Domain recovery case studies show something that a policy document cannot: how a domain name actually leaves its owner’s control, and which remedy brings it back. In the cases we handle, a stolen domain is almost never the result of a sophisticated technical exploit. It is an account takeover after an email compromise, a support-desk fraud supported by fake identification, a vendor or web developer who pushes the domain into an account they control, or a renewal that lapses while nobody is watching. Each path leaves a different trail of evidence, and the remedy depends on the facts: a registrar transfer dispute, a TURF (Transfer Undo Request Form, the registrar-to-registrar form used to reverse an unauthorized transfer), a UDRP (Uniform Domain-Name Dispute-Resolution Policy) complaint and a lawsuit each fit different circumstances.
Except where a client has already made their case public, we describe cases without identifying the domain or the client.
The two featured cases below are public and have their own full case studies. The anonymized cases that follow are described by type. Read together, these stolen domain case studies show that the same handful of patterns repeat, and that the owner’s evidence decides how quickly a recovery can move.
Featured domain recovery case studies
Patterns.com: recovered through the UDRP after registrar fraud
Patterns.com had been registered since 1995 by Cosmic Patterns Software, Inc., an astrological software company. In September 2020 someone submitted an email-change request to the company’s registrar, Network Solutions, supported by identification documents that were later found to be fake. Within days the account email was changed, the password reset, and the domain transferred to a registrar in China. Network Solutions filed a Transfer Dispute Resolution Policy complaint on the owner’s behalf, and the panel approved the transfer anyway, because the gaining registrar had followed the normal transfer procedure. Our founder, Bill Hartzer, then Director of DNProtect and now founder of DNAccess, took the case in 2021 and pursued a UDRP complaint with domain attorney Daniel Prince. The panel found the domain had been fraudulently acquired and ordered it transferred back. The domain was later stolen a second time: after the recovery, the owner agreed with Epik, Inc. to split the profit from an eventual sale, and when Epik’s domain portfolio was liquidated, Patterns.com was sold without the owner’s permission. As of November 2026 it remains a stolen domain name. The full account is in our Patterns.com stolen domain case study.
Make a Home Foundation: a nonprofit’s domains held by its web developer
Make a Home Foundation, a Connecticut nonprofit that furnishes homes for veterans, domestic violence survivors and people leaving homelessness, registered its two domains in 2010. During a website redesign, the web developer it hired used his access to the registrar account to transfer both domains to himself, then demanded additional payment for their return. We documented the foundation’s original registrations and ten years of use, spoke with the developer several times, prepared the UDRP route, and helped the foundation take its story public. As of November 2026 the developer still controls the foundation’s primary domain, and the case remains open. The full account is in our case study of a veterans nonprofit whose web developer held its domains hostage.
Anonymized stolen domain case studies
These cases omit the domain, the client and any identifying detail, and we do not state their outcomes. Their value is in the sequence of events and the evidence that mattered.
A premium .com moved overseas on a weekend
A short, premium .com had been held by the same owner for decades. On a Saturday in December 2023, a domain monitoring service alerted the owner that the domain had been transferred from its registrar to a registrar in Asia without permission. The losing registrar advised a transfer dispute, and we helped prepare the unauthorized-transfer statement and the supporting evidence. The lesson: monitoring turned what is often a weeks-long discovery into a same-day one.
A foundation’s domain after its founder’s death
In 2023 a foundation lost its domain after its founder had died. WHOIS history (the archived record of a domain’s past registration data) showed that the registrant information had switched from public to privacy in March 2022, roughly 18 months before the transfer, which is a common sign that an account has been accessed and prepared. The domain was then transferred to another registrar over the five-day transfer window, and on the day the transfer completed its nameservers were pointed at a parking monetization service. The estate’s executor held the paperwork. We notified the gaining registrar’s contacts, advised the executor to escalate to the losing registrar’s premier support and abuse teams that same day, and outlined the UDRP as the next step. The lesson: the old registrant email on file is the key evidence, and estates need registrar access planned in advance.
A four-letter .com after the registrar dispute closed
A four-letter .com had been held at one registrar since 2013, and the owner had years of renewal receipts. Two-step verification on the account was disabled, the registrant was changed, and in 2019 the domain was transferred to a European registrar. The losing registrar’s transfer dispute was closed in May 2020 after the gaining registrar concluded the transfer was valid, and the domain later appeared listed for sale. In 2023 our forensic research identified the current registrant, and outreach began through counsel familiar with that registrant. The lesson is that a “transfer was valid” finding addresses procedure, not ownership. Once the registrar dispute is closed, only negotiation, the UDRP or a court remain.
