Assess my case

How to recover a stolen .xyz domain under the applicable domain rules

By Adrian Harland, Court anticybersquatting & domain-theft recovery ·

A registrar notification arrives, or perhaps it does not. Either way, a domain you registered, paid for, and built a brand around is now pointing somewhere else – and the registrant record shows a name you do not recognize. That is domain theft: unauthorized transfer through account compromise, credential phishing, or registrar fraud. For a .xyz domain, the path back depends on exactly how the theft happened and how quickly you move.

To recover a stolen .xyz domain you have two primary routes: an emergency registrar escalation to reverse the unauthorized transfer, or a UDRP complaint filed at WIPO (the governing procedure for .xyz, which operates under the UDRP). A third route – court action – applies when the first two are unavailable or have already failed. Speed is decisive. The registrar's transfer-reversal window is narrow, typically governed by ICANN's inter-registrar transfer policy, and a UDRP proceeding at WIPO carries a filing fee starting at USD 1,500 for a single-member panel with a standard timeline of roughly two months.

This page covers the mechanics of each route, the evidence that decides the outcome, the realistic costs, and when a court action is the correct call rather than arbitration.

What governs .xyz domains and why it matters for theft recovery

.xyz is a generic top-level domain (gTLD) operated under ICANN's registry system, which means the full UDRP framework applies and WIPO is the leading forum for dispute resolution. A domain theft in .xyz is legally distinct from a trademark dispute, but the procedural tools often overlap, and understanding the distinction is the first decision you must make.

When a domain is transferred without the registrant's authorization – through phishing, SIM-swapping, registrar-account compromise, or social engineering of registrar support staff – the transfer is unauthorized under ICANN's Transfer Policy. That creates a registrar-level remedy distinct from the UDRP. However, if the thief then resells the domain or uses it to monetize traffic, a UDRP complaint may become the correct tool because the panel evaluates all three elements of Paragraph 4(a): confusing similarity to a mark, absence of legitimate interest, and registration and use in bad faith. Theft satisfies bad faith almost by definition. The challenge is the first element – you need a trademark, a registered mark or demonstrable common-law rights in the name, to anchor a UDRP complaint.

If the domain is purely descriptive or a personal name without trademark character, the UDRP path is harder. That is when the registrar escalation and, where necessary, court action become the primary tools. In our practice we assess this threshold question before recommending any route, because filing a UDRP complaint in a case that lacks a qualifying trademark is an expensive way to lose.

How does the registrar-lock and transfer-reversal process work for a stolen .xyz domain?

The first sixty minutes after discovering a theft are the most important. ICANN's inter-registrar transfer policy contains a dispute process that allows a registrant who did not authorize a transfer to file a complaint with the losing registrar – but the window to act is short and the burden is on you to move.

The mechanics work as follows. Your domain was held at a registrar (the "losing registrar"). Someone, using stolen credentials or by impersonating you, initiated a transfer to a different registrar (the "gaining registrar"). ICANN's Transfer Policy requires the gaining registrar to place the domain in a registrar lock for a defined period after transfer, during which a dispute can be initiated. If you act within that window, the gaining registrar is obligated to investigate and, where the transfer was unauthorized, to reverse it.

In practice, the steps are:

  1. Document the compromise immediately – screenshots of the RDDS/WHOIS record showing the new registrant, timestamps from your original registrar dashboard, and any phishing or password-reset emails you received.
  2. File an urgent ticket with both registrars simultaneously. Use the phrase "unauthorized transfer" and reference ICANN's Transfer Policy. Escalate beyond first-tier support to the registrar's abuse or compliance team.
  3. Report the account compromise to the relevant platform (email provider, domain control panel) to prevent further unauthorized actions.
  4. If the losing registrar confirms the transfer was unauthorized and the gaining registrar refuses to cooperate, file a formal complaint with ICANN's Contractual Compliance team. This does not directly return the domain, but it creates a record and signals to the registrar that regulatory consequences are in play.

We regularly advise registrants who discover a theft days or even weeks after the event. The transfer-reversal window has often closed by then. At that point the UDRP or a court action becomes the operative route.

For an immediate assessment of your domain theft situation, contact info@cognomenlaw.com. We can advise on whether the transfer-reversal window is still open or whether a UDRP filing is the correct next step.

When is a UDRP complaint at WIPO the right tool to recover a stolen .xyz domain?

A UDRP complaint at WIPO is the right tool when three conditions align: you hold trademark rights in the domain name (registered or established by use), the unauthorized transferee is identifiable and is either using or passively holding the domain, and the transfer-reversal window has closed or the registrar has failed to act.

