Step-by-step: reverse an unauthorized transfer of a .fr domain

Step-by-step: reverse an unauthorized transfer of a .fr domain. UDRP and ccTLD domain recovery and defense across .fr. Email the firm to assess your case.

Your .fr domain disappears overnight. The registrar's portal shows a new registrant. Someone — perhaps an attacker who compromised your account credentials, perhaps a rogue reseller, perhaps a party acting on a forged authorization — has pushed through a transfer you never approved. The clock is now running against you, and every hour the new holder entrenches its position.

To reverse an unauthorized transfer of a .fr domain, you must move on two tracks simultaneously: a registrar-level escalation to freeze or claw back the registration, and a formal dispute through Afnic's published procedures — either the SYRELI or PARL EXPERT route — or, where the scale or complexity of the theft demands it, national court action in France. The governing national procedure applies to .fr; there is no UDRP for this zone. Evidence of the unauthorized act, gathered within the first hours, is the single factor most likely to determine whether a reversal succeeds.

This guide walks each step in order, names the trap hiding inside it, and explains when to escalate from arbitration to litigation.

Step 1: Confirm the Transfer Was Unauthorized and Document Everything Immediately

A reversal starts with evidence, not with a filing. Before contacting any forum, secure a complete audit trail of the compromise — because Afnic and any French court will demand proof that you did not authorize the transfer, and that record is most reliable when made in the first hours after discovery.

Pull your registrar account logs immediately. Download every access log, every change-of-registrant notification, every authorization code (authinfo) request, and every email connected to the transfer. Screenshot the RDDS/WHOIS record showing the new registrant's data before it can be masked or updated further. Note the exact timestamp of the transfer.

The trap at this step: many domain owners assume the registrar will preserve logs on request. Registrars are generally not required to maintain detailed logs indefinitely. Some retention windows are as short as thirty days. If you delay, you lose the raw data you need. Log capture is not optional; it is the foundation of your case.

Simultaneously, change every credential associated with the registrar account — password, two-factor authentication device, recovery email address — so a still-active attacker cannot repeat the transfer or interfere with recovery communications.

Step 2: Escalate Directly to the Registrar Within 24 Hours

The fastest single action available to you is a formal written objection to the registrar — the entity that executed the transfer. For .fr domains, the registrar operates under an Afnic accreditation agreement and is bound by Afnic's framework. A well-framed escalation letter, sent within 24 hours, can cause the registrar to place a registrar lock on the domain, halting any onward transfer while the matter is investigated.

Your letter must do three things clearly. First, assert that the transfer was unauthorized and that you remain the legitimate registrant of record immediately before the transfer occurred. Second, request an immediate registrar lock — sometimes called a status lock or transfer prohibition — on the domain in its current state. Third, formally preserve all relevant account and transfer records, explicitly citing your intent to commence dispute proceedings.

The trap: registrar escalation is not a substitute for a formal dispute filing, and it rarely produces an outright reversal on its own. Registrars are intermediaries. They are not dispute adjudicators. The best realistic outcome at this stage is a freeze that buys time. Do not wait for the registrar's response before beginning Step 3; run both tracks in parallel.

If the losing registrar is different from the gaining registrar — which can occur in inter-registrar transfers — contact both. The gaining registrar now controls the domain; the losing registrar holds the historical record you need.

Step 3: Understand the .fr Dispute Landscape — SYRELI, PARL EXPERT, and the Court Route

The .fr zone does not use the UDRP. Afnic administers two distinct formal procedures, and French courts constitute the third route. Choosing the right track at the outset determines your timeline and your available remedies.

SYRELI is Afnic's online dispute procedure, designed for cases that are clear on their face: a rights holder asserts that a domain infringes a prior right and files an electronic complaint. The procedure has an official fee structure that Afnic publishes; verify the current fee schedule directly with Afnic, as our system prompt cautions against inventing figures for this procedure. SYRELI decisions are made by a sole expert and can result in transfer or deletion. The process is relatively streamlined, making it appropriate for cases where the unauthorized transfer is accompanied by an obvious prior rights violation — for example, the thief has pointed the domain at a competing commercial site.

PARL EXPERT is Afnic's more elaborate expert procedure, involving a panel and a fuller adversarial exchange. It is suited to factually or legally complex cases, including those where the identity of the person who executed the transfer is genuinely in dispute or where the attacker contests your ownership of the name.

