Recovering a Hijacked Domain Name: A Practical Guide

Summary. This guide takes the owner of a hijacked domain name from the first hour after discovery to a recovered, locked name, and shows registrars, downstream buyers, and accused developers what to do when the demand arrives. It starts with the decision points that shape the response: how the name was taken, whether it has left the original registrar, whether the owner has a trademark, and whether the person who took it can be identified. The core steps cover containment of the root accounts, evidence preservation, notifications to insurers and law enforcement, registrar-to-registrar recovery through the Transfer Emergency Action Contact and the Transfer Dispute Resolution Policy, the UDRP, the in rem action and temporary restraining order in the registry's district, John Doe and in personam claims, insider disputes, and buy-backs through escrow. A timeline and cost table, a worked example that follows an industrial supplier through each step, common mistakes, an FAQ, and takeaways close the guide.

The accounts payable clerk at a mid-sized industrial supplier in Ohio notices it first. A customer calls to ask why the supplier's "new bank details" email asked him to wire a $38,000 payment to an account in another state. The email came from the supplier's own domain. Within an hour, the company's IT manager finds that the domain's mail records were changed the night before to point to a server he does not recognize, and that the registrar account now lists an email address he has never seen. By the next morning the name has been transferred to a different registrar, and the company's website shows a parked page.

The company has three problems at once: a stolen domain, a fraud campaign against its customers running on that domain, and an unknown intruder who has been inside at least one account. It needs to act on all three in the right order. Containment comes before recovery, evidence comes before anyone starts deleting things, and the registrar channel comes before the courtroom, unless the harm is serious enough to justify going to court the same week.

This guide is that order. For the doctrine behind each step, including the cases that made domain names property and the in rem action possible, see Stolen Domain Names: How Domain Hijacking Happens and the Legal Paths to Getting One Back. For the broader set of domain loss scenarios (squatters, lapses, prior holders), see Recovering a Domain Name: A Practical Guide.

The short answer

• Hour one: secure the root accounts. The registrar account, the email account that resets it, and the phone number that receives its codes. A recovered domain will be stolen again if the thief still holds any of them.
• Hour one, in parallel: call the registrar's security or abuse team. If a transfer is pending, ask the registrar to deny it on fraud grounds. If it has completed, ask the registrar to contact the gaining registrar through its Transfer Emergency Action Contact (TEAC) and request reversal.
• Day one: preserve evidence before it disappears. Registration data, DNS records, account logs, email headers, transfer notices, and captures of the hijacked site, each logged and hashed.
• Day one: notify the insurer, law enforcement, and anyone being defrauded. Cyber policies have short notice clauses, the FBI's IC3 report creates a record, and customers being phished need warnings.
• Week one: escalate through the registrars, or go to court. If the registrars cooperate, the name may come back within days. If they do not, the losing registrar can file a Transfer Dispute Resolution Policy (TDRP) request, and a trademark owner can file a UDRP complaint or, faster and more forcefully, an in rem action under 15 U.S.C. § 1125(d)(2) with a TRO directed at the registry.
• If you know who did it, sue them. Conversion, the Computer Fraud and Abuse Act, the Stored Communications Act, and (with a mark) the ACPA in personam. If you know only an alias, a John Doe action with early discovery can produce a name.
• Expect days to weeks for registrar recovery, about two months for a UDRP decision, and two to three months for an in rem default judgment, with a TRO available within days. Costs range from almost nothing (cooperative registrars) to the mid five figures (contested litigation).
• Finish by hardening. Registry lock, hardware-key authentication, a company-owned registrar account, and a registrant email address on a domain the company controls.

Before you start: five decision points

Answer these before choosing a path. Most mistakes in hijacking cases come from skipping one.

1. What actually happened? A registration hijack (the name moved or the registrant changed) calls for registrar recovery and legal process. A DNS hijack (the registration is still yours but the name server or mail records were changed) calls for restoring the records and treating the intrusion as a security incident. An expired name that someone else re-registered is a lapse, not a theft, and the remedies are the registrar's renewal and redemption windows or trademark claims. A former employee or developer holding the name in a personal account is an ownership dispute. Use the table to sort the facts.

2. Has the name left the original registrar, and how many times? A name still at your registrar is usually recoverable by the registrar alone. A name that moved once can often be reversed between registrars. A name that has moved two or three times, or been sold, generally needs a court order or a UDRP decision.

3. Do you own a trademark that matches the domain? A federal registration, a foreign registration, or provable common law rights from use. The UDRP and the ACPA in rem action are available only to mark owners. If the domain is a generic investment name with no associated business, rely on registrars, law enforcement, John Doe litigation, and property claims.

4. Who is the client, and who is the registrant of record? The company may think it owns the name while the registration lists a founder personally, a former employee, or an agency. The person with standing to ask the registrar for help is usually the registrant of record or its authorized representative. Sort out authority (a board resolution, an assignment from the founder, a signed authorization from the employee) on day one.

