FAQ: recover a stolen .br domain under the applicable domain rules

FAQ: recover a stolen .br domain under the applicable domain rules. UDRP and ccTLD domain recovery and defense across .br. Email the firm to assess your case.

A registrant's login credentials are compromised, and within hours the .br domain they have held for years is transferred to a stranger. The account is locked, the WHOIS record shows a new owner, and the legitimate registrant cannot access the zone file. What comes next?

Recovering a stolen .br domain requires immediate action on two parallel tracks: a registrar-level escalation to Registro.br to freeze further transfers, followed by either the SACI-Adm administrative dispute procedure or a Brazilian court claim, depending on the nature of the loss and the evidence available. The process differs materially from a UDRP recovery because .br does not operate under the UDRP – the governing national procedure applies exclusively. Speed of response directly affects whether a reversal is possible.

The questions below cover the procedure, evidence, costs, timelines, and realistic outcomes for anyone seeking to recover a stolen .br domain.

What does it mean to recover a stolen .br domain?

In the .br context, "stolen" typically describes one of two situations: an account compromise that allows an unauthorized third party to initiate a transfer, or an abusive registration of a name that copies a brand or identifier the legitimate party holds rights in.

These two situations call for different remedies. Account-compromise theft – where login credentials are taken and the domain is transferred without the registrant's consent – is primarily a registrar-security and court matter. Abusive registration of a confusingly similar name – where someone registers a .br domain that copies a brand – can be addressed through the SACI-Adm administrative procedure run by Registro.br.

The distinction matters from the first hour. A registrant who has lost control through credential theft must escalate immediately to Registro.br's security channel, request a registration hold, and preserve all access logs and authentication records. A brand owner dealing with a third party's abusive registration follows the SACI-Adm complaint path. In our practice, clients sometimes conflate these two scenarios and pursue the wrong route, losing critical time.

For an assessment of which route fits your situation, contact info@cognomenlaw.com.

What does it take to bring a claim under the .br dispute procedure?

The SACI-Adm procedure, administered by Registro.br as part of Brazil's national domain governance, applies to abusive registrations of .br domains where the complainant holds identifiable rights – including trademark rights, trade name rights, or other recognized Brazilian legal entitlements – in the name covered by the domain.

The test under SACI-Adm centers on whether the registration constitutes an abusive act against the complainant's rights. This is a distinct standard from the three-element UDRP test that governs .com and other gTLD disputes. Critically, the UDRP does not apply to .br. A brand owner who wins a UDRP decision for a matching .com cannot rely on that decision to compel a .br transfer; a separate SACI-Adm or court proceeding is required.

Complainants must also satisfy Registro.br's registration-eligibility rules. Individuals and Brazilian legal entities holding valid CPF or CNPJ numbers are the primary eligible registrants. Where a foreign brand owner lacks that eligibility, the practical outcome of a successful claim may be revocation of the domain rather than direct transfer to the complainant. Confirm current eligibility rules with counsel before filing.

To weigh SACI-Adm against a Brazilian court action for your case, email info@cognomenlaw.com.

What evidence is needed to recover a stolen .br domain?

The evidence required depends on whether the claim is a theft-by-compromise or an abusive-registration dispute, but strong documentation on both fronts is the floor for any successful recovery.

For an account-compromise claim, the core evidence package includes: authentication logs showing unauthorized access (timestamps, IP addresses, and device identifiers where obtainable), communications from Registro.br or the account platform showing the unauthorized transfer event, and any prior security alerts or breach notifications tied to the account. Chain-of-custody matters: a gap in the log record weakens the case significantly.

For a SACI-Adm abusive-registration claim, the evidence package must establish the complainant's rights and the respondent's abusive intent. That typically includes registered trademark certificates or pending-application records issued by INPI (Brazil's trademark office), evidence of the domain's current use (screenshots, DNS records, archived web content), and any correspondence from the registrant offering to sell the domain at a price that reflects opportunism rather than development costs.

