How to reverse an unauthorized transfer of a .dev domain

How to reverse an unauthorized transfer of a .dev domain. UDRP and ccTLD domain recovery and defense across .dev. Email the firm to assess your case.

Your .dev domain was in your account on Monday. By Wednesday it was gone — transferred to a registrar you have never used, sitting in a name you do not recognize, with your Google registry entry pointing somewhere else. That is the opening scenario we handle regularly, and the question is always the same: how fast can this be undone, and by which route?

To reverse an unauthorized transfer of a .dev domain you have two primary tracks: an emergency registrar-lock escalation with Google Registry (the sole registry operator for .dev) and a UDRP complaint before WIPO or another accredited provider, which applies because .dev, as a Google-operated new gTLD, is subject to the standard UDRP. A court action is the fallback where the arbitration route cannot reach the harm — for example, when identity theft or criminal fraud underlies the transfer. Speed matters: the longer the domain sits with a new registrant, the harder the evidentiary record becomes to assemble.

This page covers the mechanics of each route, the evidence that decides the outcome, the cost structure, and when to combine approaches.

Why .dev is a new gTLD — and why that matters for recovery

Google operates .dev as a sponsored new gTLD under an ICANN registry agreement, which means every .dev registrar is an ICANN-accredited registrar bound by the Inter-Registrar Transfer Policy and the UDRP. That single fact opens the full toolkit available for .com recovery — the same toolkit, the same timelines, the same forums — unlike a purely national ccTLD such as .de, where no UDRP exists at all.

It also means the ICANN Transfer Policy imposes a 60-day lock after any registrar-level transfer. An unauthorized transfer triggers that lock at the gaining registrar, freezing the domain in place while you pursue recovery. That window is your operational runway. Acting within it is critical. Miss it, and the gaining registrant may transfer again — to a third registrar, a new holder, or an entirely different jurisdiction — multiplying the layers you need to unwind.

One other .dev-specific point: Google Registry runs .dev as HTTPS-only, requiring an SSL certificate. A bad actor holding your .dev cannot meaningfully monetize it the way they might park a .com, which alters the economics of a settlement approach. In our experience advising .dev registrants, the motive for unauthorized transfers in this zone tends to be either resale to the legitimate owner under duress or a stepping-stone to credential fraud. Either motive leaves a traceable evidence footprint.

How does the unauthorized transfer actually happen — and what does the record show?

The three most common attack vectors for .dev account compromise are credential stuffing against the registrar's login portal, a successful social-engineering call to registrar support that changes account contact details, and a phishing campaign that harvests the owner's authentication credentials directly. Each leaves a different trail in the registrar's log data.

Credential stuffing shows login attempts from IP ranges associated with known credential-leak tools. Social engineering shows a support ticket or phone-call record, often with a changed email address in the hours before the transfer authorization. Phishing leaves an email chain and, typically, a spoofed domain that itself may be registered in bad faith. Preserve every log you can obtain from your registrar within the first 48 hours: transfer history, WHOIS change logs, login IP logs, and the authorization code (EPP auth-info) request timestamp. Those logs degrade or are overwritten on short cycles.

In a recent matter (a .dev typosquat recovery combined with a theft reversal, spring 2025), the registrar's login-event log showed an IP address from a jurisdiction three time zones away attempting authentication four minutes before the auth-code was generated. That single anomaly anchored the entire bad-faith record submitted to WIPO, and the transfer was reversed without a court filing.

If you have just discovered that your .dev domain has moved without your authorization, contact info@cognomenlaw.com immediately. We assess the registrar-lock position, the available evidence, and the fastest route to a hold — before the 60-day window closes.

What is the UDRP route for recovering a transferred .dev domain?

Under Paragraph 4(a) of the UDRP, you must satisfy all three elements: the domain is identical or confusingly similar to a trademark or service-mark in which you have rights; the current registrant has no rights or legitimate interests; and the domain was registered and is being used in bad faith. In a theft scenario the third element — bad faith — is satisfied by the evidence of unauthorized acquisition. The gaining registrant never had a legitimate claim; their "registration" was an act of fraud, not a bona fide registration at all.