The UDRP does not require you to prove how the theft happened. It requires you to satisfy all three elements of Paragraph 4(a). In a theft scenario, the bad-faith element is typically the easiest to meet: the new registrant acquired the domain without any legitimate basis, and panels have consistently held that passive holding of a domain that corresponds to an active trademark, with no credible explanation for the registration, satisfies the bad-faith requirement. The absence-of-legitimate-interest element is similarly straightforward when the registrant has no prior association with the mark.

The confusing-similarity element is where theft cases can diverge from straightforward cybersquatting. If your domain was yourcompanyname.xyz and you hold a trademark for YOURCOMPANYNAME, the first element is met easily. If the domain is a descriptive phrase or a personal name without registered protection, you may need to establish common-law trademark rights, which requires evidence of prior use, consumer recognition, and secondary meaning.

The WIPO filing fee for a single-member panel covering one to five domains is USD 1,500. A standard case is typically decided within about two months of filing. The only remedies under the UDRP are transfer to the complainant or cancellation – no money damages, no recovery of costs.

In a recent matter involving a .xyz domain theft (spring 2025), we assembled a trademark rights record based on common-law use, documented the unauthorized transfer through account compromise evidence, and secured a transfer order roughly eight weeks after filing, with no response from the registrant. The registrant's silence – a default – did not eliminate the panel's obligation to examine the three elements, but the evidence we prepared addressed each one.

To weigh the UDRP against a court action for your case, email info@cognomenlaw.com.

What evidence decides the outcome of a .xyz domain theft recovery?

The evidence you assemble in the first days after discovering a theft will determine which route is available and whether it succeeds. The categories are distinct for registrar escalation, UDRP proceedings, and court action, but the underlying record overlaps significantly.

For a registrar escalation or ICANN Transfer Policy complaint, the core evidence is:

For a UDRP proceeding, you need all of the above plus:

For a court action, the evidentiary bar is higher and the discovery process may surface additional facts, but the initial filing requires the same core record.

What destroys a recovery attempt? Delay in documenting the compromise, failure to preserve the original WHOIS record before the new registrant changes it, and relying on a weak or non-existent trademark rights basis. We have seen registrants lose a winnable UDRP because they could not produce a single dated document showing they had used the name in commerce before the theft.

When does court action beat arbitration for a stolen .xyz domain?

Arbitration through UDRP is fast and inexpensive relative to litigation – but it is not always sufficient. A court action for domain theft or cybersquatting is the right choice in several specific situations.

The decision matrix works as follows. If the domain is .xyz and you have strong trademark rights, the UDRP is almost always faster and cheaper. If the UDRP has already produced a decision and the losing party (now the registrant of record) refuses to comply or files a court action to stay the transfer, you may need to litigate to enforce the panel's decision. If you want monetary damages – compensation for lost business, fraudulent invoices redirected, or reputational harm – the UDRP cannot provide that. Only a court can award money.

US anticybersquatting litigation is a court route that allows damages and transfer, but it applies where there is US jurisdiction over the defendant. For a .xyz theft where the unauthorized transferee is in a foreign jurisdiction, the analysis shifts to the courts of that jurisdiction or, where applicable, to arbitration under ICANN's procedures. We work with local litigation counsel in the relevant jurisdiction for cross-border court actions; we manage the strategy and the domain-specific analysis, and coordinate with counsel qualified in the applicable national law.

There is a further scenario: the registrar itself acted negligently or fraudulently in facilitating the transfer. In that situation, a court action against the registrar – separate from any action against the unauthorized transferee – may be the only route to recovery or compensation. This is relatively uncommon, but we have defended and prosecuted registrar-liability claims in connection with court recovery proceedings.

In a recent matter (a .xyz domain, summer 2024), the registrant had already lost a UDRP default proceeding before engaging us. The panel had transferred the domain to a complainant whose trademark rights, on closer analysis, were weak. We filed for de novo court review, challenged the mark's validity, and ultimately reached a negotiated return of the domain. The UDRP result was not final. Court review was available, and it changed the outcome.

How do WIPO, the Forum, and CAC compare for a .xyz UDRP filing?

The UDRP is uniform across all approved providers – the three-element test and the remedies are identical wherever you file. The difference is procedural, financial, and in some respects tactical.

WIPO administers the majority of all UDRP cases and is the default choice for most practitioners. Its fee for a single-member panel covering one to five domains is USD 1,500. It offers an expedited option delivering a decision within approximately one month, available for single-panel cases of up to five domains. For a theft scenario where speed matters, the expedited option is worth considering.

The Forum (formerly the National Arbitration Forum) is the second major provider, with filing fees beginning around USD 1,300 for one to two domains on a single-member panel. WIPO and the Forum together handle roughly 97% of all UDRP proceedings.

The Czech Arbitration Court (CAC) offers the lowest entry point, beginning around USD 500–800, and is less frequently used but fully accredited. For a straightforward .xyz theft with clear facts, the lower filing cost may be relevant if legal-fee budgets are tight.

