How to recover a hijacked .me domain after account compromise
Your .me domain points to a stranger's site. Your registrar account password no longer works. Someone – through a phishing attack, a SIM-swap, or a credential breach – took control of the registration and transferred it out before you noticed. The clock is already running.
To recover a hijacked .me domain after account compromise, the fastest initial route is an emergency registrar escalation combined with a WIPO UDRP complaint, because .me operates under the UDRP – it is one of more than 87 ccTLDs that have appointed WIPO as their dispute-resolution provider. A standard UDRP case at WIPO runs about two months, with a filing fee starting at USD 1,500 for a single-member panel. Where the transfer crossed borders or the registrar's own conduct is in question, court action may be the stronger path.
This page covers the registrar-lock mechanics, the UDRP route, the evidence that decides the outcome, when a court action beats arbitration for .me, and what to do first.
What makes a .me domain hijacking different from ordinary cybersquatting?
Account compromise is not the same legal fact pattern as deliberate cybersquatting. An ordinary cybersquatter registers a domain that resembles your brand and parks it. A hijacker takes a domain you already own, usually by exploiting a weak password, intercepting a registrar verification email, or carrying out a SIM-swap on the phone number attached to your account.
That distinction matters for the legal route you choose. The UDRP was designed for disputes about bad-faith registration of a confusingly similar name. A hijacking case requires you to show that the current registrant – whoever ended up holding the domain after the unauthorized transfer – has no rights or legitimate interests in a name that was, until recently, provably yours. Panels have consistently held that an unauthorized transfer does not extinguish the original registrant's rights. But assembling the chain of evidence to prove the transfer was unauthorized takes a different document set than a standard bad-faith case.
Because .me is treated as a UDRP ccTLD, the three-element test of Paragraph 4(a) applies: confusing similarity to your trademark or name, the current holder's lack of rights, and bad-faith registration and use. In a hijacking fact pattern, the bad-faith limb is typically the easiest to satisfy. The harder work is documenting the original registration, the account compromise event, and the chain of transfers that followed.
What are the immediate steps after discovering a .me domain has been hijacked?
Speed is the variable that most often determines whether a domain is recovered quickly or expensively. The first hours after discovery are the most valuable, because registrar systems have internal escalation paths that can freeze a domain before the new registrant deletes hosting records or re-transfers it to a third registrar.
In our practice, the sequence we recommend is as follows:
- Secure every account still accessible. Change passwords on the email address linked to the registrar account, on any secondary authentication method, and on associated hosting panels. This limits further damage even if the domain itself is already gone.
- Document the compromise event. Screenshot your registrar's account history, login logs, and any WHOIS or RDDS records showing the prior registrant data. Preservation orders exist in some jurisdictions, but registrar logs are often overwritten on short cycles – preserve them yourself immediately.
- File a registrar complaint and request an immediate registrar lock. Most ICANN-accredited registrars have a dedicated abuse escalation channel separate from general support. Ask for an emergency transfer lock (often called a "registrar lock" or "hold" status) while the unauthorized transfer is investigated. A locked domain cannot be pushed to another registrar.
- Request WHOIS or RDDS history from the registrar. Many registrars retain historical registration data. That record shows the exact timestamp of the transfer and the account that authorized it – critical evidence for both UDRP and court proceedings.
- Engage counsel and file the UDRP complaint. Once preservation is complete, a UDRP complaint at WIPO is typically the fastest formal mechanism for .me. The respondent has 20 days to file a response after the case commences. If the domain was transferred to an unresponsive third party, a default is common – but a well-constructed complaint still requires proof on all three elements.
Missing any of these steps – particularly the registrar lock request – can allow a secondary transfer to a different registrar in a different country, making recovery significantly more complicated.
The right sequence matters more than speed alone. To assess the registrar escalation path and UDRP filing strategy for your compromised .me domain, contact info@cognomenlaw.com.
How does the UDRP apply to .me, and what does the three-element test require?
Because .me has adopted the UDRP, the full Policy applies, including all four Paragraph 4(b) bad-faith factors and all three Paragraph 4(c) safe harbors that a respondent can invoke. The registrar for any .me domain is ICANN-accredited, meaning WIPO has jurisdiction regardless of whether the current registrant is in Montenegro, where the .me registry is based, or anywhere else in the world.