In a recent matter (a .br abusive-registration case, autumn 2025), we prepared a SACI-Adm filing for a brand owner that combined INPI registration certificates, a screenshot archive of approximately three months of the disputed domain's use as a phishing page, and records of an unsolicited sale approach at a five-figure BRL price. That combination of rights evidence and bad-faith use documentation was central to the outcome.

One further category is often overlooked: evidence that the complainant itself does not hold a .br registration, which can bear on questions of prior rights and legitimate priority. Check whether Registro.br records show a lapse or transfer that the claimant did not authorize.

Can I recover a stolen .br domain for more than one domain at once?

Under SACI-Adm, a single complaint may cover multiple .br domains only where the registrant of all disputed domains is the same entity. This mirrors the general UDRP rule on multi-domain complaints and limits the efficiency of a consolidated filing to cases where one bad actor holds several names.

Where different registrants hold the domains – a common pattern in distributed typosquatting campaigns targeting a brand across multiple .br second-level variations – separate complaints are required for each registrant. This increases filing costs and administrative burden proportionally.

A court action can in some circumstances address multiple domains in a single claim, depending on how the underlying cause of action is framed under applicable Brazilian law. Whether that route is more efficient than staggered SACI-Adm filings is a fact-specific judgment. We regularly advise brand owners on sequencing multi-domain recovery campaigns to manage cost and maximize enforcement impact without triggering adverse publicity before a decisive filing.

How long does it take to recover a stolen .br domain?

SACI-Adm proceedings typically resolve in a matter of months, though the published timeline and any specific figures should be verified against Registro.br's current rules with counsel, as the procedure continues to evolve. Uncontested cases – where the respondent does not file an answer – are generally resolved more quickly than contested ones.

A Brazilian court action takes substantially longer. Preliminary injunctive relief (medida cautelar) can be sought on an expedited basis and may result in a temporary domain freeze within days or weeks of filing, but a final judgment on the merits typically takes considerably longer, measured in months to years depending on the court's docket and whether appeals follow.

The registrar-level hold is the fastest available step. Registro.br can flag a domain to prevent further transfer while a dispute is pending. That freeze does not itself restore control to the original registrant, but it prevents the domain from being moved again while the substantive claim proceeds. Filing for the hold at the earliest possible moment is almost always the right first action, regardless of which dispute route follows.

Timeline pressure also affects evidence availability. Access logs and hosting records are typically retained for limited periods. In our practice, we advise clients to treat the first 48 hours after discovering a theft or abusive registration as the window for evidence capture, not for deliberation about which procedure to use.

When does a court route beat the SACI-Adm procedure for a .br domain?

The administrative SACI-Adm route is calibrated for the typical abusive-registration scenario: a faster, lower-cost proceeding focused on whether a domain registration was an abusive act against the complainant's rights. It does not reach monetary compensation, and its remedies are limited to domain-related relief.

A court action is the stronger route in several situations. First, where the claimant needs injunctive relief on an emergency basis to stop active harm – a phishing site redirecting customers, for instance – a Brazilian court can issue a takedown order faster than any administrative procedure. Second, where the claimant seeks damages in addition to domain recovery, only a court proceeding makes that possible. Third, where the case turns on evidence that must be compelled from a third party (an ISP, a hosting provider, or a payment processor), court discovery tools are necessary. Fourth, where the respondent is a sophisticated actor with legal representation and the procedural record in SACI-Adm is likely to be contested, a court's fact-finding capacity and enforcement authority may produce a more durable result.

The decision matrix, then: if the goal is domain recovery alone, the dispute is straightforward on the facts, and the complainant meets Registro.br's eligibility rules, SACI-Adm is usually the faster and lower-cost path. If emergency relief, damages, or compelled discovery is needed, or if eligibility is uncertain, a Brazilian court action – handled with local litigation counsel in the relevant jurisdiction – is the appropriate route.

