How to recover a stolen .jp domain under the applicable domain rules

Your .jp domain disappeared overnight. The registrar's RDDS record now shows a different registrant, a different email, and an address you have never seen. Customers are already reaching a site you did not build. The question is not whether to act – it is which route moves fastest and what evidence you need today.

To recover a stolen .jp domain you have two primary routes: the JP-DRP – the Japan Domain Name Dispute Resolution Policy administered by the Japan Intellectual Property Arbitration Center – and Japanese court action for cases where arbitration cannot reach the remedy you need. Immediate registrar escalation to freeze the domain runs in parallel with either route. The strength of your account-compromise evidence and the nature of the adverse registrant determine which path resolves the matter.

This page covers what the JP-DRP requires, how registrar-lock mechanics work, when a court route is the sharper tool, and what evidence decides the outcome – so you can assess your position and decide the next step.

What governs .jp domain recovery – and why it differs from a UDRP complaint

The JP-DRP is the governing arbitration-based procedure for .jp disputes. It is administered by the Japan Intellectual Property Arbitration Center (JIPAC) and applies to domain names under the .jp ccTLD. It is not the UDRP. Although both policies share a three-element structure – confusing similarity to a trademark, no legitimate interest, and bad faith – the JP-DRP operates under Japanese law principles and JIPAC procedural rules, not ICANN policy.

That distinction matters practically. A complainant who has already obtained a UDRP decision under a related gTLD dispute cannot simply carry that decision into JP-DRP proceedings and claim automatic relief. Each procedure is self-contained. The JP-DRP examines the specific .jp registration on its own record, under its own rules, before a JIPAC-appointed expert panel. Panels have consistently held that prior UDRP outcomes are persuasive but not binding on separate proceedings.

Where the UDRP is driven by an international accreditation framework and ICANN oversight, .jp is operated by Japan Registry Services (JPRS). JPRS mandates compliance with the JP-DRP as a condition of .jp registration. Any registrant of a .jp domain is therefore contractually bound by the procedure. That contractual hook is the foundation on which arbitration relief rests.

The remedies available under JP-DRP mirror those of the UDRP: transfer or cancellation of the domain. There are no monetary damages and no costs awards through the arbitration route alone. If you need damages, a Japanese court action is the appropriate path – but that is a substantially longer, more resource-intensive road than a JP-DRP complaint.

What triggers a theft scenario in .jp – and how to recognize one

A "stolen" .jp domain is a domain transferred away from the legitimate registrant without authorization. It is categorically different from a cybersquatting scenario, where a stranger registered the name in the first place. In a theft, you owned the domain; someone took it. The legal and procedural response differs accordingly.

Theft patterns in the .jp namespace typically involve one of three vectors. First, account compromise: a malicious actor gains access to the registrant's account at the JPRS-accredited registrar, changes the contact email, unlocks the domain, and initiates a transfer. Second, social engineering of registrar support: fraudulent transfer-authorization requests submitted by impersonating the registrant's identity. Third, internal bad actors: a former employee or contracted administrator who held registrar-account credentials.

Recognizing the pattern quickly matters because the transfer-reversal window is narrow. Once a .jp domain has cleared into a new registrar account, reversing it without the cooperation of the current registrant – or without a dispute resolution order – becomes significantly harder. Time pressure is not incidental here. It is structural.

A related scenario we frequently encounter in our practice involves the domain not being "stolen" in the traditional sense, but wrongly transferred to a former joint-venture partner or licensing counterparty who was granted registrar-account access during a commercial relationship. That category of dispute sits at the edge of the theft route and the cybersquatting route – and the right strategy differs from a pure account-compromise case.

How registrar escalation and transfer-reversal mechanics work for .jp

The first action in any .jp theft recovery is registrar escalation – not filing a complaint. Every JPRS-accredited registrar is obligated to investigate documented transfer-authorization irregularities. A properly submitted escalation can result in the registrar placing a registrar lock on the domain while the investigation proceeds, preventing further transfer to a third party.

That lock is critical. Without it, a bad actor can flip the domain to a second buyer, complicating your chain-of-title claim. A locked domain stays in place while you build the arbitration or court record.

The escalation package should include: a timestamped chronology of the domain's registration history under your control; records of any account-access notifications that you did not authorize; your original registration confirmation and historic RDDS records showing your name as registrant; and any communications from the registrar confirming the transfer was initiated by someone presenting your credentials. This same package forms the evidentiary spine of a JP-DRP complaint or a court application.

Where the registrar declines to act – or confirms the transfer was technically authorized by someone presenting correct credentials (even if those credentials were obtained by fraud) – the escalation path reaches its ceiling. That is the point at which JP-DRP or court action moves from a parallel track to the primary track.

