How to reverse an unauthorized transfer of a .sg domain

Your .sg domain disappeared. The WHOIS record now shows a registrant you do not recognize, and the name that underpins your Singapore web presence is pointing somewhere you did not authorize. Whether the transfer happened through a compromised registrar account, a fraudulent transfer request, or a stolen authorization code, the clock is running. Every hour of misdirected traffic and broken email is a business cost.

To reverse an unauthorized transfer of a .sg domain, the usual first step is an immediate registrar escalation to freeze further movement, followed by either a complaint under Singapore's Singapore Domain Dispute Resolution Policy (SDRP) or, where the facts warrant it, a court application for interim relief and title recovery. Evidence of the compromise — account logs, authentication records, and contemporaneous communications — decides how quickly the reversal proceeds. Timelines and cost depend on whether the case is resolved at the registrar level, through the SDRP, or through the Singapore courts.

This page covers the registrar mechanics, the SDRP procedure, when a court route is preferable, the evidence that decides outcomes, the cost structure, and how to take the next step.

What makes a .sg transfer "unauthorized" under Singapore rules?

An unauthorized transfer is one the registrant did not consent to — whether by account compromise, social engineering of the registrar, a fraudulent change-of-registrant request, or an internal security failure at the registrar itself. Singapore's registry, the Singapore Network Information Centre (SGNIC), operates under a regime that distinguishes between a disputed registration (where ownership was never legitimately the complainant's) and a stolen domain (where the registrant's own account or authorization code was used against them without consent).

The SDRP governs trademark-based disputes — situations where a third party registered a confusingly similar name in bad faith. It is modeled broadly on the UDRP. For a true theft or hijack scenario, the SDRP may not fit the facts at all; the mechanism the registrant needs is a transfer-reversal escalation, not a three-element bad-faith proceeding. Knowing which category the incident falls into determines the path entirely.

In our practice, clients often arrive believing they need to "file a UDRP" when what actually happened is a hijack of their own account. Those two situations demand completely different strategies. Getting the category right on day one avoids weeks of wasted procedure.

What is the SDRP and when does it apply to a .sg dispute?

The Singapore Domain Dispute Resolution Policy (SDRP) is the .sg equivalent of the UDRP, administered by SGNIC-appointed dispute-resolution providers. It applies when a trademark owner believes a third party registered a .sg domain confusingly similar to its mark in bad faith — not when the trademark owner's own registration was stolen. Like the UDRP, the SDRP requires the complainant to show three cumulative elements: (1) the domain is identical or confusingly similar to a mark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain was registered or used in bad faith.

Note the "or" in element three. Singapore's formulation — like Nominet's DRS and the auDRP — reads "registered or used" in bad faith, a lower bar than the UDRP's cumulative "registered and used" requirement. That single word can determine whether an older registration, registered in apparent good faith but now clearly being used abusively, is actionable under the SDRP where it might have failed under the standard UDRP.

The remedies under the SDRP are transfer or cancellation of the domain — no monetary damages, no costs award. If your goal is financial recovery from the person who hijacked or squatted on your name, the SDRP will not reach that. A Singapore court proceeding is the only route to money.

For an assessment of your .sg domain dispute — whether it belongs under the SDRP or a court application — contact info@cognomenlaw.com.

How do registrar escalation and transfer-reversal mechanics work for .sg?

The moment unauthorized access to a .sg registrant account is discovered, the priority is a registrar lock — a hold instruction that prevents any further transfer, deletion, or contact-record change while the dispute is resolved. Most accredited SGNIC registrars have an abuse or security desk capable of placing this hold within hours when presented with clear evidence of unauthorized activity. The registrar lock does not reverse what has already happened; it stops the damage from compounding.

Transfer-reversal mechanics depend on the registrar's own policies, SGNIC's dispute procedures, and — critically — how much time has elapsed since the unauthorized transfer. Immediate escalation within the first days of discovery is the single most important action a victim can take. Registrars are far more cooperative when a compromise is fresh, logs are intact, and there has been no further downstream transfer to a third party who might claim some form of good-faith acquisition.

Where the domain has been re-transferred to a second or third registrant after the initial unauthorized transfer, the mechanics become considerably more complex. The later registrant may assert a bona fide purchase. In those cases, a court application for interim relief — preserving the status quo while the substantive claim is decided — is often essential, and it must accompany or precede the registrar escalation rather than wait behind it.

