How to escalate a registrar lock to secure a .br domain

How to escalate a registrar lock to secure a .br domain. UDRP and ccTLD domain recovery and defense across .br. Email the firm to assess your case.

A .br domain disappears from your account overnight. The WHOIS record now shows a stranger's contact, the nameservers are redirecting your customers, and the registrar's standard support queue has not moved in three days. You need the domain locked – now – before the registration window closes or a further transfer buries the trail.

To escalate a registrar lock to secure a .br domain, you must engage Registro.br directly with documented proof of the unauthorized transfer or account compromise, invoke the applicable dispute mechanism under Brazil's SACI-Adm procedure, and – where the administrative route proves insufficient – pursue emergency relief through the Brazilian courts with local litigation counsel. The escalation sequence, the evidence required, and the realistic timeline each depend on whether the compromise is still live or whether a completed transfer must be reversed.

This page covers the .br governance structure, the registrar-lock mechanics specific to Registro.br, when a court route is necessary, and the evidence that decides whether you recover the domain.

What governs .br domains and why the recovery path differs from .com

Registro.br, operated by NIC.br, is the sole registry for the .br country-code zone and sets the rules that every .br registrar must follow. The UDRP does not apply to .br. Brazil operates SACI-Adm – its own administrative dispute procedure – which handles disputes about the registration itself, broadly analogous to a UDRP complaint in structure but administered under Brazilian rules and conducted primarily in Portuguese. That distinction matters immediately: a brand owner accustomed to filing UDRP complaints before WIPO cannot simply copy that process into a .br recovery.

SACI-Adm allows a complainant to challenge a .br registration where the disputed name conflicts with a trademark or other protected right recognized under Brazilian law. The governing national trademark act governs eligibility, not any ICANN policy. Where the dispute arises from account compromise or unauthorized transfer rather than from a competing registration claim, however, SACI-Adm is often not the right first tool. A pure theft scenario – one where a legitimate registrant's credentials were compromised – calls for the registrar-lock escalation path first, before any formal dispute procedure is triggered.

We regularly advise registrants and brand owners whose .br domains have been taken without consent. The critical early decision is whether you are dealing with a registration dispute (someone else registered a name conflicting with your trademark) or a theft/hijacking event (your existing registration was removed from your control). Each path has a different first move.

For an assessment of your .br domain dispute, contact info@cognomenlaw.com.

How does the registrar-lock mechanism work at Registro.br?

Registro.br maintains a registration-lock function that prevents unauthorized transfers when a compromise is reported promptly. A registrar lock at Registro.br freezes the domain's nameservers, contacts, and transfer-authorization codes in place, giving you time to document the breach and pursue the appropriate next step. The lock does not itself reverse a completed transfer – it only prevents a further one.

The escalation sequence works as follows. First, submit a formal incident report to Registro.br with a timestamp-verifiable record of the unauthorized change – login logs, email headers showing the credential-reset notification, and any communications from whoever now controls the domain. Registro.br's published process allows a registrant to flag account-security incidents and request a temporary hold. Second, if standard support does not impose the lock within a matter of hours, escalate to Registro.br's abuse and security team. Third, if Registro.br confirms the lock but the domain contact already reflects the unauthorized party, the next step shifts to evidence preservation and formal procedure.

Timing is the deciding variable. A registrar lock requested within the first 24 to 48 hours of a compromise – before nameservers are changed or a downstream transfer is attempted – gives the best chance of freezing the domain in a recoverable state. Every hour of delay narrows that window. We have seen cases where a lock was obtained within hours but the nameserver change had already propagated, meaning the lock secured the registration while traffic-layer damage continued – underscoring why network-level mitigation must run in parallel.

When does a court route beat the administrative procedure for .br recovery?

SACI-Adm handles registration disputes, not theft of an existing account. If your .br domain was hijacked – credentials compromised, registration transferred to a third party without your knowledge – the Brazilian courts, not SACI-Adm, are the forum that can order Registro.br to reverse a completed transfer and restore the original holder's control. Local litigation counsel in the relevant jurisdiction handles that proceeding. COGNOMEN coordinates the overall recovery strategy and prepares the documentation that Brazilian counsel presents to the court.

