdiction. A UDRP transfer order does not have that limitation: ICANN's system enforces it globally through the registrar's contractual obligations, without any foreign-court recognition step.

In a case we handled in autumn 2024, a .com had been hijacked through SIM swapping, resold to a holding company in a non-US jurisdiction within 48 hours, and re-listed at a domain marketplace. We filed a UDRP on the expedited track within 10 days of the hijacking, documenting the SIM-swap carrier record and the chain of WHOIS snapshots. The panel found bad faith in the unauthorized transfer and ordered the domain transferred back – a result the client's own registrar escalation had failed to produce after three weeks of correspondence.

Related at COGNOMEN

Frequently asked questions

When should I recover a hijacked .com domain after account compromise?

Immediately – within hours of discovering the unauthorized transfer, not days. The ICANN transfer policy creates a post-transfer dispute window that closes quickly. Registrar logs have retention limits. And every day the attacker holds the domain, they can re-transfer it, sell it onward, or use it to generate harm that compounds your losses. Filing a registrar complaint and retaining counsel should happen in parallel, on the same day you discover the hijacking.

What happens if the other side ignores the case?

In a UDRP proceeding, a respondent who fails to file a response does not automatically lose, but panels regularly decide on the complaint alone where the evidence of hijacking is clear. A default by the respondent shifts the evidentiary burden: the panel may draw adverse inferences from the silence. In a court action, a default judgment can be entered, and a court order can compel the registrar to transfer the domain even without the attacker's cooperation. Default is not a dead end for the complainant.

How is WIPO different from a national court for .com?

WIPO administers the UDRP – an online arbitration procedure that resolves in roughly two months, costs USD 1,500 in filing fees for a single-member panel, and delivers only transfer or cancellation as a remedy. A national court can award damages, issue injunctions, and compel registrars directly, but takes months longer and costs substantially more. WIPO works well when the goal is transfer and the evidence is strong. A court is the right tool when damages are sought, no trademark exists, or the UDRP has already failed.

Author: — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.