We regularly advise domain holders who discover a compromise days or even weeks after it occurred. The record is almost never clean by that point. The strategy shifts from "call the registrar" to building a legal chain-of-title argument and, where needed, obtaining an interim injunction to freeze further dealings with the name.

When does a Singapore court action beat the SDRP for reversing a .sg transfer?

The SDRP is the faster and cheaper route for straightforward trademark-based disputes where the facts are clear and the domain has not moved beyond the initial registrant. A court action is the right route when the SDRP cannot reach the remedy needed — typically in four situations.

First, where the dispute is not a trademark dispute at all but a domain theft: the SDRP's three-element test does not easily accommodate a claim by a rightful registrant against someone who stole their own account. Second, where interim relief is needed urgently: courts can issue ex parte injunctions to freeze a domain within days; the SDRP cannot. Third, where financial compensation is part of the objective: only a court can award damages for losses flowing from the unauthorized transfer. Fourth, where the chain of title has become complex through a series of re-transfers and a third party is claiming a clean-hands defense: a court proceeding is the only mechanism with the evidentiary depth to resolve that argument.

Singapore's courts are experienced in IP and technology disputes. The applicable national trademark legislation and general property law principles underpin these claims. For a dispute where a foreign registrant is involved, a Singapore court order may require enforcement through local litigation counsel in the relevant jurisdiction — an important cross-border consideration when the hijacker operates outside Singapore.

A practical decision matrix: if you hold a registered trademark, the domain is clearly confusingly similar, and the current registrant is the first and only transferee, the SDRP is likely faster and less expensive. If any one of those conditions is absent — no registered mark, a subsequent good-faith purchaser, a need for damages, or a need for emergency interim relief — a court route warrants serious consideration from the outset.

To weigh SDRP against a Singapore court action for your case, email info@cognomenlaw.com.

What evidence decides whether a .sg transfer reversal succeeds?

Evidence of unauthorized access is the foundation of any successful reversal claim, whether through the registrar, the SDRP, or a court. The categories of evidence that decide outcomes are consistent across all three routes, though the standard of proof and the audience differ.

The most powerful evidence is technical: server-side authentication logs showing login events from IP addresses or devices that were never used by the legitimate registrant; registrar access logs showing a password-reset request from an unfamiliar device or location; and email records showing a phishing message that preceded the compromise. Where the registrar itself suffered a security failure, internal incident-report documentation and SGNIC's own transfer-audit trail are critical.

Beyond technical evidence, contemporaneous communications matter. Demand messages from the person now controlling the domain — especially those referencing a ransom or buy-back price — are evidence of bad faith in the use of the domain after transfer, relevant to any SDRP or court proceeding. Contracts, invoices, or correspondence proving the legitimate registrant's long-standing use of the domain support the chain-of-title argument.

In a matter we handled in late 2024 — a .sg domain used by a Singapore-based professional services firm, the account compromised through a credential-stuffing attack — the critical evidence was a registrar authentication log showing a login from a jurisdiction where the client had no operations, followed within hours by a transfer-authorization request. Pairing that log with the client's own IT access records, showing no logins from that jurisdiction, produced a clear enough picture to prompt the registrar to freeze the domain voluntarily, without requiring a formal SDRP complaint. The full reversal took approximately three weeks from the date of engagement.

Where technical logs are unavailable or have been partially overwritten, the burden of reconstruction falls on circumstantial evidence: WHOIS history, registration-date records, payment records showing the legitimate registrant's annual renewals, and any prior public use of the domain. Panels and courts are accustomed to imperfect records in hijacking cases; a well-organized evidentiary bundle, even from incomplete sources, can be persuasive when the overall picture is internally consistent.

How does the .sg dispute compare with other ccTLD transfer-reversal routes?

Brand owners and registrants with multi-zone portfolios often face the same underlying hijack across more than one extension simultaneously. The .sg procedure sits at one end of a spectrum of national ccTLD approaches; understanding where it fits helps in prioritizing which dispute to resolve first when resources are limited.

