How to recover a .cn domain used for phishing

A stranger registers a .cn domain that mirrors your brand, then uses it to harvest customer credentials, intercept payments, or impersonate your staff. The harm is immediate and reputational damage compounds by the hour. You need the domain transferred or suspended — and you need to know which procedure reaches it.

Recovering a .cn domain used for phishing requires a complaint before the China Internet Network Information Center's designated dispute-resolution provider, the ADNDRC, under the CNNIC Domain Name Dispute Resolution Policy — a procedure that mirrors the three-element UDRP test of Paragraph 4(a) and delivers a transfer or cancellation remedy. A standard case runs approximately two months from filing to registrar implementation. No monetary damages are available; the only remedies are transfer or cancellation of the domain name.

This page explains the applicable procedure, the legal test, the evidence that wins and loses cases, what the process costs, and how to start.

What procedure applies to a .cn domain dispute?

The CNNIC — China's country-code registry — administers .cn domains under its own dispute-resolution rules, and the ADNDRC (Asian Domain Name Dispute Resolution Centre) is a designated provider for those proceedings. The CNNIC policy closely tracks the UDRP: a complainant must satisfy the same three cumulative elements of identity or confusing similarity, absence of respondent rights, and bad-faith registration and use. That structural parallel matters, because the extensive body of UDRP panel reasoning on phishing and cybersquatting informs how .cn panels assess nearly identical fact patterns.

The UDRP itself does not directly govern .cn — CNNIC has not adopted the UDRP wholesale the way some other ccTLD registries have. The applicable rulebook is CNNIC's own policy and the ADNDRC supplemental rules. But the standard is substantively close enough that brand owners familiar with UDRP filings will recognize the framework immediately. Where a registrant is using the domain for active phishing — spoofing login pages, sending fraudulent invoices, or redirecting traffic through deceptive look-alike sites — the bad-faith element is generally the easiest of the three to satisfy.

One practical consequence deserves early attention. If the phishing campaign spans multiple zones — a .cn paired with a confusingly similar .com or a .cn.com — you may need parallel proceedings or a coordinated strategy. We regularly advise brand owners in exactly that position, assessing whether to file simultaneously or to sequence the complaints to maximize evidence for each.

Do the three UDRP elements apply to a .cn phishing case?

The CNNIC policy requires the complainant to establish all three of the following, mirroring Paragraph 4(a) of the UDRP: first, the disputed domain is identical or confusingly similar to a mark in which the complainant has rights; second, the registrant has no rights or legitimate interests in the domain; and third, the domain was registered and is being used in bad faith. Every element must be met — a finding on two out of three is not enough.

In a phishing context, the third element is usually well-documented. Panels have consistently held that using a domain to impersonate a trademark owner, harvest credentials, or conduct fraud constitutes paradigmatic bad faith. The harder work is often on the second element: demonstrating that the registrant has no conceivable legitimate basis for the name. That burden formally sits on the complainant, though panels regularly accept that once a prima facie case is made, the burden effectively shifts to the respondent to rebut.

The first element — confusing similarity — is generally mechanical where the domain reproduces the mark exactly or adds only generic terms such as "login," "secure," or "account." Phishing operators favor these additions precisely because they increase the credibility of the fake site. Those additions do not help the registrant; panels treat them as compounding the similarity, not resolving it.

For a read on whether the three elements are met in your specific .cn situation, reach us at info@cognomenlaw.com.

What evidence decides the outcome of a .cn phishing complaint?

Evidence that a domain is being used for phishing is the most powerful factual material a complainant can put before an ADNDRC panel. The specific types that panels find most persuasive fall into four groups.

• Screenshots of the fraudulent site, timestamped and preserved by a neutral third-party archival service. A site that mimics the complainant's login page, payment portal, or customer-service interface is direct evidence of impersonation and bad faith.
• Anti-phishing and threat-intelligence reports. If the domain appears on a published blocklist, has been reported to a CERT or ISAC, or has generated a takedown notice from a browser vendor or ISP, that record corroborates the phishing use independently of the complainant's own evidence.
• WHOIS/RDDS registration data, particularly where the registrant used privacy or proxy services, registered shortly after the complainant's mark became publicly known, or used contact information that matches prior abusive registrations.
• Trademark registration certificates in the relevant class, with priority dates predating the domain registration. Chinese trademark registrations are especially useful before an ADNDRC panel, but international registrations covering the PRC are equally valid.