Note also the cross-zone dimension. A brand owner may hold a matching .com that is subject to a UDRP complaint or that was already recovered through WIPO. That UDRP result has no binding effect on the .br proceeding. Each zone is resolved independently under its own governing procedure. Running both proceedings concurrently is permissible and sometimes strategically advisable.

What are the possible outcomes when you recover a stolen .br domain?

The available outcomes under SACI-Adm are revocation of the domain registration or transfer to the complainant. Transfer is available where the complainant meets Registro.br's eligibility requirements for the specific second-level domain being claimed. Where a foreign complainant lacks Brazilian registration eligibility, the likely outcome of a successful claim is revocation – the domain is cancelled, not transferred, leaving the complainant to register it fresh if eligibility can be established.

No monetary remedy is available through SACI-Adm. If compensation for harm caused during the period of abusive use is part of the objective, a court claim is required in addition to or instead of the administrative route.

A court action can produce a broader range of outcomes: a temporary injunction freezing the domain and its use, an order to transfer the domain, an award of damages for trademark infringement or unfair competition under applicable Brazilian law, and cost recovery in appropriate cases. The scope of available remedies is wider, but so is the complexity and the time commitment.

For stolen-by-compromise cases, the outcome goal is restoration of the account and reversal of the unauthorized transfer. Registro.br has internal security escalation channels for exactly this scenario. A successful reversal reinstates the original registrant, but it requires clear documentation of the compromise and of the registrant's prior legitimate status. Where the chain of evidence is broken – for example, where the original registrant's own account was previously in default – the reversal claim becomes harder to establish. There is no guarantee of a specific outcome; results depend on the facts, the evidence, and the forum's assessment.

If a prior filing or response produced a bad outcome, a focused second read can find the element that was missed. Contact info@cognomenlaw.com to assess your options.

What does it cost to recover a stolen .br domain at SACI-Adm?

SACI-Adm is administered by Registro.br. Verify the current published fee schedule directly with Registro.br or with counsel before filing, as fee structures for national procedures can change and the applicable amounts are not reproduced in APPENDIX A above. As a general orientation, national ccTLD administrative procedures in Brazil and comparable jurisdictions tend to carry a modest official filing fee substantially lower than UDRP forum fees – but this characterization should be confirmed against current Registro.br tariffs.

Legal fees for preparing and filing a SACI-Adm complaint or respondent defense are separate from any official filing fee. The market range for legal work on a single-domain administrative proceeding is fact-dependent and reflects the complexity of the evidence and any respondent activity. A flat-fee engagement is common for straightforward cases; contested proceedings with multiple filings will carry higher legal costs.

A Brazilian court action carries substantially higher legal fees and court costs, consistent with full judicial proceedings. These are appropriately described as hourly and fact-dependent rather than reduced to a generic range.

For a stolen-by-compromise case handled entirely through Registro.br's registrar escalation channel, there is no administrative filing fee for the initial freeze request. Legal fees for preparing the evidence package and managing the escalation apply independently.

The comparison across routes: SACI-Adm is typically the lower-cost administrative path for abusive-registration disputes; a court action is costlier but offers broader remedies; registrar escalation for credential-compromise cases is the lowest-friction first step and should not be delayed while costs are being assessed.

Related at COGNOMEN

• Court action and domain theft recovery – when arbitration cannot reach
• Enforcing a UDRP decision for a .com – step-by-step guide
• Domain escrow and pre-acquisition due diligence for safe transfers

COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. For ccTLD proceedings such as SACI-Adm and Brazilian court matters, we work with local litigation counsel in the relevant jurisdiction to provide seamless cross-border coverage. To discuss a .br domain recovery, contact info@cognomenlaw.com.

By Adrian Harland – Court anticybersquatting and domain theft recovery practice at COGNOMEN.

Disclaimer: This article is general information about domain-name dispute procedures and does not constitute legal advice. Outcomes depend on the specific facts, the zone, and panel or court discretion. For advice on your domain, contact info@cognomenlaw.com.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Related

• Court Recovery
• Guide Enforce Udrp Decision Com
• Domain Escrow Ai

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.