How to escalate a registrar lock to secure a .eu domain

How to escalate a registrar lock to secure a .eu domain. UDRP and ccTLD domain recovery and defense across .eu. Email the firm to assess your case.

A .eu domain your organization depends on has been transferred without authorization. The registrar's standard support channel has gone quiet, or the response you received was a form letter. Every hour the domain sits outside your control is an hour a bad actor can redirect traffic, intercept mail, or demand a ransom. The question is not whether to act – it is which lever to pull first, and how hard.

To escalate a registrar lock to secure a .eu domain, you must move through three parallel tracks: an emergency lock request to the registrar, a formal escalation to EURid (the .eu registry), and – where the transfer was unauthorized – an ADR.eu dispute or national court action for transfer reversal. The ADR.eu procedure, administered by the Czech Arbitration Court, is the primary arbitral route for .eu; it can order transfer or revocation, and complainants may rely on a wider set of rights than registered trademarks alone. Where arbitration is too slow or legally insufficient, national court proceedings are available in parallel.

This page sets out the full escalation sequence, the evidence you will need at each stage, and when to shift from the registrar to the registry to the courts.

What governs .eu domain disputes and lock requests?

The .eu domain is administered by EURid, and disputes over .eu registrations are resolved under a distinct procedure separate from the UDRP. EURid contracts with the Czech Arbitration Court's ADR.eu platform as the authorized dispute-resolution provider. The rules that govern a .eu dispute address both bad-faith registration and abusive use; importantly, the remedy can include transfer to the complainant where that party meets the EU or EEA eligibility requirement, or revocation where it does not.

A registrar lock – sometimes called a "client hold" or "domain lock" – is a status flag set at registrar level that prevents transfer, deletion, or modification of a domain record. In a theft scenario, the attacker typically moves the domain to a new registrar (an unauthorized transfer of sponsorship) before the original registrant notices. Once that transfer completes, the lock travels with the domain to the receiving registrar, making a second unauthorized transfer harder – but the domain is now under someone else's registrar account. Reversing that requires direct EURid intervention or a formal dispute order, not just a ticket to the original registrar.

The .eu eligibility rules add an important constraint. To hold a .eu domain, a registrant must have an EU or EEA nexus: citizenship, residence, or an establishment in a member state. If the attacker or a bad-faith registrant lacks that nexus, the registration itself may be revocable on eligibility grounds alone – a route unavailable in the generic gTLD space under the UDRP.

How does the registrar-lock escalation sequence work step by step?

The escalation follows a defined sequence. Each step builds the record for the next. Moving through them quickly – ideally within the first 24 to 48 hours of discovering the unauthorized transfer – significantly affects the outcome.

1. Step 1 – Document the current registration state. Capture a timestamped WHOIS/RDDS printout showing the registrant of record, the registrar of record, the name servers, and any lock status. This is your baseline. Do it before contacting anyone, because the record can change while you are on hold with support.
2. Step 2 – Submit an emergency lock request to the current registrar of record. Address the request to the registrar's abuse contact (not general support). State clearly: the domain was transferred without authorization, you are the legitimate registrant, and you require an immediate client-hold pending investigation. Attach your registration history, any prior WHOIS screenshots showing your account as registrant, and payment records if available.
3. Step 3 – File a formal notification with EURid. EURid maintains a registrar-to-registrar transfer dispute procedure and an eligibility-based revocation route. A formal complaint to EURid's registrar operations team – with a copy to your original registrar – triggers an investigation that can result in registry-level action independent of what the receiving registrar does or does not do. EURid can impose a registry lock (a serverHold or serverTransferProhibited flag) that neither the receiving registrar nor the new registrant can lift without EURid's consent.
4. Step 4 – Initiate an ADR.eu dispute (or national court proceedings). Where the unauthorized transfer reflects a bad-faith registration or use, an ADR.eu complaint is the arbitral route. Where you need injunctive relief faster than an arbitral panel can move, or where the facts suggest fraud or identity theft, national court proceedings in the relevant EU member state jurisdiction are available in parallel – not as an alternative.
5. Step 5 – Preserve all evidence in parallel. Throughout steps 1–4, maintain a chain-of-custody record: each communication with the registrar, each EURid ticket number, each DNS change you observe, any ransom communication from the attacker, and any spoofed emails that originated from the compromised domain. This evidence record is the foundation of both the ADR.eu case and any criminal or civil court proceedings.

In our practice, the cases that resolve fastest are those where the original registrant had systematic proof of prior registration: invoices from the original registrar, email from the registrar's domain-confirmation address, dated WHOIS exports, and renewal receipts. Without that baseline, even a clear case of theft takes longer to establish at EURid.

If you have just discovered an unauthorized transfer of a .eu domain, the window for registry intervention is short. For an assessment of your domain dispute, contact info@cognomenlaw.com.

What evidence decides the outcome of a .eu lock escalation or ADR.eu dispute?

