How to reverse an unauthorized transfer of a .br domain
How to reverse an unauthorized transfer of a .br domain. UDRP and ccTLD domain recovery and defense across .br. Email the firm to assess your case.
Your .br domain disappears from your account overnight. The registrar's RDDS shows a new holder. Someone has moved the name without your authorization – through a compromised credential, a forged transfer request, or a social-engineering attack on the registrar's support queue. The next step is not obvious, and every day the domain stays in hostile hands makes recovery harder.
To reverse an unauthorized transfer of a .br domain, the registrant typically must act through Registro.br – the registry operated by NIC.br under the governance of the Brazilian Internet Steering Committee (CGI.br) – by filing a formal dispute under the SACI-Adm procedure, Brazil's administrative domain-dispute system, or by pursuing relief in the Brazilian courts where administrative remedies are unavailable or too slow. The critical factor is speed: the window to freeze a transferred domain before it is resold or modified is short, and documentary evidence of the compromise must be assembled immediately. No single outcome can be guaranteed; recovery depends on the specific facts, the quality of the evidence, and the conduct of the new registrant.
This page covers the SACI-Adm procedure, the registrar-lock mechanics, when a court action is necessary, the evidence that decides the outcome, costs, and the practical next step.
What governs .br domains and who handles disputes?
The .br ccTLD is administered exclusively by Registro.br, the registration authority run by NIC.br. No UDRP applies to .br. WIPO and the Forum have no jurisdiction over .br names. Brazil maintains its own administrative dispute procedure – SACI-Adm (Serviço Administrativo de Solução de Conflitos) – and its own legal framework, under which Brazilian courts retain ultimate jurisdiction over ownership and rights questions involving .br domains.
That jurisdictional fact matters enormously for any brand owner or registrant approaching a .br problem from outside Brazil. The toolbox that works for .com – a WIPO UDRP complaint filed from anywhere in the world – has no equivalent here. The relevant process is Brazilian-law governed, Portuguese-language administered, and resolved either through SACI-Adm or through the state and federal courts of Brazil, depending on the nature of the claim.
SACI-Adm was designed to handle disputes between competing claimants to a .br name, including cases involving unauthorized or abusive transfers. It provides an administrative path that does not require full litigation. Where the dispute turns on a clear compromised-account scenario – forged documents, hijacked credentials, an unauthorized registrant change – SACI-Adm can provide a structured forum. Where legal title, injunctive relief, or damages are in play, the Brazilian courts are the appropriate venue.
How does an unauthorized .br transfer actually happen, and what evidence should you preserve?
An unauthorized transfer of a .br domain typically proceeds through one of three channels: compromise of the registrant's Registro.br login credentials; social engineering of the registrar's or registry's support staff through falsified identity or authorization documents; or, less commonly, an insider breach at a hosting provider or domain management service. Each pathway leaves a distinct evidence trail, and the first task of recovery counsel is to identify which pathway was used – because the evidence needed to support reversal differs accordingly.
If credentials were compromised, the evidence you need includes: server logs showing the IP addresses of the unauthorized sessions; authentication records from the email account used as the recovery address; timestamps of the transfer request and any password-reset activity; and any phishing emails or malicious communications that preceded the compromise. If the transfer was effected through falsified documents submitted to support staff, you need to preserve the original registration records showing your identity, any communications in which the forged submission was made, and Registro.br's own records of the transfer process.
What you must do within hours, not days: contact Registro.br's registrar support to flag the unauthorized transfer and request a temporary hold or dispute flag on the domain. Registro.br's abuse-reporting mechanism does not automatically freeze a domain, but a prompt, well-documented escalation can trigger a voluntary hold that preserves the status quo while a formal proceeding is prepared. At the same time, preserve all email, system, and server logs before any of them rotate out of retention windows. We have seen cases where a delay of even 72 hours allowed a transferred .br name to be resold to a third party whose good-faith status complicated recovery substantially.
To assess whether your .br compromise evidence is sufficient to support a SACI-Adm filing or a court application, contact info@cognomenlaw.com.
