FAQ: reverse an unauthorized transfer of a .eu domain

When can I reverse an unauthorized transfer of a .eu domain?

You may pursue reversal any time you can show that the current registration is abusive or was obtained without proper authority. The ADR.eu procedure administered through the Czech Arbitration Court is the primary formal route for .eu disputes. It allows a complainant who holds eligible rights in a name — registered trademark, trade name, personal name, or another recognized ground under the applicable EU rules — to seek transfer or revocation of a domain that was registered or is being used in bad faith.

An unauthorized transfer — where your credentials were compromised, a social-engineering attack redirected your registrar account, or an administrative error moved the domain — creates the factual basis for a claim on the abusive-registration ground. The practical threshold is that you must show (1) you hold rights in the name corresponding to the domain; (2) the current registration is abusive — either because it was obtained without your consent or because the current holder is using it in a manner that exploits those rights; and (3) you meet EURid's eligibility requirements for .eu registrants, which require a connection to the European Union or EEA.

Critically, the ADR.eu rules read abusive registration as "registered or used" in bad faith — a lower cumulative bar than the UDRP's "registered and used" requirement. That distinction matters most when a domain was seized through compromise and then parked or held passively: passive holding after an unauthorized transfer can still satisfy the abusive-registration limb under .eu rules, whereas pure passive holding is harder to establish under the UDRP without additional circumstances.

One more timing consideration: the registrar-side escalation must run in parallel. EURid operates a registrar-lock mechanism, and a documented account compromise can trigger a hold on further outbound transfers while the formal challenge proceeds. Do not wait for the ADR.eu case to open before contacting the losing registrar and EURid directly.

Who can reverse an unauthorized transfer of a .eu domain for a .eu domain?

The party with standing to file an ADR.eu complaint is the person or entity who holds — or held — rights in the name that corresponds to the disputed domain. Under the .eu dispute rules, "rights" extends beyond registered trademarks to encompass trade names, company names, personal names, geographical indications, and certain protected titles recognized in EU member states.

If you are the original registrant and the transfer occurred without your authorization, you are the natural claimant. You will need to demonstrate that you held the domain legitimately, that the transfer was not authorized by you, and that you meet EURid's eligibility requirements. Those requirements demand a genuine connection to the EU or EEA — established through citizenship, residence, or incorporation in a member state or EEA country.

If the unauthorized transfer has moved the domain to a registrant who no longer meets EURid's eligibility rules — a common consequence of hijacking by parties outside the EU — that eligibility failure is itself a separate ground for revocation by EURid, independent of the ADR.eu complaint. We regularly advise claimants to pursue both avenues simultaneously: the ADR.eu formal complaint for rights-based transfer, and a direct eligibility challenge to EURid for administrative revocation where the current holder cannot satisfy the EU nexus requirement.

A brand owner who was never the registrant of the disputed .eu domain but whose trademark or trade name corresponds to it may also file. In that case the theory shifts from theft reversal to abusive registration by the current holder — a distinct but related claim that the ADR.eu procedure accommodates. The evidentiary package differs: the brand owner must lead with the rights evidence, while the original registrant whose domain was taken must lead with the compromise evidence.

For a read on whether the ADR.eu grounds apply to your situation, reach us at info@cognomenlaw.com.

What evidence decides the outcome of a .eu domain transfer challenge?

Evidence of the compromise itself is the foundation of an unauthorized-transfer claim. The ADR.eu panelist must understand that the transfer was not sanctioned by the true registrant, and the documentation that establishes that fact must be assembled from the first hour after discovery.

The core evidence package for an unauthorized-transfer case typically includes:

• Registrar account authentication logs showing access from an unrecognized IP address, device, or location at the time of the transfer;
• The original registrar's records of the outbound transfer authorization — specifically whether the authorization was triggered by a forged email, a compromised inbox, or a registrar-side procedural error;
• WHOIS/RDDS records capturing the registrant details before and after the transfer, ideally timestamped;
• Any phishing emails, spoofed communications, or social-engineering correspondence that preceded the transfer;
• Correspondence with the losing registrar and EURid, including any account-compromise report submitted immediately after discovery;
• Proof of the claimant's own rights — trademark registration certificates, company registration documents, or trade name evidence; and
• EURid eligibility documentation establishing the EU or EEA nexus.

In our practice we have seen unauthorized-transfer cases lost not on the merits of the compromise itself, but on inadequate documentation of the registrant's own original rights. A panelist who cannot identify a clear rights holder on the claimant's side will hesitate to order transfer even where the theft is apparent. Assemble the rights evidence with the same urgency as the compromise evidence.

Where authentication logs are unavailable — because the registrar does not retain them or will not release them without a legal demand — an ADR.eu panelist may draw adverse inferences against the current registrant if that party cannot explain how the transfer authorization arose. The burden of production effectively shifts on the question of authorization when the claimant establishes a prima facie case of compromise. Courts in relevant EU member states have reached similar conclusions in preliminary injunction proceedings, which is one reason a court route sometimes runs faster in the earliest days of a .eu theft case.