The court route is typically necessary when one or more of the following conditions apply: the transfer has already completed and Registro.br's voluntary lock mechanism is exhausted; the unauthorized party is actively defending the position; or the domain is being used in a phishing or fraud scheme where emergency injunctive relief is needed to protect third parties immediately. Brazilian procedural law provides for urgent interim measures – the local equivalent of injunctive relief – that can compel a domain freeze while the merits are heard. That interim step, not the final judgment, is often the decisive move.

The decision between SACI-Adm and the court route is not always binary. A brand owner can hold the administrative path in reserve for a parallel trademark-based challenge while pursuing emergency court relief on the theft grounds. The two routes address different legal bases and different remedies. Getting the sequencing wrong wastes time and can prejudice the evidentiary record. In a recent matter – a .br domain theft, spring 2025 – we coordinated the initial registrar-lock escalation with local Brazilian counsel's emergency application, securing an interim transfer freeze within days of the reported compromise.

To weigh the SACI-Adm route against a court action for your .br case, email info@cognomenlaw.com.

What evidence decides whether you recover the domain?

The strength of a .br domain-theft recovery rests almost entirely on the quality of the documentation you can produce, and the speed with which you can produce it. Panels and courts alike apply a factual standard: who actually controlled the domain before the disputed event, and is there clear and consistent evidence that the change was unauthorized?

The evidence categories that matter most are the following. First, proof of original registration: the original registration confirmation email, historic WHOIS / RDDS records, DNS hosting invoices, and any domain-renewal receipts that establish you as the continuous holder. Second, proof of compromise: server access logs or authentication logs showing login from an unrecognized IP address or device; emails from Registro.br or the registrar notifying you of a contact-detail or password-reset change that you did not initiate; and any communications from the unauthorized party attempting to sell the domain back or demanding payment. Third, continuity evidence: website screenshots, SSL certificate records, and email traffic through addresses at the domain that predate the compromise – these establish that the domain was in active legitimate use, which distinguishes a genuine theft from an administrative dispute.

One common evidentiary gap is the failure to preserve the post-compromise WHOIS record immediately. Once Registro.br's lock is in place, the changed contact details reflect the unauthorized registrant's information. That record must be captured and notarized promptly. Courts and arbitrators have consistently noted that a registrant who waited weeks to document the change faced a harder burden, particularly where the unauthorized party had begun making infrastructure changes to the domain.

We advise clients to build what we call a contemporaneous evidence file: a timestamped, sequentially organized dossier of every notification, log, screenshot, and communication relating to the incident from the moment it is discovered. That file is the foundation of both the registrar escalation and any subsequent court or administrative filing.

How do the SACI-Adm procedure and a court action compare on cost and timeline?

SACI-Adm is administered under Registro.br's published rules and carries its own fee structure – verify the current published fees directly with Registro.br, as they are denominated in Brazilian reais and subject to change. The administrative process is generally faster and lower in cost than court litigation for a pure registration dispute where a trademark holder is challenging a conflicting .br registration. A straightforward SACI-Adm complaint, assuming no procedural complications and a timely response from the registrant, is typically resolved in a matter of weeks to a few months under the published schedule.

A court action is materially more expensive. Brazilian court proceedings involve attorney fees, filing costs, and potential appeal stages that a single SACI-Adm complaint does not carry. The trade-off is remedial breadth: a court can order transfer reversal, damages, and interim relief on a theft theory, whereas SACI-Adm's remedy is limited to a ruling on the registration dispute itself. Where the goal is pure recovery of a hijacked domain and the evidence of theft is strong, the court's emergency interim-measure pathway – though costlier at the outset – may produce a domain freeze faster than waiting for a full SACI-Adm decision cycle.

For a brand owner dealing with a straightforward conflicting registration by a cybersquatter (rather than a theft), SACI-Adm is generally the more proportionate first route. For a verified account compromise with a completed unauthorized transfer, the court route, handled with local litigation counsel, is almost always necessary at some stage. The realistic cost of each path should be evaluated against the commercial value of the domain and the urgency of stopping any ongoing harm from the unauthorized use.

What happens after the lock is secured – how is control actually restored?

Securing a registrar lock stops further damage but does not, by itself, put the domain back in your account. Restoration of operational control follows a separate track that depends on the outcome of the legal or administrative process. If Registro.br accepts your compromise report and confirms the change was unauthorized, it may restore the original registrant contact administratively. That is the fastest outcome and requires the strongest contemporaneous evidence.

