How to recover a stolen .biz domain under the applicable domain rules
Your .biz domain went missing overnight. The registrar account shows a transfer you did not authorize, WHOIS now lists a stranger, and the site is either dark or redirecting your customers somewhere else. The clock started the moment the transfer locked in.
To recover a stolen .biz domain you have two primary routes: an emergency registrar escalation to reverse an unauthorized transfer, and a formal complaint under the UDRP – which applies to .biz as a sponsored gTLD – requiring proof that the domain is confusingly similar to a mark you hold, that the current registrant has no legitimate interest, and that registration and use are in bad faith. A standard UDRP case at WIPO is decided within approximately two months, with a filing fee starting at USD 1,500 for a single-member panel. Where arbitration cannot fully reach the harm, US anticybersquatting litigation offers a court route that adds damages.
This page covers every step: from the first emergency call to the registrar through forum selection, evidence assembly, and the cross-route decision that determines which path fits your situation.
What rules govern .biz, and why does it matter for theft recovery?
.biz is a generic top-level domain – a gTLD – which means all three UDRP elements under Paragraph 4(a) of the Policy apply directly, with WIPO, the Forum, and the Czech Arbitration Court (CAC) each authorized to hear complaints. That matters for theft cases because the UDRP's transfer remedy is available as soon as the domain is in the unauthorized transferee's hands, even if that person claims to have bought it without knowing it was stolen.
Theft cases are factually distinct from ordinary cybersquatting. In a cybersquatting dispute the registrant registered the domain deliberately targeting your mark. In a theft scenario the original registrant – usually you – had the domain first, and a bad actor obtained it through account compromise, social engineering of the registrar's support desk, or a fraudulent transfer request. Those different origin stories change which evidence matters most, and in some situations they affect whether arbitration alone is enough.
WIPO administered approximately 6,282 domain-name cases in 2025, a record figure. A growing proportion involve account compromise and unauthorized transfers rather than traditional cybersquatting. Panels have adapted their reasoning accordingly, but the formal UDRP elements remain the same three-part test the Policy has required since 1999.
How does the emergency registrar-lock process work?
The fastest available intervention is not a UDRP complaint – it is a direct registrar escalation, often available within hours of discovering the theft. The goal is to lock the domain at its current registrar before the new holder moves it again to a second registrar, which resets the 60-day transfer lock and complicates recovery.
At COGNOMEN we move on registrar escalations immediately: we document the account compromise, assemble the evidence of your prior ownership, and push the formal dispute channel at the gaining registrar. The ICANN Transfer Dispute Resolution Policy (TDRP) and the gaining registrar's own abuse procedures give you a mechanism to challenge the transfer directly, separate from any UDRP filing.
The evidence that decides this stage is the same evidence you will use later in a UDRP: domain registration history showing your prior ownership, WHOIS snapshots before and after the unauthorized transfer, any phishing or credential-compromise indicators (email headers, SMS logs, support-ticket records from the registrar), and proof of your trademark or business identity in the name. Gather everything before you make the first call to the registrar, because delay gives the current holder time to move the domain a second time.
A useful decision point: if the current holder is unreachable or has already resold the domain to an apparent third party, the registrar-lock route becomes harder. That is when a formal UDRP complaint or a court order becomes the next tool. In a recent matter – a .biz account-compromise case, winter 2025 – we secured a registrar lock within 48 hours by documenting a clear chain of prior registration and evidence of a forged transfer authorization, buying time to pursue a formal UDRP filing before the domain was moved offshore.
If you believe your .biz domain has been transferred without authorization, act immediately. For an assessment of your domain dispute, contact info@cognomenlaw.com.
What does the UDRP test require in a .biz theft case?
Under Paragraph 4(a) of the UDRP, a complainant must establish all three elements: the domain is identical or confusingly similar to a trademark or service mark in which the complainant has rights; the respondent has no rights or legitimate interests in the domain; and the domain was registered and is being used in bad faith. In a theft scenario, all three elements can be met – but the evidence map is different from a conventional cybersquatting case.
Element one – confusing similarity – is typically straightforward when you were the original registrant: your brand name matches the domain because you registered it yourself. If you hold a registered trademark, the comparison is direct. If your rights rest on common-law use or a company name without a registration, you must document the commercial use and its geographic reach sufficiently for a panel to find trademark rights.