5. Is the domain being used to harm others right now? Phishing customers, diverting payments, or impersonating the company raises the urgency and supports emergency relief. It also creates potential notification duties and should trigger warnings to customers and banks.

Step 1: Contain the root accounts (hour 0 to 2)

What to do. Change the password and enable strong multifactor authentication on, in this order: the email account that receives the registrar's password resets and notices; the mobile phone account that receives SMS codes (call the carrier, report a SIM swap or port-out if one occurred, and add a port freeze or account PIN); and the registrar account, if you can still log in. Remove unknown recovery emails, phone numbers, forwarding rules, mail filters, and API keys. Sign out all sessions. If you use a password manager, check whether it was compromised.

Then call the registrar. Ask specifically for the domain security, abuse, or fraud team, not general support. Give them the domain name, the account identifier, and a short description. Ask them to freeze the account, restore your registrant data, re-enable the registrar lock, and (if a transfer is pending) deny it. Get a ticket number and ask them to confirm in writing.

Why. Every later step fails if the thief still controls the root credentials. A domain returned to an account the thief can still reach will be taken again, and often faster the second time.

Authority. Under ICANN's Transfer Policy, a registrar may deny an inter-registrar transfer request in specified circumstances, including evidence of fraud. Registrars accredited under the 2013 Registrar Accreditation Agreement must maintain an abuse contact and take reasonable steps to investigate and respond to abuse reports, and amendments that took effect in 2024 added specific obligations to mitigate DNS abuse such as phishing. These are contractual obligations to ICANN, not rights the victim can enforce in court, but they are the reasons a registrar's security team will act.

Pitfalls. Do not delete the thief's mail filters or forwarding rules before documenting them; screenshot or export first. Do not log in to the registrar from a device that may be infected. Do not post about the incident publicly before you have locked down the accounts.

Timing and cost. Minutes to hours. Little or no cost beyond staff time.

Step 2: Preserve the evidence (day 0 to 1)

What to do. Build an evidence file that will support a registrar request, a UDRP complaint, a declaration in federal court, and an insurance claim. Collect:

• Registration data. The current RDAP record for the domain (registrar, creation and update dates, status codes, name servers), captured with the date and time. Historical registration records from a commercial history service, showing you as registrant before the theft.
• DNS data. Current DNS records and, if available, passive DNS history showing when name servers and mail records changed.
• Account records. Registrar account logs (login dates, IP addresses, changes, auth code requests), which you can ask the registrar to preserve and produce; email account security logs; carrier records of SIM changes or ports.
• Communications. Every transfer notice, confirmation, and alert from the registrar, recovered from trash and deleted-items folders if the thief deleted them, with full headers.
• The hijacked site. Captures of whatever the domain now shows, with URL, date, and time, plus Internet Archive captures of your site before the theft.
• Proof of ownership. Invoices and receipts for registration and renewals, the registrar account history, trademark registrations, business records showing use of the domain, and any assignment or authorization documents from step 0.
• Harm. Customer reports of phishing, diverted payments, lost sales, and the costs of response.

Log each item with who collected it, when, how, and a hash value. Issue a written litigation hold to employees and vendors who may have relevant records.

Why. Registration data and DNS records change constantly, registrars purge logs on retention schedules, and the thief may delete content. A clean evidence file is what makes a registrar comfortable reversing a transfer, and it is what a judge will rely on in an ex parte TRO.

Authority. Electronic evidence must be authenticated under Fed. R. Evid. 901; data copied from an electronic device or file may be self-authenticated by a qualified person's certification of its hash under Fed. R. Evid. 902(14). The duty to preserve arises when litigation is reasonably anticipated, and loss of electronically stored information can lead to measures under Fed. R. Civ. P. 37(e). See Authenticating Website Evidence: A Practical Checklist and Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.

Pitfalls. Screenshots without URLs, dates, or a capture record. Relying on a single current lookup when the history is what proves ownership. Forgetting to ask the registrar to preserve its logs (send that request in writing on day one).

Timing and cost. One to two days of focused work. A forensic firm, if the email or network was compromised, typically costs thousands to tens of thousands of dollars depending on scope, and may be covered by a cyber policy if the insurer approves the vendor.

Step 3: Notify the insurer, law enforcement, and people at risk (day 0 to 2)

Insurer. Read the cyber, crime, and business owner's policies for notice requirements, panel vendor requirements, and consent-to-incur-costs clauses. Many cyber policies require notice "as soon as practicable" and limit recovery for costs incurred before notice or with unapproved vendors. Domain hijacking can implicate coverage for network security events, cyber extortion (if the thief demands payment), funds transfer fraud or social engineering (if customers or the company paid a fraudster), and business interruption. See Placing and Tendering a D&O or Cyber Claim: A Practical Guide.