For a hijacking case the three elements break down as follows. First, confusing similarity: if the domain matches your registered trademark or a name in which you have unregistered rights, this element is almost always satisfied in a hijacking case because the domain is your name – you registered it. Second, no rights or legitimate interests: the hijacker, by definition, has none. There is no bona fide offering before notice, no common-name claim, and no legitimate noncommercial fair use. Third, bad-faith registration and use: an unauthorized transfer is not a good-faith registration, and using or warehousing a domain taken by account compromise is use in bad faith. Panels have found bad faith on the facts of account-compromise cases where the complainant produced clear evidence of prior ownership and an unauthorized transfer event.
One trap: the UDRP's bad-faith limb is cumulative – registered and used in bad faith, not one or the other. In a hijacking case where the domain is simply parked or pointed at blank content after the transfer, panels generally accept that passive holding by a party with no plausible legitimate interest constitutes use in bad faith. That reading is consistent with the consensus view under the Policy.
WIPO offers an expedited option for single-panel cases of up to five domains, typically delivering a decision within about one month. Where urgency is acute and the domain count is within that limit, the expedited track is worth considering.
When does a court action beat the UDRP for a hijacked .me domain?
The UDRP is fast and cost-predictable, but it has hard limits. The only remedies under the Policy are transfer or cancellation of the domain. There are no monetary damages, no injunction, no costs award. If you have suffered quantifiable loss – diverted invoices, payment fraud routed through your old domain, reputational damage with documented revenue consequences – a UDRP order does not compensate you for any of it.
The right route depends on what you need. Four situations call for different choices.
If the domain is a .me and the goal is simply to get it back, WIPO UDRP is usually fastest. Filing fees start at USD 1,500; a decision typically arrives within two months. If the hijacker has also used the domain to commit payment fraud or email impersonation, a UDRP complaint recovers the domain – but you need a separate civil or criminal action to pursue the money. Where the hijacker is identifiable and located in a jurisdiction with effective anticybersquatting or computer-fraud statutes, a court action with interim relief (an injunction freezing the domain pending judgment) may deliver both recovery and a damages award in a single proceeding. For that work, we coordinate with local litigation counsel in the relevant jurisdiction. If the registrar itself failed to apply standard security procedures – for example, failing to require identity verification before processing a transfer request – the registrar's own conduct may ground a separate claim, and that is a court matter, not a UDRP matter.
In a recent matter – a .me domain theft involving email account hijacking, summer 2025 – the registrant had suffered fraudulent invoice redirection for several weeks before discovery. We filed a UDRP complaint at WIPO to recover the domain while a parallel civil claim, handled with local litigation counsel, pursued damages. The WIPO phase resolved first, restoring the domain within approximately two months of filing. The parallel action addressed the financial loss that the UDRP could not reach.
If you need both the domain back and compensation for losses, UDRP and court action may need to run in parallel. To weigh UDRP against a court action for your .me domain, email info@cognomenlaw.com.
What evidence decides whether a .me hijacking case succeeds or fails?
Evidence quality is the single largest variable between a case that transfers quickly and one that stalls. Panels and courts alike need a coherent chain of proof connecting you to the original registration, the registration to the compromise event, and the compromise event to the current holder.
The documents that most often decide the outcome are:
- Registrar account creation records. Screenshots or PDFs from your registrar portal showing your account creation date, your email address, your payment history for the domain, and any auto-renewal records. These establish original ownership with timestamps.
- WHOIS or RDDS history. Historical WHOIS records showing the name and contact data at the time of your registration compared with the current record. A sudden registrant change with no transfer authorization from you is the central fact of a hijacking claim.
- Evidence of the compromise event. Login attempt logs, phishing emails received, SIM-swap carrier records, breach notification emails, or any security alert from your registrar or email provider at the time the unauthorized access occurred.
- Trademark registration or business records. A registered trademark in the domain name makes the confusing-similarity element trivially easy. If you have no registered mark, business registration documents, prior use evidence (invoices, website captures, press coverage), and domain registration predating any trademark application all help establish rights under the broader sense recognized by panels.
- Post-transfer domain use records. Screenshots of what the domain pointed to after the hijacking: a parked page, a competitor's site, a phishing clone, or a blank page. Each of these supports the bad-faith use analysis differently.
- Communications with the hijacker, if any. Any demand for payment to return the domain, any ransom-style correspondence, or any contact through the registrar's WHOIS contact all qualify as evidence of bad-faith intent under Paragraph 4(b).
In a second matter we handled – a .me domain used for a personal brand, autumn 2024 – the registrant had no registered trademark but held detailed hosting logs, registrar payment records, and a years-long email archive demonstrating continuous use of the domain address. That body of evidence was sufficient to satisfy panels on all three UDRP elements despite the absence of a formal mark registration.
