How to recover a stolen .uk domain under the applicable domain rules

How to recover a stolen .uk domain under the applicable domain rules. UDRP and ccTLD domain recovery and defense across .uk. Email the firm to assess your case.

By Adrian Harland, Court anticybersquatting & domain-theft recovery · 2025-06-25

Your .uk domain is gone. Someone transferred it out of your account – or registered a domain that was yours – and it is now pointing somewhere else. The question is not whether you can get it back. The question is which mechanism moves fastest and preserves the chain of evidence you need.

To recover a stolen .uk domain you have three concurrent routes: an emergency registrar-lock escalation to freeze the name, a Nominet DRS complaint under the abusive-registration standard, and where the facts support it, a court action with injunctive relief. Nominet's DRS applies the "abusive registration" test – distinct from the UDRP – and a reasoned expert decision typically takes about 8 to 12 weeks. The official expert fee for a full Nominet DRS decision is GBP 750 plus VAT. None of these routes excludes the others; the right combination depends on how the domain was taken and what evidence you hold.

This page covers the Nominet DRS process, the registrar-lock mechanics for theft cases, the evidence that decides outcomes, the court option, and how to choose the right route before time runs out.

What makes a .uk domain dispute different from a .com case?

The Nominet DRS governs .uk domains and it does not follow the UDRP. The key structural difference is the test itself: the UDRP requires the complainant to prove the domain was registered and used in bad faith – a cumulative standard. The Nominet DRS requires only that the registration or use was abusive. That distinction matters in theft cases, because a domain taken from its legitimate owner and parked or held unused may still satisfy the DRS test even if active harm is not yet visible.

A second difference is the built-in mediation stage. Where a response is filed, Nominet automatically opts the parties into mediation before any expert is appointed. Mediation is free. If it fails – or if the registrant does not respond at all – the case proceeds to an expert decision. The complainant pays the expert fee: GBP 750 plus VAT for a full reasoned decision, or GBP 200 plus VAT for a summary decision in an undefended case. A three-expert appeal panel costs GBP 3,000 plus VAT.

Nominet also recognizes Reverse Domain Name Hijacking, which protects legitimate registrants against abusive complaints. In our practice, we advise clients on both sides of that line – recovering domains that were genuinely taken, and defending registrants facing spurious claims dressed up as theft allegations.

How does domain theft happen, and why does the route to recovery depend on the method?

Domain theft in the .uk space typically takes one of three forms, and each demands a different first move.

Account compromise is the most common. A bad actor gains access to the registrant's account at the registrar – through credential phishing, a SIM-swap, or a data breach – and transfers the domain to a new registrar or changes the registrant contact details. The transfer may complete within hours if the registrar's security controls are weak. Here, the priority is registrar escalation and lock, not arbitration: a complaint filed while the domain is in an unlocked state and actively moving will not freeze it.

Registrar or reseller error is less common but serious. A domain is reassigned or released by mistake. The registrant had no warning and no part in the transfer. These cases often resolve through registrar escalation alone, but where the error is disputed, a DRS complaint or court action may be needed to compel reversal.

Social engineering of Nominet or the registrar – impersonating the registrant to force a registrant-data change – is rarer but documented. Evidence of the impersonation becomes the centrepiece of the DRS complaint or court claim.

What all three have in common: the clock starts the moment the transfer is processed. Evidence of the pre-theft account state – WHOIS history, DNS records, hosting logs, prior invoices – degrades or disappears. Preservation comes first.

Registrar-lock and transfer-reversal mechanics: the step before arbitration

Before filing any formal proceeding, the immediate task is to lock the domain in place. A domain that keeps moving defeats any subsequent transfer order. The steps are sequential and time-critical.

Document the current state. Screenshot the Nominet WHOIS/RDDS record, the DNS resolution, and any hosting configuration. Timestamp everything. This preserves the evidence the expert or court will need.
Contact the current registrar – the one now holding the domain – and flag an unauthorized transfer. Most accredited Nominet registrars have a security escalation path. Request an immediate domain lock pending investigation. Cite the specific transfer event and any reference numbers from your own registrar's logs.
File a formal dispute notice with Nominet. Nominet operates a dispute entry function. Once a dispute entry is lodged, the domain cannot be transferred to a third party while the proceedings are live. This is the mechanical protection that preserves the status quo pending a DRS or court outcome.
Preserve your own account records. Registration confirmation emails, renewal invoices, prior WHOIS printouts, and any communications from the registrar establish your unbroken chain of title from original registration to the date of theft. Gaps in that chain are the main weakness in theft cases.
Assess whether the registrar can reverse the transfer unilaterally. Where the transfer was clearly unauthorized and recent, some registrars will reverse it without waiting for a formal decision. That outcome requires documented evidence of the compromise and a registrar willing to act. It is not guaranteed, and it is not a substitute for a formal complaint if the registrar declines.

