Domain theft litigation is a federal lawsuit to recover a domain name taken without your authorization, usually built on the Anticybersquatting Consumer Protection Act and often paired with claims for conversion and computer fraud. A court can order the registrar to transfer the domain back to you, award up to $100,000 in statutory damages per domain under the ACPA, and in exceptional cases make the defendant pay your attorney fees. The strength of the case depends heavily on what you do in the first hours after the theft, so the legal strategy and the emergency response run together.
Lock the Domain and Preserve Evidence Before Filing
Call your registrar the moment you realize the domain is gone. Ask for an administrative lock so the thief cannot move or sell it again, and ask the registrar’s abuse or security team to investigate the unauthorized account activity. Their internal logs — password resets, login IPs, support tickets — become evidence later.
While that is in motion, start saving everything that proves the domain was yours and shows how it left your control. Original registration confirmations, renewal invoices, payment receipts, WHOIS history showing you as the registrant, screenshots of the current WHOIS record with the new registrant’s information, and email headers from any phishing messages used to compromise your account. This record is the backbone of the lawsuit; without it, even strong legal claims struggle.
Legal Claims a Domain Theft Lawsuit Is Built On
A domain theft complaint usually combines several claims, because each one covers a different piece of what happened and gives the court a different lever to pull.
Anticybersquatting Consumer Protection Act
The ACPA, 15 U.S.C. § 1125(d), lets a trademark owner sue anyone who, with a bad-faith intent to profit, registers, traffics in, or uses a domain name that is identical or confusingly similar to a distinctive or famous mark. Courts weigh nine factors to determine bad faith, and several map directly onto theft: offering the domain back for a profit, providing false registration contact information, and acquiring multiple infringing domains all cut toward bad faith, as does the absence of any legitimate intellectual property interest or real business use.1Office of the Law Revision Counsel. 15 USC 1125 – False Designations of Origin, False Descriptions, and Dilution Forbidden
The ACPA’s limit is that it requires a trademark connection. A stolen generic domain that does not function as a trademark falls outside the statute, and you have to rely on other claims.
Conversion
Conversion is the common law claim for wrongfully taking or controlling someone else’s property. Courts have increasingly recognized domain names as intangible property that qualifies. Because conversion requires no trademark, it is the primary claim when the stolen domain is not tied to a registered mark.
Computer Fraud and Abuse Act
If the thief got in by hacking your registrar account, email, or hosting panel, the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, adds a federal civil claim for unauthorized access to a computer system. A civil CFAA claim generally requires at least $5,000 in losses within a one-year period, counting not just the domain’s value but the cost of investigation, account security work, service restoration, and lost revenue while the domain was out of your hands. Most domain theft cases clear that number without difficulty.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
Trademark Infringement
If the domain is itself a registered trademark, a straight infringement claim fits alongside the ACPA. The theory is consumer confusion: visitors assume the thief’s content is yours, or that your business endorses it. The claim adds another theory of liability and another route to damages rather than replacing anything.
Suing When You Cannot Identify the Thief
Thieves routinely hide behind privacy services, falsified WHOIS data, or offshore entities. The ACPA anticipates this with an in rem action — a lawsuit filed against the domain name itself rather than against a person. You can use it if you cannot establish personal jurisdiction over whoever registered or used the domain, or you cannot find them despite reasonable effort. The suit is filed where the registry or registrar sits, which for .com and .net domains usually means the Eastern District of Virginia, home to Verisign.1Office of the Law Revision Counsel. 15 USC 1125 – False Designations of Origin, False Descriptions, and Dilution Forbidden
With no identified defendant to serve, the court may allow service by publication, which means publishing notice in a newspaper or similar public forum. Courts expect proof that you tried conventional methods first.3Legal Information Institute. Service by Publication
The trade-off: an in rem action can force forfeiture, cancellation, or transfer of the domain, but it generally cannot produce money damages. If the goal is simply getting the name back, that is often acceptable.
