How to recover a hijacked .eu domain after account compromise

How to recover a hijacked .eu domain after account compromise. UDRP and ccTLD domain recovery and defense across .eu. Email the firm to assess your case.

Your .eu domain is gone. The registrar account was accessed without your authorization, the domain was transferred to a stranger, and the site it hosted – a business, a brand, a revenue stream – now points somewhere else or nowhere at all. Speed matters. Every day of unauthorized control deepens the harm.

To recover a hijacked .eu domain after account compromise, the primary administrative route is the ADR.eu procedure administered by the Czech Arbitration Court under EURid's dispute-resolution rules. Where the registrant of record cannot be identified or the arbitral remedy is insufficient, court action remains available. Evidence of the unauthorized access – authentication logs, registrar correspondence, prior registration history – decides both the speed and the outcome of any recovery route. The ADR.eu complaint may rely on a wider set of rights than registered trademarks alone, and the remedy can include transfer where the complainant meets EU or EEA eligibility requirements.

This page covers the ADR.eu procedure, the registrar-lock mechanics that must run in parallel, the evidence that wins or loses a hijacking case, and the decision between arbitration and court action for a .eu recovery.

What does account compromise mean in the .eu context, and why does the zone matter?

A hijacked .eu domain arises from unauthorized access to the registrar account that controls the registration record – the registrant contact, the name servers, and the transfer authorization code. The intruder changes these details, often within minutes, and then either transfers the domain to a second registrar or holds it for ransom. This is not a trademark dispute in the classic UDRP sense. It is an act of unauthorized transfer, and the governing rules treat it differently.

The .eu zone is administered by EURid, the registry for the European Union's country-code top-level domain. EURid mandates that registrants maintain an EU or EEA connection – a registered office, a domicile, or an establishment in a member state or EEA country. That eligibility requirement has direct consequences for recovery: if a thief transferred the domain to an entity that does not qualify under EURid's eligibility rules, that transfer is itself a ground for revocation or re-transfer independent of any bad-faith showing. This is a .eu-specific lever that has no equivalent in the UDRP world.

We regularly advise domain holders who discover the compromise days or weeks after it occurs, when the trail has cooled but the legal options are still alive. The window for the most effective registrar-level intervention is within the first 30 days of the unauthorized transfer, because ICANN-derived transfer protections – including the 60-day lock following a change of registrant – apply to gTLDs but .eu operates under EURid's own inter-registrar transfer policy. Acting before the registration anniversary or before a second transfer occurs gives you better options.

How does the ADR.eu procedure work for a hijacking case?

The ADR.eu procedure, administered by the Czech Arbitration Court (CAC), is the principal administrative route for .eu domain disputes and is the mechanism specifically recognized by EURid. In a hijacking case, the complaint is not framed as a classic bad-faith registration dispute. It is framed as a challenge to the legitimacy of the current registrant – typically on grounds that the transfer was effected without the true registrant's authorization, that the current holder lacks EU or EEA eligibility, or that the registration itself constitutes an abusive registration within the meaning of the .eu rules.

The procedural sequence runs as follows. The complainant files a written complaint with the CAC through the ADR.eu platform, identifying the disputed domain, the factual basis for the challenge, and the remedy sought – typically transfer to the complainant (where the complainant is EU/EEA eligible) or revocation (where transfer is not available). The respondent is notified and given a period to respond. A panelist is appointed. The panelist issues a decision. If the decision orders transfer or revocation, EURid implements it. The entire procedure operates in parallel with any registrar escalation; the two tracks do not suspend each other.

One critical difference from the UDRP: the .eu rules permit the complainant to rely on a wider set of rights than registered trademarks alone. Unregistered or common-law rights, trade names, company names, and personal names may ground a complaint where they are recognizable under the applicable national law of an EU member state. For a hijacking scenario, this broadens the evidentiary base: a business that operated under the domain as a trade name for years can assert those rights even without a registered mark.

For an assessment of your hijacked .eu domain and the fastest route to recovery, contact info@cognomenlaw.com.

What registrar-lock and transfer-reversal steps must run immediately?

