How to escalate a registrar lock to secure a .ch domain

How to escalate a registrar lock to secure a .ch domain. UDRP and ccTLD domain recovery and defense across .ch. Email the firm to assess your case.

Your .ch domain is gone. The SWITCH registry record shows a new registrant, or the domain is locked at a registrar you did not authorize, or login credentials that worked yesterday now fail. You need the name back, and you need the clock to stop before any further transfer buries it deeper. The question is how Swiss registry mechanics, registrar escalation, and — where those fall short — Swiss court procedure combine to secure a .ch domain after theft or unauthorized transfer.

To escalate a registrar lock and secure a .ch domain, the immediate step is a formal lock request submitted to the current registrar of record, supported by documented proof of prior control and account compromise. SWITCH — the registry operator for .ch — does not operate a UDRP procedure; there is no arbitration route analogous to WIPO's UDRP for .ch. Recovery therefore runs through registrar escalation, SWITCH registry-level intervention, and, where those channels are exhausted, Swiss civil or interim proceedings before the competent cantonal court. The evidence assembled in the first 48 hours is typically decisive.

This page sets out the registrar-lock mechanics, the escalation ladder from registrar to SWITCH, the court route, and the evidence that decides each stage.

How does .ch domain governance work — and why is there no UDRP?

The .ch country-code top-level domain is operated exclusively by SWITCH, a Swiss foundation designated by the Federal Council. SWITCH governs the registry rules for all .ch registrations, and all accredited registrars contracting with SWITCH must follow those rules on transfer, lock, and dispute. The result is that .ch sits entirely outside the UDRP framework. No WIPO, Forum, or CAC complaint can compel a .ch transfer or cancellation. Arbitration clauses in some registrar terms may exist, but they generally address commercial fee disputes, not domain ownership following theft or unauthorized transfer. Recovery of a .ch domain therefore depends on a direct chain: the registrant contacts the registrar, the registrar contacts SWITCH, and — if the chain fails — the registrant invokes Swiss law in court.

This structure matters practically. A brand owner accustomed to filing a UDRP complaint within days of discovering a cybersquatter on a .com cannot replicate that move for .ch. Equally, a domain investor who has lost access to a .ch registration through account compromise cannot call on a standing arbitral forum. In our practice, we advise clients from the first call to treat .ch recovery as a two-track matter: administrative escalation running in parallel with legal preparation, because neither track alone is reliably fast enough.

For any ccTLD not governed by WIPO's UDRP, the governing national procedure applies, and clients should verify the current SWITCH rules with counsel before acting. Rules can change, and acting on an outdated procedure risks waiving a step that is later needed in court.

What is a registrar lock, and when does it actually stop a transfer?

A registrar lock — sometimes called a domain lock or transfer lock — is a status flag set at the registrar level that prevents outgoing transfer requests from being processed by the registry. For .ch, the lock must be set by the registrar of record; SWITCH does not accept direct lock requests from registrants. A properly set registrar lock prevents an EPP transfer command from succeeding. That is its sole function. It does not prevent the registrar from making administrative changes to WHOIS contact data, changing nameservers, or processing a deletion — all of which can cause harm even when a lock is in place.

Three failure modes appear regularly in .ch theft cases. First, the lock was never enabled by the registrar at account creation, so a phished authorization code sufficed to push a transfer. Second, the lock was disabled by an attacker who had gained control of the registrar account before the registrant noticed. Third, the lock was in place but the registrar's internal helpdesk accepted a social-engineering request and disabled it without adequate identity verification. Each failure mode calls for a different first step in the escalation ladder.

Identifying which failure mode applies is the opening task. We regularly advise clients to obtain a full audit log from the registrar — covering account logins, lock-status changes, EPP commands, and contact-data modifications — before any escalation letter is sent. That log is also the primary evidentiary document if the matter proceeds to court.

If you have just discovered that your .ch domain has moved without your authorization, the window to preserve registry evidence is narrow. For an assessment of your registrar escalation options, contact info@cognomenlaw.com.

How do you escalate step by step — from registrar to SWITCH to court?

The escalation ladder for a .ch domain runs in a defined sequence. Each step has a different evidentiary requirement and a different decision-maker. Moving too fast to court without exhausting the registry channel wastes time and money; waiting too long at the registrar level while the domain is pointed at harmful content creates ongoing liability and business interruption. The goal is to run both tracks in parallel where urgency demands it.

Step 1 — Registrar formal lock request. Submit a written demand to the registrar's abuse or legal department — not the standard helpdesk — requesting immediate imposition of a transfer lock and nameserver freeze. Attach proof of prior registration: historical WHOIS records, registration confirmation emails, invoice or payment records, and screenshots of prior nameserver configurations. State explicitly that you allege unauthorized transfer or account compromise. A formal written record triggers the registrar's contractual obligations to SWITCH and starts the clock on any response-time commitments in the registrar agreement.

