How to recover a stolen .eu domain under the applicable domain rules

Your .eu domain is gone. The registrar account shows a transfer you never authorized, or the WHOIS record now names a stranger. You need it back — and you need to understand which legal mechanism reaches it fastest before the trail goes cold or the domain is sold on.

To recover a stolen .eu domain you have two principal routes: the ADR.eu arbitration procedure administered by the Czech Arbitration Court, which can order transfer or revocation and accepts complaints grounded in rights broader than registered trademarks alone, or direct court action in the relevant jurisdiction when arbitration cannot reach the facts of a hijacking. Evidence of unauthorized account access, registrar-side transfer logs, and chain-of-title documentation decide the outcome in both forums. Time is the dominant variable: a domain transferred once can be transferred again, taking it further from reach.

This page covers the ADR.eu procedure, the registrar-lock escalation mechanics, the court route, the evidence that matters, and the realistic next step for a domain owner who needs to act now.

What does "stolen" mean for a .eu domain and why does it matter legally?

A .eu domain is stolen, in practical terms, when it is transferred away from the legitimate registrant without authorization — typically through a compromised registrar account, a social-engineering attack on registrar support, or fraudulent use of transfer authorization codes. The legal consequence matters because a theft scenario is procedurally distinct from a cybersquatting scenario, and the two call for different remedies.

In a cybersquatting case — where an abusive third party registered the domain in bad faith — the ADR.eu procedure is the primary vehicle. It adjudicates "rights" in the name and the registration's abusive character. In a theft case, the wrong is a registrar-level transfer that was never authorized by the legitimate account holder. That wrong may be faster to remedy through a registrar escalation or a court injunction than through a formal arbitration proceeding, depending on how quickly the domain was moved and whether the receiving registrar is reachable.

The distinction is not binary. Many stolen-domain situations contain both elements: an unauthorized transfer followed immediately by a re-registration in a bad-faith name that then points the domain at a phishing site. We regularly advise registrants in precisely those hybrid situations, where the first call is to the registrar and the second is to a dispute forum or court.

How does the ADR.eu procedure work for a stolen or abusively registered .eu domain?

The ADR.eu procedure, administered by the Czech Arbitration Court, is the primary dispute-resolution mechanism for .eu and governs both abusive registration complaints and certain unauthorized-transfer situations. Its rules permit a complainant to rely on a wider set of rights than the UDRP: registered trademarks, unregistered marks, trade names, business identifiers, and other protected designations under national or EU law may all found a complaint, making the procedure accessible to rights holders who have not yet registered a mark.

The complainant must show, in broad terms, that it has rights in a name identical or confusingly similar to the domain, and that the registration is either contrary to ADR rules or constitutes abusive registration. The "abusive registration" standard shares its DNA with the UDRP's bad-faith requirement, but the drafting under EU rules means the procedure is applied in the context of the EU regulatory framework for .eu domains — not the UDRP text itself.

Critically, there is an EU eligibility dimension. To hold a .eu domain the registrant must have an EU or EEA nexus: an EU/EEA member state individual, business, or organization. A complainant seeking transfer (rather than revocation) must generally be able to show its own eligibility to hold .eu. Where the complainant is EU-eligible, the remedy available is transfer. Where it is not, the remedy is revocation — the domain is cancelled rather than transferred, which may clear the namespace without restoring it to the original holder.

If your domain was stolen and re-registered by a party who is themselves EU-eligible, an ADR.eu complaint can seek transfer back to you — but you must also confirm your own current EU eligibility. We assess both sides of that eligibility question at the outset of any .eu matter, because a successful arbitration that results only in revocation rather than transfer may not serve the client's actual goal.

For an assessment of whether ADR.eu, a registrar escalation, or court action is the right route for your stolen .eu domain, contact info@cognomenlaw.com.

What are the registrar-lock and transfer-reversal mechanics — and when do they take priority over arbitration?

Registrar escalation is almost always the first move. Before any arbitration or court filing, the legitimate registrant should contact both the losing registrar (where the domain was held) and EURid, the .eu registry, to flag the unauthorized transfer and request a lock. A registrar lock freezes the domain against further transfer while the investigation proceeds. Speed is critical: EURid's transfer procedures permit a certain window for disputes to be flagged, and once a domain has been transferred through a second or third registrar, reversal becomes substantially harder.