If you have already escalated to the registrar and hit a wall, the next step is to assess whether JP-DRP or a court filing fits your timeline and evidence. To weigh those options for your domain, email info@cognomenlaw.com.

What the JP-DRP requires – the three elements and where theft cases fit

The JP-DRP, like the UDRP, requires the complainant to establish all three elements of the applicable domain dispute test: confusing similarity to a mark or name in which the complainant has rights; no legitimate interest on the part of the registrant; and registration or use in bad faith. In a pure theft scenario, the analysis runs differently from a classic cybersquatting complaint – and that difference is where experienced advocacy matters.

On the first element, the complainant is typically asserting rights in its own domain name string. If you hold a Japanese trademark registration – or a registered mark in another jurisdiction used in commerce affecting Japan – the confusing similarity element is usually straightforward. Panels have held that identity between the domain and the mark satisfies this element without further analysis.

The second element – no legitimate interest – is effectively conceded by the theft itself. A person who acquired the domain by unauthorized transfer does not hold a bona fide interest recognized under the JP-DRP safe harbors. They were not commonly known by the name before the transfer, they made no bona fide offering before a dispute arose, and they have no legitimate noncommercial or fair-use basis for holding a domain string that belonged to another party.

The third element – bad faith – is where the theft record does the heaviest lifting. Evidence that the transfer was unauthorized, that the registrant took active steps to conceal the transfer (such as switching WHOIS contact details), and that the domain is now directed to content unrelated to the registrant's purported identity all support a bad-faith finding. Panels have consistently held that registering (or receiving) a domain known to belong to another party, with no plausible explanation, satisfies the bad-faith element.

Where JP-DRP diverges from a straightforward cybersquatting complaint is in the availability of supplemental evidence. Theft cases often involve technical log records, email headers, and registrar audit trails that require authentication. Submitting that evidence in a format the panel can evaluate – and tying it to the three elements clearly – is often the difference between a transfer order and a denial.

When a Japanese court action outperforms JP-DRP

JP-DRP delivers the fastest outcome for a theft with a clear trademark nexus and a definable adverse registrant. But arbitration is not always the sharper tool. Several scenarios make a Japanese court action the more appropriate, or the only viable, route.

The first is when you need interim relief before the full merits are decided. A Japanese court can grant a provisional disposition – a court-ordered registrar lock or provisional transfer – while the main case is pending. JP-DRP does not offer provisional measures. If the adverse registrant is actively moving the domain or monetizing it in a way that causes immediate commercial harm, waiting for the arbitration timeline to run may not be acceptable.

The second is when you need damages alongside the domain. JP-DRP awards transfer or cancellation only. It cannot order compensation for lost traffic, diverted customers, or brand damage. A court action, run with local litigation counsel in Japan, can pursue both the domain and a damages claim in the same proceeding. That combination is worth the additional resource investment when the commercial harm is quantifiable and significant.

The third is when the chain of transfer is broken – the domain has moved through multiple registrants since the theft, and the current holder may be a bona fide purchaser without actual knowledge of the fraud. JP-DRP proceedings against a current holder with a plausible innocent-purchaser defense carry a higher reversal risk. A court proceeding can reach the original fraudulent transfer directly and establish the chain of title in a way that a domain-policy panel may be reluctant to do.

The right route, then, follows the facts. A single-hop theft with a clear bad actor, a registered trademark, and a domain still sitting in the first unauthorized registrant's name – that is a JP-DRP case. A multi-hop transfer, a damages claim, or an urgent interim-relief need – that case probably belongs in court, coordinated with local litigation counsel in Japan.

If the chain of transfer in your situation is complex, or if you are weighing damages alongside recovery, a focused assessment can identify whether JP-DRP or a Japanese court filing is the right first move. Contact info@cognomenlaw.com to discuss.

What evidence decides a .jp domain theft case

In our practice, the cases that succeed at JP-DRP – and in court – are almost always won on the documentary record assembled in the first 72 hours after the theft is discovered. Evidence degrades quickly: servers cycle, accounts close, and bad actors take steps to obscure their traces. Acting on the evidence before it disappears is as important as understanding the legal test.

The core evidentiary checklist for a .jp theft case includes:

• Historic RDDS / WHOIS printouts showing you as the registrant, with timestamps, covering the period of registration up to the unauthorized transfer
• Registrar account-access logs, if available, showing IP addresses and device identifiers of login sessions you did not authorize
• Email headers and server logs documenting any phishing or social-engineering communications that preceded the transfer
• Your original domain registration confirmation, renewal receipts, and any domain management agreements
• Communications with the registrar following your discovery of the transfer, including any rejection of a reversal request
• Evidence of your trademark rights: Japanese trademark registration certificate, or equivalent evidence of use in commerce relevant to Japan
• Evidence of the current registrant's use of the domain: screenshots of the site, traffic-diversion indicators, monetization activity, or contact attempts demanding payment

Panels have noted that the absence of any plausible legitimate explanation from the respondent – combined with a clear chain of registration history in the complainant's favor – routinely supports a transfer finding. Conversely, a thin evidentiary record, or one that relies on generic assertion rather than timestamped documentation, creates openings for a denial.