ADNDRC is a fourth accredited provider with fees beginning around USD 1,300 for one to two domains. It is more commonly used for disputes with an Asia-Pacific nexus.

In our practice, we select the forum based on the full picture: the registrant's apparent location, the strength of the trademark record, the urgency of the situation, and any tactical considerations around panelist appointment. We do not default to one provider for every case.

What are the realistic costs and timelines to recover a stolen .xyz domain?

Transparency on costs is a principle COGNOMEN applies consistently. The numbers below distinguish between official forum filing fees, which are fixed, and legal fees, which depend on complexity.

Registrar escalation: no filing fee. Legal fees to prepare the escalation documentation, draft the ICANN Transfer Policy complaint, and manage the correspondence are typically at the lower end of the domain-dispute range, though the work can escalate quickly if the registrar is unresponsive.

UDRP at WIPO (single-member panel, one to five domains): USD 1,500 filing fee. Legal fees for a straightforward single-domain theft complaint commonly fall in the USD 3,000–7,000 range in the market, depending on the complexity of the trademark rights record and whether the registrant files a substantive response. These are market ranges, not a COGNOMEN quote; contact us for a case-specific assessment.

UDRP at the Forum: filing fees begin around USD 1,300. Legal-fee range is comparable to WIPO.

Court action: substantially higher and typically billed hourly. The cost varies by jurisdiction, the court's procedural requirements, and whether local litigation counsel is needed. Describe this route as the highest-cost option; it is justified where damages are sought or where arbitration is unavailable.

Timeline at WIPO: the standard case runs about two months. The respondent has 20 days to file a response after commencement. The expedited option delivers a decision in approximately one month. Registrar implementation of a transfer order follows the decision by a matter of days. Court timelines depend entirely on the jurisdiction.

Is there a respondent-side risk if you are wrongly accused of theft?

Occasionally a legitimate registrant – someone who purchased a domain through a broker, acquired it in an estate, or registered it years before a brand owner became interested – receives a UDRP complaint that accuses them of theft or bad-faith registration. This is the mirror image of the theft scenario, and it is a real risk in .xyz because new-gTLD domains are frequently acquired by investors and developers without any intent to target a brand.

The UDRP's Paragraph 4(c) safe harbors protect registrants who can demonstrate a legitimate interest: a bona fide offering of goods or services before any notice of the dispute, being commonly known by the name, or legitimate noncommercial or fair use. If a complainant files a UDRP complaint without a credible trademark rights basis, or pursues transfer of a domain the registrant holds with genuine legitimacy, a panel may find Reverse Domain Name Hijacking (RDNH). That finding is reputational, not monetary, but it is a significant outcome.

We handle respondent defense and RDNH cases as a core part of our practice. If you have received a UDRP complaint concerning a .xyz domain you legitimately hold, the response deadline is 20 days after commencement – that window does not extend automatically, and a default is treated as conceding the claim.

Related at COGNOMEN

Frequently asked questions: recovering a stolen .xyz domain

What are the chances to recover a stolen .xyz domain?

Recovery is realistic but not automatic. The strongest position combines prompt action, a clear evidence record of unauthorized transfer, and trademark rights that support a UDRP complaint. Registrar escalation succeeds most often when pursued within the transfer-reversal window. UDRP proceedings result in transfer or cancellation in a significant proportion of cases where the complainant meets all three Paragraph 4(a) elements and the panel finds bad faith. However, outcomes depend on the specific facts, the quality of the trademark rights record, the registrant's conduct, and panel discretion – no outcome can be guaranteed.

What evidence do I need to recover a stolen .xyz domain?

You need proof of original registration (confirmation emails, billing records, historical WHOIS), evidence of unauthorized access (phishing emails, unsolicited password-reset requests, login anomalies), and – for a UDRP complaint – trademark rights evidence, which means either a registration certificate or documented common-law use predating the theft. For a court action, you will also need an account of the harm suffered. Assembling this record immediately after discovery significantly improves every available route.

Can I recover a stolen .xyz domain without going to court?

Yes, in most cases. The registrar's transfer-reversal process and a UDRP complaint at WIPO are both non-court routes, and the UDRP is the standard procedure for .xyz disputes. A court action becomes necessary when the UDRP is unavailable (for example, where no trademark rights exist), when the UDRP result needs enforcement through litigation, when you seek monetary damages, or when the registrar itself is implicated in the transfer. Most .xyz theft recoveries are completed without court proceedings.

About COGNOMEN

COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. Our practice covers domain theft and registrar escalation as well as UDRP proceedings, and we manage cross-border court actions with local litigation counsel in the relevant jurisdiction. To discuss a domain, contact info@cognomenlaw.com.

Author: — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.