FAQ: recover a .cn domain used for phishing

When can I recover a .cn domain used for phishing?

You may bring a .cn complaint when the domain is confusingly similar to a trademark you hold, the registrant has no legitimate interest in it, and it was registered or is being used in bad faith – with phishing activity squarely within the bad-faith category.

The .cn dispute rules require the complainant to establish all three of those elements. Phishing – operating a fake site to capture credentials or payments under cover of a known brand – satisfies the bad-faith limb readily, because it is the clearest possible demonstration that the registrant intends to harm the trademark owner and deceive its customers. The harder question is often the first element: do you hold a trademark right that a .cn panel will recognize? Registered Chinese trademarks carry the most weight. Well-known marks recognized under Chinese law and registered trademarks in other jurisdictions have also been accepted, though the evidentiary burden is higher.

We regularly advise brand owners who discover a phishing .cn domain only after customers have already been defrauded. Speed matters. The sooner a complaint is filed, the sooner the panel can order transfer or cancellation – and the sooner the registrar can be asked to lock the domain pending the outcome.

Does CNNIC ADNDRC or a court decide a .cn dispute?

Most .cn domain disputes are resolved through the CNNIC dispute procedure administered by the ADNDRC; Chinese courts are a parallel route that may be preferred when monetary damages are sought or the factual record is contested.

CNNIC accredits the ADNDRC as its primary dispute-resolution provider. The ADNDRC operates under rules that closely track the UDRP's three-element structure, and its process – complaint, response, panel decision, registrar implementation – mirrors the UDRP in most procedural respects. The remedies are limited to transfer or cancellation: no damages, no cost award, no injunction.

Chinese courts handle .cn disputes under a different, broader set of rights. A court can award damages and grant interim injunctions that the administrative procedure cannot. That advantage comes with substantially longer timelines and higher cost. For a phishing domain, where speed is paramount and monetary recovery from an anonymous registrant is often illusory, the ADNDRC route is usually the faster and more practical choice. Where the registrant is identifiable and the fraud losses are large, combining a CNNIC complaint with court action – through local litigation counsel in the relevant jurisdiction – is worth considering.

The choice also depends on whether you need the domain transferred quickly to stop the phishing, or whether you need something more: an injunction against a wider fraud operation, for instance. We assess that question at the outset of every .cn matter we handle.

What is the deadline once a case starts?

Once a .cn case formally commences, the registrant has 20 days to file a response; failing that, the panel proceeds on the complaint alone and a decision typically follows within approximately two months of filing.

The 20-day response window is procedurally fixed, not a negotiable deadline. If the registrant files nothing, the panel does not automatically transfer the domain – it still examines whether the three elements are met on the record the complainant has provided. A detailed, well-evidenced complaint is therefore essential even in default cases. Panels have consistently held that a complainant cannot rely on a registrant's silence to supply missing evidence on any element.

Extensions exist but are narrow. A registrant may seek additional time in exceptional circumstances, and a proceeding can be suspended briefly if the parties signal a settlement. Neither interruption resets the overall timeline materially. In our practice, a straightforward .cn phishing complaint – one domain, clear bad faith, registered trademark – resolves in roughly six to nine weeks from the date of filing to the registrar's implementation of the transfer order.

What evidence decides a .cn phishing dispute?

The critical evidence is: proof of trademark rights, screenshots of the phishing activity, WHOIS/RDDS registration data, and any communications from the registrant – together, these address all three UDRP-modeled elements the .cn panel must find.

On the first element, a certified copy of the trademark registration (Chinese or foreign) is the baseline. The earlier the trademark priority date relative to the domain registration, the stronger the case. Where only a common-law or unregistered right is claimed, the evidentiary burden rises considerably.

On bad faith, phishing evidence should be timestamped and comprehensive. Capture the live phishing pages with full URLs, dates, and any spoofed brand elements. If customers have reported fraud, preserve those communications. If the registrant is using privacy shielding, WHOIS/RDDS records at the date of registration (obtained via historical lookups) help establish what was known or reasonably knowable at that time. Panels have consistently held that operating a page designed to impersonate a brand to capture financial or personal data is among the clearest indicators of bad faith under Paragraph 4(b) of the standard UDRP-modeled test.

On legitimate interest, the complainant need only make a prima facie showing; the burden then shifts to the registrant to rebut. A phishing operator rarely has anything credible to offer.

For a read on whether the three elements are met for your .cn domain, reach us at info@cognomenlaw.com.

What if the registrant does not respond?

If the registrant files no response within 20 days, the panel proceeds on the complaint record alone – but it still applies the full three-element test and will deny transfer if the complaint is deficient.

Default is common in phishing cases. The operator behind the domain is typically anonymous or using false registration details, and has no interest in engaging with a formal proceeding. That does not make default cases automatic wins. Panels have denied transfer in default proceedings where the complainant failed to demonstrate bad faith independently of the registrant's silence, or where the trademark evidence was insufficient.

The practical lesson: treat every .cn phishing complaint as if it will be contested. Build the bad-faith record thoroughly – technical evidence of the phishing operation, brand prominence evidence, and the timeline of registrations relative to trademark priority. The panel will want to see that the case stands on its own without any help from the other side.

In cases where the registrant provides false contact details and cannot be served by any of the standard means, the panel provider proceeds on the basis that service was properly attempted. Procedural default on service does not invalidate the proceeding.

Can the decision be appealed or challenged?

A .cn ADNDRC decision can be challenged before a Chinese court within a specified period after the decision; absent a court challenge, the registrar implements the transfer or cancellation order.

The CNNIC dispute rules provide that a losing respondent who disagrees with the panel's decision may seek court review. The effect is a stay of the transfer: the registrar holds the domain in its current state while the court proceedings are pending. This is the respondent's primary avenue if the panel decision is contested.

From the complainant's side, a court challenge by the respondent means the transfer that the panel ordered is delayed. In a phishing scenario, that delay has real consequences – the fraudulent site may remain accessible while litigation proceeds. Interim relief from the Chinese court (a temporary injunction or domain lock) is the appropriate response, and that requires local litigation counsel in China.

Panels in the .cn system do not themselves entertain appeals. The ADNDRC has no appellate tier equivalent to the three-member panel reconsideration route available under some other ccTLD procedures. A party dissatisfied with the panel's reasoning must go to court. That asymmetry – quick administrative decision, court-side appeal – is important to understand before filing.

To weigh the ADNDRC route against court action for your .cn phishing domain, email info@cognomenlaw.com.

What is a realistic next step if I have identified a .cn phishing domain?

The immediate steps are to document the phishing activity, request a registrar lock, assess whether the three CNNIC complaint elements are met, and file with the ADNDRC – all ideally within days of discovery, not weeks.

Time is not neutral in a phishing matter. Every day the domain operates under your brand puts more customers at risk and deepens the evidentiary record against the registrant. At the same time, some brand owners hesitate because they assume the procedure is slow, expensive, or inaccessible from outside China. That assumption is wrong. The ADNDRC accepts complaints from rights holders worldwide, and the filing fee is modest compared to litigation. The WIPO filing fee for a standard UDRP complaint begins at USD 1,500; ADNDRC fees for .cn matters are set at comparably accessible levels, with legal fees that depend on the complexity of the trademark evidence and the number of domains involved.

We assess the three elements, assemble the bad-faith evidence, select the right forum for the zone, and file the complaint. Where a registrar lock or takedown is possible in parallel – through the registrar's abuse channel or a CNNIC-level request – we pursue that alongside the formal complaint.