Step-by-step: recover a stolen .fr domain

Step-by-step: recover a stolen .fr domain. UDRP and ccTLD domain recovery and defense across .fr. Email the firm to assess your case. Transparent fees, respond…

Your .fr domain is gone. The registrar dashboard shows a name you do not recognize as the new registrant, the site is pointing somewhere else, and the transfer happened without your knowledge or consent. The clock is already running. Every hour the domain sits in hostile hands is an hour a phishing page, a counterfeit storefront, or a brand-damaging redirect can operate under your name.

To recover a stolen .fr domain you have two parallel tracks: an immediate registrar-escalation to freeze the name, and a formal dispute through Afnic's SYRELI or PARL EXPERT procedure – or French court action where arbitration cannot reach. The governing rules for .fr sit outside the UDRP; Afnic administers its own procedures under French and EU rules, and the remedy can include transfer or deletion. Acting within days of discovery, not weeks, is the single factor most likely to determine whether a reversal is technically possible at all.

This guide walks every step in sequence, names the trap each one hides, and explains where the decision between the Afnic procedure and the French courts becomes the critical fork in the road.

Step 1: Confirm the theft before you do anything else

The first sentence of every theft recovery matters: confirm that what happened is an unauthorized transfer, not an administrative lapse on your own side. That distinction shapes every move that follows.

Pull the current WHOIS/RDDS record for the domain at Afnic's public lookup. Note the registrant name, the registrar of record, the creation date, and – critically – the last-updated date. If the last-updated date is recent and the registrant name is not yours, you have a transfer event to investigate. Now check your own registrar account. Has your password changed? Has your contact email address been altered to redirect notifications? Is there a pending or completed outbound transfer in your account history?

This step hides a trap: many victims assume the transfer was a registrar error and spend days on informal support tickets, losing the window for an emergency registrar lock. If the WHOIS record shows a new registrant and your account shows an outbound transfer you did not authorize, treat it as a theft and escalate formally, immediately.

Preserve everything digitally before you change any password or account setting. Screenshot the WHOIS record with a timestamp, the registrar account history, and any suspicious emails in your inbox or sent folder. This evidence becomes the foundation of your formal complaint. Altered or deleted evidence is almost impossible to reconstruct from a registrar's logs, and registrars are under no universal obligation to retain account-level data indefinitely.

Step 2: File an emergency registrar lock – and know its limits

Contact the gaining registrar – the one now holding the domain – and request an immediate lock on outbound transfers pending investigation of an unauthorized transfer claim. This is the single fastest technical action available, and it can prevent the domain from moving to a third registrar before you have built your formal case.

The trap here is treating the registrar lock as a remedy rather than a holding measure. A registrar lock freezes the name in place; it does not reverse the transfer or restore you as registrant. The gaining registrar is also under no obligation to reverse a completed transfer on the basis of a customer-service complaint alone. Most accredited registrars will lock the domain while an investigation is open, but they require formal documentation – a police report, a signed declaration of unauthorized access, or a formal dispute submission – before taking any action that affects the current registrant's contractual rights.

Contact your original registrar at the same time. Ask them to document the outbound transfer in their logs and preserve all account-access records. If the attack involved a compromised email account used to authenticate the transfer request, also contact your email provider and file an abuse report. That email-compromise chain is among the strongest evidence you can present in any subsequent procedure.

Document every communication with timestamps. If the registrar refuses to lock the domain, note that refusal in writing. A registrar's inaction in the face of a documented theft claim is itself relevant evidence in a French court proceeding.

At this stage the risk of permanent loss is highest and the options still open are most numerous. For an assessment of your domain dispute, contact info@cognomenlaw.com.

Step 3: Gather the evidence that decides the outcome

An Afnic SYRELI or PARL EXPERT complaint, and a French court claim, are each decided on evidence. Assembling that evidence early – before the registrar closes its investigation, before the new registrant moves the domain again, and before memories fade – is not optional.