Law enforcement. File an IC3 complaint with the FBI's Internet Crime Complaint Center, keeping the confirmation. If customers wired money to the fraudster, the speed of the IC3 report matters, because banks can sometimes recall or freeze funds only within a short window. File a local police report if the insurer, carrier, or registrar wants a report number. Relevant federal offenses include computer intrusion, 18 U.S.C. § 1030; wire fraud, 18 U.S.C. § 1343; and aggravated identity theft, 18 U.S.C. § 1028A.

People at risk. Warn customers, vendors, and banks not to act on payment instructions from the domain. If the thief accessed email containing personal information, evaluate state breach notification laws. See Responding to a Data Breach: The First Seventy-Two Hours.

Pitfalls. Paying anyone, or hiring a recovery service, before notifying the insurer. Telling customers more than you know. Promising customers the domain "will be back tomorrow."

Timing and cost. Same day. Low cost.

Step 4: Recover through the registrars (day 1 to 14)

What to do. Send the losing registrar (your registrar) a written request, in addition to the phone call. Attach a short declaration of ownership and the evidence file index. Ask the registrar to:

1. confirm the date and method of the transfer and preserve all related logs;
2. contact the gaining registrar through its Transfer Emergency Action Contact and request reversal of the transfer as unauthorized;
3. if the gaining registrar does not agree, file a request under the Transfer Dispute Resolution Policy; and
4. identify any information it can share about the account changes that preceded the transfer.

Then send the gaining registrar a separate abuse report through its published abuse contact, with the same evidence. Many gaining registrars will place a name on hold when they receive a credible theft report from the prior registrant, particularly if the account that received the name was newly created or paid with suspicious credentials.

If the domain has passed through a reseller, contact both the reseller and the accredited registrar behind it.

If a registrar does not respond to abuse reports or TEAC communications, a complaint to ICANN Contractual Compliance is available. ICANN does not decide ownership, but compliance inquiries prompt responses.

Why. Registrar-to-registrar reversal is the fastest and cheapest recovery path. It needs no trademark, no court, and no identification of the thief. Registrars cooperate because their own terms prohibit fraudulent registrations and because they want reciprocal cooperation when their customers are the victims.

Authority. ICANN's Transfer Policy requires each registrar to maintain a TEAC that responds to urgent communications from other registrars within four hours under the current policy, and it allows a transfer to be reversed when a registrar fails to respond. Recommendations from ICANN's Transfer Policy Review, approved by the GNSO Council in March 2025, would change several procedures, including the transfer code's name and validity period and the treatment of registrant changes, but they bind registrars only after ICANN Board adoption and a lengthy implementation period, so confirm which version your registrars are applying. Registrars generally may not disclose redacted registration data to the public, but they can share information with each other and respond to legitimate requests under ICANN's Registration Data Policy and through the Registration Data Request Service.

Pitfalls. Sending the gaining registrar a threatening letter before your own registrar has contacted it. Asking the registrar to "give you the thief's information" (it will usually refuse without legal process). Failing to keep a record of every call and email, which you will need for a TDRP filing or a court declaration.

Timing and cost. A cooperative reversal can take one to five business days. A refusal or non-response becomes clear within a week or two. Cost is mostly counsel time for the letters and declaration.

Step 5: Ask your registrar to file under the TDRP (week 1 to 8)

What to do. If the gaining registrar refuses or ignores a reversal request, ask the losing registrar to file a TDRP request with an ICANN-approved dispute resolution provider. Offer to prepare the factual record and, if the registrar asks, to cover the filing fee. The registrar's filing should show: that you were the registrant of record before the transfer; that the transfer was initiated by someone without authority (the account compromise); that the transfer therefore did not comply with the Transfer Policy's authorization requirements; and that reversal is the appropriate remedy.

Why. The TDRP is the only formal ICANN process for reversing an improper inter-registrar transfer. It is narrow (it asks whether the Transfer Policy was followed), but a transfer authorized by a thief using stolen credentials did not receive the authorization of the registrant, and panels can order the name returned.

Authority. Under the TDRP, only registrars may file, the dispute providers decide, and a request generally must be filed within twelve months of the alleged violation. Decisions can be challenged in court. Revisions that took effect in 2016 removed the registry as a first-level decision-maker. The Transfer Policy Review recommendations also address the TDRP, so cite the version in force on the transfer date.

Pitfalls. Treating the TDRP as your only path. It is slow relative to the harm in many cases, and your registrar may decline to file. Run it in parallel with step 6 or 7 where the facts justify that.

Timing and cost. Several weeks to a few months. Provider fees vary; check the provider's current schedule. Counsel time to prepare the record.

The toolkit includes a TDRP request outline: see Domain Recovery Toolkit: Registrar Demands, Transfer Dispute Filings, and In Rem Complaints.

