How to recover a stolen .net domain under the applicable domain rules

Your .net domain was transferred without your authorization. Someone gained access to your registrar account, forged a transfer request, or exploited a compromised email address – and your domain is now pointing somewhere it should not. You want it back, and the window to act is narrow.

To recover a stolen .net domain you must move on two tracks simultaneously: a registrar escalation to freeze the domain and document the unauthorized transfer, and a legal route – typically a UDRP complaint before WIPO, the Forum, or CAC, or in serious cases a court action – to compel the return of the name. The UDRP applies to .net domains in full, with a 20-day response window for the current registrant and a standard decision timeline of roughly two months. The right route depends on whether the theft is a simple account compromise, an organized hijacking, or a disputed ownership claim that a panel must resolve.

This page explains the applicable rules, the registrar mechanics, the evidence that decides the outcome, the choice between arbitration and court, and the realistic next step for a .net owner who needs to act now.

What rules apply to .net and why domain theft is a distinct legal situation

The UDRP applies to .net in full. Verisign operates the .net registry, and all registrars accredited by ICANN for .net are bound by the UDRP Policy and the ICANN Transfer Policy. Domain theft – meaning an unauthorized transfer of registration out of a legitimate owner's account – sits at the intersection of those two rule sets, and the path to recovery depends on which part of the scheme broke down.

A UDRP complaint before WIPO, the Forum, or CAC addresses whether the domain was registered and is being used in bad faith by a person with no legitimate interest. It works well when the thief has parked the domain, monetized it, or offered it for sale. It is less well suited to situations where the dispute is purely about account access and there is no ongoing bad-faith use to point to – in that scenario, the ICANN Transfer Policy and registrar-level processes are the first lever to pull.

The ICANN Transfer Policy imposes a procedure on gaining and losing registrars when a transfer request is made. A transfer that bypassed the required authorization – a domain authorization code that was obtained by fraud, a WHOIS/RDDS email address that was hijacked, or an account password obtained through phishing – is a wrongful transfer under that policy. Documenting the exact mechanism of compromise is the single most important step in the first 48 hours, because that documentation drives both the registrar escalation and any subsequent filing.

In our practice, we regularly advise domain owners who discover the theft only when a registrar sends a routine transfer-confirmation email – sometimes weeks after the event. Acting on that notice immediately, before the gaining registrar releases the name further or the thief requests a second transfer, is critical to preserving the most direct recovery path.

How does the registrar-lock and transfer-reversal process work for a stolen .net?

The registrar-level process is the fastest path to stopping further movement of the domain, and it runs in parallel with any legal filing. The original registrar – the losing registrar in ICANN's terminology – can place a registrar lock on a domain it no longer holds only in limited circumstances, so the focus shifts to the gaining registrar and to ICANN's own escalation channels.

First, file a formal complaint with the gaining registrar within the ICANN-prescribed window. Describe the unauthorized transfer, identify the mechanism of compromise (phishing, account breach, social engineering of the registrar's support desk), and demand that the domain be locked pending investigation. Gaining registrars have an obligation under ICANN's Transfer Policy to investigate a reported unauthorized transfer. They do not always act quickly without a documented, specific complaint – so the written record matters as much as the demand itself.

Second, submit an ICANN Registrar Dispute Escalation complaint if the gaining registrar does not respond or refuses to cooperate. ICANN's compliance function does not itself decide ownership, but documented non-compliance by a registrar creates procedural pressure that frequently accelerates movement. The goal at this stage is to prevent a second transfer out of the gaining registrar's system while you prepare the UDRP or court filing.

Third, document everything before those first 48 hours pass. DNS history, WHOIS/RDDS snapshots, email headers showing the phishing attempt or social-engineering sequence, and account-access logs from the original registrar are the evidentiary core. Courts and UDRP panels both weigh the documentary record of compromise heavily when deciding whether a transfer was unauthorized. Without that record, the burden of proving theft is harder to discharge.

If your .net has been transferred without your consent and you need to act now, contact COGNOMEN at info@cognomenlaw.com for an assessment of the registrar and legal routes available for your specific situation.

When does the UDRP work to recover a stolen .net domain?

The UDRP works best for .net theft recovery when the case can be framed as a dispute involving all three elements of Paragraph 4(a): the domain is confusingly similar to a mark you hold, the current registrant has no rights or legitimate interests in it, and the domain was registered (or taken over) and is being used in bad faith. A straight account hijacking – where the thief has no particular reason to want your mark and is simply monetizing the domain or holding it for ransom – often satisfies all three elements, particularly the bad-faith limb, because using a domain you stole for parking revenue or a resale demand is a recognized bad-faith pattern under Paragraph 4(b).