The practical sequence is: (1) document the state of your account and any evidence of compromise immediately; (2) contact your registrar in writing, citing an unauthorized transfer and requesting a lock and a hold on the receiving registrar; (3) escalate to EURid directly if the registrar does not act within hours, not days; (4) preserve all email access logs, authentication records, and registrar correspondence.

When does direct court action beat the arbitration route? Two situations stand out. First, where the domain has already been transferred to a jurisdiction whose local registrar is unresponsive to voluntary lock requests — a court injunction in the registrant's home jurisdiction can compel EURid-level action faster than an ADR.eu proceeding, particularly where the complainant can show irreparable harm from the domain's continued misuse (for example, an active phishing campaign using the stolen name). Second, where the theft is part of a larger fraud — a company takeover, an identity impersonation scheme, or a coordinated attack on multiple domains — and the complainant needs discovery, damages, or criminal referral alongside a transfer order. ADR.eu delivers no monetary damages and no discovery. Those tools exist only in court.

In a recent matter involving a stolen .eu domain in the retail sector (spring 2025), we escalated directly to the registry and secured a temporary lock within 48 hours while simultaneously preparing the ADR.eu filing. The dual-track approach — registrar escalation plus arbitration — prevented the domain from being moved again during the proceedings and kept both remedies open.

What evidence decides a stolen-domain recovery in .eu proceedings?

Evidence is the pivot of every .eu stolen-domain case. The formal legal standard is important, but in practice the party that documents its position earliest and most completely almost always prevails — because the opposing party typically cannot produce a coherent account of a legitimate transfer.

The core evidence categories for a theft/unauthorized-transfer case are:

• Proof of original registration and continuous use: historical WHOIS records, invoices from the registrar, renewal confirmations, and screenshots of the domain in active use under the complainant's brand.
• Evidence of unauthorized access: registrar account access logs, IP geolocation data showing logins from unfamiliar locations, security alerts from the registrar or associated email provider, and any phishing or social-engineering communications received.
• The transfer record itself: the registrar's transfer log showing the date, the method, and the receiving registrar, which the original registrant can request under data protection and registry access rules.
• Chain of title: any prior purchase or assignment agreements, business records associating the entity with the domain, and trademark registrations or business registrations covering the name.
• Current misuse: screenshots of where the domain currently points, archived pages showing phishing content, fraud reports from customers, and any communications from the current holder attempting to sell the domain back.

In an ADR.eu proceeding the complaint and supporting annexes are submitted together; there is no discovery phase. The panel works only from what you file. That means the quality of the evidence bundle at the outset is decisive. We structure the evidence submission to address each required element directly, with the strongest proof on chain of title front-loaded.

For a court action, the evidence standard is higher and the rules of civil procedure apply — authentication, admissibility, and expert evidence may all be relevant. We work with local litigation counsel in the relevant EU jurisdiction for any court-based recovery.

How does the ADR.eu route compare with UDRP for a .eu domain?

A question we hear often: can you file a UDRP complaint to recover a stolen .eu domain? The short answer is no. The UDRP applies to gTLDs — .com, .net, .org, and other ICANN-delegated generic zones — and to the ccTLDs that have voluntarily adopted it. .eu is not one of those ccTLDs. The governing procedure is the ADR.eu process administered by the Czech Arbitration Court, not WIPO or the Forum.

That said, the two procedures share structural DNA. Both require the complainant to assert rights in a name, demonstrate the respondent's lack of legitimate interest, and establish an abusive registration or use. The ADR.eu procedure diverges meaningfully on three points.

First, the rights base is broader under ADR.eu, as noted above: you are not limited to registered trademarks. Second, the EU eligibility requirement adds a layer that UDRP does not have — the complainant seeking transfer must qualify to hold .eu, which eliminates the procedure as a transfer remedy for non-EU complainants. Third, the remedy for ineligible holders is revocation rather than transfer, a point with significant practical consequences for a business that has been using its .eu domain actively and needs it back rather than merely cancelled.

If a brand owner holds both a .eu and a .com, and both are abusively registered by the same party, we typically coordinate two parallel filings — ADR.eu for the .eu and a UDRP at WIPO or the Forum for the .com. The timelines do not run identically, but the evidence overlaps substantially, and a coordinated strategy avoids inconsistent fact statements across the two proceedings.

To weigh ADR.eu against a court action for your case, or to coordinate a multi-domain recovery across .eu and .com, email info@cognomenlaw.com.

When is court action the right path to recover a stolen .eu domain?

