How to reverse an unauthorized transfer of a .pl domain

How to reverse an unauthorized transfer of a .pl domain. UDRP and ccTLD domain recovery and defense across .pl. Email the firm to assess your case.

Your .pl domain moved to a stranger's registrar account overnight. The registrar's dashboard shows a completed transfer you never authorized. Every hour of downtime costs real business — customers who cannot reach your site, email that bounces, brand trust that quietly erodes. The question is not whether to act; the question is how to act fast and correctly under Polish law.

To reverse an unauthorized transfer of a .pl domain you must work on two parallel tracks: an immediate registrar escalation to lock the domain and halt any onward transfer, and a civil-court proceeding in Poland, the governing jurisdiction for all .pl disputes, because no UDRP or ccTLD arbitration procedure exists for .pl. NASK, the Polish registry, does not administer its own dispute-resolution service; ownership and transfer rights are decided by the Polish courts, applying civil and IP law. Speed is everything — evidence of the compromise degrades quickly, and a domain that moves again becomes significantly harder to recover.

This page sets out the registrar mechanics, the court route, the evidence that decides the outcome, and the realistic timeline for a .pl recovery.

Why .pl Is Different from UDRP Zones

Unlike .com, .net, or the many ccTLDs that have adopted the UDRP, .pl has no policy-mandated arbitration procedure. NASK administers the zone under Polish law, which means the only formal route to compel a transfer reversal is a Polish court action — typically before a civil court with territorial jurisdiction over the respondent or the registry. That single structural fact changes everything about strategy.

What does it mean in practice? It means the compressed UDRP timeline — roughly two months from filing to decision — is not available here. Polish civil proceedings move on a different clock, measured in months rather than weeks for an ordinary case. However, the Polish courts do offer interim relief: a provisional injunction (zabezpieczenie roszczenia) can freeze the domain, preventing any onward transfer, while the substantive case proceeds. That injunction, obtained early, is the functional equivalent of the registrar lock that the UDRP triggering-of-lock mechanism provides automatically elsewhere.

We advise every .pl registrant who discovers an unauthorized transfer to treat the first 24 to 48 hours as a triage window. The registrar escalation and the injunction application run simultaneously. Neither waits for the other.

Step One: Registrar Escalation and the Transfer-Lock Mechanics

The first action is not a court filing — it is a documented, timestamped complaint to every registrar in the chain. An unauthorized transfer typically involves at least two registrar accounts: the domain was pushed out of your original registrar to a receiving registrar controlled by the unauthorized party. Both registrars have ICANN-bound obligations to respond to credible evidence of account compromise or policy violation.

Practically, the escalation should include the following elements in this order:

• A written notice to your original registrar citing the specific transfer you did not authorize, with the date, the gaining registrar's name if visible in RDDS/WHOIS, and a demand to preserve all transfer logs and authentication records.
• A parallel notice to the gaining registrar demanding a voluntary lock pending investigation, citing ICANN's Inter-Registrar Transfer Policy obligations where applicable.
• A formal complaint to NASK as the registry operator, requesting a registry-level hold while the dispute is assessed.
• Preservation of your own account records: login timestamps, two-factor authentication logs, email notifications of the transfer, and any phishing or social-engineering communications you received around the time of the transfer.

Do not assume the registrar will act without pressure. Registrars have competing obligations — including to their existing customer, the new registrant — and they are not adjudicators. The escalation is a paper trail for the court, not a guaranteed rollback. In our experience, registrars with strong compliance teams do place voluntary holds when presented with clear evidence of unauthorized access. Others require a court order before they will act at all.

For an assessment of your .pl domain dispute, contact info@cognomenlaw.com.

Step Two: The Polish Court Route — When to File and What to Claim

The substantive claim in a .pl unauthorized-transfer case is ordinarily framed in Polish civil law, drawing on provisions governing unlawful interference with property or economic rights, unjust enrichment, and, where a trademark is involved, the applicable national trademark act. The goal of the claim is a declaratory judgment establishing the original registrant's right to the domain, combined with a mandatory order requiring NASK to restore the registration or transfer it back.