The evidence package for a .fr theft case typically has three layers. First, proof of your prior rights: the original domain registration confirmation, invoices for hosting or services tied to the domain, trademark registrations or pending applications covering the name, and any published materials associating your brand with the .fr address. Afnic's procedures recognize a wider set of rights than registered trademarks alone, which is an important advantage over the UDRP structure.

Second, proof of unauthorized access: the timestamp mismatch between your last known login and the transfer date, any account-security alerts from the registrar or your email provider, evidence of a phishing email that may have harvested your credentials, and any law-enforcement report you have filed. In France, filing a complaint with the police or the gendarmerie is straightforward and carries real evidentiary weight in both the Afnic procedure and civil litigation – do not skip this step because it feels bureaucratic.

Third, proof of harm or ongoing misuse: screenshots of what the domain now resolves to, any customer complaints or brand confusion reported to you, and evidence that the new registrant has no plausible legitimate claim to the name. If the domain is pointing to a competitor's site, a parking page with your brand's keywords, or a phishing page mimicking your own, that evidence directly supports both the theft claim and any request for urgent interim measures in court.

The trap in this step is waiting to file a police report until you have "more evidence." File it as soon as the theft is confirmed. French authorities issue a receipt immediately, and that dated receipt anchors your timeline in every subsequent proceeding.

Step 4: Choose between the Afnic procedure and the French courts – the critical fork

The most consequential decision in a .fr theft recovery is whether to proceed through Afnic's formal dispute procedures, through the French courts, or – where the facts support it – both in sequence. Neither route is universally superior; the right choice depends on the nature of the theft, the identity and conduct of the new registrant, and the urgency of the remedy you need.

Afnic operates two procedures. SYRELI is a streamlined online procedure for clearly abusive registrations; it is relatively fast, proceeds under published rules, and the remedy can be transfer or deletion. PARL EXPERT is a fuller expert-panel procedure for more complex cases. Both sit outside the UDRP, and both apply French and EU law rather than the UDRP's three-element test. Crucially, Afnic's procedures are designed primarily for disputes about whether a registration is abusive relative to a complainant's rights – they are well-suited to cybersquatting-type scenarios. A pure account-compromise theft, where the question is not whether the registration was abusive but whether the transfer was technically fraudulent, may sit more naturally in the French courts, which can order interim measures, investigate fraud, and award damages.

The Afnic route is generally faster and lower in cost. The court route is slower and more expensive, but it is the only path if you need injunctive relief to stop ongoing harm – such as a phishing site running under your name – or if you want to pursue the attacker for damages. French courts can also issue orders directed at registrars and hosting providers, compelling them to act, which an Afnic panel cannot do.

In practice, we regularly advise clients in theft situations to file for a registrar lock and the Afnic procedure simultaneously, while preserving the option to escalate to a référé d'urgence – an emergency interim application before the French courts – if the domain begins moving again or the harm is acute. That combination maximizes pressure on the new registrant without committing to the cost of full litigation unless it becomes necessary.

Consider a parallel .com or other gTLD dimension. If the same attacker also redirected associated gTLD domains, a UDRP complaint can run concurrently with the Afnic procedure. A UDRP complaint before WIPO starts at USD 1,500 for a single-member panel covering one to five domains and typically resolves within about two months. That concurrent approach is one we have used in recent matters where a brand's entire online footprint – both the .fr and the .com – was targeted in a single compromise event.

To weigh the Afnic procedure against a French court action for your case, email info@cognomenlaw.com.

Step 5: File the formal complaint – and get every element right the first time

Filing a defective complaint is nearly as damaging as not filing at all. Under Afnic's procedures, a complaint that fails to establish your prior rights clearly, or that misstates the nature of the transfer event, can be dismissed on technical grounds, burning both time and the element of surprise.

