How to escalate a registrar lock to secure a .cn domain

How to escalate a registrar lock to secure a .cn domain. UDRP and ccTLD domain recovery and defense across .cn. Email the firm to assess your case.

A .cn domain that was registered to your business or acquired through years of brand-building disappears overnight. The registrant record in RDDS changes to an unknown entity. The domain resolves to a site you did not authorize. Every day without a lock in place is a day the domain can be transferred further, obscured behind privacy, or liquidated to a third party who takes it beyond reach.

To escalate a registrar lock and secure a .cn domain after unauthorized transfer or account compromise, the first step is a formal written demand to the registrar to freeze all outbound transfers pending investigation, supported by documented evidence of compromise. The governing dispute mechanism for .cn is the ADNDRC (Asian Domain Name Dispute Resolution Centre), which operates under CNNIC's dispute-resolution policy for .cn. Where arbitration cannot achieve a lock or where the compromise involved criminal conduct, Chinese courts offer an alternative route that can compel the registrar directly. Time is the critical variable: registrar escalation within the first 24 to 48 hours of discovery gives the strongest chance of preventing onward transfer.

This page covers the registrar-lock mechanics, the ADNDRC procedure, the court route, the evidence that decides each, and how to take the next step.

What governs .cn domain disputes and why the rules differ from .com?

The .cn zone is administered by CNNIC (China Internet Network Information Centre), which sets the rules for registration and dispute resolution. Unlike .com, where the UDRP applies universally across all accredited registrars, .cn operates under a distinct national policy. The UDRP does not govern .cn disputes. The applicable procedure is CNNIC's Domain Name Dispute Resolution Policy, and the designated provider for that policy is the ADNDRC.

This distinction matters immediately for anyone accustomed to WIPO or Forum filings. A UDRP complaint filed at WIPO over a .cn domain will be declined on jurisdiction grounds. The complainant must file with the ADNDRC and satisfy the CNNIC policy's elements, which broadly track the UDRP's three-part test but are applied by ADNDRC panelists under Chinese regulatory context. The ADNDRC is one of the four institutions named in APPENDIX A; it handles disputes across several Asian zones, including .cn.

There is a second layer that makes .cn distinct: the registrar landscape. Most .cn domains are held through registrars accredited with CNNIC and operating primarily in mainland China. Reaching those registrars with a freeze demand requires knowing which escalation channel they honor – a generic abuse-form submission is almost never sufficient for a transfer-lock request in a theft scenario. Registrar-level escalation, done correctly and in writing, is the first action and often the one that buys the time needed to pursue the formal procedure.

How does the registrar-lock escalation process work for .cn?

Escalating a registrar lock for a .cn domain is a formal written process directed to the registrar of record, not a self-service toggle. The goal is to place an administrative hold on the domain that prevents any outbound transfer, modification of registrant data, or change of registrar while the dispute is investigated. This is the action to take within the first hours of discovering a compromise.

The escalation process runs in three parallel tracks. First, identify the current registrar of record from the CNNIC WHOIS (now RDDS) data – the registrar may have changed in the unauthorized transfer, so query current data, not cached records. Second, send a formal written demand to the registrar's abuse or legal contact, in both English and Chinese where possible, citing the account compromise, identifying the domain by full name, and requesting an immediate transfer lock pending investigation. Third, gather and preserve the evidence of compromise at the same time – do not wait for the registrar to respond before building the evidence record.

What happens after the lock demand? A cooperating registrar will place a clientTransferProhibited status on the domain within hours or days. A non-cooperating registrar – or one that has already processed the outbound transfer – requires escalation to CNNIC directly, or a move to the ADNDRC or court route. In our practice, we have seen registrars respond constructively to a well-documented, formally structured demand where a bare-form abuse report produced no result. The quality and formality of the submission changes the outcome at this stage.

If your .cn domain has been moved without authorization and you need a transfer lock placed today, contact info@cognomenlaw.com. We assess the registrar of record, the evidence of compromise, and the fastest route to a hold.

What evidence decides whether the registrar lock is granted and maintained?

Evidence of account compromise is the load-bearing element of every registrar-lock escalation. A registrar will only maintain a freeze – and the ADNDRC or a court will only act – if the record clearly supports that the transfer was unauthorized. The evidence needed falls into three categories.

Ownership evidence establishes that the complainant was the legitimate registrant before the compromise. This means historical WHOIS or RDDS records showing the claimant's name, business registration documents, registration confirmation emails from when the domain was first acquired, and any trademark registrations that correspond to the domain name. For brand owners, a Chinese trademark registration in the relevant class is particularly useful because it anchors both the ownership claim and any subsequent ADNDRC or court filing.