Three legal theories are most frequently combined in a .pl recovery action:

1. Unlawful appropriation of a property-equivalent right. Polish courts have recognized contractual rights in domain registrations as economically significant rights capable of protection under civil law, even where a domain is not itself classified as property in the traditional sense.
2. Interference with an enterprise's identifying sign. Where the domain contains a business name or trademark, the claim extends to unfair competition and trademark protection under the applicable national intellectual property legislation, which strengthens both the substantive claim and the basis for interim relief.
3. Unjust enrichment. The unauthorized transferee holds the domain at the expense of the original registrant without legal basis — a straightforward unjust-enrichment framing that Polish civil courts routinely apply to domain disputes.

The interim injunction application (zabezpieczenie) is the strategic core of the early-stage filing. A Polish court may grant it ex parte — without notice to the other side — if delay would cause irreparable harm and the applicant can establish a credible prima facie case. The injunction freezes the registration at NASK, preventing the domain from being transferred again or deleted while the full case proceeds.

In a recent matter — a .pl brand-name domain, spring 2025 — we coordinated a registrar-lock demand and a Polish-court injunction application within 48 hours of the client discovering the unauthorized transfer. The injunction was granted, the domain was frozen, and the substantive case proceeded with the registration preserved under the original registrant's practical control for operational continuity.

What Evidence Decides the Outcome?

A .pl recovery action stands or falls on the evidence of two things: that the original registrant held a legitimate right to the domain, and that the transfer was unauthorized — meaning it did not result from the registrant's own act or a lawfully authorized agent's act.

The most persuasive evidence package typically includes:

• Proof of original registration. Invoices, confirmation emails, registrar account screenshots, and historical RDDS records showing the complainant as the registrant of record before the transfer.
• Proof of no authorization. The registrar's authentication log showing that the transfer-authorization code (AuthInfo/EPP code) was requested or used without the registrant's action, or that account credentials were compromised — typically through phishing, SIM-swap, or credential-stuffing evidence.
• Trademark or business-name rights. Registration certificates, company registry extracts, long-standing commercial use — any evidence that ties the domain to a right the original registrant genuinely holds.
• Evidence of the unauthorized party's conduct. Particularly useful: demands for payment, use of the domain for phishing or redirection, or communications that acknowledge the transfer was not consensual.
• Contemporaneous communications. Phishing emails, SMS messages, or voice calls that the registrant received around the time of the transfer, evidencing a social-engineering attack.

What courts look for most critically is the gap between what the registrant did and what the transfer record shows. If the registrar's log shows an AuthInfo code request from an IP address never previously associated with the account, that gap is powerful. If the transfer notification email was rerouted — because the attacker had also compromised the registrant's email — records showing the rerouting rule can be decisive.

We regularly advise clients to preserve forensic evidence immediately: do not change passwords, do not delete suspicious emails, and do not reset accounts until a practitioner or a forensic specialist has imaged the relevant data. Premature remediation destroys the record that the court will need.

To plan recovery of a stolen or hijacked .pl domain, contact info@cognomenlaw.com.

How the Court Route Compares to Arbitration in Other Zones

The structural difference between .pl and arbitration-enabled zones is worth making explicit, because many brand owners discover it too late — after they have spent time looking for a UDRP filing option that does not exist for this zone.

For a .com or .net domain stolen by account compromise, the recovery route combines a registrar-escalation demand with ICANN's Inter-Registrar Transfer Policy and, if bad faith is shown, a UDRP complaint before WIPO or the Forum, with a filing fee starting at USD 1,500 and a decision in roughly two months. The UDRP is fast, relatively predictable in cost, and decided by a specialist panelist. The remedy is transfer or cancellation — nothing more.

For a .pl domain, none of that applies. The Polish court route is slower in ordinary proceedings. However, it offers remedies the UDRP cannot: the possibility of damages for the operational disruption caused by the unauthorized transfer, the availability of interim injunctions that a UDRP panel cannot grant, and in principle a broader range of equitable orders tied to the full facts of the case. Where the unauthorized transferee has already monetized the domain or caused measurable loss to the business, the court route may recover more than a UDRP transfer order ever could.