The WIPO filing fee for a single .dev domain is USD 1,500 for a single-member panel. A standard case runs approximately two months from filing to a decision. If speed is critical, WIPO's expedited option can deliver a decision in approximately one month for single-panel cases covering up to five domains.

One important framing point: the UDRP's only remedies are transfer or cancellation. It does not award damages, costs, or an injunction. If the unauthorized transfer caused material financial harm — lost transactions, credential fraud downstream, or identity theft losses — a court route is the only path to monetary relief.

Forum choice: WIPO and the Forum together handle roughly 97% of all UDRP proceedings. For a .dev theft, WIPO is typically the better choice: its decision record is publicly searchable and its panelists have extensive experience with account-compromise fact patterns.

When does a court action beat the UDRP for .dev recovery?

Four scenarios push a .dev recovery toward court rather than UDRP, and they are not mutually exclusive.

First, if the identity of the person who authorized or executed the transfer is unknown — the WHOIS has been replaced with privacy-masked contact data — a court with civil-discovery powers can compel the registrar to produce account records that WIPO cannot order. The UDRP has no subpoena power. Second, if the theft was accompanied by broader fraud (fraudulent invoices re-routed through your domain, SIM-swapping, impersonation of your business), the scope of harm exceeds what a domain-transfer order can remedy and an equitable court order or injunction is needed to stop ongoing damage. Third, where the gaining registrant has taken affirmative steps to establish "new" rights in the domain — filing a trademark application after the fact, building out a site to manufacture a legitimate-interest record — a court can examine that conduct under fraud-on-the-registry theories that panels handle less cleanly. Fourth, if the domain has been re-transferred past the ICANN 60-day lock and is now in a third party's hands, a court may be the only forum able to reach a bona fide purchaser argument and resolve competing chain-of-title claims.

Court anticybersquatting litigation in the US jurisdiction — the registrar infrastructure for .dev runs through US-based entities — is substantially more expensive and slower than the UDRP. We handle that route with local litigation counsel in the relevant jurisdiction. The decision between UDRP and court is never abstract: it turns on whether you need only the domain back, or whether you also need damages and the power of discovery.

In a second matter we handled (a .dev developer-tools brand, summer 2024), the unauthorized transfer was followed two days later by re-transfer to a third registrar outside the US. The UDRP route remained open — the new registrant still had no legitimate interest — but we filed simultaneously with a court-side emergency motion to enjoin further transfer while the UDRP proceeded. Both tracks ran in parallel, and the domain was secured under the court's interim order before the WIPO panel even issued its decision.

If a prior registrar complaint has not produced results, or if a UDRP filing on your .dev is already pending with a bad outcome possible, email info@cognomenlaw.com. A focused review of what the record is missing can change the trajectory of the case.

What is the registrar escalation process — and what does it actually involve?

Registrar escalation is not a filing; it is a timed operational sequence that runs on a parallel track to any formal proceeding, and it is usually the first thing we initiate.

Step one: file a written abuse report with the gaining registrar's abuse desk within the first 24 hours, citing the ICANN Inter-Registrar Transfer Policy and requesting a hold on further outbound transfer. Most ICANN-accredited registrars maintain an abuse-response channel and are required under their accreditation agreement to respond to credible transfer-reversal requests. Step two: notify Google Registry (as the .dev registry operator) of the unauthorized transfer, citing the transfer anomalies in the log data. The registry can apply a server-side hold — "serverTransferProhibited" or "serverUpdateProhibited" — that overrides even the registrar's lock status. Step three: file a Registrar Transfer Dispute Resolution Policy complaint with ICANN if the gaining registrar refuses to act. That procedure is separate from the UDRP and focuses on whether the Inter-Registrar Transfer Policy was violated — typically, whether a valid authorization code was used, and whether the transfer was initiated by the actual registrant of record.

None of these steps requires a trademark. They require documentation: proof of original registration, proof of account ownership at the losing registrar, and evidence of the unauthorized access event. A registrar-level reversal, when it succeeds, is faster than any UDRP or court proceeding — a matter of days rather than weeks. It also preserves the domain's original registration date, which matters for trademark-priority purposes and for any subsequent UDRP proceeding.

