How to reverse an unauthorized transfer of a .biz domain

How to reverse an unauthorized transfer of a .biz domain. UDRP and ccTLD domain recovery and defense across .biz. Email the firm to assess your case.

You built a business identity around a .biz domain. Then someone moved it – without your authorization. The registrar's WHOIS now shows a stranger as owner, your email is bouncing, and the name you spent years building is no longer yours. The question is not whether you have a claim. The question is which route gets the name back fastest, and what evidence makes that route work.

To reverse an unauthorized transfer of a .biz domain you have two primary routes: a UDRP complaint filed before WIPO or the Forum, which can result in transfer within roughly two months at a filing fee starting at USD 1,500; or registrar-level escalation – and, where escalation stalls, court action – aimed at voiding the transfer as unauthorized. Which route fits depends on whether the transfer was a theft by a third party or an abusive registration requiring proof of all three UDRP elements.

This page covers the governing rules for .biz, the registrar mechanics of a stolen-domain reversal, the UDRP path, when a court action becomes necessary, and the evidence that decides the outcome.

Why .biz falls under the UDRP and what that means for recovery

.biz is an ICANN-accredited generic top-level domain. All .biz registrars are bound by the UDRP as a condition of their accreditation, meaning that a complainant can file before WIPO, the Forum, or the Czech Arbitration Court (CAC) to secure a transfer order. This matters: you are not limited to the registrar's own dispute process or to a domestic court unless you choose that path.

The UDRP provides the fastest arbitral route to transfer. A standard case before WIPO is normally decided within about two months of filing, with the respondent given 20 days from commencement to answer. The only remedies available are transfer or cancellation – no damages, no costs, no injunction. If you need monetary relief – for example, losses caused by customer redirection during the period of unauthorized control – that requires a separate court proceeding.

One critical distinction governs whether the UDRP is your first tool or a fallback. If a sophisticated third party acquired the domain through an abusive registration (typosquatting, a lookalike registration at renewal lapse), the UDRP is purpose-built for that scenario. If the domain was taken from you through account compromise – someone hacked your registrar account and initiated an unauthorized outbound transfer – the mechanics are different, and the registrar-escalation path must be engaged in parallel.

Registrar-lock and transfer-reversal mechanics: the first 72 hours

An unauthorized outbound transfer of a .biz domain exploits the registrar-to-registrar transfer protocol. Once the gaining registrar accepts the transfer, ownership moves. Reversing it requires a coordinated escalation that most registrants do not know exists.

The moment you confirm the transfer was unauthorized, document the state of your account: save all access logs, email confirmations, and any anomalous login notifications. Contact your losing registrar immediately and request that they flag the transfer as unauthorized and open an escalation with the gaining registrar. ICANN's transfer dispute resolution process requires the gaining registrar to respond within a defined window. Speed matters: the longer the domain remains with the gaining registrar, the more likely it is to be resold or modified.

Simultaneously, request a registrar lock or domain hold at both registrars. A domain under dispute should not be transferred again while proceedings are pending. If the gaining registrar does not cooperate, an ICANN complaint through the Registrar Compliance Department is the next lever. That complaint creates a formal record and, in our experience, accelerates registrar cooperation significantly when the unauthorized-transfer evidence is clear.

In a recent matter involving a .biz domain (autumn 2024), we documented an account-compromise event, escalated through the losing registrar within 48 hours of discovery, and secured a voluntary retransfer from the gaining registrar before any formal proceeding was necessary. The evidence of unauthorized access – login from an unfamiliar IP, a password-reset confirmation the registrant never requested – was decisive.

If your .biz domain has been transferred without your authorization, the first step is a fact assessment. Contact info@cognomenlaw.com to evaluate the transfer record and the fastest available route.

How do the three UDRP elements apply to a stolen .biz domain?

When the unauthorized transfer has moved the domain into the hands of a party who is using it – parking it, redirecting traffic, or actively monetizing it – the UDRP becomes the correct forum, supplementing or replacing registrar escalation. All three elements of Paragraph 4(a) of the UDRP must be satisfied.

First element: confusing similarity. You must hold trademark rights in a name that is identical or confusingly similar to the .biz domain. For a stolen domain bearing your own brand name, this element is rarely contested. Registered trademark rights are the strongest evidence. Common law rights – documented in sales records, press coverage, and continuous use – can also satisfy the element, but they require more evidentiary care.