If your .uk domain has moved without your authority, the first 48 hours determine how much leverage you retain. For an assessment of your domain dispute, contact info@cognomenlaw.com.

The Nominet DRS complaint: what the test requires and what evidence decides the outcome

The Nominet DRS test has two limbs: the complainant must show (1) rights in a name or mark that is identical or similar to the domain, and (2) that the registration or use of the domain is an "abusive registration." In theft cases, both limbs are usually met – but the evidence required to meet them is different from a conventional cybersquatting complaint.

On the rights limb, the complainant needs to demonstrate that the name belongs to them. In a commercial case, a registered trademark or a trading name with documented use will suffice. In a personal-name or small-business case where no trademark exists, documented use of the name in trade – invoices, website archives, correspondence – carries weight. Panels have consistently held that a complainant who originally registered the domain and used it commercially for years satisfies the rights requirement, even without a registered mark.

On the abusive-registration limb, a theft scenario presents differently from a straightforward cybersquatting case. The complainant is not arguing that the registrant registered a name targeting a well-known brand. The argument is that the current registrant acquired the domain through unauthorized means and has no legitimate claim to it. Evidence of the compromise – phishing logs, account-access alerts, registrar correspondence confirming the unauthorized transfer – replaces the circumstantial bad-faith indicators that appear in ordinary DRS complaints.

The Nominet DRS does not award damages. The only remedies are transfer of the domain to the complainant or cancellation. In a theft case, transfer is almost always the correct remedy to seek.

In a recent matter involving a .uk domain (a small-business trading name, summer 2025), we assembled a chain of registrar logs, DNS history, and renewal invoices spanning several years and secured a transfer through the DRS process without the need for a court application. The mediation stage resolved quickly once the evidence of the unauthorized transfer was presented.

When does a court action beat the Nominet DRS?

The DRS is fast and affordable for most .uk theft cases. But there are situations where a court action – or a parallel court application alongside the DRS – is the better or only route.

Injunctive relief is unavailable through the DRS. If the domain is being actively used to cause ongoing harm – impersonating the legitimate owner, redirecting customers, intercepting invoices – a court injunction can stop the harm immediately. The DRS can order a transfer in 8 to 12 weeks; a court can grant an interim injunction within days in an urgent case. In our practice, we advise clients to consider a parallel court application where the harm is financial and ongoing rather than merely reputational.

Damages are only available in court. The DRS provides no monetary remedy. Where the theft caused quantifiable financial loss – diverted sales, compromised transactions, brand damage – a court claim is the only route to compensation. Court proceedings are substantially more expensive and slower, but the damages exposure may justify the cost.

Criminal conduct creates a parallel track. Account compromise through phishing or unauthorized access may constitute a criminal offence under the applicable national law. A criminal complaint to the police, while unlikely to produce a rapid domain-recovery outcome, creates a contemporaneous record of the theft and may support a civil claim.

The registrant is outside the UK and the DRS outcome is not complied with. Nominet can order a transfer. If the registrar does not comply, enforcement may require court action. In cross-border cases where the registrar holding the domain is not a Nominet accredited registrar, local litigation counsel in the relevant jurisdiction may need to be engaged.

The decision matrix, simplified: if the domain is locked, the harm is not immediate, and budget is a constraint, the DRS is usually the correct first route. If the harm is live and ongoing, a court application runs in parallel. If damages matter, the court is the only path. If you are uncertain, an early assessment clarifies which fact pattern you are in.

To weigh a Nominet DRS complaint against a court action for your case, email info@cognomenlaw.com.

What evidence determines whether you win a .uk theft recovery?

Panel decisions in Nominet DRS theft cases turn on the quality and completeness of the documentary record. Missing evidence is harder to replace six months after filing than it is to preserve the day the theft is discovered.

The most important evidence categories are:

Chain of title. Registration confirmation, renewal invoices, and any registrar correspondence that connects you, by name and account, to the domain from the date of original registration forward.
WHOIS / RDDS history. Third-party WHOIS history services archive registrant data over time. A printout showing your details in the registrant field before the unauthorized transfer, and different details after it, is direct evidence of the change.
DNS and hosting records. Zone file changes, nameserver logs, and hosting-provider confirmation that the domain pointed to your infrastructure before the theft date corroborate the chain of title.
Account-compromise evidence. Phishing emails, login alerts, account-modification notifications, and any communication from the registrar flagging unusual activity all point directly at the mechanism of theft.
Contemporaneous use. Website archives (via public archiving tools), customer correspondence sent to the domain address, published materials using the domain as a contact address – these establish legitimate use at the date of theft.
Communications from the current registrant. Ransom demands, purchase offers, or any communication from whoever now holds the domain are admissible and often dispositive on the abusive-use limb.

The most common weakness in theft claims is the gap in renewal records. Where a domain changed hands at renewal without the registrant noticing – a lapsed renewal that a third party immediately scooped – the "theft" framing may not apply. The registrant who missed renewal and wants the name back is in a different procedural posture from the registrant whose active registration was compromised. The DRS test and the evidence required differ accordingly.