For a SYRELI or PARL EXPERT filing, the complaint must identify your rights in the name (trademark registration, trade name, widely-known use, or other recognized basis under French and EU law), demonstrate that the current registration or use is unjustified relative to those rights, and present the chain of evidence clearly. Afnic's procedures allow you to rely on a wider set of rights than the UDRP permits – a significant advantage for smaller businesses that have not yet registered a trademark but have established trading presence under the name.

For a French court application, the procedural requirements are distinct. An emergency référé application requires a showing of urgency and a serious prima facie case. A full merits claim requires compliance with French civil procedure, which in practice means working with counsel in the relevant jurisdiction. We coordinate with local litigation counsel in France for all court-stage work; the procedural rules are jurisdiction-specific and the risk of a technical error in a court filing is not one we would ask a client to accept.

One practical point on forum selection: if an associated gTLD domain is also in dispute, the UDRP and the Afnic procedure are not mutually exclusive, and a single coordinated filing strategy across both forums can prevent the attacker from defending on one front while retreating to another. We have structured exactly this approach in cases where a theft spanned a French-registered entity's .fr and its corresponding .com within a short window in 2024 and 2025.

Step 6: Manage the registrar's response and the interim period

Between filing and a formal decision, the domain remains under the new registrant's control unless interim measures have been granted. That interval is dangerous, and managing it requires active monitoring and, where necessary, parallel pressure on the registrar and the hosting provider.

Set up automated monitoring of what the domain resolves to during this period. If it points to a phishing site, you may have grounds for an urgent abuse complaint to the hosting provider under applicable terms of service, entirely independent of the dispute procedure. Hosting providers generally respond faster than registrars to abuse reports tied to active phishing, and a swift takedown of the harmful content reduces ongoing harm even while the recovery procedure runs.

If the domain begins to move to a different registrar while the procedure is pending, notify Afnic immediately. A lock obtained in the earlier step should prevent this, but enforcement of that lock depends on the gaining registrar's cooperation. An escalation to Afnic – citing the pending procedure and the attempted transfer – typically triggers a harder administrative hold.

Keep all communications with the registrar in writing. If the registrar takes any unilateral action that affects the domain during this period, document it. We have seen cases where registrar error during a pending dispute added a procedural complication that could have been avoided with a clear paper trail.

Step 7: Secure the domain after recovery and prevent recurrence

A transfer order or court judgment returning the domain to you is not the end of the process. It is the beginning of the hardest-to-neglect step: hardening the domain's security so the same attack cannot recur.

Immediately after recovery, change every credential associated with the domain: the registrar account password, the associated email address (ideally moving to a dedicated, non-public address), and all API keys if the domain management is automated. Enable two-factor authentication on both the registrar account and the associated email. Request that the registrar place a registry lock – a higher-level lock that requires multi-party verification to release – if the registry and registrar support it for .fr domains.

Review the WHOIS/RDDS record carefully after restoration. Confirm that the registrant name, administrative contact, technical contact, and nameservers all match your intended configuration. A common post-recovery error is assuming the restoration was clean without checking every field; a residual malicious nameserver record can redirect traffic even after the registrant record is corrected.

Consider whether your current registrar provides adequate security controls for a domain of this value. Not all accredited registrars offer the same level of account protection, and a domain theft is, in our practice, almost always preceded by inadequate account-security hygiene at the registrar level. A domain that has been stolen once is a statistically higher-risk asset; treat it accordingly.

Finally, consider whether pre-acquisition due diligence or a formal domain assignment agreement – transferring the domain into a structure with clearer chain of title and documented ownership – is warranted, particularly if the domain is material to the business. A clean post-recovery record now is significantly easier to establish than reconstructing history after a second incident.

Related at COGNOMEN

• Court recovery and domain theft services – all zones and routes
• Global stolen domain recovery – multi-zone and multi-forum strategies
• Domain assignment agreements for .fr – securing chain of title post-recovery