A second scenario worth considering: what if the same actor has taken both a .com and a .pl domain? Here the routes run in parallel. A UDRP complaint for the .com and a Polish court action for the .pl can proceed simultaneously. They are governed by different rules, but the underlying evidence — proof of the registrant's rights and the bad-faith conduct — is largely the same, and a coordinated strategy avoids the gap that arises when one domain is recovered and the other is used to continue the attack.

In another recent matter — a dual-zone compromise affecting a .com and a .pl, summer 2025 — we filed a UDRP complaint for the .com and a coordinated Polish-court injunction application for the .pl within the same week. The .com transferred back within approximately two months under the UDRP. The .pl was frozen by court order within days and returned through the substantive proceedings thereafter.

Realistic Timeline and Cost Structure

Clients ask two questions before any other: how long, and how much? Both have honest answers, and both depend on the complexity of the facts and whether the unauthorized transferee cooperates or contests.

Timeline. The registrar escalation and NASK registry-hold demand can be dispatched within hours of discovery. A Polish court interim injunction application, properly prepared, can be filed within one to three business days of retaining counsel. Ex parte interim relief, when granted, typically comes within days to a few weeks of filing, depending on the court's docket. The substantive case — the full declaratory and transfer-order proceedings — takes months in Poland's civil courts; the precise duration varies with the complexity of the facts, the number of parties, and whether expert evidence is needed.

Cost structure. Court proceedings in Poland carry official court filing fees set by the applicable national fee schedule — not a fixed arbitration fee of the WIPO type. Legal fees for a .pl domain recovery depend on whether the matter is contested, how complex the evidence trail is, and whether foreign counsel needs to be engaged for any cross-border element. COGNOMEN works with local litigation counsel in Poland for the in-country filings; we coordinate strategy, evidence preparation, and the cross-border elements from the outset. Fees are discussed openly at the assessment stage; we do not obscure the cost structure.

What increases the cost and the timeline: a highly contested respondent; a domain that has already been transferred again to a second unauthorized party; evidence that was partially destroyed before counsel was engaged; and cross-border complications where the unauthorized transferee is located outside Poland. What reduces them: a clean, timestamped evidence trail; a voluntary lock by the registrar; and an unauthorized transferee who, confronted with a credible court filing, returns the domain without a contested hearing.

Who Is the Unauthorized Transferee? Does That Change the Strategy?

The identity and motive of the party who holds the domain after the unauthorized transfer matters more than most registrants initially assume. Three profiles appear most often in our practice, and each calls for a different tactical emphasis.

The opportunistic credential thief. This party compromised the registrant's account — through phishing, credential stuffing, or SIM-swap — and transferred the domain to demand a ransom. The primary evidence is the account-compromise record. Courts treat this as clear-cut unauthorized appropriation. The injunction application is straightforward; the demand for payment is itself evidence of the bad faith.

The internal actor. A former employee, contractor, or business partner who had authorized access to the registrar account and used that access improperly after the relationship ended. This is more complex. The court must distinguish between an authorized act that exceeded its scope and a fully unauthorized act. The employment or partnership agreement, the scope of the actor's account access, and any post-termination communications are central to the analysis.

The commercially motivated third party. A competitor or speculator who may have purchased the domain from the original unauthorized transferee, potentially in good faith at the time of their acquisition. This scenario presents the hardest recovery facts: the current registrant may argue they acquired the domain lawfully. The original registrant's claim then turns on whether they can show the unauthorized origin of the transfer chain and whether the current holder's good faith extinguishes the original registrant's right under Polish civil law — a question that courts have resolved differently depending on the specific facts of the acquisition chain.

In our practice, understanding which profile applies shapes how we draft the injunction application, which parties we name, and whether we pursue criminal referral as a parallel track — because unauthorized computer access and identity fraud have their own criminal dimensions under Polish law that can accelerate a civil resolution.

Related at COGNOMEN:

• Court action and domain theft recovery across gTLDs and ccTLDs
• Recovering a domain stolen through cloud account compromise
• Case study: checking ccTLD eligibility before a .eu dispute filing