How the Lawsuit Moves Through Federal Court
The case begins when your attorney files a complaint in federal court setting out the facts of the theft, naming the defendant (or the domain itself in an in rem action), and listing the legal claims. The federal civil filing fee runs approximately $405.
The first substantive move after filing is almost always a request for a temporary restraining order freezing the domain so the thief cannot transfer it again, delete content, or let the registration lapse while the case runs. A court can issue a TRO without the defendant present if you show that waiting would cause irreparable harm, and a preliminary injunction hearing follows where the defendant can respond.
Once the defendant is formally served, they have roughly 21 days to answer in federal court. Discovery then opens up, and in domain theft cases it tends to focus on registrar records, DNS history, and any financial transactions tied to the domain. Many cases settle once that evidence is on the table, often with the thief agreeing to return the domain in exchange for the suit being dropped. Cases that do not settle go to summary judgment or trial.
What a Court Can Order if You Win
The core remedy is the domain itself. Courts can order the registrar to transfer the name back to you or cancel the thief’s registration outright. The ACPA specifically authorizes forfeiture, cancellation, or transfer to the trademark owner.1Office of the Law Revision Counsel. 15 USC 1125 – False Designations of Origin, False Descriptions, and Dilution Forbidden
On top of that, courts can award actual damages: lost revenue during the outage, wasted advertising spend tied to the stolen domain, costs of notifying customers, breach investigation costs, and any profits the thief earned from the domain. Under the ACPA you can elect statutory damages instead, ranging from $1,000 to $100,000 per domain name, with the court setting the amount based on the circumstances. Statutory damages are particularly useful when actual losses are hard to prove or the thief operated anonymously.4Office of the Law Revision Counsel. 15 USC 1117 – Recovery for Violation of Rights; Profits, Damages and Costs; Attorney Fees; Treble Damages
Attorney fees are available in “exceptional cases” under the Lanham Act, and the deliberate conduct behind most domain theft often qualifies. A finding that the case is exceptional means the defendant can be ordered to reimburse your legal costs on top of damages.4Office of the Law Revision Counsel. 15 USC 1117 – Recovery for Violation of Rights; Profits, Damages and Costs; Attorney Fees; Treble Damages
Faster Alternatives Worth Trying First
Litigation is not always the first move, and two administrative paths can resolve a theft without ever filing in federal court.
ICANN’s Transfer Dispute Resolution Policy is built for exactly this problem. Your registrar can file a dispute with the registry operator to reverse an unauthorized transfer between registrars. The gaining registrar must have obtained a standardized Form of Authorization from the registered owner or administrative contact; if it did not, the transfer violated the policy and can be undone. Decisions can be appealed to an independent dispute resolution provider, and that ruling is final unless the matter goes to court. The hard deadline: the dispute must be filed within six months of the unauthorized transfer.5ICANN. Registrar Transfer Dispute Resolution Policy The TDRP works best for clear-cut unauthorized transfers; cases involving identity theft, social engineering, or registrar misconduct usually need a courtroom.
Filing a complaint with the FBI’s Internet Crime Complaint Center creates an official federal record and can trigger an investigation when the loss is significant or fits a wider pattern. IC3 does not investigate complaints itself and will not send you updates, so a time-sensitive matter also warrants a call to the local FBI field office.6Internet Crime Complaint Center (IC3). Frequently Asked Questions Even without criminal charges, the IC3 complaint is useful evidence in the civil case, showing you reported promptly and treated the theft as a crime.
What to Expect Realistically
Domain theft cases can run months or years, and intellectual property attorney rates add up fast. Digital forensics help, if you need it to trace the theft, is a separate cost. That cost structure is why the administrative response matters: a registrar lock in the first day or a successful TDRP in the first month can close the matter without a lawsuit.
When litigation is the right path, the strongest cases combine disciplined evidence preservation with layered claims. An ACPA claim supported by a CFAA count, backed by registrar records, WHOIS history, and an IC3 complaint, puts most defendants in a position they cannot defend. And when the thief stays anonymous, the in rem option still lets you get the domain back without ever learning their name.