Evidence is the single most important variable. The escalation process and the ADR.eu procedure both turn on the quality of the record you can assemble, not the sincerity of your claim.

The core evidence categories are:

• Proof of prior registration. Registrar confirmation emails, renewal invoices, payment records with dates that predate the disputed transfer. WHOIS historical exports are useful corroboration but are not, on their own, enough – they show the past record but can be disputed.
• Evidence of the unauthorized nature of the transfer. Any correspondence from your registrar that you did not initiate (transfer authorization request, transfer confirmation) that was sent to an email address you do not control, or that you never received. If the attacker compromised your registrar account, account-access logs showing login from unrecognized IP addresses or geographies are critical.
• Trademark or other rights documentation. For an ADR.eu complaint, the .eu rules allow a broader rights base than registered trademarks: trade names, geographic indications, company names, and other rights recognized under national or EU law. If your .eu domain corresponds to a registered mark, national trademark registration certificates are the clearest proof. If it corresponds to a trade name or company name, company registration documents serve the same function.
• Evidence of bad faith on the part of the current registrant. Ransom communications, redirection of the domain to a competing or harmful site, use of the domain to intercept email, or a pattern of similar registrations by the same party all go to bad faith. Screen-captures of the current site with timestamps; email headers from mail sent to or through the hijacked domain; any ransom or buy-back correspondence.
• Eligibility documentation. If you are relying on EU eligibility as an independent revocation ground, your own eligibility documentation – passport or company registration showing EU/EEA nexus – and evidence that the current registrant lacks that nexus are both relevant.

Panels in .eu disputes have consistently treated a registrant's failure to demonstrate EU/EEA eligibility as independently sufficient grounds for revocation, regardless of whether bad faith is shown. That is a significant procedural tool that does not exist in the UDRP context and should be assessed at the outset of every .eu theft matter.

When does a court route beat the ADR.eu procedure for .eu recovery?

The ADR.eu arbitral procedure is the fastest path to a transfer or revocation order in most .eu disputes. But it is not always the right path, or the only one.

Consider the decision this way. Where the dispute is primarily a trademark-based bad-faith registration – a third party registered your brand as a .eu domain – the ADR.eu procedure is usually the right starting point. It is faster than litigation, the fees are published, and the remedy (transfer) directly addresses the harm. In our experience, a straightforward bad-faith registration case proceeds from filing to decision in a matter of weeks to a few months, depending on whether the respondent participates and whether procedural complications arise.

Where the situation involves actual theft – unauthorized account access, fraudulent transfer of sponsorship, identity impersonation – the calculus shifts. An ADR.eu panel can still order a transfer, but it cannot issue emergency interim relief. A national court can. If the domain is actively being used to impersonate your organization – redirecting payments, issuing fraudulent invoices, intercepting email – the harm accumulating during the arbitral process may be unacceptable. In that scenario, national court proceedings in the relevant EU member state, handled with local litigation counsel in the relevant jurisdiction, can seek an interim injunction freezing the domain's DNS configuration while the merits are resolved.

A parallel track – filing the ADR.eu complaint and simultaneously seeking a court interim order – is a recognized approach. The two proceedings do not preclude each other. The ADR.eu complaint establishes the rights-based record; the court order provides the immediate operational freeze. When the court order is served on EURid, the registry can impose a serverHold that makes the domain functionally inert until the dispute is resolved.

In a recent matter (a .eu domain theft, spring 2025), we coordinated a simultaneous EURid notification, ADR.eu complaint, and emergency court application in the relevant member state jurisdiction. The court order was obtained within days, the domain was placed on serverHold within the week, and the ADR.eu transfer order followed within the standard arbitral window. No ransom was paid.

For pure cybersquatting (bad-faith registration, no theft), a court route generally adds cost without adding speed for .eu. For theft with active harm, court and arbitration together are frequently the correct combination.

If you are weighing the ADR.eu procedure against court action for a .eu domain, email info@cognomenlaw.com to assess which route fits your facts.

How does .eu compare to gTLD and other ccTLD recovery routes?

Understanding how .eu fits within the broader domain-dispute landscape helps calibrate both strategy and expectations.

The UDRP applies to .com, .net, .org, and other generic TLDs accredited to ICANN-approved registrars. WIPO and the Forum together handle the large majority of UDRP filings, with the WIPO filing fee starting at USD 1,500 for a single-member panel covering one to five domains. A standard UDRP case runs roughly two months to a decision. The UDRP remedy is limited to transfer or cancellation – no damages, no injunction, no cost award.

The .eu ADR.eu procedure differs from the UDRP in two significant respects. First, the rights base for a complaint is broader: it includes trade names, company names, and other rights recognized under EU or member-state law, not only registered trademarks. Second, the remedy in a .eu case depends on eligibility: a complainant with EU/EEA nexus can obtain a transfer; one without that nexus may obtain only a revocation. This creates a situation where the right outcome for you – transfer, not mere cancellation – depends on your own eligibility documentation being in order before you file.