Court action is the right path when arbitration cannot deliver the remedy you need. ADR.eu transfers or revokes a domain. It does not award damages, does not compel disclosure of the attacker's identity, and does not issue interim injunctions freezing the domain before a decision is issued. For some stolen-domain situations, those limitations are decisive.

The scenarios where court action is preferred — or necessary — include the following. Where the domain is being used for an active fraud that is causing ongoing financial harm to customers and the business needs an immediate interim injunction, a national court can move faster than an arbitration panel. Where the theft was carried out by an identifiable individual or organized group and the complainant intends to pursue damages or a criminal complaint, court proceedings provide the procedural tools that ADR.eu does not. Where the registrar itself acted improperly — processed a transfer on deficient authorization or failed to apply standard identity checks — a claim against the registrar may run alongside the domain-recovery claim.

EU member states have civil courts with jurisdiction over .eu domain disputes. The choice of jurisdiction depends on where the complainant is established, where the respondent is located, and in some cases where the harm is most concentrated. We handle the strategy and filing for EU-based court matters and engage local litigation counsel in the relevant member state jurisdiction for the procedural steps that require local court admission.

In a matter involving a mid-size logistics company (autumn 2024), a hijacked .eu domain was rerouted to a fraudulent invoicing page. We secured an interim injunction through local litigation counsel within five business days, preventing further customer harm, before the ADR.eu complaint was decided. The dual strategy — court injunction plus arbitration — produced a transfer order and a damages award that ADR.eu alone could not have delivered.

What does it cost to recover a stolen .eu domain through ADR.eu or court?

The ADR.eu procedure is administered by the Czech Arbitration Court, which publishes its own fee schedule. Formal arbitration fees for .eu proceedings are set by the CAC and are at the lower end of the domain-dispute market — the CAC's entry-level fees for domain complaints begin around USD 500–800, making ADR.eu one of the more cost-accessible dispute procedures. Legal fees for preparing and filing an ADR.eu complaint are separate and depend on the complexity of the matter, the volume of evidence to assemble, and whether an eligibility analysis is required.

Court action is substantially more expensive. National civil proceedings involve court filing fees, legal representation at local admission rates, and in some jurisdictions expert-evidence costs. These vary significantly across EU member states and are best discussed in the context of a specific jurisdiction and a specific claim value. We give clients a realistic cost range at the initial assessment stage, before any filing commitment is made.

The cost of inaction is also a factor. A stolen .eu domain being used for phishing or fraud generates ongoing liability and brand damage. The longer the domain stays out of the legitimate holder's hands, the more difficult the evidence of misuse becomes to contain — and the more expensive the secondary harm is to remedy. We treat cost-of-inaction as part of every initial assessment, not an afterthought.

See COGNOMEN's court recovery and domain theft service for a broader overview of the routes available across all zones when a domain is hijacked or wrongfully transferred.

How do you choose between ADR.eu and court — and what about multi-zone situations?

The right route depends on the goal, the speed required, and the remedies needed. Consider the situation in practical terms:

If the .eu was abusively registered by a cybersquatter and you are EU-eligible, ADR.eu delivers a transfer order without the cost or delay of litigation. That is the standard case, and ADR.eu handles it efficiently. If the domain was stolen through an unauthorized transfer and the registrar has already locked it pending investigation, a well-assembled ADR.eu complaint may suffice — but only if no further misuse is occurring and the domain is not at risk of being moved again.

If the domain is being actively misused in a way that harms third parties in real time, if the theft was sophisticated, or if you need to know who did it, court is the correct route — or the court route runs in parallel with ADR.eu. The two are not mutually exclusive, and in high-stakes matters we routinely run both.

Multi-zone situations add a further dimension. A brand that has been targeted across .eu, .com, and national ccTLDs simultaneously needs a coordinated plan: ADR.eu for the .eu, a UDRP at WIPO or the Forum for the .com, and the governing national procedure for each ccTLD involved. The forum-selection decision has real cost and timeline implications — WIPO's filing fee for a single-domain, single-member UDRP is USD 1,500, while ADR.eu through the CAC runs lower. We model both before recommending a filing sequence.

For cross-border chain-of-title questions that arise before a recovery filing — or when acquiring a .eu domain with disputed history — see our guidance on verifying chain of title before a domain acquisition.

Related at COGNOMEN

• Court recovery and domain theft: all zones and routes, including injunctions and registrar escalation
• FAQ on court action for cybersquatting and domain disputes across national jurisdictions
• Verifying chain of title before acquiring a domain with contested history

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.