A stolen domain is one whose registration has been moved out of your control without your consent: transferred to another registrar, re-assigned to a different registrant, or kept in your registrar but with the login and contacts changed so you cannot get back in. Recovery is possible more often than people expect, because every change leaves a record at the registry and because ICANN policy gives registrars a formal way to reverse unauthorised transfers. But it is a race. The thief's plan is to move the domain again, to a second registrar in a distant jurisdiction, as soon as the 60-day post-transfer hold allows, and to sell or use it before you find the right person to call.
What you do in the first 24 hours decides most of the outcome. The order matters: stop the bleeding, prove ownership, then pursue the return through the fastest channel that applies.
MailShrine Domains keeps transfer lock and WHOIS privacy on by default and supports two-factor authentication on the account and on its Business Email mailboxes, which is why theft from a MailShrine account is rare. If a domain is stolen from elsewhere and recovered, you can transfer it in afterwards and the lock goes on at arrival.
Real-life example: Marcus's photography studio
Marcus Kalisa runs a wedding photography studio in Kigali on kalisaphoto.com. On a Monday morning his website shows a parking page, his Gmail-hosted business email has stopped receiving, and the login to his registrar says the password is wrong. A lookup shows the domain now sits at a different registrar, the registrant is "REDACTED FOR PRIVACY", and the nameservers changed two days ago.
Marcus's goals this week:
- Stop the attacker from doing more damage with the domain and the email that depends on it.
- Assemble proof that he is the rightful registrant.
- Get the domain back through the fastest route and make sure it cannot happen again.
The recovery channels
| Channel | Who you deal with | Applies when | Typical speed | Cost |
|---|---|---|---|---|
| Your (losing) registrar's security team | The registrar you held the domain at | Any theft; always the first call | Hours to days | Free |
| Inter-registrar transfer reversal | Losing and gaining registrars agree to undo | Transfer was unauthorised and both registrars cooperate | Days | Free |
| Transfer Dispute Resolution Policy (TDRP) | Your registrar files with the registry or a dispute provider | Gaining registrar refuses to cooperate | Weeks | Registrar may pass on a fee |
| UDRP complaint | WIPO or another provider, against the current holder | Domain matches your trademark and the holder acted in bad faith | About two months | From $1,500 |
| Court order | A court with jurisdiction over the registry or registrar | High-value theft, or other channels failed | Months | Legal fees |
| Police / cybercrime unit | National cybercrime reporting body | Always, in parallel | Variable | Free |
For most small-business thefts, the first two rows resolve it. The gaining registrar does not want stolen property on its books, and the losing registrar has the EPP transaction logs that prove the transfer was not authorised by the account holder's normal pattern.
Why speed matters: the 60-day window
ICANN's Transfer Policy puts a 60-day hold on a domain after any inter-registrar transfer. During that time the domain cannot be transferred again. For a thief this is a waiting room; for you it is a guarantee that the domain stays at one known registrar, under one jurisdiction, for two months. Everything you do in that window is against a fixed target. After it closes, the domain can move to a registrar that ignores emails, and each hop makes recovery slower and more expensive.
The same policy allows a transfer to be reversed if the losing registrar can show it was not authorised by the registrant. This is the mechanism behind row two of the table and it works best with your registrar's cooperation and your documentation in hand within days, not weeks.
What you need before you start
| You need | Why |
|---|---|
| Registrar invoices and receipts for the domain | Prove you paid for the registration and renewals |
| The registrant details you used | Name, address and email must match the registrar's history |
| Dated screenshots of the current RDAP result | Fix the state of the record at the moment of discovery |
| Evidence of long-term use | Website archives, business registration, printed materials with the domain |
| Access to any account the attacker did not reach | A second email, a phone, a bank statement showing the charges |
Step 1: Contain, in the first hour
Change the password on every account that could have been the entry point: the registrar, the registrant email and its recovery email. Turn on 2FA wherever it was off. Check the email account for forwarding rules and connected apps the attacker left behind, and remove them. If the attacker still has the domain's DNS, assume they can read any password-reset email sent to an address on that domain, so move critical service logins to a different email now.
Step 2: Record the evidence
Run a lookup at lookup.icann.org and save it with a timestamp. Note the gaining registrar, the creation and update dates, the nameservers and the status flags. Pull your registrar's receipts and any correspondence. Do this before anything changes again.
Step 3: Report to your registrar's security team
Contact the registrar you held the domain at, through its abuse or security channel rather than general support. State that the domain was transferred without your authorisation, give the date you last had access, and attach your evidence. Ask them to contact the gaining registrar and request a transfer reversal under the Transfer Policy. If the domain is still with your registrar but the account was taken over, ask them to freeze the domain and restore the account to the verified owner.