Compromise evidence documents how the unauthorized transfer occurred. Login logs or session records showing anomalous access from an unrecognized IP address, email notifications of a change-of-registrant request that the legitimate registrant did not initiate, and correspondence with the registrar before and after the transfer all belong in this record. Where the compromise involved phishing or credential theft, forensic records of the attack – even a preserved phishing email – materially strengthen the file.

Timeline evidence demonstrates that the legitimate registrant acted promptly. A registrar or panel evaluating a lock request is more sympathetic to a claimant who discovered the compromise on a Monday and escalated formally by Wednesday than to one who waited weeks before raising the issue. Promptness is both substantive evidence of bona fide ownership and a practical argument against any acquiescence defense.

In a matter we handled involving a .cn e-commerce domain (spring 2025), the registrar initially rejected a bare abuse-form submission. When we re-approached with a formal legal letter, a timestamped evidence package, and a direct reference to CNNIC's dispute rules, the registrar placed a clientTransferProhibited hold within approximately 72 hours. The speed turned on the formality and completeness of the submission, not on a change in the underlying facts.

How does the ADNDRC procedure apply to a stolen or hijacked .cn domain?

The ADNDRC is the dispute-resolution provider designated by CNNIC for .cn. Where a registrar lock has been placed – or where escalation alone has not been sufficient – filing an ADNDRC dispute is the formal arbitration route to reverse the transfer and recover the domain. The ADNDRC procedure broadly tracks the UDRP's structure: the complainant files a complaint, the respondent has a defined period to respond, a panel is appointed, and a decision issues. The substantive test under CNNIC's policy requires the complainant to show rights in a name or mark and that the registrant's use is in bad faith or without a legitimate right.

There is an important procedural distinction from the UDRP: the ADNDRC operates under Chinese-language procedural norms, and filings are typically conducted in Chinese. An English-language complaint may be accepted in some circumstances, but a complaint drafted with Chinese-language support and familiarity with ADNDRC practice carries a procedural advantage. Filing deadlines, evidence requirements, and panel selection operate under the ADNDRC's own rules, which differ from the WIPO Supplemental Rules you may know from gTLD filings.

The remedy available in an ADNDRC .cn proceeding can include transfer of the domain back to the legitimate registrant. It can also include cancellation. The ADNDRC cannot award monetary damages. Where the theft involved a criminal element – identity fraud, unauthorized computer access, or extortion – the ADNDRC's civil-arbitration remedy may be insufficient on its own, and the court route becomes relevant.

What if the current registrant of record cannot be identified or has no presence in China? Default cases – where the respondent does not answer the complaint – are common in domain-theft scenarios. ADNDRC panels can and do proceed to a decision on the complaint alone, and transfer orders are issued in default cases where the evidence is clear. A well-constructed complaint, with the ownership and compromise evidence organized as described above, is the foundation of a successful default proceeding.

For a read on whether your .cn evidence meets the ADNDRC threshold for a transfer order, email us at info@cognomenlaw.com before the trail goes cold.

When does a Chinese court route outperform arbitration for a .cn domain?

The court route is not a fallback for failed arbitration. There are specific situations where Chinese court proceedings are the better first or parallel action, and choosing the wrong track wastes weeks you cannot recover.

A court action is preferable – or necessary – in four situations. Where the compromise involved a criminal act (unauthorized access, phishing, identity fraud), a criminal complaint or civil claim in the relevant Chinese court can compel the registrar to freeze and reverse a transfer under authority that the ADNDRC lacks. Where the registrar is non-responsive to a lock demand and CNNIC escalation has not produced a hold, a court interim injunction can force the registrar's hand on an urgent basis. Where the domain was transferred to a third-party purchaser who claims good-faith acquisition and is not the original bad actor, the ADNDRC may struggle with standing and fact-finding that a court handles more effectively. And where substantial monetary damages are at stake in addition to domain recovery, only a court can reach the money.

The tradeoff is cost and timeline. Court proceedings in China, handled with local litigation counsel in the relevant jurisdiction, take longer than an ADNDRC proceeding and carry higher fees. The ADNDRC operates on a defined schedule measured in weeks; Chinese court proceedings for domain-related matters are typically measured in months. But where the facts require court-level compulsion – particularly an interim freeze order – starting in court may be faster than waiting for ADNDRC to issue a decision and then separately seeking enforcement.

