Update: changes affecting how to reverse an unauthorized tran… (.us 2)

Update: changes affecting how to reverse an unauthorized tran… (.us 2). UDRP and ccTLD domain recovery and defense across .us. Email the firm to assess your ca…

A .us domain disappears from a registrant's account overnight. The WHOIS record shows a new holder. No authorization was given. The clock is now running — and the procedural path to reverse an unauthorized transfer of a .us domain has specific mechanics that differ from the better-known gTLD routes.

Reversing an unauthorized transfer of a .us domain requires acting on two parallel tracks: a registrar escalation to trigger an immediate lock, and a formal dispute filing under the usDRP (the .us Dispute Resolution Policy) or, where the facts warrant it, a court route. Evidence of the account compromise — access logs, phishing indicators, forged authorization — is what decides whether a reversal is achievable and how quickly. Speed matters: transfer chains become harder to unwind with each passing day.

This alert covers what applies under the usDRP, when to choose court instead, and the evidence that decides the outcome.

What Changed — and Why It Affects .us Recovery Now

The .us zone operates under the usDRP, a distinct procedure administered through the National Arbitration Court (the Forum) rather than through WIPO. Unlike the UDRP, the usDRP is specifically scoped to .us domains, and its eligibility rules carry an additional layer: a registrant must generally satisfy the US nexus requirement to hold a .us registration. That eligibility constraint shapes who can receive a transfer order and how quickly a panel can act.

Practitioners working .us recovery cases have observed tightening registrar verification standards at the point of transfer. Registrars handling .us domains are expected to maintain audit trails of authorization. Where those trails are missing or suspect, the registrar's own escalation procedures become the first — and sometimes fastest — avenue for relief before any formal filing is made.

If your .us domain has moved to an unknown holder, the standard UDRP route does not apply. You are in usDRP territory, or potentially in federal court. That distinction matters to how you build your case from day one.

How Do the Registrar-Lock and Transfer-Reversal Mechanics Work?

The immediate action is registrar escalation. Once an unauthorized transfer is identified, the losing registrar and the gaining registrar both have roles. The losing registrar holds records of the pre-transfer authorization request. The gaining registrar now controls the registration. A formal escalation — with documented evidence of the compromise — can result in a voluntary lock while the dispute is assessed. That lock prevents further downstream transfer while formal proceedings are initiated.

The usDRP then provides the structured route. A complaint must still satisfy elements analogous to those in the UDRP: confusing similarity to a mark, absence of legitimate interest in the respondent, and bad-faith registration or use. In a theft scenario, the "registrant" is the thief, and bad faith is typically straightforward to demonstrate — though the procedural record still has to be built correctly.

When does court beat arbitration? If the unauthorized transfer involved criminal conduct — identity fraud, account hijacking, phishing of registrar credentials — a US court action can reach remedies that the usDRP cannot: injunctive relief, asset tracing, and potential damages. We regularly advise registrants that a parallel or sequential court filing is worth assessing where the domain carries significant commercial value and the thief has been identified or is identifiable.

If your .us domain has been moved without authorization, the fastest first step is a documented escalation to both registrars. For an assessment of your domain dispute, contact info@cognomenlaw.com.

What Evidence Decides the Outcome?

Evidence of compromise is the center of gravity in any unauthorized transfer case. Panels and courts look for concrete indicators that the transfer was not authorized by the true registrant. The stronger and more contemporaneous that record, the more credible the recovery claim.

The evidence categories that matter most include: account access logs showing logins from unrecognized IP addresses or geolocations; phishing emails or spoofed communications sent to the registrant prior to the transfer; registrar correspondence showing a change-of-registrant request the true holder did not initiate; and WHOIS snapshots capturing the pre- and post-transfer state of the record. Screenshots alone are rarely sufficient. Server logs, email headers, and registrar ticket records carry significantly more weight.

We have handled .us recovery matters where the difference between a successful reversal and a dead-end filing came down to whether the client had preserved their registrar's audit trail before the record was overwritten. In a recent matter (a .us business domain, winter 2025), escalation and a documented phishing record allowed us to secure a voluntary lock within 48 hours of engagement, creating the procedural space for a formal usDRP complaint.

One myth worth addressing: a usDRP or court route is not foreclosed simply because the domain has already been transferred to a second or third holder downstream. Panels have addressed transferred-registration chains before. The analysis becomes more complex, and the evidence burden is higher — but the route remains open if the record of original unauthorized transfer is preserved.

To weigh the usDRP against a court action for your case, email info@cognomenlaw.com.

Related at COGNOMEN

• Court action and domain theft recovery — full service overview
• Registrar lock escalation and transfer reversal for compromised accounts
• URS versus UDRP — choosing the right procedure for your domain