Step 2 — SWITCH registry escalation. If the registrar does not respond within 24–48 hours, or acknowledges the issue but claims it cannot act unilaterally, escalate directly to SWITCH. SWITCH can, in certain circumstances, impose a registry-level hold that prevents further transfers pending investigation. This is not an arbitration proceeding — it is an administrative intervention. SWITCH's published rules describe the conditions under which it will act. Document every interaction with the registrar in writing before contacting SWITCH; the registry will ask for that record.

Step 3 — Swiss interim court order (vorsorgliche Massnahmen / mesures provisionnelles). Where the registrar and SWITCH channels have stalled or where the domain is being actively used for fraud or impersonation, a Swiss cantonal court can issue an interim order. Swiss civil procedure allows the applicant to seek a provisional measure — effectively a court-ordered transfer lock or nameserver freeze — on an expedited basis without prior notice to the respondent in urgent cases. The applicant must demonstrate a credible legal claim and the risk of imminent irreparable harm. This is handled with local litigation counsel in the relevant Swiss jurisdiction, coordinating with COGNOMEN on the domain-specific technical and chain-of-title evidence.

Step 4 — Main proceedings or settlement. The interim order preserves the position while the parties either negotiate a transfer or proceed to main civil proceedings to establish ownership. In many cases, a registrar who sees a court order in place will process the transfer administratively, rendering main proceedings unnecessary.

What evidence decides the outcome at each stage?

Evidence is the variable that separates a successful escalation from a stalled one. The same facts that persuade a registrar's legal team to act on day two are the facts that persuade a Swiss judge to grant an interim measure without a hearing. Assembling them systematically — not piecemeal — is the single most important task in the first 48 hours.

The core document set is as follows. Historical WHOIS or RDDS records showing you as registrant prior to the unauthorized event — screenshots with timestamps, Wayback Machine captures, or registry-produced history. Registration confirmation emails from the original registration date. Payment records: invoices, credit card statements, or bank transfers showing you or your entity paid the registration fee. Nameserver configuration history, including DNS records pointing the domain to your controlled infrastructure. Access logs or account logs from your registrar portal if available. Any communications from the registrar acknowledging your account. And, critically, evidence of the compromise event itself: phishing emails received, password-reset confirmation emails you did not request, or unauthorized-login alerts.

For court, you will also need a declaration setting out the chain of events in chronological order, signed by an appropriate officer if the registrant is a corporate entity. Swiss courts expect a concise, structured presentation. A disorganized submission — even one with good underlying facts — loses credibility in front of an interim-measure judge who has minutes to decide.

One additional element matters specifically for .ch: Swiss law places significant weight on the contractual relationship between the registrant and the registrar. If your registrar agreement is in German, French, or Italian — all official Swiss languages — and your legal team is working in English, make sure the key provisions are translated accurately before you cite them in correspondence or in court. A mistranslated contractual obligation is a liability, not an asset.

To review the evidence you have and identify what is still needed before filing with the registrar or SWITCH, email info@cognomenlaw.com.

When does the court route outperform registrar escalation for .ch?

For .ch, the court route is not the last resort — it is a parallel tool that becomes primary when the administrative channel is too slow or structurally unable to help. Three situations call for immediate court involvement rather than waiting out the registrar ladder.

First, active harm. If the domain is currently resolving to a site impersonating your business, collecting customer credentials, or hosting malware, every hour of delay causes compounding harm. A Swiss court can issue an interim measure faster than a registrar's legal team can complete its internal review. We have handled matters in which a registrar took more than two weeks to respond to a formal lock request while the domain remained pointed at a fraudulent site.

Second, registrar location. If the registrar of record is based outside Switzerland and has no contractual obligation to respond to Swiss administrative requests, the SWITCH escalation path may produce only a holding response. A Swiss court order, by contrast, reaches SWITCH directly and does not depend on the foreign registrar's cooperation. SWITCH, as a Swiss entity, is subject to Swiss court jurisdiction.

Third, disputed ownership. Where the current registrant disputes your ownership claim — asserting, for example, that the transfer was authorized — the registrar has no adjudicative function. It cannot determine who owns the domain. That question goes to a court. The interim-measure application frames the dispute for the judge and preserves the status quo while the merits are determined.

In a recent matter involving a stolen .ch domain (central Europe, summer 2025), the registrar acknowledged receiving the lock request but stated it needed verification documents that were themselves inaccessible because the attacker had changed the contact email on the account. We escalated to SWITCH and simultaneously filed for an interim measure with the competent cantonal court. The court order was served on SWITCH within the week, and the domain was locked at the registry level pending the main proceedings. The attacker's ability to transfer or delete the domain was suspended before any further harm occurred.

How does the .ch route compare to dispute routes in other zones?

Understanding the .ch route is easier against comparable zones. The comparison also matters because a registrant may control the same brand name across multiple ccTLDs simultaneously, requiring coordinated action across different procedures.

