Patterns.com is a domain name that has been stolen twice. It was first taken from its owner’s registrar account in September 2020 through support-desk fraud and moved to a registrar in China, where a registrar-to-registrar dispute concluded that the transfer had followed procedure. It was recovered in 2022 only after the owner filed a UDRP complaint and the panel treated the fraudulent acquisition itself as bad faith. After that recovery, the domain was sold without the owner’s permission when Epik, Inc.’s domain portfolio was liquidated. As of November 2026, Patterns.com remains a stolen domain name. This case study explains how the domain was taken, why the first remedy failed, how the UDRP recovered it, how it was lost again, and what any domain owner, or prospective buyer, should take from it. It is one of our domain recovery case studies.
A note on timing: Patterns.com was handled in 2021 and 2022 by our founder, Bill Hartzer, then Director of DNProtect and now founder of DNAccess. DNAccess itself was founded in March 2023.
The client and the domain
Cosmic Patterns Software, Inc. is an astrological software company. Its domain, patterns.com, carries a registry creation date of November 2, 1995, and the registry record still shows that 1995 date today. The company states that it has used PATTERNS in commerce for astrological software for more than twenty years. It did not hold a registered trademark for the word. That detail matters later, because the UDRP (Uniform Domain-Name Dispute-Resolution Policy) requires a complainant to show rights in a mark, and Cosmic Patterns had to prove those rights through use rather than through a registration certificate.
A short, dictionary-word .com with a 1995 creation date is exactly the kind of asset that attracts thieves. It has resale value, it carries steady type-in traffic, and its owner, like many long-time registrants, had held it at the same registrar for decades without any reason to think about account security.
How Patterns.com was taken
The theft did not involve any technical attack on the domain system. It was social engineering aimed at the registrar’s support desk. According to the findings recorded in the later transfer dispute, in September 2020 Network Solutions received a request to change the primary email address on the account that held patterns.com. The request was supported by identification documents that were later found to be fake. The email change was processed on September 12, 2020.
Once the account email belonged to the requester, the rest followed quickly. On September 14 a password reset was sent to the new address, giving the requester full control of the account. On September 21, 2020, the domain was transferred out to Bizcn.com, Inc., a registrar in China. From the first email change to the completed transfer took nine days. Patterns.com was not an isolated incident; it was one of several domains beginning with the letter P that were taken from Network Solutions accounts in the same period.
This sequence is the textbook pattern of domain hijacking (the unauthorized transfer or control of a registered domain): take the email address, reset the password, and transfer the domain to a registrar where the rightful owner has no account and no relationship. Each step looks routine to the systems processing it, which is exactly why it works.
Why the registrar route failed
Network Solutions, as the losing registrar, filed a complaint against Bizcn.com under the Transfer Dispute Resolution Policy, or TDRP, the ICANN procedure for disputes between registrars over inter-registrar transfers. The case, Forum file FA2102001933246, was filed on February 23, 2021, and decided on March 18, 2021, by a single panelist.
The panel approved the transfer, and the domain stayed with the gaining registrar. The reasoning is the most instructive part of the case. The panel found that Bizcn.com had followed the normal transfer process, and that a fraud committed against the registrant did not amount to a breach of the Transfer Policy by the gaining registrar. The panel expressed sympathy for the owner but said the policy gave it no power to grant any other relief. The full reasoning is in the Forum’s TDRP decision in FA2102001933246.
That result follows directly from how the TDRP is built. Under ICANN’s Transfer Dispute Resolution Policy, only the gaining or losing registrar may file, a dispute must be filed no later than twelve months after the alleged violation, and the panel’s remedy is limited to approving or denying the transfer. The TDRP asks whether transfer procedure was followed. It does not ask who owns the domain. When the fraud happens before the transfer request, at the losing registrar’s own support desk, the transfer itself can be procedurally correct even though everyone involved agrees a theft occurred.
The UDRP that recovered Patterns.com
The owner contacted DNProtect in June 2021. Bill alerted Network Solutions and contacted Bizcn.com directly; the gaining registrar declined to return the domain. With the registrar route closed, the remaining paths were the UDRP or a lawsuit. DNProtect pursued the UDRP with domain attorney Daniel Prince. A UDRP proceeding is generally faster than litigation, and the facts fit its three elements. Our guide to the UDRP process explains each stage of a complaint.
The case was Cosmic Patterns Software, Inc. v. the registrant of record, Forum case FA2201001981716. Forum received the complaint on January 24, 2022, and the sole panelist, Dawn Osborne, issued her decision on February 28, 2022. No response was filed. The panel ordered the domain transferred to the complainant. The full text is in the Patterns.com UDRP decision, and Bill wrote about the result at the time in his March 1, 2022 article on the recovery.