Step 6: File a UDRP complaint, if you have a mark (week 1 to 9)

What to do. If the domain matches your trademark and the name sits with a registrar that has not reversed the transfer, file a UDRP complaint with WIPO, Forum, or another approved provider. Frame the complaint around the theft:

• Element one. Your trademark rights (registration certificates, or evidence of common law rights from long use of the domain as your business name) and the identity of the domain to the mark.
• Element two. The current registrant has no rights or legitimate interests, because it obtained the name through unauthorized access to your account and has made no bona fide use.
• Element three. Registration and use in bad faith. The current registrant's acquisition is the relevant registration, and acquiring a name by theft is bad faith. Use for phishing, impersonation, or an offer to sell reinforces it.

Attach the evidence file, the account compromise timeline, and the IC3 confirmation. Ask for transfer.

Why. The UDRP is fast, inexpensive relative to litigation, and implemented by the registrar without needing the thief's cooperation. Filing also triggers a registrar lock that prevents the name from being moved again during the proceeding.

Authority. UDRP paragraph 4(a) sets the three elements, paragraph 4(b) lists non-exclusive bad-faith circumstances, and paragraph 4(i) authorizes transfer. The UDRP Rules require the registrar to lock the name within a short period after the provider's verification request. Panels follow the consensus views collected in the WIPO Jurisprudential Overview 3.0. For filing mechanics, see How to File a UDRP Complaint for Domain Name Disputes and Filing a UDRP Domain Name Complaint: A Practical Checklist.

Pitfalls. Filing without a mark. Filing against a name held by a downstream buyer who will raise a factual dispute the panel considers outside the policy's scope. Forgetting that a losing registrant can suspend implementation by filing suit within ten business days under paragraph 4(k), and that a court treats the panel's decision as having no preclusive effect, Dluhos v. Strasberg, 321 F.3d 365 (3d Cir. 2003).

Timing and cost. Decisions usually issue within about 45 to 60 days of filing when the respondent defaults. Provider fees for a single-member panel and a small number of domains are roughly in the low thousands of dollars; check current schedules. Counsel fees vary with complexity.

Step 7: File an in rem action with a TRO in the registry's district (week 1 to 12)

When the domain is being used to defraud people, is listed for sale, or has moved beyond the reach of cooperative registrars, a trademark owner should consider going straight to federal court.

What to do.

1. Pick the court. File in the judicial district where the registrar, registry, or other domain name authority is located. For .com and .net names, the registry is Verisign, in Reston, Virginia, so the Eastern District of Virginia (Alexandria Division) is the usual forum regardless of where the registrar sits. See Mattel, Inc. v. Barbie-Club.com, 310 F.3d 293 (2d Cir. 2002) and FleetBoston Financial Corp. v. FleetBostonFinancial.com, 138 F. Supp. 2d 121 (D. Mass. 2001). Check the registry for other top-level domains.
2. Plead the claims. An in rem complaint against the domain name under 15 U.S.C. § 1125(d)(2), alleging that the domain violates your rights under the ACPA's bad-faith provision and, where supported, under the infringement and dilution provisions, which Harrods holds may be brought in rem, Harrods Ltd. v. Sixty Internet Domain Names, 302 F.3d 214 (4th Cir. 2002). Plead the theft facts in detail. Subject matter jurisdiction rests on 28 U.S.C. § 1331 and 28 U.S.C. § 1338.
3. Show that in rem is proper. Allege, and later prove, that you cannot obtain personal jurisdiction over a person who would be a defendant in an in personam ACPA case, or that through due diligence you could not find that person. Send notice of the alleged violation and your intent to proceed in rem to the registrant's postal and email addresses in the registrar's records (including the privacy service), and ask the court to direct publication.
4. Deliver the complaint to the registry and registrar. Once they receive written notice of a filed, stamped complaint, the statute requires them to deposit documents establishing the court's control over the name and not to transfer, suspend, or modify it during the case except by court order, 15 U.S.C. § 1125(d)(2)(D)(i).
5. Move for a TRO. Under Fed. R. Civ. P. 65(b), ask the court to direct the registry to lock the name and, where it is being used for fraud, to disable its resolution pending the case. Support it with a declaration of specific facts showing immediate and irreparable injury and an attorney's certification of efforts to give notice. Address each factor under Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008). Offer a modest bond under Rule 65(c). An ex parte TRO lasts fourteen days unless extended for good cause, so schedule the preliminary injunction hearing or the default timeline accordingly.
6. Take the default. If no one appears after notice and publication, request entry of default and a default judgment under Fed. R. Civ. P. 55 ordering the registry to transfer the name to your chosen registrar. See Obtaining or Setting Aside a Default Judgment: A Practical Guide.

