How to reverse an unauthorized transfer of a .cn domain

How to reverse an unauthorized transfer of a .cn domain. UDRP and ccTLD domain recovery and defense across .cn. Email the firm to assess your case.

Your .cn domain vanished overnight. The registrar's RDDS shows a new registrant. Someone – a credential thief, a rogue reseller, or an insider – moved the name without your authorization, and every email address, customer portal, and payment gateway tied to it is now under a stranger's control. The question is not whether you have a claim. The question is how fast you can act.

To reverse an unauthorized transfer of a .cn domain you have two principal routes: an emergency registrar escalation to freeze the domain in its new position, followed by a dispute filing with CNNIC's designated provider (ADNDRC handles .cn administrative dispute proceedings) or, where arbitration cannot reach, an action before the Chinese courts. Speed is critical. Evidence of the account compromise – access logs, correspondence, authentication records – must be assembled before the registrant's trail goes cold.

This page covers the mechanics of each route, what evidence decides the outcome, when to use arbitration versus court, what the process costs, and how COGNOMEN structures this work for clients with a .cn at risk.

What makes a .cn transfer "unauthorized" and why the distinction matters

An unauthorized transfer is one that was not initiated by the legitimate registrant-of-record, or was induced by fraudulent misrepresentation – account compromise, phishing the registrar's authentication system, social engineering a reseller, or exploiting a security gap at the registrar level. The distinction between an unauthorized transfer and a disputed registration matters acutely in China's domain space because the available remedy and the standard of proof diverge sharply depending on which category applies.

A disputed registration – where someone registered a name in bad faith to trade on your trademark – is addressed through a standard CNNIC administrative dispute procedure, applying an abusive-registration test broadly analogous to the UDRP. An unauthorized transfer, by contrast, is closer in character to a property theft: the original registrant's account was compromised, forged authorization was submitted, or the registrar was deceived. The legal basis for reversal is the invalidity of the transfer itself, not the newcomer's bad faith in registering a confusingly similar name.

That distinction is not merely academic. It shapes the evidence you need to gather, the forum you approach first, the timeline you face, and – critically – whether you can obtain an interim freeze before the domain is transferred a second time to a good-faith purchaser, which would complicate recovery significantly.

How does CNNIC and the ADNDRC procedure work for .cn domains?

CNNIC (China Internet Network Information Center) is the registry authority for .cn and manages the policy framework under which .cn registrations and disputes are handled. For administrative dispute resolution, CNNIC has designated the Asian Domain Name Dispute Resolution Centre (ADNDRC) as a provider. The ADNDRC applies the China Internet Domain Name Dispute Resolution Policy (the .cn Policy) to cases where a complainant asserts that a registration is abusive.

The .cn Policy tracks the UDRP's three-element structure closely. A complainant must show: (1) the domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain was registered or is being used in bad faith. Note the disjunctive in element three – the .cn Policy reads "registered or used" in bad faith, which is a lower threshold than the UDRP's cumulative "registered and used" requirement. That difference benefits complainants pursuing names that were originally registered in good faith but are now being used abusively.

For a pure unauthorized-transfer situation, however, the .cn Policy's abusive-registration framework is not the natural fit. The question is not whether the current registrant registered the name in bad faith – they may not have registered it at all; it was pushed into their account. In those cases, the dispute is characterized as a transfer-invalidity claim, and the evidentiary basis shifts from bad-faith indicators to proof of the unauthorized act itself.

We regularly advise registrants who discover that CNNIC's administrative procedure is a useful first lever for some transfer scenarios but an imperfect tool for others. Knowing which category your case falls into before you file – rather than after an adverse panel decision – is the threshold judgment that determines strategy.

For a first read on whether your .cn recovery is an administrative dispute, a registrar-escalation matter, or a court case, contact info@cognomenlaw.com.

What are the registrar-lock and transfer-reversal mechanics for .cn?

The first action after discovering an unauthorized transfer is not to file a complaint. It is to contact both the losing registrar (the one that held your account before the transfer) and the gaining registrar (the one that accepted it) and demand an immediate hold. Under ICANN's Transfer Policy framework – which applies to gTLDs directly, and shapes many registrars' conduct even for ccTLD transfers – an unauthorized transfer triggers a right to reversal if reported promptly. CNNIC's own registrar-management rules impose duties on accredited .cn registrars that a competent registrar will take seriously when formally notified.

The practical steps run in this sequence. First, document the last known legitimate state of your account: screenshot the RDDS at that point, preserve email records of the domain's association with your business, and retrieve any authentication logs your registrar can provide showing the transfer was initiated from an IP or device you did not control. Second, send a formal written notice to both registrars – via email and registered mail where possible – specifying the unauthorized nature of the transfer and demanding a registrar lock on the domain pending resolution. Third, file a complaint with CNNIC directly, referencing the specific transfer event and requesting an interim suspension of any further transfers while the matter is under review.