The national court route — specifically the French civil courts — applies where arbitration cannot reach the problem. If the unauthorized transfer was part of a broader criminal fraud, if you need interim injunctive relief (a court-ordered freeze enforceable immediately), if the domain has been sold onward to a third-party purchaser whose position the Afnic procedures may not fully address, or if you seek damages, a court action is the appropriate — and sometimes the only — path. Anticybersquatting and domain theft litigation in France is handled with local litigation counsel in the relevant jurisdiction. COGNOMEN coordinates that engagement and manages the dispute strategy across the arbitral and judicial tracks.

If you are weighing SYRELI against a French court action for your .fr situation, email info@cognomenlaw.com for an assessment of which route best fits your evidence and timeline.

What Evidence Decides the Outcome of a .fr Domain Reversal?

Strong evidence of an unauthorized transfer, preserved immediately, is what separates a successful reversal from a failed one — regardless of whether the case runs through Afnic or a French court.

The core evidence package a decision-maker needs includes the following:

• Proof of prior registration — the historical RDDS/WHOIS record showing you as registrant, your registration confirmation emails, and any renewal invoices you paid, dating back as far as possible.
• The authinfo or transfer authorization code request log, showing who requested the code and from which IP address, compared against your own access history.
• Any phishing emails, spoofed registrar notifications, or social-engineering messages the attacker used — these are direct evidence of the unauthorized act and often show the compromise vector.
• A timestamped screenshot of the RDDS record post-transfer, capturing the new registrant data.
• Your registrar account's access log, ideally showing a login from an unfamiliar IP address or geographic location at the time of the transfer.
• A police or cybercrime report, if filed — which we strongly recommend because it establishes a contemporaneous official record of the theft.

The trap at the evidence stage: many registrants focus entirely on proving their own ownership and overlook the need to demonstrate the mechanism of the unauthorized act. A Afnic expert or French court will ask not merely "was this your domain?" but "how was the transfer effected without your knowledge?" The answer to that second question — phishing, credential compromise, insider abuse at the registrar — shapes the legal theory and the relief available.

In our practice, the cases most likely to fail at the evidentiary stage are those where the rightful registrant can show historical ownership but cannot explain how the transfer happened. That gap creates doubt. Fill it with whatever technical and documentary record you can assemble, and do so before filing.

Step 4: File the Afnic Dispute — SYRELI or PARL EXPERT

Once your evidence package is assembled, the Afnic formal filing follows a defined procedure. Both SYRELI and PARL EXPERT are initiated through Afnic's online platform. The complaint must identify the domain, the prior rights or legitimate interests you assert, and the grounds for contesting the transfer. Afnic's published guidelines specify the documentary requirements; follow them precisely, because an incomplete filing can delay commencement.

Key procedural points to observe:

1. Identify your rights clearly. The .fr procedures permit a wider set of "rights" than registered trademarks alone — trade names, company names, personal names, and protected designations may all qualify. State the specific right and its priority date.
2. Name the correct respondent. The respondent is the new registrant shown in the RDDS record at the time of filing. If the domain has been sold onward, the chain of transferees may complicate the case; flag this in the complaint and seek guidance on whether interim measures are needed to prevent further transfer during the proceedings.
3. Request interim measures if the domain is actively being used to harm your business — redirecting your customers, hosting counterfeit content, or generating fraudulent correspondence in your name. Afnic's procedures and the French courts can both address urgency, but the mechanisms differ.
4. Preserve the right to parallel court action. Filing with Afnic does not bar you from pursuing court proceedings in France; the two tracks can operate concurrently. If the arbitral outcome is unfavorable or inadequate, the court route remains available.

The trap at the filing stage: assuming that default by the respondent guarantees a favorable outcome. A defaulting respondent at Afnic does not automatically lose. The decision-maker still evaluates the complaint on its merits. A thin complaint with weak evidence can fail even when the other side says nothing. File as if the other side will contest every point.

When Does a Court Action Beat the Afnic Route?

The right route depends on your specific circumstances, and a clear decision framework is worth mapping before you commit. Consider these situations and the path each points to.

If the unauthorized transfer is recent, the evidence of compromise is clean, and the new registrant has not yet sold the domain onward, SYRELI is usually the faster path to a transfer order, at Afnic's published fee. It is the standard entry point for straightforward cases. The timeline for an Afnic procedure is an official procedure with published timelines; verify the current schedule with Afnic or counsel.

If the case is factually contested — the attacker claims you authorized the transfer, or disputes your prior rights — PARL EXPERT's fuller adversarial process better accommodates the evidentiary exchange needed to resolve those disputes.