Why. The in rem action needs no defendant, binds the registry (a domestic entity that complies with court orders), and ends with a transfer even when the registrar of record is offshore and unresponsive. Its constitutional footing was settled early: exercising jurisdiction over the domain whose ownership is in dispute satisfies due process, as Harrods held applying Shaffer v. Heitner, 433 U.S. 186 (1977). And a registrant's late offer to submit to jurisdiction does not defeat a properly brought in rem case, Porsche Cars North America, Inc. v. Porsche.net, 302 F.3d 248 (4th Cir. 2002).

Pitfalls. Filing in your home district. Pleading in rem when the thief is identifiable and subject to personal jurisdiction somewhere in the United States (the in rem and in personam tracks are alternatives; the Fourth Circuit measures the availability of personal jurisdiction at filing, Prudential Insurance Co. of America v. Shenzhen Stone Network Information Ltd., 58 F.4th 785 (4th Cir. 2023)). Expecting damages (none are available in rem). Forgetting to deliver the complaint to the registry, which is what triggers the statutory freeze. Failing to check local rules on TRO procedures and proposed orders.

Timing and cost. A TRO can issue within days of filing. A default judgment usually follows within two to three months. The federal filing fee is currently $405, and total costs through default commonly run from several thousand to the low tens of thousands of dollars, more if the case is contested. For the TRO papers, see Preliminary Injunction and TRO Application Checklist: A Practical Checklist.

Step 8: Pursue the person (month 1 onward)

When the thief, an intermediary, or a downstream holder can be identified, or when the victim has no mark and cannot use steps 6 and 7, sue in personam.

What to do.

• Identify. If you have only an alias, an email address, or an account ID, file a John Doe complaint and move for leave to serve subpoenas before the Rule 26(f) conference under Fed. R. Civ. P. 26(d)(1), then serve Fed. R. Civ. P. 45 subpoenas on registrars, email providers, carriers, payment processors, and escrow services. Providers may give non-content subscriber records to private parties under 18 U.S.C. § 2702(c)(6), but not message contents. The procedure is detailed in Identifying an Anonymous Defendant Online: A Practical Guide and the forms are in John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash.
• Plead. Conversion (domain names are property under California law, Kremen v. Cohen, 337 F.3d 1024 (9th Cir. 2003); check the governing state's law, and note that Virginia treats a registration as a service contract for garnishment purposes, Network Solutions, Inc. v. Umbro International, Inc., 529 S.E.2d 80 (Va. 2000)); CFAA under 18 U.S.C. § 1030(g) (requires a qualifying harm, usually $5,000 in loss within a year, and suit within two years); Stored Communications Act under 18 U.S.C. § 2707 if email was accessed; ACPA in personam under 15 U.S.C. § 1125(d)(1) with statutory damages of $1,000 to $100,000 per name under 15 U.S.C. § 1117(d) if you have a mark; and declaratory relief under 28 U.S.C. § 2201 that you own the name.
• Get jurisdiction right. A foreign thief who targeted a U.S. business through U.S. registrars may be subject to jurisdiction on an effects theory, but courts look for conduct expressly aimed at the forum, not just harm felt there. See Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor. Serving a foreign defendant may require alternative service under Fed. R. Civ. P. 4(f)(3); see Service of Process: Domestic and International Methods That Work.
• Collect. A judgment against an identified thief can be enforced against the thief's other domain names, which are reachable where their registry sits. In Office Depot, Inc. v. Zuccarini, 596 F.3d 696 (9th Cir. 2010), a creditor used Fed. R. Civ. P. 69 and a receiver under Fed. R. Civ. P. 66 to reach a typosquatter's portfolio.

Pitfalls. Naming the registrar as a defendant. Registrars are protected for registration activities absent bad-faith intent to profit and for compliance with court orders under 15 U.S.C. § 1114(2)(D), and courts reject contributory theories against them, Rigsby v. GoDaddy Inc., 59 F.4th 998 (9th Cir. 2023); Petroliam Nasional Berhad v. GoDaddy.com, Inc., 737 F.3d 546 (9th Cir. 2013). Pleading CFAA claims without documenting the $5,000 loss threshold. Naming a suspect publicly before corroborating the identification.

Timing and cost. Identification takes months. Contested litigation takes a year or more and can cost well into six figures. A default judgment against an identified but absent thief is faster and cheaper.

Step 9: Resolve insider and developer disputes (week 1 to 8)

Many "hijackings" turn out to be a current or former vendor, employee, or co-founder holding the name.

What to do. Gather the engagement agreement, statements of work, invoices showing the client paid for the registration or renewals, and emails discussing the domain. Send a calm, specific demand: identify the name, state that it was registered for the client as its agent, request transfer to a specified account by a date, and offer to pay any genuine out-of-pocket registration costs. If the developer claims an unpaid invoice, separate the issues: pay the undisputed amount or escrow the disputed amount in exchange for the transfer, and preserve claims.