Step 4: Report to the gaining registrar
Find the gaining registrar's abuse contact in the RDAP result and send the same report. Ask them to place the domain on hold, which prevents the thief from changing nameservers or deleting it while the registrars talk. Many will do this within a day on a credible report.
Step 5: File with police and, if applicable, your bank
Report the theft to your national cybercrime unit (in Rwanda, the Rwanda Investigation Bureau's cybercrime division; in the US, the FBI's IC3; in the UK, Action Fraud). A police reference number strengthens every other request. If your card was charged for the transfer, tell your bank.
Step 6: Escalate if the registrars stall
If the gaining registrar will not cooperate within a week or two, ask your registrar to initiate a Transfer Dispute Resolution Policy proceeding with the registry. If your business name is a registered trademark, you can file a UDRP complaint in parallel; panels regularly order stolen domains returned where the current holder cannot show rights to the name. For domains worth more than legal fees, a lawyer can seek a court order directed at the registrar or registry.
Step 7: Secure it on return
When the domain comes back, change nameservers to your own DNS, confirm every record, lock it, enable DNSSEC where available, and put 2FA on everything. Then transfer it to a registrar whose defaults you trust; on MailShrine the transfer is refunded in full if it is rejected and the lock goes on the moment it arrives.
Marcus's checklist
- Changed passwords on Gmail, the old registrar and his recovery Yahoo account; turned on 2FACompleted
- Removed a hidden forwarding rule the attacker had added to GmailCompleted
- Saved a timestamped RDAP result showing the new registrar and a two-day-old update dateCompleted
- Emailed his old registrar's abuse team with receipts going back to 2019Completed
- Sent the same report to the gaining registrar's abuse contact and asked for a holdNot completed
- Filed with the RIB cybercrime unit and noted the reference numberNot completed
- Planned the transfer into MailShrine once the domain is backNot completed
Common mistakes
Contacting the thief. Some attackers invite a ransom conversation. Paying funds the next theft and does not prevent them keeping the domain anyway. Work through the registrars.
Using an email address on the stolen domain for any correspondence. The attacker controls its MX records and reads everything. Use an outside address.
Waiting to see if it resolves itself. Every day inside the 60-day window is a day the domain is fixed in place. Every day after it is a day it can move again.
Filing UDRP first. It costs money, takes two months, and requires a trademark. It is the right tool when registrars will not act, not before you have asked them.
Recovering the domain and leaving the entry point open. If a password reset through a weak email account took the domain once, it will take it again. Fix the account before you celebrate.
Check your work
Within 24 hours you should have: new passwords and 2FA on every account involved, a timestamped copy of the RDAP record, reports lodged with both registrars' abuse teams, and a police reference number. Within a week you should know whether the gaining registrar has placed a hold. If both hold, you are inside the process that recovers most stolen domains; if the registrars have gone quiet, escalate rather than wait.
FAQ
How long do I have to reverse a stolen domain transfer?
Act immediately. The 60-day post-transfer hold keeps the domain at the gaining registrar, which is your best window. Formal dispute processes have their own deadlines, and your registrar's logs become harder to act on as months pass.
Can the thief sell my domain before I get it back?
They can list it, but any buyer takes the domain subject to your claim, and a registrar hold prevents transfer. Most marketplaces will remove a listing on evidence of theft.
What if the domain was taken over inside my account rather than transferred?
That is easier. Your registrar can verify your identity against the original registrant data and payment history, restore the account, and revert the changes. Still change every password and check the email account for forwarding rules.
Do I need a lawyer to recover a stolen domain?
Usually not for a small-business domain. Registrar cooperation and, if needed, the TDRP handle most cases. A lawyer becomes worthwhile when the registrars refuse to act or the domain's value justifies a court order.
Will MailShrine help if my domain was stolen from another registrar?
Recovery runs between the registrars involved, so the work happens there. Once the domain is back in your control, you can transfer it to MailShrine, where lock and privacy go on at arrival and the transfer is refunded in full if it is rejected.
Next steps
- How to Stop Domain Hijacking — the six routes that get domains stolen and the control for each.
- Registrar Account Security: 2FA, Recovery and Access — closing the entry point so it cannot happen twice.
- Domain Lock / Transfer Lock: What It Protects Against — the flag that would have rejected the transfer at the registry.
Citations & References
- Reference: ICANN: Transfer Policy
- Reference: ICANN: Transfer Dispute Resolution Policy
- Reference: ICANN SSAC: SAC007 Domain Name Hijacking report
- Reference: WIPO: Domain Name Dispute Resolution Service
Written by Elena V., migrations editor. Elena walks owners through moving domains and mail between providers, including the hard cases where a name has to come back from somewhere it should never have gone.