In a second recent matter (a .uk personal-name domain, spring 2025), the registrant had held the domain for approximately a dozen years. We located archived WHOIS records and hosting invoices going back nearly to the original registration. The panel found the abusive-registration standard met on those facts and ordered transfer within the standard DRS timetable.

Costs and realistic timelines for .uk domain recovery

Transparency on costs is part of how we work. The figures below separate the official fees from the legal-fee component.

Official Nominet DRS fees are fixed and published:

Mediation stage: free (paid for by Nominet).
Summary expert decision (undefended): GBP 200 plus VAT, paid by the complainant.
Full expert decision (defended): GBP 750 plus VAT, paid by the complainant.
Three-expert appeal: GBP 3,000 plus VAT.

Legal fees are separate and depend on complexity. A straightforward theft case with a clean documentary record and an undefended or quickly mediated DRS claim is at the lower end of the market range for UDRP-equivalent proceedings – typically a flat fee. A defended, contested case requiring a full written submission, archive research, and expert evidence is more involved. We provide a case-specific assessment, not a generic estimate, after reviewing your documentation.

Timeline: where a registrar lock can be obtained immediately, the domain is preserved. Mediation (if the registrant responds) adds a few weeks. A full DRS expert decision follows in about 8 to 12 weeks from commencement once mediation is concluded or the respondent defaults. An appeal adds further time; the appeal panel rarely admits new evidence. Court proceedings are substantially longer – measured in months, not weeks – and are reserved for the fact patterns described above.

How does the .uk route compare to recovering a domain across other zones?

A brand that holds both a .com and a .uk version of a name may face theft or cybersquatting across both simultaneously. The routes diverge.

For the .com, the UDRP applies: the three-element test (confusing similarity, no legitimate interest, bad faith registration and use), filed at WIPO, the Forum, or another accredited provider. WIPO filing fees start at USD 1,500 for a single-member panel covering one to five domains. A standard WIPO case runs about two months. The theft framing in a UDRP – where a domain was genuinely taken from its registrant – is less well-developed than in the Nominet DRS, because the UDRP was designed primarily for cybersquatting rather than outright theft. Account-compromise cases at .com often require registrar escalation and potentially a court action under US anticybersquatting legislation rather than (or in addition to) a UDRP complaint.

For .de domains, there is no UDRP equivalent. Disputes go to the German courts, with a DENIC dispute entry available to block transfers while the case is live. For .eu domains, the ADR.eu platform administered by the Czech Arbitration Court handles disputes, with eligibility requirements tied to EU or EEA presence.

For a registrant holding .uk, .com, and potentially other ccTLDs, a coordinated multi-zone response – simultaneous registrar locks, parallel filings calibrated to each zone's rules – prevents a piecemeal recovery where the bad actor retains one zone while losing another. We handle that coordination as a single matter.

Related at COGNOMEN

Frequently asked questions about recovering a stolen .uk domain

How long does it take to recover a stolen .uk domain?

The timeline depends on the route taken and whether the current registrant responds. A registrar escalation that produces a voluntary reversal can resolve within days. A full Nominet DRS proceeding – where the registrant files a response and the case proceeds through mediation to an expert decision – typically takes about 8 to 12 weeks from commencement. An undefended summary decision is faster. A court action is substantially longer and should be reserved for cases where injunctive relief or damages are needed, or where the DRS is unavailable or insufficient.

What does it cost to recover a stolen .uk domain at Nominet DRS?

The official Nominet DRS fees are fixed. A summary decision in an undefended case costs GBP 200 plus VAT; a full reasoned expert decision in a defended case costs GBP 750 plus VAT. A three-expert appeal costs GBP 3,000 plus VAT. The mediation stage is free. Legal fees are separate and depend on the complexity of the case, the depth of the documentary record, and whether the matter is contested. COGNOMEN provides a case-specific assessment after reviewing your documentation.

Do I need a lawyer to recover a stolen .uk domain?

The Nominet DRS does not require legal representation. But in a contested theft case – where the current registrant files a response, disputes the compromise, or raises legitimate-interest arguments – the quality of the written complaint and supporting evidence often determines the outcome. A poorly assembled complaint can fail on the rights limb or the abusive-registration limb even where the underlying facts clearly support recovery. Professional preparation is particularly important where the documentary chain of title has gaps, where a parallel court application is under consideration, or where significant commercial value is at stake.

About COGNOMEN

COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures including the Nominet DRS, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. Our fee ranges are published and case-specific, not concealed behind a call. To discuss a stolen or disputed .uk domain, contact info@cognomenlaw.com.

By Adrian Harland – court anticybersquatting and domain theft recovery practice.

Disclaimer: This article is general information about domain-name dispute procedures and does not constitute legal advice. Outcomes depend on the specific facts, the zone, and panel or court discretion. For advice on your domain, contact info@cognomenlaw.com.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.