Element two – no legitimate interest – is met by showing that the current holder is not commonly known by the domain name, has no bona fide commercial history under it, and is not making legitimate noncommercial or fair use. A person who obtained the domain through fraud cannot, almost by definition, assert a legitimate interest in it. Panels have consistently held that rights acquired through deception or unauthorized transfer cannot satisfy the Paragraph 4(c) safe harbors.
Element three – bad faith registration and use – requires more care in a theft case. The UDRP requires bad faith at the moment of registration as well as in subsequent use. Where the current holder acquired the domain knowing it was stolen, bad faith is present at both stages. Where the holder claims to be a good-faith purchaser, panels look to whether the holder took reasonable steps to verify the transferor's authority. A cursory or fictitious purchase from a hijacker rarely satisfies that bar. Passive holding of a domain with an established brand identity behind it can also constitute use in bad faith under the consensus view of the Policy.
Which forum should you file with to recover a stolen .biz domain?
WIPO is the default choice for most .biz theft recovery matters. It is the most established forum, its decisions are publicly searchable and provide useful persuasive precedent, and its case administration is reliable at the documented fee of USD 1,500 for a single-member panel covering one to five domains. The Forum is an equally valid option at a filing fee beginning around USD 1,300; it is sometimes preferred when the complainant or the domain is US-connected and speed of filing matters. The CAC offers the lowest entry point but sees lower volume.
WIPO and the Forum together handle roughly 97% of all UDRP proceedings. For a single .biz domain with a clear-cut ownership history and an identifiable bad-faith holder, a single-member panel is almost always appropriate. A three-member panel – at WIPO, USD 4,000 – is worth considering only when the factual record is genuinely complex, the domain is highly valuable, or you anticipate a serious procedural challenge from the other side.
One additional option: WIPO offers an expedited procedure delivering a decision within approximately one month, available for single-panel cases of up to five domains. In a theft case where every week of continued redirection damages your brand, that expedited route deserves serious consideration. Ask about eligibility when you assess the complaint.
When does a court route outperform arbitration for .biz theft?
The UDRP's only remedies are transfer and cancellation. No damages. No costs. No injunction against the thief who ran a phishing campaign against your business. When the harm extends beyond the domain itself – when customers were defrauded, invoices intercepted, or confidential data compromised – the UDRP does not reach that harm. A court action does.
US anticybersquatting litigation offers statutory damages and a court-ordered transfer enforceable against the registrar directly. That route is substantially more expensive and slower than UDRP arbitration, but it is the correct instrument when the domain theft is part of a wider fraud or when the current holder is accessible in a US court. We handle court anticybersquatting work with local litigation counsel in the relevant jurisdiction.
The decision matrix works like this. If your .biz domain was transferred without authorization and the current holder is identifiable, the registrar-lock plus a UDRP complaint is usually the fastest and most cost-efficient path. If the holder has already monetized the domain, redirected your customers, or is operating a fraud scheme under your name, the UDRP gets you the domain back while a parallel or subsequent court action pursues the damages. If the holder is outside any reachable jurisdiction and has already moved the domain multiple times, the registrar escalation combined with a UDRP default proceeding – where the respondent simply does not answer – is typically the outcome that transfers the domain fastest, often before the formal two-month window closes.
In a second representative matter – a .biz brand-impersonation case, spring 2025 – a client's domain had been redirected to a fraudulent storefront for over three weeks before we were retained. We filed at WIPO simultaneously with a registrar-abuse report. The respondent defaulted. Transfer was ordered and implemented, and the client separately pursued damages claims with local litigation counsel. The combination of routes is sometimes the only way to address both the immediate loss and the downstream financial harm.
To weigh UDRP against a court action for your case, email info@cognomenlaw.com.
What evidence decides the outcome in a .biz domain theft case?
Evidence quality is the single largest determinant of outcome. Panels and courts cannot award what the record does not support, and a rushed or incomplete submission is the most common reason a winnable theft case underperforms.