In a recent matter involving a .jp domain stolen via account compromise in early 2025, we assembled the registrar log evidence, demonstrated that the transfer-authorization email had been sent from a spoofed address, and secured a transfer order through the dispute resolution process before the bad actor could monetize the domain further. No amount was put into dispute; the record spoke for itself.

Decision matrix: JP-DRP, registrar escalation, or Japanese court action

Choosing the right route requires mapping your situation to the remedy and the timeline you need.

If the domain was transferred within the last few days and the registrar's escalation channel is still open, begin with registrar escalation immediately. This is not a substitute for a formal filing, but it buys a registrar lock while you prepare the substantive case. Cost is zero; timeline is registrar-dependent. Risk is that registrars are inconsistent – some will lock quickly on strong evidence; others will insist on a dispute resolution order first.

If escalation stalls and you have a Japanese or internationally recognized trademark, JP-DRP through JIPAC is typically the fastest formal route. The procedure is arbitration-based, conducted in Japanese, and the outcome is binding on the registrar. Filing fees and timelines should be confirmed directly with JIPAC, as the governing national procedure applies and published fees may be updated. Legal fees for a straightforward JP-DRP complaint are typically in the same range as a UDRP matter – commonly in the USD 3,000–7,000 range for preparation and representation, separate from official fees. The only remedies are transfer or cancellation.

If you need damages, interim relief, or if the domain has passed through multiple hands, a Japanese court action is the appropriate path. This is substantially more resource-intensive and time-consuming than arbitration. It is handled with local litigation counsel in Japan, with COGNOMEN coordinating the strategy and cross-border elements. This route is the right choice when the commercial harm is large enough to justify the investment, or when the JP-DRP route is unavailable or insufficient for the specific facts.

If the stolen .jp domain is part of a portfolio that also includes a .com or another gTLD registered by the same unauthorized registrant, a parallel UDRP complaint before WIPO or the Forum may run simultaneously with the JP-DRP, targeting the gTLD component. Those proceedings are independent but strategically complementary – an adverse UDRP decision on the .com adds pressure and persuasive weight to the .jp proceeding.

Cross-zone considerations: when the theft spans .jp and gTLDs

Domain theft rarely stops at one extension. A sophisticated actor who successfully hijacks a .jp will frequently register or attempt to hijack the corresponding .com, .co.jp, or other extensions simultaneously – to maximize leverage or to confuse the recovery effort.

Where the theft spans both a .jp and a generic top-level domain such as .com or .net, you are operating under two different rule systems. The .com is governed by the UDRP, with WIPO, the Forum, or CAC as provider options. The .jp is governed by JP-DRP and JIPAC. Each must be filed separately, before the respective forum, on its own evidentiary record.

Coordinating those filings matters. The chronology of the theft, the trademark record, and the bad-faith evidence are common across both cases, but they must be formatted and submitted according to each forum's rules. In our practice, we regularly advise brand owners who face this multi-zone scenario – assembling a single unified evidence record and then preparing two tailored filings from it, rather than running two fully independent efforts that risk inconsistency.

Where the bad actor is based outside Japan, the court route adds a further layer: enforcement of a Japanese judgment or a JP-DRP order against a foreign-based registrant may require parallel proceedings in the relevant jurisdiction. That is handled with local litigation counsel in the relevant jurisdiction, coordinated through COGNOMEN's cross-border practice.

In a recent multi-zone matter (a .jp and .com portfolio, summer 2025), we coordinated simultaneous JP-DRP and UDRP filings, using a unified evidence base to demonstrate the unauthorized transfer across both zones. The two proceedings reached conclusions within weeks of each other, and the portfolio was restored to the legitimate registrant without court intervention.

Related at COGNOMEN

• Court action and domain theft recovery across zones and forums
• Enforcing a UDRP decision: the Singapore perspective on cross-border compliance
• Court action for cybersquatting in the UAE: when arbitration is not enough

About COGNOMEN

COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones – before WIPO, the Forum, CAC, ADNDRC, and national procedures including JP-DRP and related ccTLD proceedings – and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants, including respondent-side defense and cases involving reverse domain name hijacking. Our practice covers single-domain theft matters and multi-zone portfolio recovery coordinated across jurisdictions. To discuss a stolen or disputed .jp domain, contact info@cognomenlaw.com.

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.