How to recover a stolen .online domain under the applicable domain rules

A domain stolen overnight can redirect years of brand equity to a stranger within hours. For .online registrants, the theft typically follows a familiar script: account credentials are compromised, an unauthorized transfer is initiated, and by morning the domain resolves to a parking page or a phishing site. The question is not whether recovery is possible. The question is which legal mechanism applies and how quickly it can be deployed.

To recover a stolen .online domain, the available routes are registrar-level transfer reversal, a UDRP complaint at WIPO (where .online operates under ICANN's gTLD policy), or court action where arbitration cannot reach the specific facts. A standard WIPO proceeding runs approximately two months from filing to decision; the filing fee for a single-member panel covering one to five domains starts at USD 1,500. The record of how the theft occurred – account logs, registrar correspondence, WHOIS history – determines which route moves fastest and which one the panel or court will find decisive.

This page covers the legal framework that governs .online, the registrar mechanics of transfer reversal, the evidence that decides outcomes, when a court route outperforms arbitration, and the realistic next step for a registrant who has already lost control of the name.

What legal rules govern .online, and does the UDRP apply?

.online is a new generic top-level domain (gTLD) launched under ICANN's 2012 new gTLD program, and like all ICANN-accredited gTLDs, it is subject to the Uniform Domain-Name Dispute-Resolution Policy – the UDRP. That means WIPO, the Forum, CAC, and ADNDRC all have jurisdiction to hear complaints about abusive registrations in the .online zone. It also means a stolen .online domain sits within the same Policy framework as .com or .net, with one important qualification: theft and cybersquatting are legally distinct, and the procedural response differs accordingly.

When a domain is stolen, the registrant has not lost a trademark dispute – it has lost control of a registration it legitimately holds. That distinction shapes the strategy. The UDRP is designed to resolve disputes between a trademark owner and a registrant who registered abusively; it was not designed as a title-recovery mechanism for the original registrant after unauthorized transfer. In practice, however, panels do hear cases where theft is the underlying event, and where the current holder cannot demonstrate any legitimate interest, a transfer back is possible. What drives the outcome is the quality of the evidence, not the label attached to the grievance.

If you have lost control of a .online domain and need an immediate read on which mechanism applies, contact info@cognomenlaw.com.

How does the registrar-lock and transfer-reversal process work for a stolen .online domain?

The fastest first response to a stolen .online domain is almost always a registrar escalation, not a UDRP filing. Transfer reversal operates through ICANN's Transfer Policy, which requires that any inter-registrar transfer be preceded by authorization from the registrant of record. When that authorization was obtained through account compromise – phishing, credential stuffing, SIM-swap – the transfer is voidable, and the gaining registrar is required to cooperate with a reversal request supported by evidence of unauthorized access.

The mechanics work like this. The original registrant contacts the losing registrar (the one from which the domain was transferred out) and files an abuse report documenting the unauthorized transfer. The losing registrar escalates to ICANN's Contractual Compliance team if the gaining registrar is unresponsive. ICANN can direct the gaining registrar to place the domain on a registrar lock – freezing further transfers – while the complaint is processed. If the gaining registrar confirms the unauthorized transfer, it initiates a transfer back through the standard EPP protocol.

Speed is everything here. ICANN's Transfer Policy provides a 60-day lock after any transfer that prevents another outbound transfer within that window, which can work for or against the original registrant depending on timing. Filing the abuse report within days of discovering the theft – before the domain is moved again – substantially increases the probability of a clean reversal.

In a recent matter involving a .online domain theft in autumn 2024, we escalated a registrar lock within 48 hours of the client's first contact, documented the phishing campaign that compromised the account credentials, and secured a full transfer reversal without initiating any arbitral proceeding. The domain was back in the original registrant's control in under three weeks.

When does a UDRP complaint work for recovering a stolen .online domain?