Why. Agency principles generally require an agent to deliver to the principal property acquired on its behalf, and the Restatement (Third) of Agency states the rule plainly. Work-made-for-hire doctrine, a copyright rule under 17 U.S.C. § 101, does not apply to a domain registration. Most developers transfer once the contract is quoted to them.

If they refuse. Claims for breach of contract, breach of fiduciary duty, and conversion (where available) are the base. If the developer uses the name to extract payment and it matches the client's mark, the ACPA's bad-faith factors, including an offer to transfer for financial gain without bona fide use, come into play. A UDRP complaint against a former vendor is risky if the vendor has a colorable claim, because the panel may see a contract dispute and the respondent may seek a finding of reverse domain name hijacking. On ownership disputes generally, see Resolving a Trademark Ownership Dispute: A Practical Guide.

Timing and cost. A demand letter usually resolves the matter within weeks. Litigation is the exception.

Step 10: Consider a buy-back, carefully (any time)

What to do. If the name is generic, you have no mark, the formal paths are slow, and the asking price is less than the cost of litigation, buying the name back may be rational. Before paying: notify the insurer and law enforcement; screen the counterparty against Treasury's sanctions lists to the extent possible; use a reputable domain escrow service so funds are released only after the name is in your account; and document the transaction. If the holder claims to be a good-faith purchaser from the thief, negotiate a transfer and a release rather than a payment to the thief's chain.

Authority. Payments to sanctioned persons can violate regulations administered by the Office of Foreign Assets Control, including the cyber-related sanctions in 31 C.F.R. Part 578, regardless of the payer's intent. See Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses and the payment-decision analysis in Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers. For escrow mechanics, see Setting Up and Administering a Deal Escrow: A Practical Guide.

Pitfalls. Paying in cryptocurrency to an anonymous seller. Paying before the insurer agrees. Assuming the seller can deliver.

Step 11: Restore, harden, and close out (week 1 to 12)

When the name comes back:

• Move it into a company-owned registrar account with named administrators and no personal email addresses as the registrant contact.
• Enable registry lock where the registry and registrar offer it, so status changes require out-of-band verification.
• Require hardware security keys or app-based authentication for the registrar and the email accounts that control it. Remove SMS as a recovery method.
• Use a registrant contact email on a domain the company controls and will never let lapse, and use a role address rather than an individual's.
• Turn on auto-renew with a valid payment method and a renewal reminder routed to a team.
• Review DNS records, remove dangling records, and enable DNSSEC where appropriate.
• Write a one-page post-incident report: what happened, what worked, what changes.

The full list is in Domain Name Security and Recovery Checklist: A Practical Checklist, and a domain portfolio security policy template is in the toolkit.

The other side: when the demand arrives at your door

If you are the gaining registrar

A credible theft report about a name that just arrived in your system is a fraud signal, not a customer service issue. Route it to your abuse or compliance team. Respond to TEAC communications within the policy's deadline. Preserve the account records (creation date, login IPs, payment method, contact data) and place the name on hold while you review. If the evidence is strong, agree to reverse; if it is not, say so in writing and explain what more you need. Comply with court orders directed at the name. The Lanham Act's registrar protections in 15 U.S.C. § 1114(2)(D) cover good-faith registration activity and compliance with court orders and reasonable policies; they do not protect a registrar that itself acts with bad-faith intent to profit.

If you are the losing registrar

Your customer is the victim, and you hold the best evidence. Preserve logs immediately, use your TEAC channel, consider a TDRP filing, and document the account compromise. Respond to subpoenas for account records under your normal process. A registrar that ignores obvious fraud in an outbound transfer may face questions about whether it acted reasonably; Kremen involved a registrar that transferred a name on a forged letter.

If you bought the name and now face a theft claim

Preserve the purchase records, escrow documents, and all communications with the seller. Do not move or modify the name. Evaluate your position honestly: a thief cannot pass good title, so your strongest claim is usually against the seller. If the price was far below market or the seller had no history, a court is unlikely to view you as an innocent purchaser. Negotiating a return in exchange for a release, and pursuing the seller, is often better than defending. If you were a genuine purchaser and the victim's theft claim is doubtful, you may contest a UDRP complaint, and a registrant whose name is suspended or transferred under such a policy may sue to establish that its registration and use are lawful under 15 U.S.C. § 1114(2)(D)(v); see Sallen v. Corinthians Licenciamentos LTDA, 273 F.3d 14 (1st Cir. 2001).

If you are the developer or agency accused of holding a client's name

Separate the domain from the fee dispute. Holding a client's domain hostage creates exposure under contract, agency, conversion, and possibly the ACPA, and it rarely produces payment. Transfer the name, document your invoice, and pursue the invoice as a collection matter. If the engagement agreement gave you ownership of the name (rare), say so and provide it.