How does the SACI-Adm procedure work for an unauthorized transfer?
SACI-Adm is an administrative dispute procedure specifically designed for the .br zone. It provides a forum-based route to resolution without the cost and delay of full litigation, and it can result in an order directing Registro.br to transfer or restore a domain to the rightful holder. The procedure is administered in Portuguese and governed by Brazilian rules; representation by counsel familiar with Brazilian domain-law practice is standard.
The claimant submits a formal complaint setting out the basis of the right to the domain (typically, prior registration and continuous use), the unauthorized nature of the transfer (supported by documentary evidence), and the relief sought. The current respondent – the unauthorized holder – is served and has an opportunity to respond. A panel then decides whether the transfer was unauthorized and whether reversal is warranted. Unlike the UDRP's narrow three-element test, SACI-Adm analysis is fact-driven and turns substantially on which party can better prove its identity as the legitimate registrant and the circumstances of the transfer.
The key evidentiary variables in a SACI-Adm unauthorized-transfer case are: (1) proof of original registration – the original registration confirmation, payment records, and historical RDDS data; (2) proof of continued use – hosting invoices, SSL certificates, email routing records, and screenshots of the domain in active operational use before the unauthorized transfer; (3) proof of the compromise – the log and document evidence described above; and (4) absence of legitimate authorization – any evidence negating the claim that the transfer was consensual, such as the fact that no transfer confirmation was received at the authentic registrant email address.
Default by the current holder – where the unauthorized registrant does not respond – does not automatically produce a decision in the claimant's favor, but panels consistently treat non-response as permitting adverse inferences where the claimant's own evidence is credible and documented. The stronger the claimant's original-registration and compromise evidence, the less the outcome turns on the other side's cooperation.
When does a Brazilian court action become necessary?
There are four scenarios in which a Brazilian court action is the right route rather than, or in addition to, SACI-Adm. First, where the domain has been resold to a third party who claims good-faith acquisition: a SACI-Adm panel's ability to cut through an intervening transfer to a bona fide purchaser for value is limited, and only a court can adjudicate competing title claims with binding effect on third parties. Second, where the claimant needs interim relief quickly – a preliminary injunction freezing the domain and preventing further transfers while the main proceeding runs. Brazilian courts can issue such orders on an urgent basis; SACI-Adm cannot. Third, where the claimant also seeks damages for the unauthorized transfer, whether from the hijacker, a negligent provider, or both. SACI-Adm, like the UDRP, has no authority to award monetary compensation. Fourth, where the transfer involved criminal conduct – identity fraud, computer crime – and the claimant wants to pursue a parallel criminal complaint to law enforcement in Brazil, which strengthens the overall record and may produce a faster freeze of the domain through prosecutorial channels.
In our practice, the most effective strategy for a serious .br unauthorized transfer often combines an emergency registrar escalation to Registro.br, a SACI-Adm filing to address the domain directly, and a parallel court application for interim relief where the domain has been moved or where third-party rights are in play. Local litigation counsel in Brazil handles the court proceedings; we coordinate the overall strategy and manage the evidence preparation across tracks.
A word on jurisdiction: Brazilian courts have asserted jurisdiction over .br disputes on the basis that the .br registry operates in Brazil, that Brazilian law governs the registration contract, and that the harm to a Brazilian registrant or a registrant operating in the Brazilian market occurs in Brazil. Foreign brand owners or registrants who hold a .br name as part of an international portfolio are subject to the same framework; Brazilian law governs, and the proceedings will be in Portuguese before a Brazilian tribunal, whether administrative or judicial.
If a court application is needed alongside SACI-Adm, we work with local litigation counsel in Brazil to prepare the combined strategy. Email info@cognomenlaw.com to discuss the parallel-track approach.
What evidence decides an unauthorized .br transfer case?
The single strongest piece of evidence in an unauthorized-transfer case is a contemporaneous digital record showing the registrant's continuous control of the domain up to the moment of the unauthorized act. Panels and courts weight this heavily because it is hard to fabricate retrospectively and is typically corroborated by independent third-party records (hosting providers, SSL issuers, DNS operators).