Where the unauthorized party contests the position or where Registro.br declines to act without a formal order, you will need either a SACI-Adm decision or a court order directing the transfer back to the original holder. Once that order exists, Registro.br's compliance process takes effect and the domain is re-pointed to the correct holder's account. Nameserver restoration and SSL certificate reissuance follow at the DNS level – these are operational steps that run after legal recovery but must be planned in advance to minimize downtime.

One practical point: if the domain was used for email, the email records (MX records and any hosted mailboxes) should be treated as a separate recovery workstream. In cases of account compromise, attackers frequently use the domain's email infrastructure to pivot into other accounts – banking, cloud services, trademark filings. Documenting and securing those secondary systems in parallel with the domain recovery is a step practitioners and clients frequently overlook.

Does COGNOMEN handle .br domain recovery directly?

COGNOMEN manages the strategy, documentation, and procedural coordination for .br domain recovery. For the SACI-Adm administrative pathway, we prepare the complaint, organize the evidence dossier, and handle procedural communications in the matter. For the court route – emergency applications, injunctions, and transfer-reversal proceedings – we work with local litigation counsel in Brazil who carry the matter before the relevant court. COGNOMEN's role is to ensure that the legal strategy is sound, the evidence is organized to the standard both forums require, and that the registrar-escalation track and the legal track run in a coordinated sequence rather than at cross-purposes.

What does that engagement look like in practice? At the outset, we assess the three key questions: Is the transfer reversible under current Registro.br rules? Does the evidence of compromise meet the threshold for an emergency application? And is the domain's commercial value proportionate to court proceedings if SACI-Adm proves insufficient? Those answers shape the specific path we recommend.

We also handle .br domains within a broader portfolio context. A brand owner who operates across .com, .br, and other ccTLDs may face simultaneous disputes in multiple zones. Coordinating a UDRP filing before WIPO for the .com element while escalating a registrar lock at Registro.br for the .br element, and running both alongside a potential court application, requires a single coordinating counsel who understands all three forums. That cross-zone coordination is a practical differentiator in cases where the squatter or attacker has targeted multiple registrations simultaneously.

In a recent matter – a cross-zone brand attack targeting both a .com and a .br registration, autumn 2024 – we managed the UDRP filing before WIPO for the gTLD element while briefing local Brazilian counsel on the concurrent .br recovery application. Both proceedings resolved within the same quarter. The outcome on each domain turned on its own evidentiary record, but the coordinated timeline prevented the respondent from using delay in one forum to frustrate resolution in the other.

COGNOMEN publishes transparent price ranges for domain-dispute services, including .br recovery. Contact info@cognomenlaw.com for a written assessment of your specific matter.

Cross-zone considerations: .br alongside .com and other zones

The right route depends on the zone and the goal. If the contested domain is a .com and the goal is transfer, a UDRP complaint before WIPO – with a USD 1,500 filing fee for a single-member panel on one domain – is usually the fastest administrative path, resolved in roughly two months. If it is a .br, SACI-Adm handles a registration dispute, but a court application is necessary for theft or transfer reversal. If the attacker holds both, parallel proceedings are required: the UDRP for the .com and the court or SACI-Adm track for the .br, each governed by its own rules.

New gTLD domains (under extensions administered by ICANN-accredited registries) can use the URS – Uniform Rapid Suspension – for a faster, lower-cost suspension remedy. URS does not transfer ownership; it suspends the domain. That tool is irrelevant to .br, which sits outside the UDRP/URS universe entirely.

Where a .br domain is held by a party who also holds typosquat variants under .com or other gTLDs, a coordinated filing strategy can address the full pattern of abuse rather than leaving a foothold in one zone while recovering another. Panels deciding the gTLD complaint may note the broader pattern; the .br proceeding turns on Brazilian rules regardless, but presenting a coherent narrative across both tracks strengthens each.

For brand owners with .de registrations in parallel, note that .de disputes also sit outside the UDRP – the DENIC DISPUTE entry mechanism blocks transfer while German court proceedings run, a structure broadly analogous to the Brazilian approach of combining a registry block with court-ordered relief. If your brand exposure spans .br and .de simultaneously, the procedural logic in both jurisdictions favors early court engagement rather than waiting for administrative paths that do not reach the transfer-reversal remedy.

Related at COGNOMEN

• Court action and domain theft recovery – full service overview across zones
• Reversing an unauthorized domain transfer – process and strategy
• Analysis: recovering a domain used in a phishing scheme (.tv and beyond)