Step-by-step: recover a stolen .cn domain

Step-by-step: recover a stolen .cn domain. UDRP and ccTLD domain recovery and defense across .cn. Email the firm to assess your case. Transparent fees, respond…

Your .cn domain – one registered, renewed, and built into a live business – disappears from your account overnight. The WHOIS shows a new registrant. The site redirects elsewhere. Someone either hijacked the registrar account or executed an unauthorized transfer, and the clock started the moment that record changed.

To recover a stolen .cn domain you must move across two tracks simultaneously: a registrar-level lock and escalation to freeze the registration before any further transfer, and a formal dispute through the CNNIC-authorized dispute procedure or, where the circumstances warrant, Chinese court litigation. Evidence of the account compromise is the pivot on which both tracks turn. Time is the adversary – each transfer that clears makes recovery harder.

This guide walks the steps in order, names the trap hidden in each one, and explains where the .cn process departs from the UDRP you may already know.

What governs .cn domains – and how is it different from the UDRP?

The .cn zone is administered by CNNIC (China Internet Network Information Center), and the dispute procedure for .cn domains is the China Internet Network Information Center Domain Name Dispute Resolution Policy, administered through approved providers including the ADNDRC (Asian Domain Name Dispute Resolution Centre). That is the correct starting point for any trademark-based cybersquatting or unauthorized-registration complaint under the .cn rules.

The .cn dispute test is broadly analogous to the three UDRP elements – confusing similarity, no legitimate interest, and bad faith registration or use – but there are important differences. First, the .cn rules are interpreted under Chinese law and policy context. Second, for cases of actual account theft (stolen credentials, unauthorized transfer, hacked registrar account), the dispute-resolution pathway is different from a straight cybersquatting complaint. Domain theft is not cybersquatting. The mechanism of loss matters: a bad-faith registrant who grabbed an expiring domain is a UDRP-style fact pattern; a criminal who broke into your account and transferred it is an account-compromise fact pattern that calls for registrar escalation, a police report, and potentially court action in parallel.

For stolen .cn domains, panels and courts in China will want to see that the original registrant held the domain legitimately, that the transfer was not authorized, and that the current holder acquired it without a valid basis. The ADNDRC is one approved provider for .cn proceedings; verify the current CNNIC-approved provider list with counsel before filing, as this list can change.

For an assessment of your domain dispute, contact info@cognomenlaw.com.

Step 1: Lock the domain immediately – and the trap if you wait

The first step is to freeze the registration status. Contact the registrar of record the moment you discover the unauthorized transfer. Request a registrar lock (also called a "Hold" or "clientTransferProhibited" status) on the domain pending investigation. If the .cn registrar is a Chinese-accredited registrar, CNNIC itself can sometimes impose a hold during a formal dispute – but that requires a filed complaint, not a phone call.

The trap: many brand owners spend the first 48 hours trying to recover the account through password resets or calling customer service. Those steps are not wasted, but they must run in parallel with – not instead of – a written, documented escalation to the registrar's abuse or security team. The registrar needs a paper trail to act. Email, with screenshots, timestamps, and account evidence, is that trail.

What you need to send in that first communication:

• Proof of original registration – historical WHOIS or RDDS records, renewal receipts, or registrar account statements showing your ownership.
• Dates and times the change was first noticed, and any login anomaly notices from the registrar.
• A formal written request to suspend all outbound transfers pending a dispute or police investigation.
• If there is evidence of credential theft (phishing email, unknown login from a foreign IP), include that documentation.

If the domain has already been transferred to a second or third registrar, escalate through CNNIC's formal complaint channel as well. The registrar chain matters. Each transfer hop reduces your recovery window.

Step 2: File a police report in the relevant jurisdiction – why it is not optional

Account compromise and unauthorized transfer of a domain can constitute computer fraud or property theft under Chinese law. Filing a police report – even if you have low expectations of a criminal outcome – serves three procedural functions that are not optional if you intend to litigate.

First, it creates an official record of the date you reported the theft. That date anchors your timeline in any subsequent arbitration or court proceeding. Second, Chinese courts and CNNIC-authorized dispute panels look more favorably on complainants who documented the compromise formally. Third, the police report can support a preservation order (a notarization or evidence preservation step) that locks digital evidence before it disappears.

The trap here is jurisdictional. If you are a foreign brand owner with a .cn domain, you may assume the police report must be filed in your home country. It should be. But a parallel report – or at minimum, a formal written complaint – filed in China, through a local agent or local litigation counsel in China, carries considerably more weight in Chinese proceedings. Do not treat the domestic police report as a substitute for the Chinese record.