In terms of hierarchy, the evidence that most consistently drives successful reversals is, in descending order of weight: original registration confirmation and payment records predating the unauthorized transfer by months or years; DNS history showing continuous pointing of the domain to the claimant's servers; operational use records (invoices, hosting contracts, email traffic); access logs showing the unauthorized login or transfer request was made from an IP address inconsistent with the claimant's history; and communications showing the claimant promptly reported the compromise and received no legitimate authorization confirmation.
Evidence that weakens a claim: dormant domains with no operational use history are harder to recover, because the claimant cannot rely on continuity-of-use records; shared hosting environments where multiple parties had credential access; failure to enable two-factor authentication on the Registro.br account, which can be used to suggest the account was poorly secured; and any prior dispute or communication between the claimant and the current holder that could be characterized as an authorization.
In a recent matter (a .br brand domain, early 2025), we coordinated the emergency escalation and SACI-Adm filing for a registrant whose domain had been transferred following a credential-compromise attack on the registrant's email provider. The transfer had occurred approximately ten days before the registrant noticed it. The original registration confirmation, DNS records, and a detailed log of the email compromise – showing that the recovery email address had itself been hijacked 48 hours before the domain transfer – produced a clear evidentiary record. The domain was restored to the registrant through the administrative procedure without needing a court application.
How does .br compare to other Latin American ccTLDs in unauthorized-transfer cases?
The right route depends on the zone and the goal. If the domain is a .com and has been stolen, the UDRP at WIPO or the Forum can address the dispute globally, with a USD 1,500 WIPO filing fee for a single-member panel and a timeline of approximately two months. The UDRP offers no damages, but transfer to the legitimate owner is a recognized remedy where bad faith is shown. For .br, neither WIPO nor the Forum has jurisdiction; SACI-Adm is the administrative path, with Brazilian courts as the backup.
For .mx (Mexico), the .mx registry operates its own dispute procedure; the recovery route is analogous to .br in that no UDRP applies, and a country-specific administrative filing is required. For .ar (Argentina), .cl (Chile), and .co (Colombia), the governing rules differ materially, and counsel must verify the current registry rules before advising on route. The governing national procedure applies in each case, and what works for .br is not necessarily available or sufficient for a neighboring ccTLD.
The cross-zone point matters most for portfolios. If a brand owner holds both a .com and a .br that have both been hijacked in the same attack, two concurrent proceedings are necessary – one UDRP before WIPO or the Forum, and one SACI-Adm (or court) filing for the .br. The evidence assembled for one will largely serve both, but the procedural steps, languages, timelines, and decision-makers are entirely separate.
In a second recent matter (a .br and .com portfolio attack, spring 2025), we handled the WIPO UDRP complaint for the .com in parallel with coordinating the .br SACI-Adm filing through local counsel in Brazil. The .com proceeding produced a transfer decision approximately eight weeks after filing; the .br proceeding ran on a separate administrative track. Both names ultimately returned to the legitimate registrant, but the parallel management was essential – assuming that a WIPO victory would automatically extend to the .br would have left the ccTLD in hostile hands indefinitely.
What are the realistic costs and timeline for a .br unauthorized-transfer reversal?
SACI-Adm published official fees are set by the Brazilian registry and should be verified against current Registro.br pricing at the time of filing; do not rely on figures from a prior year. Legal fees for a straightforward SACI-Adm unauthorized-transfer case, where the evidentiary record is already assembled, are typically in a range comparable to a standard UDRP legal engagement – the market range for UDRP legal work on a single domain runs approximately USD 3,000–7,000, separate from forum fees, and .br administrative proceedings of similar complexity tend to be in a similar band. More complex matters involving court applications, third-party purchasers, or parallel criminal referrals will carry materially higher costs.
Timeline varies significantly. A clean SACI-Adm case – with strong evidence, prompt filing, and a cooperative or defaulting respondent – can resolve in a matter of weeks to a few months. Court applications for interim relief can sometimes be obtained faster on an emergency basis, but full court proceedings in Brazil take longer, as they would in most jurisdictions. The most important timeline variable is not the proceeding itself; it is the time between the unauthorized transfer and the first escalation to Registro.br. Every day of delay reduces the chance of a voluntary hold and increases the risk that the domain will be resold.