A UDRP complaint is the appropriate mechanism when the domain is now held by a party who registered it in bad faith – or who has used the domain in bad faith following an unauthorized transfer – and when registrar-level reversal has either failed or is unavailable because the domain has already changed hands multiple times. To succeed, the complainant must prove all three elements of Paragraph 4(a): the domain is identical or confusingly similar to a mark in which the complainant has rights; the current holder has no rights or legitimate interests; and the domain was registered and is being used in bad faith.

The complication in a theft scenario is element three. The original registration was in good faith – by the rightful owner. The bad faith arose at the point of unauthorized transfer or subsequent use. Panels have generally found that the relevant inquiry, in cases of post-transfer bad faith, is the conduct of the current holder, not the origin of the registration. Where the current holder is using the domain to host malware, redirect traffic for commercial gain, or demand a ransom payment from the original registrant, the bad-faith finding is well-supported. Where the domain is simply parked with no apparent use, the evidence package must be stronger.

Forum selection within the UDRP matters. WIPO administers the largest volume of .online and other new gTLD cases and offers an expedited option for single-panel cases covering up to five domains, delivering a decision in approximately one month. The Forum is the second principal provider. CAC offers the lowest entry-point filing fee – approximately USD 500–800 – though it handles a smaller share of total volume. For a stolen .online domain where speed is the priority, WIPO's expedited track merits consideration alongside its standard two-month timeline.

What evidence decides whether a UDRP panel will order the domain returned?

Evidence is the variable that panels weight most heavily. The framework is fixed – three elements, the Paragraph 4(b) bad-faith factors, the Paragraph 4(c) safe harbors – but within that framework, the documentary record is what separates a transfer order from a denial.

For a stolen .online domain specifically, the core evidence package typically includes the following. Registration history: WHOIS records and registrar logs showing the original registrant's unbroken tenure before the unauthorized transfer. Account compromise documentation: email headers from the phishing attempt, two-factor authentication bypass records, registrar login logs showing access from an anomalous IP or geography. Trademark or common-law rights evidence: a registered mark, or clear secondary-meaning evidence tied to the domain name, demonstrating that the complainant has rights in a corresponding mark. Post-transfer use evidence: screenshots of how the domain resolves under the current holder – phishing pages, parking revenue pages, ransom demands, or redirect chains. Communications: any messages from the current holder demanding payment, threatening further action, or acknowledging awareness of the original registrant's claim.

Panels have consistently held that passive holding alone – a domain that resolves to an inactive page – can still constitute bad faith use where the circumstances of acquisition were plainly abusive and no plausible good-faith purpose is evident. The "passive holding" doctrine is well-settled in UDRP jurisprudence and is particularly relevant to stolen domains that are held dormant while the thief awaits an offer.

What panels do not reward is a complaint filed with conclusory allegations and thin documentation. We regularly advise brand owners and registrants who arrive with a credible underlying claim but insufficient evidence assembled before filing. The investment in building a complete record before the complaint is submitted – not after – is what turns a strong factual claim into a panel transfer order.

To weigh UDRP against a court action for your stolen .online domain, email info@cognomenlaw.com.

When does court action outperform arbitration for a stolen .online domain?

The UDRP has real limits for theft scenarios. It cannot award monetary damages. It cannot sanction the thief for identity fraud, unauthorized computer access, or unjust enrichment. And it cannot compel third parties – hosting providers, payment processors, law enforcement – to cooperate with evidence collection. When those remedies matter, court action is the mechanism that reaches them.

Consider the decision matrix. If the domain was stolen and the current holder is making phishing or fraud use of it, and you have evidence of the specific actor, a court injunction is often faster than any arbitral process at restraining that use. If the theft involved criminal activity – credential theft, wire fraud, account compromise for financial gain – parallel criminal referral to law enforcement may be the appropriate first step alongside civil proceedings. And if the domain theft is part of a broader cybersecurity incident, the evidentiary discovery available in court – subpoenas to registrars, hosting providers, and payment processors – gives access to facts that no UDRP panel can compel.