The UDRP — the standard route for .com, .net, .org and accredited gTLDs — applies only to trademark disputes, not theft, and remedies are limited to transfer or cancellation. The SDRP mirrors that structure for .sg, with the "registered or used" modification noted above. For .uk domains, Nominet's DRS adds a mandatory free mediation stage before any expert decision; that step adds time but can produce faster resolution where the parties are willing to talk. For .tv domains, the UDRP applies, because .tv has adopted the Policy. For .de, there is no arbitration at all — Germany's DENIC offers a registration block while a court proceeding is pursued.

The .sg context presents one particular complexity absent from .com disputes: SGNIC imposes eligibility requirements on .sg registrations. A foreign entity that registered a .sg domain without meeting those requirements may face a separate challenge to the validity of the registration itself — a potential additional avenue for the rightful owner when pursuing reversal through the courts.

In a spring 2025 matter involving simultaneous compromise of a .sg and a .com domain, we coordinated a UDRP filing for the .com at WIPO — where the USD 1,500 filing fee applies for a single-member panel — alongside a registrar escalation for the .sg, rather than pursuing both through arbitration. The .com proceeding ran its standard course of roughly two months; the .sg registrar escalation, supported by the same evidence package, concluded before the WIPO decision issued. Coordinating the evidence at the outset saved time and cost on both fronts.

What does it cost to reverse an unauthorized .sg domain transfer?

Cost depends almost entirely on the route. A successful registrar-level escalation — where the evidence is clear and the registrar cooperates voluntarily — involves legal fees for preparing the escalation submissions but no forum filing fee. That is the least expensive outcome and the one worth pursuing first in every case.

If the matter proceeds under the SDRP, the governing national procedure applies its own published fee schedule. SGNIC's rules specify the applicable dispute-provider fees; verify the current schedule directly with the appointed provider, as fees are subject to change. Legal fees for preparing an SDRP complaint or defense are broadly comparable to those for a UDRP matter — in the market, flat fees for a straightforward single-domain UDRP complaint commonly run in the USD 3,000–7,000 range, though a .sg matter with a hijack dimension and the need to coordinate evidence with a registrar escalation typically sits toward the higher end of that range or above it.

A Singapore court application for interim relief involves court filing fees, legal fees for the application and any substantive claim, and — if the defendant is outside Singapore — service and enforcement costs through local litigation counsel in the relevant jurisdiction. Court proceedings are materially more expensive than the SDRP. They are also the only route to damages and the only route capable of dealing with a multi-transfer chain. The cost is proportionate to the value of the domain and the commercial loss flowing from the unauthorized transfer.

One cost-reduction lever available in nearly every .sg hijack case: a well-prepared registrar escalation submission, even if ultimately unsuccessful, produces a documentary record that reduces the preparation cost of any subsequent SDRP or court proceeding. Investing in the escalation is not wasted effort — it is the foundation of the record.

What happens if the current holder ignores or defaults on the proceedings?

Default is common in domain-theft cases. The person who hijacked or fraudulently transferred the domain frequently has no interest in participating in any proceeding — they acquired the domain to flip it, ransom it, or monetize its traffic, and they have little to gain from formal engagement. Under the SDRP, as under the UDRP, a default by the respondent does not mean automatic success for the complainant. The panel still applies the applicable test and requires the evidence to meet it.

What default does mean, practically, is that the panel proceeds on the record the complainant has assembled. A strong evidentiary package is therefore at least as important in a default case as in a contested one. Panels have consistently held that clear and unrebutted evidence of compromise, account breach, and unauthorized transfer, combined with evidence of the complainant's prior legitimate registration, is sufficient to support transfer even absent a respondent filing.

In Singapore court proceedings, default rules are governed by the applicable rules of court. A defendant who fails to appear or respond within the required period may be subject to judgment in default — but the claimant must still present a prima facie case and comply with procedural requirements. For defendants outside Singapore, serving process and enforcing a judgment or order abroad requires coordination with local litigation counsel in the relevant jurisdiction, adding time and cost that should be factored into the strategy from the outset.

Related at COGNOMEN

• Court action and domain theft recovery across gTLDs and ccTLDs
• Reversing an unauthorized transfer of a .tv domain: registrar escalation and UDRP options
• ccTLD transfer remedy FAQ: what the national procedure can and cannot do

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.