For .uk domains, the Nominet DRS provides a distinct procedure with a free mediation stage before any expert decision. The DRS test is "abusive registration," and the key difference from the UDRP is that the DRS reads "registered or used" abusively, a lower bar than the UDRP's cumulative "registered and used in bad faith."

For .de, there is no UDRP equivalent. Disputes go through the German courts. DENIC offers a DISPUTE entry – a registration block that prevents the domain from being transferred to anyone other than the claimant while a court claim proceeds – but DENIC does not itself decide ownership. If a dispute spans a .eu and a .de domain held by the same bad actor, you are running two separate procedures simultaneously: ADR.eu for the .eu and German court proceedings (with DENIC DISPUTE entry) for the .de.

In a second illustrative matter (a cross-zone cybersquatting dispute involving both a .com and a .eu, autumn 2024), we filed a UDRP complaint at WIPO for the .com and an ADR.eu complaint for the .eu in parallel. The two proceedings ran concurrently, and both resulted in transfer orders within a comparable timeframe. The facts in each were identical, but the legal tests were distinct, and the evidence packages had to be tailored to each forum's rules.

What are the realistic costs and timelines for .eu lock escalation?

Costs and timelines depend on which track – registrar escalation, ADR.eu arbitration, or national court proceedings – you are on, and whether those tracks run sequentially or in parallel.

Registrar-level escalation and EURid notification carry no official filing fees. The investment is time and the quality of the evidence package you can assemble quickly. If the registrar responds and cooperates, a registry lock may be achievable within days. If the registrar is unresponsive or located in a jurisdiction where EURid's contractual leverage is limited, escalation to EURid directly becomes the operative step, and that process can take somewhat longer.

ADR.eu official fees are published by the Czech Arbitration Court. The entry-level fee for a .eu dispute is a modest official fee; verify the current rate at the ADR.eu platform before filing, as fees can be updated. Legal fees for preparing and filing an ADR.eu complaint – building the rights documentation, drafting the complaint, assembling the evidence record – are separate from the official filing fee and are, in the market, typically in a range comparable to a UDRP complaint preparation, adjusted for the .eu-specific requirements.

National court proceedings are substantially more resource-intensive. Emergency interim relief applications involve court fees, local litigation counsel in the relevant member state jurisdiction, and, where the domain is actively causing harm, an urgency that compresses preparation time. Those proceedings are appropriate when the operational risk of waiting for an arbitral decision outweighs the additional cost.

The realistic full timeline from initial escalation to a transfer order, assuming an uncontested ADR.eu proceeding and a cooperative EURid, is measured in weeks to a few months. A contested proceeding, or one complicated by a non-EU registrant who is difficult to locate, will take longer. Court proceedings add their own timelines, which vary by jurisdiction and by whether the application is for interim relief or a full merits hearing.

What common mistakes undermine a .eu lock escalation?

Several recurring errors cost registrants time and, in some cases, the domain.

The first is delay. Domain theft moves fast. A registrar-to-registrar transfer can complete in as little as five days once initiated. By the time a registrant notices the domain is gone, the transfer may already be final. The window for a registrar-level reversal – before EURid or a panel must intervene – is brief. Every day spent waiting for a response from general customer support rather than escalating to the registrar's abuse contact is a day lost.

The second is treating registrar escalation and formal dispute proceedings as sequential rather than parallel. Filing an ADR.eu complaint does not prevent you from simultaneously pursuing a registrar-level lock request or an EURid notification. The complaint itself puts the registrar on notice. In our practice, sending a copy of the ADR.eu complaint filing confirmation to the registrar's abuse contact has, on more than one occasion, accelerated the registrar's own response.

The third is filing an ADR.eu complaint without securing the rights documentation first. A complaint that asserts trademark rights but does not attach the registration certificate, or that asserts company-name rights without attaching the company registration, is deficient on its face. The ADR.eu rules require the complainant to specify the legal basis for the rights claimed and to submit supporting evidence with the complaint, not as a later supplement.

A fourth mistake – one that affects a significant number of .eu cases – is failing to address eligibility from the outset. If your goal is a transfer (not just revocation), your own EU/EEA eligibility must be documented in the complaint. A panel that orders revocation because the complainant did not establish EU nexus has still resolved the dispute, but the domain is deleted rather than transferred to you. You may then need to re-register it – with no guarantee it will be available, or that the bad actor will not register it again.

A fifth is communicating directly with the attacker about buy-back or ransom without legal advice. Those communications can complicate the bad-faith analysis and, in some cases, are used by respondents to argue that the complainant had constructive knowledge of the transfer and acquiesced.

Related at COGNOMEN

• Court action and domain theft recovery – the full service menu across all zones and forums
• Court action for cybersquatting under the .au framework – a cross-zone comparison for multi-zone disputes
• How complainants prove no legitimate interest in a group of disputed domains – panel reasoning and evidence strategy