FAQ: reverse an unauthorized transfer of a .dev domain

What does it mean to reverse an unauthorized transfer of a .dev domain?

Reversing an unauthorized transfer means restoring registrant control to the legitimate owner after a domain was moved without authorization – whether by account compromise, social-engineering of the registrar, or internal fraud. Under ICANN's transfer policy, a registrar may reverse an erroneous or fraudulent transfer within a defined window if the losing registrar and gaining registrar cooperate. Beyond that window, or where cooperation is refused, a formal UDRP complaint before WIPO or a court route may become necessary. The distinction matters: a transfer reversal is a registrar-level remedy; a UDRP complaint is a panel-level remedy. Both can result in the domain returning to the rightful owner, but they operate through different processes and on different timelines.

What makes .dev different from other gTLDs for this type of dispute?

.dev is a gTLD – specifically a restricted, HSTS-preloaded zone used primarily by developers and technology companies. Because it is a gTLD administered under ICANN's accreditation system, the UDRP applies in full. That means WIPO, the Forum, CAC, and ADNDRC all have jurisdiction to hear a complaint if the unauthorized transfer involved bad-faith conduct. The HSTS preloading (forcing HTTPS connections) does not affect the dispute-resolution rules. What does differ is the registrar landscape: .dev registrations are typically handled through a narrower pool of accredited registrars, and prompt contact with the correct registrar technical and abuse teams is essential. Registry-level escalation to Google Registry is available in exceptional circumstances but is not a substitute for the formal dispute route.

What evidence is needed to reverse an unauthorized transfer of a .dev domain?

The strength of an unauthorized-transfer case rests almost entirely on documentation. A panel or registrar escalation team will look for: original registration records showing you as the rightful registrant (confirmation emails, invoice or payment history, historical WHOIS or RDDS data); authentication logs demonstrating that the transfer was initiated without your credentials or following a compromise event; any communications showing the transfer was not authorized (absence of transfer approval emails, or evidence those emails were intercepted); and a timeline of discovery – when you noticed the domain was gone and what steps you took immediately. Supporting materials such as business records linking your operations to the domain, prior correspondence about the name, and any ransom or resale demands from the new holder all strengthen the claim. The sooner you gather these records, the less likely they are to be overwritten or deleted.

How long does it take to reverse an unauthorized transfer of a .dev domain?

Timeline depends on the route taken. A registrar-level transfer reversal, if pursued within the applicable ICANN transfer-policy window and with full cooperation from both registrars, can resolve in a matter of days to a few weeks – though cooperation is never guaranteed. A WIPO UDRP complaint, the standard formal route when registrar escalation fails, is normally decided within about two months of filing; the respondent has 20 days to file a response once the case commences. WIPO also offers an expedited option delivering a decision within approximately one month for single-panel cases of up to five domains. A court action – relevant where the theft involves fraud or where the registrar will not cooperate without a court order – adds substantially more time, measured in months to over a year depending on the jurisdiction. Speed matters in these cases: acting in the first 24 to 72 hours to lock the domain and document the compromise is the single most consequential step.

What does it cost to reverse an unauthorized transfer of a .dev domain at WIPO?

The WIPO filing fee for a UDRP complaint covering one to five domains on a single-member panel is USD 1,500. A three-member panel costs USD 4,000. These are the official forum fees only; legal fees for preparing and filing the complaint are separate and typically fall in a range commonly seen in the market for straightforward single-domain cases, though the complexity of gathering and presenting theft evidence can affect that figure. If a case is withdrawn or settled before panel appointment, WIPO commonly refunds approximately USD 1,000 of the single-panel fee. For a multi-domain claim covering six to ten domains, the WIPO fee rises to USD 2,000 (single panel) or USD 5,000 (three-member panel). CAC offers an entry point at a lower filing fee, but WIPO's experience with theft and compromise cases makes it the more common choice for .dev matters.

Can I reverse an unauthorized transfer of a .dev domain for more than one domain at once?

Yes, a single UDRP complaint may cover multiple domains where the registrant of record is the same holder across all domains in dispute. If several .dev domains – or a mix of .dev and other gTLD domains – were moved in the same compromise event and now sit with the same respondent, consolidating them into a single complaint is procedurally efficient and reduces total forum fees compared with filing separately. Where the domains have landed with different registrants or are spread across multiple holding accounts (a common tactic in organized theft), separate complaints or parallel proceedings may be required. The decision about whether to consolidate or file separately turns on the current registrant data, which your counsel should verify before filing. WIPO has the clearest consolidation procedures; the Forum and CAC operate on similar principles.

When does a court route beat arbitration for reversing a .dev domain transfer?

Arbitration – the UDRP – is faster and cheaper than court for most unauthorized-transfer cases. But there are situations where court action is the stronger path. If you need immediate injunctive relief to freeze the domain from further transfers before a panel can be appointed, only a court can issue that order. If the unauthorized transfer involved wire fraud, identity theft, or criminal conduct where you want law-enforcement involvement, a court proceeding creates the legal record those agencies require. And if you need monetary damages – the UDRP provides no damages remedy, only transfer or cancellation – court is the only route that reaches compensation. US anticybersquatting litigation, for example, allows damages and transfer in a single proceeding. For cross-border theft where the wrongdoer is outside the US, coordinating with local litigation counsel in the relevant jurisdiction is often necessary alongside any ICANN-level escalation.

What are the possible outcomes when you reverse an unauthorized transfer of a .dev domain?

The available outcomes depend on the forum and the route. At the registrar level, a successful transfer reversal restores the domain to its pre-transfer registrant of record with no formal decision issued. In a UDRP proceeding before WIPO or another forum, the panel's only remedies are transfer (the domain moves to the complainant) or cancellation (the domain is deleted and drops back to the pool); there is no monetary award and no injunction. If the respondent's conduct was abusive – including filing a bad-faith complaint against a legitimate registrant – a panel may issue a Reverse Domain Name Hijacking (RDNH) finding, though that carries no financial penalty. In a court action, the range of outcomes is wider: transfer, monetary damages, injunctive relief, and, in some jurisdictions, cost recovery. No dispute procedure guarantees an outcome; the specific facts, the strength of your evidence, and the forum's discretion all shape what is achievable.