Practical note: Chinese law requires certain evidence to be notarized and, in many cases, authenticated through an apostille or Chinese consular process before it is admissible in Chinese arbitration or litigation. Collect and notarize evidence of compromise early, before the window closes.

Step 3: Choose between CNNIC arbitration and court action – the decision that determines everything else

Two formal routes exist. The choice between them turns on the nature of the dispute, the relief you need, and the speed you can afford.

The CNNIC-authorized dispute procedure (before a provider such as ADNDRC) is the faster route for a clean trademark-versus-domain dispute. It does not award monetary damages. The remedy is transfer or cancellation of the domain. If the theft involved a criminal actor who has already sold the domain to an apparent good-faith purchaser, the arbitration panel must grapple with a bona-fide-purchaser question that some panels handle conservatively.

Court action in China – before the relevant People's Court – can award damages, issue injunctions, and sometimes reach assets associated with the person who stole the domain. It is slower and more expensive. But it is the only route that can recover monetary compensation for losses caused by the theft, and it is the only route that can compel a registrar to act where the registrar refuses to cooperate with arbitration orders. For high-value domains, the court route is often the correct one, even if arbitration runs in parallel.

The decision matrix in brief: if you want the domain back and the chain of title is clear (the current holder is the thief), file the arbitration first and preserve the court option. If the domain has changed hands to an apparent innocent third party, or if the theft caused significant business disruption, pursue court action with local litigation counsel in China as the primary route. If you are a foreign brand owner without a Chinese trademark registration, check eligibility carefully – the .cn rules require rights in a name, and those rights may need to be demonstrated differently than in a UDRP before WIPO.

Where gTLDs (.com, .net) are also affected by the same theft, a UDRP complaint at WIPO or the Forum can run alongside the .cn proceedings. The WIPO filing fee starts at USD 1,500 for a single-member panel covering one to five domains. That cost is separate from .cn proceedings entirely. We regularly advise brand owners managing theft across multiple zones simultaneously, which is the typical pattern in organized account-compromise operations.

Step 4: Build the evidence record – what panels and courts actually require

Evidence is where recovery claims succeed or fail. Whether you are in CNNIC arbitration or Chinese court, the evidence record needs to answer four questions completely.

First: who registered the domain originally? Historic WHOIS/RDDS records, registration confirmation emails, invoices from the original registrar, and any trademark registrations in China or internationally that predate the current holder's acquisition. If you have a Chinese trademark (registered through CNIPA), lead with it. If you have only an international registration, establish its recognition in China with counsel's help.

Second: how did the transfer happen? Server logs, registrar account activity logs, phishing emails, authentication tokens used, and the IP address or device from which the transfer was initiated. The registrar holds most of this data. You must formally request it – in writing, citing the dispute – before it is purged under routine data-retention policies. Registrars in China typically hold logs for a limited period. Move within days, not weeks.

Third: did you authorize the transfer? The answer, obviously, is no. But you need to prove it. That means showing no outbound transfer request was initiated from your verified contact details, no authorization code was issued by you, and any communication that appears to authorize the transfer was forged or obtained through compromise. Two-factor authentication logs (or the absence of them) are relevant here.

Fourth: what is the current holder's basis for holding the domain? A thief or mule account holder will often have no plausible answer. A good-faith purchaser from the thief will argue they paid value. If you can show the purchase price was anomalously low, or that the seller had no visible connection to any name or business that would explain holding the domain, that weakens the good-faith-purchaser defense.

In a recent matter (a .cn domain theft, spring 2025), we assembled the registrar-log evidence, notarized it in China with local litigation counsel, and filed the formal CNNIC dispute within three weeks of the compromise being discovered. The account-access logs showed the transfer was initiated from an IP address in a jurisdiction with no connection to the registrant of record, at an hour inconsistent with any normal business operation. That evidence was the cornerstone of the recovery argument.

Step 5: File the formal complaint – and the trap in the first draft

The formal complaint, whether in CNNIC arbitration or court, must be drafted with the governing rules in mind, not the UDRP rules you may know from gTLD proceedings. The elements differ at the margins, and the procedural requirements differ more. Complaints that import UDRP-style drafting without adapting to the .cn rules create gaps that a respondent's counsel will exploit.