What evidence is decisive for reversing an unauthorized .dev transfer?

The evidence that moves registrars, WIPO panels, and courts is consistent across all three forums, though each weights it differently.

The strongest single piece of evidence is a contemporaneous log showing the transfer-authorization event originated from an IP address, device fingerprint, or geographic location inconsistent with the registrant's own access patterns. Registrars keep these logs for varying periods — some as short as 30 days — which is why the 48-hour preservation window matters so much. Second strongest: a screenshot or email record showing the phishing vector (a spoofed registrar email, a support-call transcript, a password-reset confirmation sent to an address you do not own). Third: proof of continuous prior ownership — original registration confirmation, renewal invoices, DNS configuration records, and any trademark registration or application predating the transfer.

For a UDRP, panels require that you demonstrate trademark rights. For a .dev domain used in commerce — a developer tool, a SaaS product, a professional services brand — unregistered trademark rights (common-law rights, based on use in commerce) are accepted under the Policy. Document them with screenshots, sales records, media coverage, and customer communications predating the transfer.

What panels and registrars look for on the other side: did the gaining registrant make any public claim to the name before the transfer? Have they developed the domain after acquiring it? Is there any conceivable innocent explanation for how they obtained the auth-code? In a straight theft scenario, none of those factors favor the gaining registrant — but the record needs to say so affirmatively, not leave gaps for a panel to fill with doubt.

What does the process cost, and what are the realistic timelines?

The cost structure for .dev unauthorized-transfer recovery breaks into three layers: the registrar escalation, any formal proceeding filing fee, and legal fees.

Registrar escalation carries no official fee. It is entirely a function of preparation time and the quality of the evidence package submitted. For a matter where the logs are clean and the abuse-desk submission is well-framed, this can move in days.

A UDRP filing at WIPO for a single .dev domain costs USD 1,500 for a single-member panel, separate from legal fees. Three-member panels — which some respondents request, triggering a higher cost split between the parties — cost USD 4,000. Legal fees for a straightforward single-domain UDRP complaint typically fall in the USD 3,000–7,000 range in the current market, separate from the forum fee.

A court action is substantially more expensive and is measured in months rather than weeks. We quote that route individually based on the jurisdiction, the scope of harm, and whether emergency interim relief is needed. Describing it as "substantially higher and billed hourly" is the honest frame.

Timeline summary: registrar escalation can conclude in days to a few weeks; a WIPO UDRP case runs approximately two months; WIPO's expedited option compresses that to approximately one month; court action in the US jurisdiction typically runs six months to over a year to a merits decision, with emergency-injunction relief available within days of filing if the facts support it.

The right budget choice depends on which route is open and what you need at the end. If the only goal is recovering the .dev domain, UDRP plus registrar escalation is nearly always the more efficient path. If you need damages or discovery, the court track earns its cost.

Is there a cross-zone dimension — and what if you also hold related domains?

Many .dev registrants also hold the matching .com, .net, or a country-code domain for the same brand. An unauthorized transfer of the .dev alone may be the first move in a broader attack on the portfolio. In parallel with the .dev recovery, it is worth checking whether auth-codes have been requested or contacts changed on related domains — especially if the compromise originated at the registrar level rather than at the domain-specific account level.

If the .com is also at risk or has already been moved, the UDRP complaint can cover multiple domains in a single filing, provided the registrant of record is the same holder. That is worth confirming: if the attacker has split the domains across different holding accounts to avoid a consolidated filing, separate complaints are required.

For a .dev plus a ccTLD in the same portfolio, the analysis diverges sharply by zone. A .uk domain theft follows the Nominet DRS process; a .eu domain theft involves EURid's ADR procedure; a .de domain dispute goes to the German courts with a DENIC DISPUTE entry as a transfer block. None of those procedures can be consolidated with a .dev UDRP at WIPO. Each runs on its own timetable and its own rules. We identify and coordinate the parallel tracks from the outset so nothing is inadvertently waived or expired.

Related at COGNOMEN

• Court action and domain theft recovery across all zones and registrar escalation routes
• Recovering a stolen domain through Singapore-based proceedings and registrar escalation
• New gTLD launch protection and group URS strategy for brand owners