Second element: no legitimate interest. A party who acquired the domain through theft or unauthorized transfer has no legitimate interest by definition. The challenge is proving that to the panel. Panels have consistently held that a respondent who defaults – by failing to file a response – permits an adverse inference, which strengthens a complainant's position on this element. The Paragraph 4(c) safe harbors (bona fide use before notice, commonly known by the name, legitimate noncommercial or fair use) are unavailable to a bad-faith transferee.

Third element: bad faith. Registration and use in bad faith must both be shown under the UDRP. Where the domain was taken in a targeted theft from a known brand owner, panels have found the bad-faith indicators under Paragraph 4(b) present – particularly the pattern of targeting a mark owner for commercial gain. Passive holding of a stolen domain, pointing it nowhere, does not insulate a respondent; the consensus view is that passive holding combined with other suspicious circumstances can satisfy the use-in-bad-faith limb.

What evidence decides the outcome of a .biz unauthorized-transfer case?

Evidence is the variable that separates a strong UDRP record from a weak one, and it is the variable you control. Assemble it before filing, not after.

The most important categories are:

• Proof of your trademark rights: the registration certificate, the date of first use in commerce, and the registration date relative to the domain's first registration date. If the domain predates your mark, additional argument is needed on secondary meaning.
• Proof of the unauthorized transfer: the WHOIS history, registrar account access logs, email confirmations sent to an address you did not control, and any ransom or buy-back demand made after the transfer.
• Proof of the current use: screenshots of the domain resolving to parking pages, pay-per-click (PPC) advertising, phishing pages, or a competitor's site – all of which support the bad-faith use limb.
• Prior correspondence: any demand letter, broker inquiry, or email from the new registrant is evidence of bad-faith purpose even if the amount demanded is not yet stated.
• RDDS/WHOIS change records: a printout showing the pre-transfer registrant data alongside the current data is baseline documentation for any forum.

What weakens a case? Delay in filing after discovery of the transfer damages credibility and may affect the equitable posture of the claim. An incomplete evidence package – screenshots without timestamps, trademark evidence limited to a pending application, or no clear chain of title – allows a respondent to contest each element independently.

When does a court route beat arbitration for a .biz domain dispute?

The UDRP is fast and relatively affordable, but it has limits. There are situations where a court action – or a court action pursued alongside a UDRP filing – is the more powerful tool. The right route depends on what you are trying to achieve.

If you need damages, only a court can award them. A company that suffered fraud losses, reputational harm, or customer diversion during a period of unauthorized control cannot recover that money through the UDRP. US anticybersquatting litigation is the statutory route for monetary relief in those circumstances.

If the identity of the thief is unknown, a court proceeding with subpoena power may be the only way to compel disclosure of registrar records, payment processors, and hosting logs that reveal who actually took the domain. A UDRP panel cannot compel third-party disclosure.

If the domain has been transferred again to a second buyer – a downstream purchaser who may claim to have acquired it without knowledge of the dispute – the UDRP is ill-suited to resolve a contested chain-of-title question. Courts can void fraudulent transfers along the chain and impose constructive trust remedies that arbitration cannot reach.

In a .biz matter we handled in summer 2025, the unauthorized transfer had been followed by a resale to a third party within a fortnight. The UDRP was filed to put the domain into a procedural hold, and court proceedings were commenced in parallel to address the chain of title. The UDRP complaint resulted in a transfer order; the court action addressed the downstream buyer's claim to bona fide purchaser status.

Conversely, if the transfer is recent, the current registrant is identifiable, and the evidence of theft is documentary and clear, a UDRP complaint before WIPO is typically faster, cheaper, and equally effective at securing the transfer. Legal fees for a straightforward UDRP complaint run in the USD 3,000–7,000 range on the market, separate from the WIPO filing fee of USD 1,500 for a single-member panel on one to five domains.

How do you choose? The matrix is this: UDRP when the goal is transfer only, the registrant is identifiable, and the three elements are clearly met. Court action when damages are sought, disclosure is needed, or a downstream transferee complicates the chain of title. Both, in parallel, when the domain is at risk of a further transfer and the time to secure an order matters as much as the form of that order.

If you are weighing a UDRP complaint against court action to recover a .biz domain, email info@cognomenlaw.com for a read on which route fits the facts you have.