If you are accused of hijacking a name you lawfully registered

Some "theft" claims come from former owners who let a name lapse or sold it and regret the sale. Preserve your registration and purchase records, respond to the registrar's inquiry promptly, and in a UDRP proceeding, document your rights or legitimate interests. A complainant who brings a UDRP case in bad faith can be found to have attempted reverse domain name hijacking. See Domain Name Dispute Checklist: A Practical Checklist.

Timeline and cost table

Figures are typical ranges for a single .com domain and a U.S. victim. They are estimates for planning, not quotes; provider fees and court costs change.

Worked example: Tidewell Supply Co.

Tidewell Supply Co., an Ohio corporation, has sold industrial fasteners as "Tidewell" since 2003 and has a federal registration for TIDEWELL. Its domain, tidewell.com, was registered in 2004 by the company's first IT contractor, Gene Haskett, who listed his own consulting company's email address (gene@haskettit.net) as the registrant contact. Haskett retired in 2016. His consulting domain expired in 2018.

The theft. In early March, someone registers haskettit.net, sets up a mailbox for gene@haskettit.net, and uses the registrar's password reset to take over the account that holds tidewell.com. The thief changes the mail records first, sends invoices with new bank details to Tidewell's customers, and two days later transfers the name to a registrar overseas.

Decision points. Tidewell sorts the facts: a completed registration hijack, preceded by a DNS hijack, through a lapsed email domain. It has a federal mark. It cannot identify the thief. The domain is being used to defraud customers. The registrant of record was Haskett's company, so authority will need to be shown.

Step 1 (hour 0 to 2). Tidewell's IT manager calls the registrar's security team, reports the takeover, and asks for an account freeze and a record of the transfer. The company also contacts Haskett, who signs a short declaration confirming that he registered the name for Tidewell as its contractor and that he has no claim to it, and an assignment of any interest to Tidewell.

Step 2 (day 0 to 1). Counsel builds the evidence file: historical registration records showing Haskett's company as registrant since 2004 and Tidewell's address in the organization field; renewal invoices paid by Tidewell; the registrar's transfer notices; the RDAP record of haskettit.net showing a new registration days before the theft; customer copies of the fraudulent invoices; and captures of the parked page. Each item is hashed and logged.

Step 3 (day 0 to 2). Tidewell notifies its cyber insurer, which assigns panel counsel and a forensic firm. It files an IC3 complaint and warns customers by phone and through a notice on a temporary site. One customer who wired $38,000 asks its bank to recall the wire, citing the IC3 report.

Step 4 (day 1 to 7). Tidewell's registrar contacts the gaining registrar through the TEAC. The gaining registrar acknowledges the request but declines to reverse without "a court order or dispute decision."

Step 5 (week 1). The losing registrar agrees to file a TDRP request but cautions that it will take weeks.

Step 6 (decision). Counsel considers a UDRP complaint but decides the fraud makes speed critical. The UDRP would take two months and would leave the domain active during that time.

Step 7 (week 1 to 10). Tidewell files an in rem complaint against tidewell.com in the Eastern District of Virginia, alleging cybersquatting and infringement, and moves for an ex parte TRO directing Verisign to lock the name and disable its resolution. The declaration describes the lapsed-email attack, attaches the evidence log, and documents notice to the registrant email and the privacy service. The court grants the TRO two days later. Verisign implements it, and the fraudulent invoices stop working because the domain no longer resolves. After publication and no appearance, the court enters default judgment in the ninth week ordering transfer to Tidewell's registrar. The TDRP request is withdrawn.

Step 8. The forensic firm traces the payment account used in the invoice fraud to a money mule. Tidewell gives the information to the FBI rather than suing the mule, whose assets are minimal.

Step 11. tidewell.com goes into a Tidewell-owned account with registry lock, hardware keys for two named administrators, and a registrant email address at tidewell.com routed to a role mailbox. The company audits its other 14 domains and finds two more registered through Haskett's lapsed email. Both are moved the same week.

Costs. Roughly $24,000 in legal and forensic fees, most covered by the cyber policy after the retention. The $38,000 wire was partially recovered.

Common mistakes

• Treating the incident as a domain problem only. If the thief got in through email or a phone account, that account is the real breach.
• Waiting for the registrar's general support queue. Ask for security, abuse, or fraud teams and escalate in writing.
• Starting with the UDRP when the domain is being used for fraud. The UDRP does not stop the harm during the proceeding. An in rem TRO does.
• Filing in rem in the wrong court. In rem venue follows the registrar or registry, not the plaintiff.
• Not documenting authority. If the registrant of record is a contractor, founder, or former employee, get a declaration and assignment immediately.
• Paying before notifying the insurer. Many policies exclude voluntary payments and unapproved costs.
• Forgetting the other domains. The weakness that allowed one theft usually affects others in the same portfolio.
• Not hardening afterward. Recovered names are stolen again when the same email, phone, or account setup remains.