Speed matters here in a way that is difficult to overstate. A .cn domain transferred to a registrant who then sells it to a good-faith purchaser for value creates a chain-of-title complication that significantly raises the cost and uncertainty of recovery. Getting a lock in place within 24 to 48 hours of discovery is the difference between a clean reversal and extended litigation. In our practice, the cases where the interim freeze is obtained quickly resolve far more cleanly than those where days pass before formal notice is given.

When does a Chinese court action beat the ADNDRC arbitration route?

The administrative procedure has real advantages: it is relatively fast, it is cheaper than court, and it produces a decision that CNNIC will implement by directing the registrar. But there are fact patterns where court is the better – or only – route.

Court becomes the dominant option when: (a) the transfer was effected through identity fraud, forgery of authorization documents, or credential theft, and you need discovery powers to trace what happened and who did it; (b) you want damages alongside domain recovery, since the ADNDRC procedure offers only transfer or cancellation, not monetary relief; (c) the registrant has transferred the domain a second time to a third party who claims good faith, creating a title dispute the administrative panel lacks authority to resolve; or (d) the registrar refuses to cooperate with an interim freeze and you need a court order to compel it.

Chinese courts have jurisdiction over .cn domain disputes involving parties with a connection to the mainland. The applicable framework draws on civil law principles of property rights, tortious interference, and – where a trademark is involved – the relevant national trademark legislation. We work with local litigation counsel in the relevant Chinese jurisdictions when court action is required; COGNOMEN prepares the dispute strategy, the evidence package, and the coordination with local counsel, so our clients have a single point of contact throughout.

Consider two contrasting situations. Situation A: your .cn was transferred after your registrar account was phished, the transferee is still the registrant, and no further transfers have occurred. ADNDRC or direct registrar escalation is fast and proportionate – the evidence of the phishing event, combined with a formal invalidity notice, gives the registrar grounds to reverse without requiring a panel to decide bad faith. Situation B: the transfer occurred six months ago, the domain has changed hands twice since then, and the current registrant operates a business under the name in China. That situation is a court case, almost certainly requiring expert witnesses, local discovery, and a damages claim alongside the recovery of the name itself.

To weigh ADNDRC arbitration against a Chinese court action for your case, email info@cognomenlaw.com.

What evidence decides the outcome in a .cn unauthorized-transfer case?

Evidence wins or loses these cases. The standard for reversal – whether at the registrar, through CNNIC's administrative procedure, or before a court – is proof that the transfer was not authorized by the legitimate registrant. That proof comes from several categories of record, and assembling them promptly is the most important early task.

The strongest evidence is access-log data showing the transfer request originated from an IP address, device, or geographic location inconsistent with your normal account access. Most registrars retain server-side access logs for a limited period – sometimes as short as 30 days – so the clock on obtaining this record begins immediately. A formal data-preservation request to the registrar, citing the unauthorized transfer, is step one.

Secondary evidence includes: email header analysis of any phishing messages or spoofed registrar communications you received around the time of the transfer; business-use documentation showing your continuous operation of the domain before the transfer (hosting invoices, SSL certificate records, email system records, web-analytics exports); evidence of your trademark or business-name rights in the corresponding name; and any communications from the person or entity that now holds the domain, particularly if they have demanded money for its return – that conduct is probative of bad faith if the dispute is characterized as an abusive registration rather than an unauthorized transfer.

In a recent matter involving a .cn domain (spring 2025), we secured a registrar-level freeze and subsequent transfer reversal for a brand owner whose account had been compromised through a reseller channel. The key record was a discrepancy between the registrar's own authentication log and the IP address on file for the legitimate account holder – a single data point that the registrar accepted as conclusive proof of an unauthorized act.

Documentary evidence of your trademark rights matters even in an unauthorized-transfer framing. CNNIC's accredited registrars and, where relevant, Chinese courts treat an existing trademark registration in the corresponding name as a strong indicator of the legitimate registrant's identity – particularly when combined with years of continuous use. Where no trademark is registered, business-name records, ICP filing records for the associated website, and banking or tax records linking the domain to commercial activity serve a similar function.

What does it cost and how long does a .cn reversal take?

Cost and timeline vary significantly depending on which route you take and how contested the matter is.

A registrar-level escalation – the fastest and cheapest route – carries no official filing fee. Your cost is the legal work of preparing and sending formal notices, the evidence-preservation requests, and coordination with CNNIC if the registrar requires a registry-level instruction. If the registrar cooperates promptly, a reversal can be accomplished in a matter of days to weeks. Many cases that reach us resolve at this stage once a precisely drafted formal demand lands on the right desk at the registrar's compliance team.

