How to recover a stolen .pl domain under the applicable domain rules

You open your registrar dashboard one morning and the domain is gone. The WHOIS record shows a new registrant you have never heard of, the DNS now points elsewhere, and your business email has stopped delivering. That is not a dispute over who has a better claim to the name. That is theft — and recovering a stolen .pl domain requires a different playbook from a standard UDRP complaint.

Recovering a stolen .pl domain means reversing an unauthorized transfer through a combination of immediate registrar escalation, evidence of account compromise, and — where the registrar route stalls — a court action under the applicable Polish national procedure. There is no UDRP for .pl. The governing rules sit with NASK, the Polish registry, and with the Polish civil courts, which have jurisdiction over unauthorized domain transfers as a matter of property and tortious interference. Speed is the single most important variable: the longer the domain sits with a new registrant, the more the chain of title complicates recovery.

This page covers what applies in .pl, how registrar-lock and transfer-reversal mechanics work, when court action overtakes the registrar route, and what evidence decides the outcome.

Why .pl has no UDRP – and what applies instead

NASK, the Polish registry operator, has not adopted the UDRP and does not operate a published UDRP-equivalent arbitration procedure for .pl domains. That single fact shapes every step that follows. You cannot file a WIPO complaint and wait two months for a transfer order. If you need to recover a stolen .pl domain, the procedural options are the registrar's internal abuse and transfer-reversal process, a formal dispute with NASK, and — where those routes are insufficient or too slow — an application to a Polish civil court.

What makes the .pl situation workable is that Polish civil law provides a coherent basis for a domain-theft claim. A domain registration is treated as a contractual right that can be protected against unauthorized transfer, analogous to an unlawful taking of property. Courts in Poland have jurisdiction to order a domain returned to its rightful registrant, to enjoin further transfers, and to award damages. The court route is longer and more expensive than UDRP arbitration, but it is the route that can produce enforceable, binding relief — including an interim order to freeze the domain while the case is resolved.

For a comparison of how this differs from the German .de theft route — where a DENIC DISPUTE entry blocks transfer during litigation — see our analysis of reversing an unauthorized .de domain transfer. The mechanics differ, but the strategic logic is the same: lock the domain first, litigate second.

What counts as a stolen domain – and why the distinction matters

Domain theft in the .pl context takes three common forms, and each calls for a different immediate response. The first is account compromise: a bad actor gains access to the registrant's registrar account — usually through phishing, credential stuffing, or an SIM-swap attack — and initiates a transfer to a new registrar or updates the registrant contact to themselves. The second is social engineering of the registrar: the attacker impersonates the legitimate registrant and persuades the registrar to change account credentials or authorize a transfer. The third is a fraudulent transfer at the registry level, which is rarer but documented.

The distinction matters because the evidence you need, and the party you need to pressure first, depends entirely on which form the theft took. Account-compromise cases require you to document the intrusion — access logs, forensic images of phishing emails, and a timeline showing you did not authorize the transfer. Social-engineering cases require you to show the registrar what authentication process was bypassed. A registrar that transferred the domain on a forged authorization bears its own liability and is therefore more likely to cooperate in a reversal — an argument that experienced counsel can deploy in the opening escalation letter.

If you have discovered an unauthorized transfer of your .pl domain, the window for a voluntary reversal is typically shortest in the first 48 to 72 hours. For an assessment of your recovery options, contact info@cognomenlaw.com.

How does registrar escalation work – and when does it stop being enough?

Registrar escalation is always the first step, even when the domain has moved to a different registrar. Under ICANN's transfer policies — which apply to .pl to the extent that accredited registrars follow them — a registrar that processed a transfer on fraudulent credentials is required to investigate and, in clear cases, reverse the transfer without a court order. The practical reality is more uneven: some registrars act within days; others treat theft complaints as low-priority tickets and stall.

The escalation sequence, run correctly, works like this. First, the legitimate registrant sends a formal, written demand to the current registrar of record, asserting unauthorized transfer and requesting an immediate domain lock — meaning no outbound transfers, no DNS changes, and no registrant-contact changes while the investigation proceeds. That letter should arrive with supporting evidence: authentication records, the account-compromise timeline, and any forensic documentation of the phishing or credential attack. Second, if the registrar does not respond within a short defined period, a parallel notice goes to NASK as the registry operator, asserting the transfer violated the registration agreement. Third, if the domain has moved through multiple registrars since the theft — a common laundering step — the escalation chain becomes longer and the voluntary-reversal window shorter.