Frequently asked questions

Can my registrar simply take the name back? Only if the name is still in its system. Once it has transferred, the gaining registrar controls it, and your registrar must request reversal or file under the TDRP.

Will the gaining registrar tell me who took the name? Usually not without legal process. Ask your registrar to share what it can, and serve subpoenas once you have a lawsuit on file.

Do I need a lawyer for the registrar steps? Not always, but a clear written demand with a declaration and an evidence index often makes the difference between a quick reversal and a refusal.

How fast can a court act? An ex parte TRO in a well-prepared in rem case can issue within a day or two of filing. The statutory freeze takes effect when the registry and registrar receive the filed complaint.

What if the domain is a country-code name? The registry's own policies and local courts govern. Many ccTLD registries have dispute policies modeled on the UDRP, and some can act quickly on theft reports. The ACPA's in rem provision applies only where a U.S. court can reach the registrar, registry, or domain authority.

Is a domain hijacking a reportable data breach? It depends on whether personal information was accessed, such as through a compromised email account. Analyze the state breach laws with the forensic findings in hand.

Should we offer a reward or hire a "recovery agent"? Be cautious. Some recovery services are legitimate brokers; others are scams that target victims. Use counsel, verified escrow, and the formal channels.

Takeaways

• Secure email, phone, and registrar accounts before anything else.
• Call the registrar's security team immediately; a pending transfer can often be stopped.
• Build an evidence file on day one that will work for a registrar, a panel, a judge, and an insurer.
• Registrar reversal is fastest; the TDRP is the formal registrar channel; the UDRP and in rem action require a mark.
• When the domain is being used for fraud, file in rem in the registry's district with a TRO.
• Sue the person when you can identify them; plead conversion, CFAA, SCA, and the ACPA as the facts allow.
• Separate developer fee disputes from domain ownership.
• Harden the portfolio before closing the file.

This document is general information, not legal advice for any particular situation; ICANN policies are being revised, procedures differ by registry and court, and the facts matter.

Related Documents

Related Articles

• Stolen Domain Names: How Domain Hijacking Happens and the Legal Paths to Getting One Back: the doctrine and case law behind each step.
• Beyond the UDRP: Uniform Rapid Suspension, Country-Code Domain Disputes, In Rem ACPA Actions, and Reverse Domain Name Hijacking: in rem and country-code procedures in depth.
• Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court: the TRO standards.
• Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers: sanctions and insurance analysis for any payment to an attacker.
• Paid Vulnerability Disclosure and the Line Between Research and Extortion: handling a stranger who reports, or exploits, a weakness in your domain setup.
• Social Media Account and Handle Disputes: Impersonation, Username Squatting, and Who Owns a Company Account: ownership, impersonation, and squatting disputes over social media accounts and handles.

Related Guides

• Recovering a Domain Name: A Practical Guide: squatters, lapses, prior holders, and insiders.
• Choosing the Right Domain Name Dispute Procedure: A Practical Guide: comparing UDRP, URS, and litigation.
• Identifying an Anonymous Defendant Online: A Practical Guide: John Doe identification.
• Obtaining or Setting Aside a Default Judgment: A Practical Guide: how most in rem cases end.
• Responding to a Ransomware Attack: A Practical Guide for the First Two Weeks: incident response discipline.
• Resolving a Trademark Ownership Dispute: A Practical Guide: ownership disputes with insiders and partners.
• Recovering or Defending a Social Media Account or Handle: A Practical Guide: ownership, impersonation, and squatting disputes over social media accounts and handles.

Related Checklists

• Domain Name Security and Recovery Checklist: A Practical Checklist: the tasks from this guide in order.
• Preliminary Injunction and TRO Application Checklist: A Practical Checklist: the emergency papers.
• Authenticating Website Evidence: A Practical Checklist: evidence that survives challenge.
• Filing a UDRP Domain Name Complaint: A Practical Checklist: the UDRP filing tasks.
• Social Media Account Ownership and Impersonation Response Checklist: A Practical Checklist: ownership, impersonation, and squatting disputes over social media accounts and handles.

Related Toolkits

• Domain Recovery Toolkit: Registrar Demands, Transfer Dispute Filings, and In Rem Complaints: letters, declarations, outlines, and pleadings for every step.
• John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash: identification papers.
• Ransomware Response Toolkit: Decision Memos, Sanctions Screening Records, and Notification Templates: sanctions screening and notice templates.
• Advanced Domain Dispute Toolkit: URS Complaints, In Rem Pleadings, and Reverse Hijacking Defenses: cybersquatting-oriented in rem pleadings.
• Social Media Account Toolkit: Ownership Policies, Platform Complaints, and Demand Letters: ownership, impersonation, and squatting disputes over social media accounts and handles.