The absence of any of these document categories does not automatically doom a case, but it changes the argument. We regularly advise registrants on which gaps can be filled by secondary evidence and which require a different legal route.
How does cross-border complexity affect .me recovery?
A .me hijacking almost always crosses at least two jurisdictions. The registry (.ME Registry, based in Montenegro) is one; the registrar holding the compromised account is typically accredited by ICANN and may be incorporated in a third country; the hijacker may be in a fourth. The UDRP resolves this cleanly for the domain question: because WIPO has jurisdiction over all ICANN-accredited registrars for .me, the complaint proceeds regardless of where anyone is located.
Court action is more complicated. An injunction or damages claim requires a court with personal jurisdiction over the defendant, service of process, and enforcement of any judgment – all of which depend on where the hijacker is located and what treaties apply. This is where the cross-border dimension is most likely to slow recovery or foreclose the damages route entirely.
For multi-domain compromises – where a hijacker gained access to an account holding both .me and .com or .net domains – a single UDRP complaint can cover multiple domains if they are registered in the same name. That consolidation cuts costs and reduces the risk of parallel panel decisions reaching inconsistent conclusions on the same underlying facts.
Where the .me domain was part of a portfolio that also included a country-code domain operating under a different procedure – for example, a .de domain that requires a DENIC DISPUTE entry and German court action – the recovery plan must run two tracks in parallel. We identify the governing national procedure for each zone, check eligibility, and prepare the appropriate filing for each registry.
What are the cost and timeline expectations for .me domain recovery?
Transparent fee information is something many practitioners avoid. We do not. Here is what the numbers look like for a standard .me hijacking recovery.
The WIPO filing fee for a UDRP complaint covering one to five domains on a single-member panel is USD 1,500. If either party requests a three-member panel, the fee rises to USD 4,000, with the parties generally splitting the increment if it was the respondent who demanded the larger panel. Legal fees for a straightforward UDRP complaint – preparing the complaint, assembling the evidence, and managing the proceeding – are typically in the USD 3,000–7,000 range in the market, separate from the forum fee. Cases involving multiple compromised accounts, a secondary transfer chain, or parallel court proceedings will cost more.
For a case on the expedited WIPO track, a decision can arrive within about one month. Standard single-member cases resolve within roughly two months. If the hijacker responds and requests a three-member panel, that adds time and cost.
Court proceedings vary enormously by jurisdiction. They are substantially more expensive than UDRP and typically measured in months rather than weeks. They are worth it when the damages figure is large enough to justify the investment or when the registrar's conduct is itself in issue.
If WIPO withdraws or terminates the case before a panel is appointed – for example, because the hijacker returns the domain voluntarily after a complaint is filed – WIPO typically refunds approximately USD 1,000 of the USD 1,500 single-panel filing fee. That partial refund mechanism makes early settlement less costly than it might appear.
Related at COGNOMEN
Frequently asked questions about recovering a hijacked .me domain
When should I recover a hijacked .me domain after account compromise?
Act within hours, not days. Registrar logs and account histories are overwritten on short cycles. An early registrar lock request can freeze the domain before it is transferred to a second registrar, which would require starting the escalation process over. The UDRP complaint can be filed while the registrar investigation is still open – the two tracks run in parallel and neither waits for the other to conclude first.
What happens if the other side ignores the case?
If the current registrant fails to file a response within the 20-day window after UDRP commencement, the panel proceeds to a decision on the complainant's submissions alone. A default does not guarantee a transfer – the panel still reviews the complaint against all three UDRP elements – but panels deciding on default consistently apply the Policy and routinely grant transfer where the evidence clearly supports all three elements. A well-constructed complaint with full evidence is therefore just as important in a default case as in a contested one.
How is WIPO different from a national court for .me?
WIPO's UDRP process is faster, cheaper, and limited in remedy: transfer or cancellation only, with no damages and no costs award. A national court can grant damages, interim injunctions, and in some jurisdictions criminal referrals – but proceedings are slower, substantially more expensive, and require jurisdiction over the defendant. For most .me hijacking cases where the goal is domain recovery, WIPO is the primary route. Court action is added when financial loss or registrar liability makes the broader remedy worth the additional cost and time.
COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking claims. Our practice handles the full sequence for account-compromise cases: registrar escalation, UDRP filing, and parallel court coordination through local litigation counsel where damages are in issue. To discuss recovery of a hijacked .me domain, contact info@cognomenlaw.com.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.