If the domain has been used to commit fraud — generating phishing emails, redirecting invoices, deceiving customers — and you need a court order enforceable against the registrar, a hosting provider, or a bank account connected to the fraud, national court action is the only route that reaches those targets. The Afnic procedures decide domain ownership; they do not issue injunctions against third parties, award damages, or direct payment platform seizures.

If the new registrant is located outside France and beyond the reach of Afnic's enforcement, a French court judgment carries the force of national law and can be used to compel action through international judicial cooperation mechanisms. That is a materially stronger instrument than an Afnic decision in cross-border theft scenarios.

In our experience, the most complex .fr theft cases involve an attacker who acquires the domain, immediately transfers it again to a second-tier holder in a different jurisdiction, and then points it at a parking page while negotiating a ransom. A court action — filed on an emergency basis — with a DENIC-style notation or equivalent registrar-lock mechanism is often the only way to freeze that chain. We handle the overall strategy and coordinate with local litigation counsel in France for the court proceedings.

If a prior approach to the registrar or an Afnic filing has not produced a reversal, or if the domain has already been transferred onward, contact info@cognomenlaw.com before the next step is taken.

Step 5: Manage the Post-Decision Implementation

A favorable Afnic decision — ordering transfer — does not move automatically. The decision must be implemented through the registrar. Afnic notifies the registrar, but in our practice we always send a direct written notice to the gaining registrar immediately after the decision issues, citing the decision, demanding implementation, and requesting written confirmation of the transfer timeline.

The trap: assuming implementation is instantaneous. Registrar implementation typically takes a matter of days, but delays occur — particularly where the gaining registrar is located outside France or has not yet received formal notification. Monitor the RDDS record actively. If the domain has not been transferred within the period the registrar's own policies specify, escalate immediately — first to the registrar's compliance team, then back to Afnic if the registrar is non-compliant with a valid decision.

A court order, once obtained, is enforced through judicial channels. Non-compliance by a registrar with a French court order carries different and often sharper consequences than non-compliance with an Afnic decision. Where you have obtained both an Afnic decision and a parallel court order, lead with the court order in enforcement correspondence.

Once the domain is returned to your control, take the following hardening steps immediately:

• Enable registry-level transfer lock (registrar lock, EPP status code clientTransferProhibited) to prevent any further outbound transfer without explicit registrar action.
• Rotate all credentials, including the authinfo code, and store the new code in a secure offline record.
• Activate DNSSEC if the registrar supports it, to prevent DNS hijacking even if the registration record remains nominally intact.
• Set renewal reminders well in advance of the expiry date — expired domains are the single most common entry point for opportunistic theft.

Cross-Zone Considerations: What If You Also Hold a .com or Other Zone?

The .fr dispute, once resolved, may leave a residual problem in other zones. An attacker who successfully hijacked your .fr may also have targeted — or may next target — your .com, .eu, or other national-code registrations under the same brand. Those are separate zones with separate procedures: the UDRP applies to .com and most gTLDs, the EURid ADR procedure governs .eu, and so on.

If the same attacker controls both your .fr and your .com, you can pursue the .fr recovery through Afnic while simultaneously filing a UDRP complaint for the .com before WIPO or the Forum. The UDRP filing fee at WIPO starts at USD 1,500 for a single-member panel covering one to five domains, and a standard case is normally completed within about two months. The two proceedings are independent; neither binds the other's decision-maker, and WIPO panels do not defer to Afnic outcomes.

In a recent matter — a multi-zone credential compromise affecting a .fr and a corresponding .com, spring 2025 — we ran parallel tracks at Afnic and WIPO, coordinating the evidence packages so each filing was consistent and mutually reinforcing. The .com transfer was ordered first; the .fr reversal followed within weeks of the Afnic filing, with the WIPO decision used as supplementary evidence of the pattern of bad-faith conduct.

Where the brand spans further European zones — .de, .eu, .nl — each requires its own procedure. The .de zone has no arbitration procedure for transfer disputes; that route runs through the German courts, with a DENIC dispute entry to block onward transfer during litigation. The .eu procedure runs through ADR.eu, the Czech Arbitration Court's platform, with its own eligibility and rights requirements. We assess each zone in the same engagement to give you a consolidated strategy rather than piecemeal filings.

For further detail on recovering a hijacked domain across multiple zones and the court routes that apply, see our analysis of hijacked domain recovery and our court recovery service page.

Related at COGNOMEN

• Court action and domain theft recovery – when arbitration cannot reach the problem
• Recovering a hijacked domain: multi-zone strategy and evidence framework
• Proving bad faith in a UDRP complaint – evidence and forum selection