A travel creator’s .com resold abroad
In 2023 a travel creator’s .com had its nameservers changed to a parking service, and two weeks later changed again to a large registrar’s nameservers, where the domain was resold to a business using a near-identical name in another country. Fraud cases were opened with ICANN and the registrar, and a cease-and-desist letter went to the party that received the domain. That letter documented ownership with hosting records, renewal receipts, WHOIS and DNS history and archived pages. The lesson is that a complete evidence pack, meaning the registrant record before the hijack, the DNS history, the renewal receipts and the archived site, is what registrars and recipients respond to.
Two small-business domains and the TURF affidavit
Two small-business domains were transferred without authorization, one in 2024 and one in 2025. The first moved from a large US retail registrar to a European registrar; the second moved from a long-established US registrar to another registrar. In both matters we prepared Transfer Undo Request Form affidavits stating ownership and non-authorization, to be notarized with photo identification. The lesson is that when the gaining registrar cooperates, TURF is the fastest path, and it requires a sworn, notarized statement from the registrant.
An author’s four domains pushed by a vendor
In 2025 an author and publisher gave a publishing services vendor access to her hosting account. The vendor pushed all four of her domains into its own account and refused to return them, citing a billing dispute. We issued a written opinion letter documenting that the domains had been registered between 2011 and 2024, before any business with the vendor, and that no permission to move them had been given. The lesson is that a billing dispute is separate from domain ownership. An account push (a move of a domain from one account to another at the same registrar) is easy to do and hard to undo.
A domain that looked expired but was not
In 2023 an owner believed a domain had simply expired. One WHOIS archive showed it renewed through late 2023 at its original registrar, yet it had been registered fresh at a different registrar in mid-2023. We asked the owner for renewal receipts to prove the renewal, because a renewed domain that disappears points to account access and deletion rather than a lapse. The lesson is to compare multiple WHOIS archives. Receipts decide whether a matter is an expiration case or a theft case.
What the cases have in common
Across these domain recovery case studies, the same patterns repeat. The details change from one registrar to the next, but the sequence of a theft is consistent, and recognizing it early separates a fast recovery from a long one.
The email account or registrar account is the entry point
Most thefts begin with control of the registrant’s email address or the registrar account itself. Patterns.com was taken through a fraudulent email-change request at the support desk; the four-letter .com was taken after two-step verification was turned off. This is why ICANN’s Security and Stability Advisory Committee, in SAC044, its registrant’s guide to protecting registration accounts, recommends setting transfer, update and delete prohibitions with registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band) as an additional layer. A registry lock stops a fraudulent transfer because the request cannot be completed by anyone who merely controls the account.
Privacy is switched on before the transfer
A switch from public registrant data to a privacy service, months before a transfer, appears again and again in WHOIS history. It hides the change of control from the real owner and from anyone watching the record. When we see that switch, we treat its date as the likely start of the theft.
Nameservers are pointed at parking
Pointing nameservers at a parking monetization service on the day a transfer completes is another common signature. Parking earns money from existing traffic and often precedes a sale. In the Patterns.com decision, pay-per-click links unrelated to the owner were one of the facts the panel relied on to find bad faith.
Vendors and developers hold the keys
Web developers, hosting providers and publishing vendors are routinely given access to an owner’s accounts, and some of them move the domains into accounts they control. Make a Home Foundation and the author’s four domains are both examples.
Registrar disputes only answer a procedural question
The registrar-to-registrar routes are fast when they work, but they have firm limits. Under ICANN’s Transfer Dispute Resolution Policy, a dispute must be filed no later than twelve months after the alleged violation, only the gaining or losing registrar may file, and the panel can only approve or deny the transfer. Patterns.com and the four-letter .com both show what follows: the registrar dispute concluded that procedure was followed, and the ownership question had to be answered elsewhere, through the UDRP, negotiation or a court.
How DNAccess handles stolen domain recovery
Every case above began with the same question: what actually happened to the domain, and what evidence proves it. Our stolen domain name recovery service starts with forensic research into WHOIS history, DNS history, registrar records and archived pages, then matches the facts to the remedy that fits them, whether that is registrar escalation, a TURF, a UDRP complaint coordinated with counsel, or litigation support. If a domain has left your control, contact DNAccess and send what you have. The sooner we see the record, the more options remain open.