An ADNDRC administrative proceeding carries official filing fees set by the Centre. ADNDRC is among the lower-cost providers in the international domain dispute space, with fees beginning at accessible levels for single-domain matters – verify the current schedule directly with ADNDRC, as the Centre publishes its fee table on its own site. Legal preparation for an ADNDRC case – assembling the complaint, the evidence annexes, and the accompanying legal argument – typically adds several thousand US dollars in professional fees, depending on complexity. A standard decision timeline runs in the range of weeks to a few months, though contested matters with multiple procedural steps take longer.

A Chinese court action is the most expensive and longest route. Court litigation in China involves local counsel fees, court filing charges, translation costs, and – in complex theft or fraud cases – forensic expert costs. Timelines are measured in months to years. The tradeoff is the court's power to award damages, order discovery, bind third parties, and resolve title disputes that administrative panels cannot reach.

For most unauthorized-transfer scenarios where the current registrant is still the transferee and no further sale has occurred, the registrar escalation followed if necessary by an ADNDRC filing is the proportionate path. Court is reserved for the cases described above – where the chain of title is complicated, damages are at issue, or the registrar is uncooperative.

How does .cn compare to .com and .org in unauthorized-transfer recovery?

The comparison is instructive because clients with multi-zone portfolios often face the same theft event across several names simultaneously.

For a .com domain, ICANN's inter-registrar transfer policy provides a defined complaint channel, and the UDRP – administered by WIPO, the Forum, or CAC – applies the well-established three-element test with an extensive body of published decisions. The WIPO filing fee is USD 1,500 for a single-member panel on one domain. The process is entirely in English, panelists are drawn from a global pool, and decisions are typically rendered within about two months.

For a .cn domain, the ADNDRC is the designated provider, the .cn Policy applies (with its "registered or used" formulation), and proceedings may involve Chinese-language filings depending on the registrant's location and the registrar's requirements. The registry authority – CNNIC – has direct control over registrar conduct in China, which can make registrar-level escalation effective where a strong compliance culture exists. The corresponding weakness is that disputes touching mainland-registered entities may require engagement with local counsel earlier in the process than a .com or .org matter would.

For a .org domain, the reverse unauthorized transfer of a .org domain follows the UDRP path through the same forums, with the same USD 1,500 WIPO entry point and two-month standard timeline. If your theft event spans both .com and .org, those can be addressed in a single UDRP complaint provided the same registrant holds both – a significant efficiency. The .cn cannot be bundled into that proceeding; it runs in parallel under separate rules.

Where a theft event spans .cn plus gTLDs, we advise coordinating the registrar escalations and the formal filings so that interim freezes across all zones are requested simultaneously, preventing a domain moved out of one jurisdiction from being used to redirect traffic away from another. In our practice, multi-zone theft events are increasingly common and require a structured parallel-track approach from day one.

What are the common mistakes that sink a .cn reversal attempt?

Several avoidable errors routinely reduce the chance of a fast, clean reversal.

The first is delay. Every day after discovery that passes without a formal freeze request gives the unauthorized holder more time to transfer the domain again, redirect it to generate revenue, or simply allow the evidence trail to cool. Registrar access logs expire. Phishing emails get deleted. The case that would have been a clean registrar reversal last week becomes a protracted ADNDRC filing this week.

The second is contacting the unauthorized holder directly without legal advice. Reaching out informally signals that you are aware of the situation but are not yet taking formal action. It gives the holder time to maneuver. Worse, any informal communications can be used in the proceeding – sometimes against you, if the phrasing suggests you accepted the transfer or negotiated over the domain's return price without reservation.

The third is mischaracterizing the claim. Filing an ADNDRC abusive-registration complaint when the correct framing is an unauthorized-transfer invalidity claim wastes time and risks an adverse decision on the wrong merits. The .cn Policy's three-element test is designed for bad-faith registration cases. Forcing an account-compromise situation into that mold – and failing to address element three on bad faith – produces a panel decision that does not answer the right question.

The fourth is failing to preserve evidence. A .cn reversal ultimately rests on documentary proof that the transfer was not authorized by the legitimate registrant. That proof exists in registrar systems, email servers, and hosting logs. Some of it disappears quickly. Instructing counsel at the earliest stage – before any evidence is overwritten or deleted – is the single most consequential early decision.

A myth we encounter regularly is that a successful .cn reversal requires proving criminal fraud in a Chinese court. That is not always the case. Many unauthorized-transfer reversals are accomplished at the registrar or ADNDRC level by demonstrating the invalidity of the transfer authorization, without reaching the criminal threshold. The correct framing and the right forum can resolve a matter in weeks that would take years in court.

Related at COGNOMEN

• Domain theft recovery and court action – full service overview
• How to reverse an unauthorized transfer of a .org domain
• TMCH Claims Notice analysis – brand protection in new gTLD rounds