Registrar escalation is the first move, not the last. It runs in parallel with any formal procedure and can occasionally resolve the matter without filing a complaint at all – though in our experience, a registrar acting alone rarely reverses an inter-registrar transfer without a formal dispute or court order in hand.

The immediate steps are these. First, document everything before you act: screenshots of the registrar portal showing loss of access, WHOIS or RDDS records reflecting the changed registrant, any notification emails from the registrar about account changes, and your own prior registration history (renewal invoices, original registration confirmation, billing records going back years). This documentation is the foundation of every route that follows. Second, submit a formal unauthorized-transfer report to your registrar. Most registrars maintain an abuse desk. A report citing account compromise – with evidence of your legitimate account credentials and the timeline of the unauthorized change – triggers an internal investigation. Some registrars will impose a registrar-side lock pending the outcome. Third, if the domain transferred to a second registrar, report the matter to that registrar's abuse desk as well. EURid itself has a published procedure for reporting registrant data that does not comply with eligibility requirements; an eligibility violation by the current holder can trigger a registry-level suspension independent of any formal dispute.

Do not attempt to recover the domain by contacting the current holder directly without legal advice. Unsolicited contact can inadvertently supply evidence that the current holder uses against you in a dispute – framing your approach as a negotiation rather than a recovery action.

What evidence decides an account-compromise recovery case?

Evidence is the backbone of a hijacking case. A panel or court deciding whether to order transfer back to the original registrant will look for a coherent, documented chain of ownership and a credible account of how the compromise occurred. The absence of evidence is not neutral – it is a reason to deny the remedy.

The evidence that matters most falls into three categories.

Proof of prior legitimate registration. Domain renewal invoices, payment records, original registration confirmation emails, website hosting agreements, SSL certificate history, and any IP addresses associated with the domain's historical DNS. If the domain was used commercially, brand materials, advertising invoices, or court or trademark filings citing the domain all reinforce the chain.

Proof of unauthorized access. Registrar authentication logs (request these from your registrar immediately – they are often purged after 30 to 90 days), email headers showing login or change notifications, evidence of credential theft (phishing emails, data breach notifications, password-manager breach records), and any law-enforcement report you have filed. Filing a police or cybercrime report is not required to succeed in an ADR.eu complaint, but it strengthens credibility significantly.

Proof that the current registrant lacks eligibility or legitimate interest. In a .eu hijacking, eligibility is often the sharpest tool. If the entity now listed as registrant is not EU or EEA established, that is documentable from the RDDS record itself. If no business with that name exists in the relevant member state – verifiable through company registries – that absence is relevant evidence.

In a recent matter (a .eu hijacking case, spring 2025), we assembled a full chain-of-ownership record for a registrant who had held the domain for over a decade. The current holder could not demonstrate any EU eligibility and had pointed the domain at a parked monetization page. The ADR.eu panel ordered revocation within weeks of the complaint being filed.

When does court action beat the ADR.eu route for a hijacked .eu domain?

The ADR.eu procedure is fast and cost-effective relative to litigation, and it is the right starting point for most hijacking cases. But there are situations where court action is the better or necessary route – and occasionally the only viable one.

The most common scenario where court action is required: the hijacked domain was used as a stepping stone to access other assets. If the attacker used your .eu email to reset passwords on financial accounts, intercept business emails, or divert payments, the ADR.eu procedure does nothing about those consequential losses. Only a court can award damages, issue injunctions against third parties, or compel disclosure of the attacker's identity through subpoena-equivalent mechanisms. The administrative procedure gets the domain back; it does not compensate you for what the compromise cost.

A second scenario: the current registrant has a facially plausible rights claim. A competitor who transferred your domain through a compromised account may argue in ADR.eu proceedings that it has its own mark rights and that the complaint is improperly constituted as a hijacking case. That kind of dispute – where both parties assert rights – often belongs in court, where the evidentiary record is fuller and the procedural tools are broader.

A third scenario: the transfer originated in an EU member state where domestic court action is fast and interim relief is readily available. Some EU jurisdictions issue emergency injunctions – interim measures freezing the registrar record pending a hearing – within days of filing. In those jurisdictions, going to court first can lock the domain record while the substantive case proceeds. We work with local litigation counsel in the relevant jurisdiction to assess whether that path makes sense before committing to it.