Registrar escalation stops being enough in three situations. One: the registrar is unresponsive or seated in a jurisdiction with no effective compliance mechanism. Two: the domain has been re-sold to a third party who may claim to be a good-faith purchaser. Three: the domain is being actively monetized in a way that is causing ongoing commercial harm — revenue diversion, phishing attacks against your customers, or impersonation. At that point, interim judicial relief — an injunction freezing the domain pending a full hearing — is worth the additional cost.

When does the court route become necessary to recover a stolen .pl domain?

Polish civil courts can grant interim relief quickly when the standard for urgency is met. The applicable threshold, under the general provisions of the Polish civil procedure applicable to injunctive applications, requires the applicant to demonstrate a plausible legal claim and a genuine risk of harm if the interim measure is not granted. A stolen domain that is actively redirecting traffic, collecting credentials from former customers, or blocking the legitimate owner's business communications almost always clears that threshold on the face of the evidence.

The strategic decision between persisting with registrar escalation and moving to court turns on three variables. First, the value and urgency of the domain: a domain that is a business-critical asset — the primary trading address, the root of the email system, the anchor of an e-commerce platform — justifies the cost and speed of a court application far more readily than a defensive registration that was parked idle. Second, the identity of the current registrant: if the domain is now held by a professional domain-theft operation rather than an individual opportunist, voluntary reversal is unlikely regardless of how clear the evidence is. Third, the chain of title: if the domain has passed through one transfer since the theft, recovery at the registrar level is still possible; if it has passed through three, you almost certainly need a court order to unwind the chain.

In our practice, we have advised registrants in situations where the stolen domain had been sold twice within a week of the initial theft — a common pattern designed to complicate recovery. The court route in those cases is not a last resort. It is the only route that can reach all parties in the chain simultaneously.

What evidence decides the outcome of a .pl domain theft recovery?

Evidence quality is the single variable most within the registrant's control — and the one most often neglected in the first hours after the theft is discovered. Courts and registrars assessing a transfer-reversal claim need to see a coherent, documented timeline showing (1) that the domain was legitimately registered by the claimant, (2) that the transfer occurred without authorization, and (3) that the claimant moved to recover it promptly upon discovery.

The strongest evidence package typically includes the following categories. Registration history: the original registration confirmation, renewal invoices, WHOIS or RDDS records from before the theft showing the legitimate registrant's details, and any documentation of the business operated under the domain. Authorization records: the registrar's authentication logs, showing what credentials were used to authorize the transfer and from what IP addresses. Compromise evidence: phishing emails or social-engineering communications directed at the registrant or their registrar, access logs showing anomalous login activity, and any communications from the attacker (demands, ransom notes, re-sale offers). Business-harm evidence: evidence of traffic diversion, customer communications to the hijacked address, financial losses, or security incidents triggered by the redirected domain. Prompt-action evidence: the dates and contents of the initial escalation letters, NASK correspondence, and any registrar responses, showing that the legitimate owner acted without undue delay.

Where the evidence of account compromise is strong and contemporaneous, a Polish court is well-equipped to grant interim relief on an expedited basis. Where the documentary record is sparse — common when registrants took several weeks to notice the theft — the evidentiary burden shifts, and the case becomes harder but not impossible. In those situations, expert forensic evidence about the transfer mechanics can partially compensate for gaps in the registrant's own records.

To assess your evidence package and identify the fastest available route, email info@cognomenlaw.com.

How does .pl domain theft recovery compare to other country-code zones?

The right route for domain theft always depends on the zone, and .pl sits in a specific position on the spectrum of available procedures. Consider the decision across three representative scenarios.

If the stolen domain is a .com — a gTLD operating under ICANN's transfer policies and serviced by an ICANN-accredited registrar — the registrar-escalation path is generally more structured and more consistently enforced. ICANN's Transfer Policy requires the losing registrar to investigate unauthorized-transfer complaints and to reverse compliant ones. For a .com theft that resists registrar reversal, UDRP is not the right tool (it addresses rights disputes, not account compromise), but ACPA-type US anticybersquatting litigation can reach damages. A .pl theft has no equivalent policy-level enforcement backstop; the registrar's goodwill and NASK's cooperation are more variable.

If the stolen domain is a .de, the structure is different again. DENIC, the German registry, offers a DISPUTE entry that blocks further transfers while the legitimate owner pursues the matter through the German courts. NASK does not publish an equivalent interim-registration-block mechanism, which makes the interim court injunction more important in the .pl context rather than less.