Specific traps in the first draft:

• Rights basis: the complaint must clearly identify the rights on which it relies. A Chinese trademark registered with CNIPA is the strongest foundation. A well-known mark recognized in China is the next best. An international registration without Chinese recognition is the weakest – do not file without addressing this gap.
• The theft narrative: in an account-compromise case, you are not filing a standard cybersquatting complaint. The complaint must explain the theft mechanism, cite the evidence, and distinguish this from a simple "registration in bad faith" scenario. Panels that see a well-documented theft account are in a different analytical posture than panels reading a standard cybersquatting filing.
• The remedy requested: be explicit. Request transfer to the original registrant (you), not cancellation. Cancellation means the name goes back into the pool; transfer means it comes back to you. In a theft case, cancellation is almost never the right remedy to request.
• Timing and forum choice: confirm the current CNNIC-approved provider before filing. The ADNDRC is a known authorized provider for .cn disputes, but confirm this remains current with counsel at the time of filing.

The trap that costs cases: filing quickly but incompletely. Speed matters at the registrar-lock stage. It matters less at the formal complaint stage than thoroughness does. A deficient complaint that is dismissed on procedural grounds costs more time than a careful complaint that takes two additional weeks to prepare.

To weigh UDRP against a court action for your case, email info@cognomenlaw.com.

Step 6: Manage the response period and the registrar's implementation

Once the formal complaint is filed, the respondent has an opportunity to file a response. In CNNIC arbitration proceedings, the procedural calendar is set by the applicable rules of the chosen provider. In court proceedings, timelines follow the relevant civil procedure rules of the People's Court.

The trap at this stage: passivity. Many complainants file and wait, assuming the process runs automatically. It does not. You should monitor:

• Whether the respondent files any response, and whether it raises a good-faith-purchaser defense that requires you to address it on reply.
• Whether the domain's registration status changes again during the proceeding. An unscrupulous current holder may attempt a further transfer to a third party – or worse, may destroy the site content that serves as evidence of harm.
• Whether the registrar implements any interim lock. If the registrar has not confirmed a hold, follow up in writing.

If a three-member panel is available and the case is complex – or if the current holder is mounting a serious defense – consider whether the panel composition warrants the higher cost. A three-member panel at WIPO, for comparative reference, costs USD 4,000 versus USD 1,500 for a single-member panel. The .cn procedure's comparable fees should be confirmed with the chosen provider, as they differ from WIPO's published schedule.

After a decision in your favor, the registrar implements the transfer. In practice, this step can take additional days. Monitor the registration record actively, and confirm the transfer in writing with the registrar once it is complete. Document the completion date.

When a court route is the better path – and the cross-zone dimension

Some .cn theft cases are not well-suited to arbitration at all. Where the theft is part of a broader scheme – organized account compromise across multiple registrars and zones, or a theft that caused measurable business losses – the court route provides remedies that arbitration simply cannot.

Chinese courts can issue preservation orders, compel registrar cooperation, award damages for business interruption, and impose penalties. The cost and timeline are substantially higher than arbitration, and foreign brand owners will need local litigation counsel in China to conduct the proceedings. That is not a reason to avoid the court route; it is a reason to make the decision deliberately, with a clear view of the domain's value and the losses sustained.

The cross-zone dimension matters here. Organized domain theft operations rarely confine themselves to .cn. A brand owner whose .cn domain was stolen may find companion .com, .net, or new-gTLD domains also affected. Those gTLD disputes can be addressed through the UDRP at WIPO or the Forum, running concurrently with the .cn proceedings. The two tracks are procedurally independent. Evidence gathered for one will generally be usable in the other, and the resolution of one does not bind the other. We have handled matters where coordinated filings across zones produced faster overall resolution than sequential proceedings would have allowed.

In one recent matter (a multi-zone theft, autumn 2024), we coordinated UDRP filings at WIPO for the gTLD domains simultaneously with a formal complaint in the .cn procedure. The gTLD decisions came first – as expected, given the UDRP's typical two-month timeline – and those decisions' findings on bad faith provided a supporting factual record for the .cn proceeding. The .cn recovery followed within a further period, with the combined record proving decisive.

For any theft that extends into court proceedings abroad, we work with local litigation counsel in the relevant jurisdiction. COGNOMEN manages the dispute strategy across zones and forums; local court filings are handled by qualified counsel in each territory.

Related at COGNOMEN

• Court recovery and domain theft: full service overview for gTLD and ccTLD zones
• Case study: court action for cybersquatting across multiple zones
• UDRP recovery against serial cybersquatters using AI-generated content