The core record in a .biz theft recovery includes the following categories. First, prior registration history: WHOIS archives showing you as the original registrant, renewal payment records, and hosting or DNS configuration records tied to your account. Second, trademark or commercial rights documentation: a registered mark certificate, or a body of evidence establishing common-law use sufficient to constitute rights in the mark – sales figures, press coverage, and consistent use in commerce, gathered from the period before the unauthorized transfer. Third, evidence of the compromise: phishing emails, unauthorized support-desk tickets at the registrar, two-factor authentication logs, and any communications between the hijacker and the registrar's abuse team. Fourth, evidence of bad faith by the current holder: screenshots of how the domain is currently being used, any demands for payment the holder has made to you, and WHOIS records showing the transfer chain.
What panels look for most closely in theft cases is the gap between the domain's established association with your brand and the current holder's inability to explain a legitimate basis for holding it. Passive holding of a domain whose DNS records, historical content, and commercial associations all point to the complainant is an established pattern of bad faith under the consensus view of the Policy. You do not need to prove the exact mechanism of the theft to succeed – you need to show that the domain is yours by right and that the holder has none.
A registrant who can demonstrate an unbroken registration history, a coherent trademark record, and clear evidence that the transfer was unauthorized has, in our practice, a strong record for the forum. The submission must be organized, complete, and filed with all annexes properly authenticated. We regularly assist registrants in assembling this record efficiently, including obtaining certified WHOIS archives and coordinating with hosting providers to confirm account-access logs.
How do you protect your .biz domain from being stolen again?
Recovering a stolen domain is a reactive step. The follow-on question every recovered registrant should ask is: what structural change prevents this from recurring?
The most effective technical control is registrar-level domain lock, sometimes called transfer lock or registrar lock, combined with WHOIS privacy and two-factor authentication on the registrar account. Many registrars now offer registry lock – a higher-security designation that requires out-of-band verification before any change is processed. For a high-value .biz domain, registry lock is worth requesting explicitly.
On the legal side, a trademark registration in the relevant class creates a documented anchor for any future UDRP claim, reduces the evidentiary burden in proving rights under Element 1, and enables monitoring services to flag identical or confusingly similar new registrations in other zones. We offer portfolio brand-protection monitoring and pre-acquisition due diligence for registrants who need ongoing coverage rather than reactive dispute handling.
Does a recovered domain carry any residual risk? It should not, but the chain of title should be documented in your records once transfer is complete. A domain with a prior unauthorized-transfer episode in its WHOIS history is not inherently weaker, but due diligence on any future sale or acquisition should disclose and explain that history to avoid complications at the buyer's end.
Related at COGNOMEN
Frequently asked questions
Is it worth it to recover a stolen .biz domain?
For most brand owners, yes – particularly when the domain carries established customer traffic, an email history, or a commercial identity that cannot be cleanly migrated to a new name. The UDRP process is faster and far less expensive than court litigation, with a WIPO filing fee starting at USD 1,500 and a typical decision timeline of approximately two months. The calculus changes when the domain has low commercial value and the evidence of compromise is thin; an honest pre-filing assessment will tell you whether the record is strong enough to justify the filing cost.
What are the most common mistakes when you recover a stolen .biz domain?
The most damaging mistakes are delay, incomplete evidence, and filing in the wrong forum or under the wrong route. Delay allows the current holder to re-transfer the domain, complicating the registrar-lock process and sometimes defeating a UDRP filing on procedural grounds. Incomplete evidence – particularly a gap in the pre-transfer WHOIS record or an absence of trademark documentation – gives the panel no basis to find the first element. Filing a UDRP when a registrar-lock reversal was still available wastes time and money. An early assessment of all three routes – registrar escalation, UDRP, and court – prevents all three mistakes.
Can a three-member panel change the outcome?
It can, in either direction. A three-member panel at WIPO costs USD 4,000 versus USD 1,500 for a single panelist, and the cost is borne by the complainant unless the respondent requests the three-member panel, in which case the parties generally split the higher fee. Three panelists provide a more deliberative record and are sometimes preferred when the respondent is likely to challenge the outcome or when the domain is commercially significant enough to warrant the investment. For a straightforward theft recovery with a clean chain-of-title record, a single-member panel is usually sufficient.
Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.