Can you lose a domain you held legitimately – and how do respondents defend?

Not every .biz domain dispute ends with a complainant win. A registrant who received a UDRP complaint over a domain they acquired and hold in good faith has defenses, and those defenses are meaningful.

Paragraph 4(c) of the UDRP lists the safe harbors that demonstrate a legitimate interest. A respondent who was operating a bona fide business under the domain name before receiving notice of the dispute – documented through invoices, website archives, customer correspondence, and registration history – can defeat both the legitimate-interest and bad-faith elements. The longer and better-documented the legitimate use, the stronger the defense.

Where a complaint is filed without adequate trademark rights, without evidence connecting the respondent to bad faith, or as a tactical measure to wrest a legitimately held domain from its owner, a panel may find Reverse Domain Name Hijacking (RDNH). An RDNH finding carries no monetary penalty, but it is a public, reputational sanction against the complainant and a formal record that the complaint was filed in bad faith. We regularly act on the respondent side in exactly these circumstances.

The most common respondent error is defaulting – failing to file a response within the 20-day window. Default does not automatically mean loss, but it removes the panel's ability to hear the respondent's side and allows an adverse inference to stand. If a UDRP complaint arrives at your .biz domain, treat the 20-day clock as a hard deadline and seek counsel immediately.

Choosing the right forum for your .biz dispute: WIPO, the Forum, or CAC?

All three principal UDRP providers accept .biz complaints. The choice is more consequential than many complainants assume.

WIPO handles the largest volume of UDRP filings – roughly 97% of all proceedings are filed between WIPO and the Forum combined. WIPO's filing fee is USD 1,500 for a single-member panel on one to five domains. WIPO also offers an expedited option that delivers a decision within approximately one month, available for single-panel cases of up to five domains. For a stolen .biz domain where time is pressing, this expedited route is worth considering.

The Forum (formerly the National Arbitration Forum) offers a comparable single-member panel, with filing fees beginning around USD 1,300 for one to two domains. The Forum has a substantial body of published precedent, a competent panelist roster, and a fast case-management system. Some complainants prefer the Forum for procedural reasons relating to panel selection and response management.

CAC (the Czech Arbitration Court) is the lowest-cost entry point – filing fees beginning around USD 500–800 – but it is less frequently used and has a smaller published decision base. For a domain-theft case where the evidence is clear and you want speed and established precedent, WIPO or the Forum is the stronger choice.

One practical consideration: if the complainant requests a single panelist but the respondent requests a three-member panel, the parties generally split the higher three-member fee. Build this into your cost planning if the case is likely to be contested.

Cross-zone considerations: what if the same brand is registered as a .com and a .biz?

A common scenario in our practice is a brand owner who discovers parallel unauthorized registrations across multiple zones – a .com and a .biz taken at the same time, or a .biz lifted by theft while the .com remains unaffected. The UDRP permits a single complaint to cover multiple domains only when the registrant of record is the same holder. If the .com and .biz show different WHOIS registrants – a common tactic by sophisticated actors – two separate complaints are required.

That is not necessarily a problem. Each can be filed before the same forum simultaneously, before the same or different panels. In some cases, the factual record from the .com proceeding strengthens the .biz case when filed shortly after: a prior transfer order in the .com can itself be cited as evidence of a pattern of abusive registrations, supporting the Paragraph 4(b) bad-faith analysis in the .biz complaint.

Where the dispute also involves a country-code domain – a .uk, a .de, or a .eu registration alongside the .biz – the procedures diverge sharply. A .uk dispute goes before Nominet's DRS with its own "abusive registration" test; a .de dispute belongs in the German courts with a DENIC DISPUTE entry to block transfer during litigation. Neither is resolved by the same UDRP filing. Multi-zone theft cases require a coordinated strategy across procedures, and the .biz UDRP should normally be the first proceeding to commence while other routes are prepared in parallel.

Is there a zone where arbitration is unavailable? Yes. For .de, there is no UDRP equivalent, and the DENIC DISPUTE mechanism is a holding tool, not a decision-making procedure. Any .de component of a multi-zone theft must be handled through local litigation counsel in Germany. The .biz UDRP does not extend to that zone.

Related at COGNOMEN

• Court action and domain theft recovery – when arbitration is not enough
• How to recover a stolen .store domain through registrar escalation and UDRP
• Recovering a .tv domain after a failed buy-back attempt