Panels have consistently held that a registrant who acquires a domain through unauthorized means and then uses it for commercial gain – redirecting traffic, displaying pay-per-click advertising, or demanding payment from the original owner – satisfies the bad-faith element under the Policy. The confusing-similarity element is typically straightforward when the domain is identical to the legitimate owner's registered trademark. The legitimate-interest element is almost always absent where the transfer was unauthorized: a thief cannot manufacture a legitimate interest in a domain they did not lawfully register.

In a matter we handled in early 2025 – a .net domain, spring 2025 – we secured a WIPO transfer order for a brand owner whose domain had been moved to a foreign registrar and pointed at a parking page carrying third-party advertising. The entire UDRP process, from filing to the registrar implementing the transfer order, ran approximately nine weeks. The respondent filed a brief reply asserting a spurious purchase claim; the panel found no credible evidence of a legitimate acquisition and ordered transfer.

Where the UDRP is less effective: when the dispute turns entirely on account access rather than trademark rights. If you hold no registered or unregistered trademark in the domain string – for example, if the domain is a generic or descriptive term – the UDRP's first element is harder to satisfy, and the registrar-escalation or court route may be the only viable path. We assess the trademark position as the first step in any .net theft instruction.

What evidence decides a .net domain theft case at WIPO or in court?

The evidentiary record for a stolen-domain case differs from a standard UDRP complaint in one key respect: you must prove not only that the domain corresponds to your mark and that the respondent lacks legitimate interests, but also that the transfer was unauthorized. That second element – compromise – requires documentation that a standard trademark-similarity filing does not.

The core evidence categories for a .net theft case are as follows.

• Account-access records: login timestamps, geographic anomalies, and session logs from the original registrar showing access from an unfamiliar IP address or device at the time of the transfer.
• Transfer-mechanism evidence: the domain authorization code (also called an EPP auth-info code) and how it was obtained – was it requested through a compromised email address? Was the registrar's support desk manipulated into issuing a replacement?
• Phishing or social-engineering documentation: emails purporting to be from the registrar, any password-reset requests you did not initiate, and headers showing a spoofed sender domain.
• WHOIS/RDDS history snapshots: timestamped records showing the registrant details before and after the transfer, capturing the exact moment ownership changed in the public record.
• Trademark ownership evidence: registered trademark certificates, use-in-commerce records, and evidence that your mark predates the domain's original registration – establishing that you were the intended and rightful owner.
• Post-theft use evidence: screenshots of the domain resolving to a parking page, a for-sale listing, a redirect to a competitor, or any other use that confirms bad faith after acquisition.

At WIPO, the complaint must attach this evidence as annexes to the filing. WIPO's electronic filing system accepts annexes up to a substantial size, but the discipline required is to present the compromise evidence clearly and in chronological order. Panels are not investigators; they decide on the record placed before them. A well-organized evidentiary submission – compromise timeline first, trademark rights second, post-theft use third – is consistently more persuasive than a voluminous but unordered exhibit set.

In court, the evidentiary standard is higher and the process is longer. For a .net theft that requires a US court action – for example, because the gain was organized, involves a sophisticated actor, or requires damages – the same evidence forms the foundation of an anticybersquatting or conversion claim, but expert testimony on DNS and registrar mechanics may be required.

When should a court action replace or supplement the UDRP for a stolen .net?

The UDRP's only remedies are transfer or cancellation of the domain. It awards no damages, no legal costs, and no injunction against future conduct. For most .net theft cases, that is sufficient. But several scenarios call for court action either instead of, or alongside, the UDRP.

The right route depends on the goal and the facts. Consider the following situations.

If the theft involved a coordinated attack on multiple domains, or if the same actor has targeted other brand owners in a pattern, a UDRP complaint covers only the specific domains named in it. A court action – US anticybersquatting litigation, in particular – can address the pattern, seek damages, and potentially reach injunctive relief covering future conduct. The filing fee and legal costs are substantially higher than a UDRP, but the remedial scope is wider.

If the registrar chain includes a foreign registrar in a jurisdiction with no cooperative relationship with ICANN compliance, a court order from a relevant jurisdiction may be more effective than a UDRP transfer order in compelling the registrar to act. We work with local litigation counsel in the relevant jurisdiction when a court route abroad is required.

If the original transfer involved wire fraud, identity theft, or computer fraud – as many organized domain hijackings do – a law enforcement referral runs in parallel with the civil route. Courts can compel temporary restraining orders that freeze the domain during litigation faster than a UDRP panel can be appointed. For high-value .net domains, the cost of a TRO application is often justified by the speed of the interim freeze.