In a separate matter (a .cn corporate brand domain, summer 2024), the registrar had already processed an outbound transfer before our client discovered the compromise. The ADNDRC route was still available, but an urgent application for interim measures in the relevant Chinese court, coordinated with local litigation counsel, achieved a provisional freeze on the receiving registrar within a period that arbitration alone could not have matched. We managed the international coordination; local counsel handled the court filings. The domain was ultimately recovered through a combination of both routes.

How does recovering a .cn domain compare with recovering a .com or other ccTLD?

The right route depends heavily on the zone and the registry's dispute architecture. The differences are material and affect cost, timeline, and the available remedy.

For a .com domain, the UDRP applies universally. A complainant files at WIPO, the Forum, the CAC, or the ADNDRC – the four authorized providers – and the rules are identical regardless of where the registrar is located. The WIPO filing fee starts at USD 1,500 for a single-member panel, and a standard case completes in roughly 45 to 60 days. The registrar is ICANN-accredited and bound to implement transfer orders. The infrastructure is mature and familiar.

For a .cn domain, there is no UDRP. The CNNIC policy and the ADNDRC govern, and the registrar may be a mainland Chinese entity with no direct ICANN accreditation obligation. Registrar-level escalation requires a different approach. The substantive test is similar to the UDRP's but applied in a distinct regulatory context, and proceedings are typically conducted in Chinese. If the domain theft has a criminal dimension, the court route interacts with the Chinese legal system rather than with a neutral arbitral body.

For a .uk domain, the Nominet DRS applies. Nominet offers a free mediation stage before any expert decision. The DRS test is an "abusive registration" standard, and crucially it reads "registered or used" abusively – a lower bar than the UDRP's cumulative "registered and used in bad faith." Published expert-decision fees are GBP 750 + VAT for a full decision. A reasoned .uk case typically runs about 8 to 12 weeks.

For a .de domain, neither the UDRP nor a CNNIC-style procedure applies. Disputes proceed through the German courts. DENIC offers a DISPUTE entry that blocks further transfer while litigation proceeds, but DENIC does not itself adjudicate ownership. Court proceedings with local litigation counsel in Germany are the primary route.

The practical implication: a brand that holds registrations across .com, .cn, .uk, and .de that are all compromised simultaneously faces four different procedures with different evidence standards, different timelines, and different cost profiles. Managing those in parallel, without letting any zone's deadline lapse, requires coordinated handling from the outset.

What does escalating a .cn registrar lock cost, and what is realistic to expect?

Cost in a .cn domain-theft matter breaks into two components: the formal procedure fees and the legal fees for assembling the evidence, preparing the escalation, and managing the filing.

ADNDRC filing fees for .cn disputes are set by the ADNDRC and are generally in a range comparable to a CAC filing – the ADNDRC is among the lower-cost providers of the four ICANN-designated institutions. The ADNDRC begins at approximately USD 1,300 for a single-member panel for one to two domains. Verify the current published schedule with ADNDRC directly, as fee schedules are subject to revision. For a registrar-lock escalation that resolves at the registrar level – without a formal ADNDRC filing – there is no forum fee, though the legal work of preparing the demand and the evidence package still applies.

Legal fees for a .cn domain-theft matter are fact-dependent. A straightforward registrar escalation with a clear evidence record is materially less involved than a full ADNDRC proceeding with a disputed respondent. A contested ADNDRC proceeding with Chinese-language filings and coordinated court interim measures is at the higher end. Market rates for UDRP and ccTLD work of this complexity typically run in the USD 3,000 to 7,000 range for a single-domain matter, exclusive of forum fees and, where applicable, local court-counsel costs.

What is realistic to expect? A registrar-lock placed within the first 24 to 48 hours of escalation – assuming the registrar is cooperative and the evidence is clear – can prevent the domain from moving further while the formal procedure is prepared. Where the domain has already transferred to a third party, recovery through an ADNDRC proceeding adds weeks. Where a court route is needed, add months and the cost of local litigation counsel. No procedure guarantees transfer or recovery; outcomes depend on the specific facts, the quality of the evidence, and the discretion of the panel or court.

Related at COGNOMEN

• Court action and domain theft recovery – the full service overview for stolen and hijacked domains
• Step-by-step guide to recovering a stolen .cn domain through ADNDRC and Chinese courts
• .cn transfer remedy – ccTLD dispute options and CNNIC policy for Chinese-zone registrations