The decision matrix in brief: if the only goal is to get the .eu domain back and the current holder is clearly illegitimate, ADR.eu is usually faster and significantly less expensive. If consequential losses are involved, if a competing rights claim complicates the picture, or if interim freezing is urgent, court action – run with local litigation counsel – is the right instrument. The two routes are not mutually exclusive; in the right case, a court filing and an ADR.eu complaint run simultaneously.

To weigh the ADR.eu route against court action for your hijacked .eu domain, email info@cognomenlaw.com.

How does .eu recovery compare to recovering a hijacked .com or .dev domain?

The zone determines the rulebook. That principle matters practically when a business has been hijacked across multiple domains at once – a scenario we see more often than most registrants expect.

A hijacked .com is subject to UDRP at WIPO or the Forum, with a filing fee starting at USD 1,500 for a single-member panel and a typical timeline of about two months. The UDRP requires a trademark right, and the bad-faith test is cumulative: registration and use in bad faith must both be shown. In an account-compromise case, the "legitimate interest" and "bad faith" elements are usually straightforward, but the complainant still needs a trademark right or a right cognizable under the Policy. A pure domain theft where the complainant holds no trademark at all is harder to manage through UDRP.

A hijacked .eu, as detailed above, gives the complainant more tools: a wider set of rights, the eligibility lever, and the ADR.eu procedure calibrated to the .eu registry's own rules. The CAC administers ADR.eu with published fees and a process adapted to the zone.

A hijacked .dev sits in the new-gTLD space operated by Google Registry, subject to UDRP and URS. The URS suspends the domain rather than transferring it, at a lower cost than a UDRP complaint but with a higher evidentiary standard. For an account-compromise case where transfer – not just suspension – is the goal, UDRP is typically the stronger route even for new gTLDs.

Where the same attacker has hijacked a .com and a .eu simultaneously, the two disputes run in parallel under different rules and different forums. Coordinating the evidence and the timing across both proceedings is a material advantage: the .eu eligibility challenge often resolves faster, and the resolution can be used in the .com proceeding to establish the pattern of bad faith.

In a recent matter (a coordinated .com and .eu hijacking, autumn 2024), we ran parallel recovery proceedings across both zones, using the .eu eligibility finding as corroborating evidence in the gTLD UDRP complaint. Both domains were returned to the registrant within roughly three months.

What are the realistic costs and timelines for a .eu hijacking recovery?

Transparency on cost is part of how we operate. The following is a factual breakdown of what a .eu hijacking recovery typically involves, separated between official fees and legal fees, which are distinct.

On the official side, ADR.eu fees are published by the CAC. They represent the lowest entry point among the major dispute-resolution providers – beginning at around USD 500–800 for a standard single-panelist case, though the exact current figure should be confirmed with the CAC at the time of filing, as fees are denominated in EUR and subject to adjustment. There is no filing fee for the preliminary registrar-escalation track; that step costs only time.

On the legal-fee side, a straightforward ADR.eu complaint for a well-documented hijacking case typically falls in the market range of USD 3,000–7,000 in flat fees, separate from the official filing fee. Cases that require parallel court action, multi-zone coordination, or expert forensic input sit at the higher end of that range or beyond it. We present our fees in a specific range at the outset of any engagement, not after the work is done.

Timeline: an ADR.eu case, from filing to decision, typically runs a matter of weeks to a few months depending on whether a response is filed and whether the panelist requests additional submissions. A default case – where the current registrant does not respond – moves faster. EURid implements a transfer or revocation order promptly after the decision issues. Court action in an EU member state adds time and cost but may be the only route that reaches consequential losses or third-party disclosure.

The registrar-escalation track has no official fee and no guaranteed timeline. In the best outcome it resolves the matter within days. In the common outcome it produces a formal denial that becomes useful evidence in the ADR.eu complaint.

Related at COGNOMEN

• Court action and domain theft recovery: the full menu of routes and how to choose
• How to recover a stolen .dev domain: registrar escalation, UDRP, and URS compared
• Domain due diligence for .com acquisitions: chain of title, dispute history, and red flags