Does ADR.eu or a court decide a .eu domain dispute?

ADR.eu, administered by the Czech Arbitration Court, is the designated dispute-resolution procedure for .eu domains and is the standard first route for most claimants. It is faster and less expensive than court litigation for rights-based claims. The remedy, however, is limited to transfer or revocation of the domain — no monetary damages, no injunction against the current holder's conduct outside the domain name itself.

A court in the relevant EU member state remains available and, in some scenarios, is the better path. The case for a court route arises when:

• You need an emergency interim measure — a court-ordered registrar lock or transfer freeze — faster than ADR.eu can commence a formal proceeding;
• You are seeking monetary damages alongside domain recovery, which only a court can award;
• The facts involve criminal conduct (identity fraud, phishing, unauthorized computer access) where a police report and parallel criminal referral strengthen the civil claim and may prompt EURid to act administratively; or
• The identity of the person who executed the unauthorized transfer is disputed and requires discovery powers that only a court possesses.

In a recent matter (a .eu domain, spring 2025), we advised a brand owner to pursue an immediate court-ordered interim injunction in the relevant member state to freeze the domain while ADR.eu proceedings were prepared in parallel. The two tracks reinforced each other: the court order prevented onward transfer, and the ADR.eu decision ultimately produced the formal transfer order. Neither track alone would have been as effective against a registrant who was actively attempting to move the domain through a second registrar.

For matters needing urgent court-side relief in a specific EU member state, we work with local litigation counsel in the relevant jurisdiction. COGNOMEN coordinates the ADR.eu filing and the strategic direction; local counsel handles the interim application under national procedural rules.

What if the registrant does not respond to the ADR.eu complaint?

A default — the current registrant's failure to file a response within the prescribed time — does not result in automatic transfer. The panelist still examines the complaint on the merits and must be satisfied that the claimant has established abusive registration. The practical effect of a default is that no contradictory evidence enters the record, which typically strengthens a well-documented complaint. Panelists regularly transfer or revoke domains on default decisions where the claimant's rights and the abusive-registration ground are clearly set out.

The risk of a default scenario is that a claimant who submitted an underdeveloped complaint cannot cure that deficiency once the respondent fails to appear. The panelist has only what the complaint contains. This is why completeness in the initial filing — rights evidence, compromise documentation, the abusive-registration argument — is as important in a likely default case as in a contested one.

Default decisions in the ADR.eu procedure tend to be issued on a shorter timeline than fully contested cases, though the exact duration varies. EURid and the Czech Arbitration Court publish their procedural timelines; verify the current rules with counsel at the time of filing.

Can the ADR.eu decision be appealed or challenged?

The ADR.eu procedure includes an appeal mechanism. A party dissatisfied with the panel's decision may challenge it, but the grounds and time limits are strict. An appeal must generally be lodged within a defined period after the decision is issued. The appellate panel reviews the original decision and the record; it does not ordinarily admit new evidence except in narrow circumstances.

A separate judicial challenge in the courts of the relevant EU member state is also available under the .eu dispute framework. Court oversight is the backstop for either party. A claimant who loses at ADR.eu may pursue rights through the national courts. A respondent who loses may seek a court suspension of the transfer pending challenge — though courts in EU member states have generally been reluctant to stay ADR decisions where the evidence of abusive registration was clear.

The reverse-domain-name-hijacking analog exists in the ADR.eu context as well: if a panelist finds that a complaint was filed in bad faith to deprive a legitimate registrant, that finding is recorded in the decision. There is no monetary penalty, but the reputational consequence for the complainant and their representative is real. We have defended registrants against abusive .eu complaints and, where warranted, sought findings of that kind.

What is the deadline once a case starts?

Once the ADR.eu case formally commences, the current registrant — the respondent — has a defined window to file a response. The exact procedural deadline is set by the Czech Arbitration Court's .eu dispute-resolution rules; verify the current figure with counsel, as procedural rules can be updated. The pattern mirrors other UDRP-adjacent procedures, where response windows are typically measured in weeks rather than months.

For the complainant, the practical deadline pressure runs in the opposite direction: the faster the complaint is filed after discovery of the unauthorized transfer, the more likely the domain remains at a single registrar and the lower the risk of a further onward transfer. Every day of delay after discovery is a day the current holder can attempt to move, monetize, or restructure the registration.

From the claimant's side we recommend a preparatory timeline structured around three phases: (1) immediate registrar escalation and EURid account-compromise report within the first 24 to 48 hours; (2) evidence assembly and complaint drafting within the first week; and (3) formal filing at ADR.eu as soon as the complaint package is complete and reviewed. Rushing an underprepared complaint is as costly as delay — a deficient filing in a likely-default case leaves the claimant with no opportunity to supplement.

To weigh the ADR.eu route against a court action for your .eu domain, email info@cognomenlaw.com.