For a .com domain under the UDRP, a complainant with a registered trademark can file before WIPO or the Forum, pay a filing fee from USD 1,500 for a single-member panel at WIPO, and expect a decision in approximately two months. The UDRP is a specialized arbitration designed for cybersquatting; it is not designed for post-theft recovery where ownership is the question, not bad faith. If a .com is stolen — not cybersquatted — the UDRP may not be the right vehicle either, and a registrar escalation or US anticybersquatting litigation may be required there too.

For a .uk domain, Nominet's DRS provides a structured dispute resolution procedure with a mediation stage and a published decision framework. The DRS test — abusive registration — is distinct from the UDRP's three-element test and reads "registered or used" abusively, a meaningful difference. But like the UDRP, the DRS is not designed for account-compromise theft; its evidence framework assumes a deliberate bad-faith registration by a third party, not an unauthorized transfer from an existing legitimate registrant.

For .de, as with .ch, there is no UDRP. Disputes proceed through the German courts, and DENIC offers a DISPUTE entry that blocks further transfers while a claim is pursued — functionally similar to the registry-level hold that SWITCH can impose in appropriate .ch cases. The parallel is useful when advising clients whose brand is registered in both zones.

For .eu, the ADR.eu platform administered by the Czech Arbitration Court provides a dispute mechanism with its own eligibility requirements. Theft recovery in .eu may also require court proceedings in a competent EU member state.

The practical takeaway for a registrant with multi-zone exposure: each zone requires a separate, zone-specific action. A WIPO complaint filed for .com does not affect the .ch registration. Coordination matters, and the sequence of filings across zones should be planned from the outset so that evidence assembled for one proceeding is usable in another.

What are the realistic costs and timelines for .ch recovery?

Cost and timeline depend on which stage of the escalation ladder is required. Registrar escalation — a formal written demand, organized evidence set, and follow-up correspondence — is the least expensive phase. The legal work involved is focused: a few hours of counsel time to draft and send the formal demand and to organize the evidence bundle. If the registrar acts quickly, the domain can be locked within days of the initial demand.

SWITCH escalation adds time and, depending on whether SWITCH requires legal correspondence, additional counsel involvement. This phase typically resolves in a matter of days to a few weeks, depending on SWITCH's current administrative workload and the complexity of the chain-of-title question.

Swiss court proceedings — specifically, interim-measure applications — involve local litigation counsel fees, court filing costs, and translation costs where documents are not already in the relevant cantonal language. These fees are substantially higher than a UDRP filing fee and are charged hourly. The timeline for an interim measure in urgent cases can be very short — Swiss courts are experienced with expedited applications — but the preparation time required to file a credible application should not be underestimated. A rushed application with a disorganized evidence set risks refusal and wastes the urgency advantage.

In our experience advising on .ch theft recovery, the total elapsed time from discovery to a locked domain ranges from a few days (registrar-resolved) to several weeks (court-intervened). The key variable is not the procedure — it is the quality of the evidence assembled on day one. Clients who arrive with a complete, organized chain-of-title record move through every stage faster than clients who must reconstruct that record under time pressure.

What are the common obstacles — and how does a well-prepared claim avoid them?

The most common obstacle is identity verification. After an account compromise, the very credentials used to prove identity — the registrar-account email, the authorization codes, the contact records — may be in the attacker's control. A registrar's standard helpdesk is not equipped to adjudicate a competing-identity dispute. The formal legal escalation path — directly to the registrar's legal or abuse team, with external evidence rather than account-credential verification — bypasses this bottleneck.

A second obstacle is the registrar's location and responsiveness. Many .ch registrations are held through registrars based in other jurisdictions. Their contractual obligations to SWITCH exist, but their practical responsiveness to a Swiss registrant's legal demand varies. Where a foreign registrar is unresponsive, the SWITCH escalation and the court route converge as the effective remedies.

A third obstacle — less common but significant — is a chain of secondary transfers. An attacker who has obtained unauthorized control of a .ch domain may immediately transfer it again, inserting a second registrar or a second nominal registrant between themselves and the original holder. Each transfer generates a new WHOIS record and, potentially, a new registrar of record with its own escalation process. Swiss courts handling interim-measure applications for .ch domains are familiar with this pattern; the application should address the full transfer chain rather than just the most recent record.

What a well-prepared claim avoids is the reactive posture of chasing each new registrar in turn without a registry-level hold in place. The goal of the early escalation steps — both to SWITCH and, where necessary, to a court — is to freeze the domain at the registry level so that secondary transfers become impossible while the ownership question is resolved.

A myth worth addressing directly: some registrants believe that because .ch is a Swiss ccTLD and they are Swiss residents or companies, SWITCH will simply return the domain on request. SWITCH does not adjudicate ownership disputes. It applies its rules procedurally and will, in appropriate circumstances, impose a registry-level hold — but it will not order a transfer without either registrar cooperation or a court order. The legal step cannot be skipped.

Related at COGNOMEN

• Court action and domain theft recovery services — full overview of routes
• Guide to court action for cybersquatting — when arbitration is not enough
• Respondent defense for generic domain registrations — RDNH and legitimate interest