The trade-off is cost and timeline. Court action in the United States, for example, under US anticybersquatting legislation, is substantially more expensive and slower than a WIPO proceeding. It is also jurisdictionally bounded: a US court action reaches US-registered entities and US-based actors most cleanly. Where the thief is outside the US, coordinating with local litigation counsel in the relevant jurisdiction is necessary to pursue a court route with teeth.

The practical answer for most stolen .online domains is a phased approach: registrar escalation immediately, UDRP filed concurrently or shortly after if escalation stalls, and court action reserved for cases where damages, discovery, or third-party orders are essential. We have defended and pursued all three routes in parallel in complex theft matters, and the right calibration depends on facts we assess at the outset.

In a matter from early 2025 involving a .online domain used for credential-harvesting post-theft, we advised a combined approach: registrar lock escalation within 24 hours, a WIPO complaint filed ten days later, and a parallel referral to the relevant law enforcement authority documenting the phishing infrastructure. The WIPO panel ordered transfer approximately eight weeks after filing. The court route was held in reserve pending the arbitral outcome.

What is the realistic cost to recover a stolen .online domain?

Cost has two distinct components: the forum's official filing fee and the legal fee for preparing the case. They are separate, and conflating them is a common source of confusion.

For a WIPO UDRP complaint covering a single .online domain before a single-member panel, the official WIPO filing fee is USD 1,500. A three-member panel costs USD 4,000. If you request a single panelist and the respondent requests a three-member panel, the parties generally split the higher fee. The Forum's filing fee for one to two domains starts at approximately USD 1,300. CAC starts lower, around USD 500–800, though it is used least frequently of the major providers. These are forum fees only – they do not include legal preparation.

Legal fees for preparing a UDRP complaint for a single domain, in a straightforward case, run in a market range commonly cited as USD 3,000–7,000, separate from the filing fee. Theft cases can exceed that range where the evidence record requires forensic assembly or where the registrar escalation phase demands significant advocacy before arbitration is even filed. Court action carries a substantially higher cost basis and is priced on an hourly or matter-specific basis depending on jurisdiction and scope.

COGNOMEN publishes its approach to fee transparency because this market frequently does not. We assess the merits and the evidence before recommending a route, and the filing fee versus legal fee split is part of every initial discussion.

How does the cross-zone picture affect strategy for a stolen .online domain?

Many brand owners whose .online domain is stolen also hold the same name in other zones: .com, .net, a ccTLD, or multiple new gTLDs. That cross-zone position shapes the strategy in two ways.

First, trademark rights established in connection with a .com or registered trademark strengthen the UDRP complaint for the .online theft, because Paragraph 4(a)(i) requires only that the domain be confusingly similar to a mark the complainant holds – not a mark registered specifically for the .online zone. A brand owner with a registered mark in any ICANN-recognized jurisdiction has the rights foundation needed for the UDRP complaint, regardless of the zone in which the theft occurred.

Second, where the same actor has stolen or abusively registered the same name across multiple zones, a single UDRP complaint may cover all domains held by that registrant, provided the same holder controls them. A complaint covering five .online, .com, and .net variants at WIPO costs USD 1,500 for a single-member panel covering one to five domains – no more than a single-domain filing. That economics argument alone often favors consolidation.

For ccTLD variants – a .de, .uk, or .eu counterpart to the stolen .online – the governing procedure is different in each zone and may not accept a UDRP complaint at all. A stolen .de domain, for instance, does not have a UDRP remedy: disputes in the .de zone go through the German courts, with a DENIC DISPUTE entry available to block further transfer while litigation proceeds. A stolen .uk domain falls under the Nominet DRS, which applies a distinct test – "abusive registration" – and moves on its own timeline. Cross-zone coordination, where multiple zones are involved, is a work-stream we manage explicitly rather than treating each zone as an isolated matter.

Related at COGNOMEN

• Court action and domain theft recovery services – overview of all routes
• Step-by-step guide to court action for cybersquatting across jurisdictions
• Analysis: recovering a typosquat domain under US anticybersquatting law

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.