If the stolen domain is a .uk, the Nominet DRS offers a mediation-first procedure. But the DRS addresses abusive registration disputes, not unauthorized transfers: a domain-theft case in .uk would similarly route through the registrar escalation process and then to the English courts. The .pl path is broadly comparable in that structural logic.

The practical implication: .pl domain theft recovery tends to be more dependent on the quality of the initial registrar engagement and the speed of court access than recovery in zones with a structured arbitration backstop. That makes legal preparation at the escalation stage — not after it fails — the most cost-effective investment.

What does a .pl domain theft recovery typically cost?

Costs separate cleanly into two categories: the registrar/NASK engagement stage and the court stage. They are not always both necessary.

At the registrar engagement stage, the costs are primarily legal — the preparation and submission of a formal demand letter with a full evidentiary package. That work, done properly, requires counsel who understands both the technical mechanics of domain transfers and the legal basis for demanding a reversal. In our experience, a well-constructed escalation letter resolves a meaningful proportion of theft cases without court involvement — particularly where the registrar is an accredited provider with a compliance function and the evidence of compromise is unambiguous.

At the court stage, costs escalate. Polish civil court proceedings — including an application for interim relief — involve court filing fees, local litigation counsel in the relevant jurisdiction, translation costs where documents are not in Polish, and, depending on complexity, expert evidence. These costs are materially higher than the WIPO filing fee of USD 1,500 that applies to a standard UDRP single-domain complaint, and they are incurred on a time-and-effort basis rather than a fixed filing fee. For a domain that represents material business value, the cost-benefit calculation generally favors early court involvement over a prolonged registrar negotiation that produces no result.

In a recent matter — a .pl e-commerce domain, summer 2025 — we structured the engagement so that the registrar-escalation stage ran in parallel with the preparation of an interim-injunction application. The registrar reversed the transfer voluntarily three days after receiving the formal demand, and the court application was not filed. The parallel preparation cost less than the court filing would have; more importantly, the domain was back in the legitimate registrant's control within a week of the theft being discovered.

What steps should you take in the first 72 hours?

The first 72 hours after a .pl domain theft determine how much of the recovery rests on voluntary cooperation versus compelled legal relief. Speed, documented in writing, also demonstrates prompt action — a fact that matters in any subsequent court proceeding.

Step one: secure your adjacent registrations. If you hold related .com, .eu, or other ccTLD versions of the same name, check that they have not been compromised simultaneously. Change the account credentials for every registrar account you operate, enable two-factor authentication, and place outbound-transfer locks on all remaining domains.

Step two: document the state of the stolen domain immediately. Screenshot the current WHOIS/RDDS record, the DNS configuration, and any website the domain now resolves to. Archive these with timestamps. This is the baseline against which you will show change over time.

Step three: contact the current registrar of record in writing — not by phone — with a formal demand asserting unauthorized transfer and requesting an immediate domain lock. Copy NASK. Set a response deadline of 48 hours and state clearly that failure to respond will be cited in any subsequent legal proceedings.

Step four: engage counsel to run a parallel assessment of the court route. That assessment does not commit you to filing; it tells you how long a court application would take, what the interim-relief standard requires, and whether your current evidence package is sufficient. In our practice, we run that assessment simultaneously with the registrar escalation so that the two tracks remain synchronized.

Step five: preserve all evidence of the compromise. Do not delete phishing emails, unusual login notifications, or suspicious communications. Send them immediately to a secure, separate account. Note any demands or re-sale offers from the party now holding the domain — those communications are among the most powerful evidence of bad faith available in a court proceeding.

In a second matter from our practice — a .pl media domain, early 2026 — the registrant waited ten days before acting, believing the registrar would resolve the issue without legal pressure. By the time we were engaged, the domain had been transferred twice and was being used to distribute malware under the registrant's former brand. The recovery ultimately succeeded, but required court proceedings that would have been unnecessary had the formal demand gone out in the first 48 hours.

Related at COGNOMEN

• Court action and domain theft recovery across all zones — the full menu of court-based and registrar-escalation routes for stolen and cybersquatted domains
• Reversing an unauthorized .de domain transfer — how the DENIC DISPUTE entry and German court route compare to the .pl process
• Domain registered before your trademark: a cross-zone analysis — when prior registration cuts against recovery, and how panels and courts treat the timing question

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.