We provide transparent, defined fee arrangements for SACI-Adm filings and registrar-escalation work, with clear separation between our legal fee and any applicable official filing fee. Where a court component is required, local litigation counsel in Brazil quotes their fees separately and directly.
What are the limits of the administrative route, and when is court the only option?
SACI-Adm is powerful in the right scenario, but it has real limits. It can order a domain transferred or restored. It cannot award monetary damages, enjoin the respondent from other conduct, or bind third-party registrars or platforms where the hijacker may be monetizing the domain. Where any of those outcomes matter – and they often do in commercial cases – a Brazilian court is the only forum that can reach them.
The RDNH (reverse domain name hijacking) concept familiar from UDRP practice has no direct equivalent in SACI-Adm, but abusive complainants who file without genuine basis can be exposed to cost consequences and adverse findings under Brazilian law. This works in both directions: a registrant who is wrongly accused of an unauthorized transfer has procedural defenses and can challenge the complaint. We act on both sides of .br disputes, and that bilateral experience informs how we assess the strength of any filing before it is made.
What SACI-Adm cannot do: it cannot override a court injunction, it cannot compel disclosure of the hijacker's identity beyond what Registro.br holds, and it cannot reach assets or conduct outside the .br domain itself. Where the full picture of a hijack attack – multiple domains, financial harm, criminal activity – demands a broader remedy, a coordinated multi-forum approach is necessary, and the SACI-Adm filing is one element of a larger strategy rather than the whole answer.
Related at COGNOMEN
Frequently asked questions: reversing an unauthorized .br domain transfer
When should I reverse an unauthorized transfer of a .br domain?
You should act as soon as you discover the unauthorized transfer – ideally within 24 to 48 hours. The first step is an emergency escalation to Registro.br to request a hold or dispute flag on the domain. Simultaneously, preserve all access logs, email records, and registration documents. Delay increases the risk of resale to a third party, which complicates recovery significantly. SACI-Adm or court proceedings can begin once the initial evidence is assembled, but the registrar escalation should not wait for counsel to be fully briefed.
What happens if the other side ignores the case?
If the unauthorized holder does not respond to a SACI-Adm complaint, the panel may proceed to a decision on the record before it. Non-response is treated as permitting adverse inferences where the claimant's evidence is credible and documented. It does not guarantee a transfer order, but panels consistently hold that a well-evidenced claim by the original registrant, met with silence by the current holder, supports reversal. In Brazilian court proceedings, default by a respondent triggers its own procedural consequences under Brazilian civil procedure, which local litigation counsel in Brazil will advise on specifically.
How is SACI-Adm different from a national court for .br?
SACI-Adm is an administrative procedure specific to the .br zone; it can order transfer or restoration of a domain but cannot award damages, issue injunctions, or bind third parties outside the registry system. A Brazilian court can do all of those things and is the necessary venue when the domain has been resold, when interim relief is needed urgently, or when the claimant seeks monetary compensation. SACI-Adm is typically faster and less costly for a straightforward unauthorized-transfer claim; court proceedings are slower and more expensive but reach further. Many serious cases require both tracks running simultaneously.
About COGNOMEN
COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach – including coordination with local litigation counsel in Brazil, Mexico, and other jurisdictions for ccTLD proceedings that require in-country representation. We act for brand owners, domain investors, and registrants, including respondent-side defense and reverse domain name hijacking cases. Our practice covers unauthorized-transfer reversals in the .br zone, parallel multi-zone recovery strategies, and the full range of domain theft escalations from registrar lock to court application. To discuss a .br domain transfer or any domain dispute, contact info@cognomenlaw.com.
Disclaimer: This article is general information about domain-name dispute procedures and does not constitute legal advice. Outcomes depend on the specific facts, the zone, and panel or court discretion. For advice on your domain, contact info@cognomenlaw.com.
Speak with Cognomen Law
For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter
Related
This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.