If the dispute is fundamentally about ownership rather than theft – for example, a business partnership breakdown where both parties claim the domain – the UDRP may not be the right forum at all. Panels decline jurisdiction over pure ownership disputes that do not fit the bad-faith framework. In those cases, court is the starting point, not the fallback.

In a second matter from our caseload – a .net domain, autumn 2025 – a client faced a situation where the gaining registrar was based outside the US and declined to respond to ICANN compliance escalations. We pursued a dual track: a UDRP complaint at WIPO to establish the transfer as unauthorized and bad faith, alongside a parallel court filing in the relevant US jurisdiction to obtain a temporary order directing the .net registry operator to lock the domain at the registry level pending the UDRP decision. The approach preserved the domain against a further transfer while the UDRP proceeded.

For a read on whether the UDRP or a court action – or both – fits your stolen .net situation, email COGNOMEN at info@cognomenlaw.com.

What is the realistic cost structure for recovering a stolen .net domain?

For .net theft cases pursued through UDRP, the forum filing fee and the legal fee are separate costs. At WIPO, the filing fee for a single-domain, single-member panel complaint is USD 1,500. The Forum's fee starts at around USD 1,300 for one or two domains with a single-member panel. CAC starts lower, around USD 500–800, making it the lowest-cost arbitration entry point for a straightforward case. Legal fees for a UDRP complaint in the domain theft context typically fall in the range commonly seen for single-domain cases – fact-dependent, but generally in the range of several thousand US dollars for complaint preparation and filing, separate from the forum fee.

The choice between WIPO, the Forum, and CAC is not purely a cost decision. WIPO carries the largest case volume and the deepest published jurisprudence, which is an advantage in a theft case where you need a panel to understand the technical evidence of account compromise. The Forum is also a well-established forum. CAC is the least used of the three, though a legitimate option. WIPO and the Forum together account for approximately 97% of all UDRP proceedings.

Court action carries substantially higher costs and is hourly in most structures. For high-value .net domains – those with a meaningful market value, or those whose ongoing redirection is causing quantifiable business damage – the economics of court can be justified. For a lower-value domain, UDRP is almost always the proportionate route.

One cost consideration specific to theft cases: if WIPO partially refunds the filing fee when a case is withdrawn or terminated before panel appointment, and the registrar escalation succeeds before the WIPO panel is appointed, the effective cost of using WIPO as a pressure tool while pursuing the registrar route is lower than the headline filing fee. WIPO commonly refunds approximately USD 1,000 of a USD 1,500 fee in those circumstances. We factor this into the filing strategy for clients pursuing a parallel track.

How does a .net theft case compare to a .de or .uk theft case?

The cross-zone comparison matters because many domain owners hold the same brand name across multiple zones, and theft of a .net often involves or reveals vulnerabilities in a broader portfolio. The rules diverge sharply once you move off .net.

For .net, as explained above, the UDRP applies in full. For .uk, the Nominet DRS applies – a distinct procedure with a free mediation stage before any expert decision, and a test of "abusive registration or use" rather than the UDRP's cumulative "registered AND used in bad faith" requirement. The Nominet DRS uses "registered OR used" abusively, which in some theft scenarios is a lower bar. A reasoned .uk case typically runs about 8–12 weeks. For .de, there is no UDRP and no equivalent administrative procedure: disputes go to the German courts, with a DENIC DISPUTE entry available to block transfers during litigation. For .eu, the ADR.eu procedure administered by the Czech Arbitration Court applies, with remedies that can include transfer where EU eligibility is met.

The practical implication: if your .net theft also affected a .uk or .eu registration in the same portfolio, those cases run on entirely separate procedural tracks, with separate filings, separate forums, and different evidence requirements. A unified strategy that coordinates timing across zones – so that a UDRP transfer order in .net does not leave the .uk or .eu exposure unaddressed – is worth planning from the outset. We handle multi-zone instructions as an integrated matter.

For ccTLDs not confirmed in the above list, the governing national procedure applies, and the current registry rules should be verified with counsel before any filing is made.

Related at COGNOMEN

• Court action and domain theft recovery: when arbitration is not enough and what to do instead
• Recover a hijacked .cn domain: procedures and cross-border strategy for Chinese-zone theft
• Domain due diligence alert: what to check before acquiring a domain in the .ae zone

COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. In the domain theft context, we escalate registrar locks, document account compromise, and pursue transfer reversals and UDRP filings as an integrated process. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking matters. To discuss a stolen .net domain or any domain theft situation, contact info@cognomenlaw.com.

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.