Element one: rights in the PATTERNS mark
The UDRP first requires that the domain be identical or confusingly similar to a mark in which the complainant has rights. Cosmic Patterns had no registered trademark, so the panel looked to use. It accepted that more than twenty years of using PATTERNS for astrological software had created common-law rights (trademark rights that arise from use in commerce rather than from registration). The domain was identical to that mark. Documented, long-running use carried this element.
Element two: no rights or legitimate interests
The panel found that the respondent had acquired the domain in November 2020 through a deception practiced on the complainant’s registrar, and that it had no rights or legitimate interests in the name. A general offer to sell the domain was not a bona fide offering of goods or services. Pay-per-click links unrelated to the complainant were not a fair use. The absence of any response left those findings unchallenged.
Element three: bad faith registration and use
Bad faith is usually the hardest element in a stolen domain case, because the UDRP was written for cybersquatting, not theft. Here the panel treated the fraudulent acquisition itself as bad-faith registration. It added the general offer to sell the domain and the diversion of traffic to pay-per-click links as evidence of bad-faith use. That reasoning is what made the UDRP work where the TDRP could not: the panel was allowed to look at how the respondent came to hold the domain, not just whether a transfer form was processed correctly.
Recovered by the UDRP in 2022
The panel ordered Patterns.com transferred back to Cosmic Patterns Software, Inc. The domain was stolen in September 2020, the registrar dispute failed in March 2021, and the UDRP decision ordering its return was issued in February 2022. That is roughly seventeen months from theft to decision. Most of that time was consumed by a remedy that could not reach the ownership question, which is the first lesson of the Patterns.com stolen domain case.
Stolen a second time
The UDRP decision was not the end of the story. After the domain was recovered, the owner and Epik, Inc. entered into an agreement under which, when Patterns.com was sold, the profit from the sale would be split between Epik and the domain name owner. The domain was never sold under that agreement.
Instead, when Epik’s domain portfolio was liquidated, Patterns.com was sold along with it, without the domain name owner’s permission. The owner had agreed to a sale on agreed terms with a share of the proceeds. The owner never agreed to the domain being disposed of as part of a liquidation, and never consented to that transfer. A domain name that leaves its owner’s control without the owner’s authorization is a stolen domain name, whether it is taken with a forged identification document or moved through an unauthorized sale.
Where Patterns.com stands today
As of November 2026, Patterns.com is still a stolen domain name. It has now been stolen twice: first through registrar fraud in 2020, and again through an unauthorized sale after the 2022 recovery. The owner has not consented to any transfer of the domain since the UDRP returned it.
That has a direct consequence for anyone considering the name. Anyone acquiring Patterns.com would be acquiring a stolen domain name. A buyer of a stolen domain takes on the risk that the rightful owner pursues its return through the UDRP or the courts, whatever the buyer paid and however many hands the domain has passed through. Our guide to buying a domain name someone else owns explains why a domain name background check belongs before any money moves.
Lessons for domain owners
Use registry lock on any domain you cannot afford to lose
The Patterns.com theft began with a fraudulent email change at the support desk. Registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band) is designed for exactly that situation. Even if an account is fully taken over, a locked domain cannot be transferred until the registry and registrar confirm the request through a separate, pre-agreed channel. Adoption remains low even among large companies: CSC found that only 24% of Forbes Global 2000 companies use registry lock, according to its 2024 Domain Security Report.
Ask your registrar how it verifies account changes
Fake identification documents defeated the support-desk check in this case. Ask your registrar what it requires before changing an account email, whether it calls a number on file, and whether you can require multi-factor confirmation for contact changes. Our guide to registrar account security covers the settings worth turning on.
Monitor the registration record
An email change, a password reset and a transfer each leave a trace in the registration record. Monitoring that alerts on contact, status and registrar changes turns a theft discovered months later into one discovered the same day, while faster remedies are still open.
Treat a recovery as the start of a new risk, not the end of one
Patterns.com was lost the second time after it had been recovered. Any agreement that gives a third party a role in selling or holding a recovered domain should be in writing, should require the owner’s written consent to any sale, and should say what happens to the domain if that third party is acquired, fails or liquidates its assets. Keeping the domain in the owner’s own registrar account, under registry lock, is the strongest protection.
Document your use of the name
The UDRP succeeded because Cosmic Patterns could prove two decades of use. Keep renewal receipts, archived copies of your site, invoices and marketing that show the name in commerce. If you ever need common-law rights, that file is your trademark.
How DNAccess recovers stolen domains
Patterns.com shows why the remedy has to match the facts, and why a recovered domain still needs protecting: a registrar dispute answers a procedural question, while the UDRP and the courts answer the ownership question. Our stolen domain name recovery service begins with the forensic record, identifies which remedy can actually reach the domain, and works with registrars and counsel to pursue it. If your domain has been transferred without your permission, contact DNAccess as early as you can. The sooner the record is preserved, the more remedies remain open.