Evidence that weakens a complaint is equally important to understand. Delay between discovering the phishing domain and filing — particularly if the complainant sent informal demand letters that the registrant ignored and the complainant still waited months before filing — can raise questions about urgency. More fundamentally, any evidence that the complainant's own mark is generic, descriptive, or unregistered in the relevant class will be seized upon. We assess trademark strength before filing, not after.

In a recent matter (a .cn typosquat used for credential-harvesting, spring 2025), we assembled the full evidence package — archived screenshots, blocklist entries, and Chinese trademark records — and secured a transfer order within approximately eight weeks of filing. No supplemental submissions were needed on either side.

How does the ADNDRC procedure work, step by step?

The ADNDRC procedure follows five stages that will be familiar to anyone who has run a UDRP complaint. The differences are in the local rules, not the structure.

1. Complaint filing. The complainant submits the complaint to the ADNDRC in writing, naming the disputed domain, the trademark, and the registrant. The complaint must plead each of the three CNNIC policy elements and attach supporting evidence. Complaints may be filed in Chinese or English; where the registrant is likely to respond, language strategy matters.
2. Administrative review. The ADNDRC conducts a formal compliance check. Deficiencies must be cured within a specified period. CNNIC then locks the domain pending the proceeding.
3. Service on the respondent and response window. The respondent receives notice and has 20 days to file a response — the same window as under the UDRP. Default by the respondent does not automatically produce a transfer; the panel still evaluates the complaint on its merits.
4. Panel appointment and decision. A single-member or three-member panel is appointed. The panel issues its decision in writing, addressing each element. The only remedies available are transfer or cancellation.
5. Registrar implementation. If the panel orders a transfer or cancellation, CNNIC or the registrar implements the remedy after a short waiting period — typically ten business days — during which the registrant may seek a court stay.

A complication unique to .cn proceedings: if the registrant initiates litigation in a Chinese court before the ADNDRC proceeding is concluded, the panel may be required to suspend the administrative case. Phishing operators occasionally use this tactic to buy time. Anticipating it, and structuring the complaint to minimize the window for that maneuver, is part of sound case management.

What does it cost to file, and how does it compare to other routes?

The right route depends on the zone, the goal, and the urgency of the harm. Here is how the main options stack up for a .cn phishing domain.

ADNDRC complaint under the CNNIC policy is the primary route. ADNDRC fees for .cn proceedings are published and are at the lower end of the ccTLD dispute-resolution market — broadly comparable to, and in some configurations less than, the WIPO filing fee of USD 1,500 for a single-member panel on 1–5 .com domains. Verify current ADNDRC rates directly, as they are periodically updated. Legal fees to prepare and file a .cn complaint — evidence collection, drafting, and language review — fall in the market range for specialist domain-dispute counsel, broadly in the USD 3,000–7,000 range for a single, straightforward case. Complex cases with parallel proceedings cost more.

UDRP before WIPO or the Forum does not reach a .cn domain unless CNNIC has specifically appointed the relevant provider for that zone. In practice, the ADNDRC is the correct venue. If you are also pursuing .com or other gTLD registrations by the same phishing operator, a parallel UDRP can address those simultaneously: the WIPO filing fee starts at USD 1,500 for up to five domains on a single-member panel, provided the registrant is the same holder.

Chinese court proceedings are theoretically available and can produce injunctive relief, damages, and a criminal referral for fraud — remedies entirely unavailable through the ADNDRC. The trade-off is cost, timeline, and the need for local litigation counsel in China. For phishing campaigns where the brand damage is severe and the operator is identifiable, court action is worth evaluating alongside the administrative route. We coordinate with local litigation counsel in the relevant jurisdiction for matters that require it.

Registrar-level abuse complaints are not a substitute for a formal dispute, but they can produce a faster temporary takedown of the phishing site itself (distinct from transferring the domain name). Filing an abuse complaint with the registrar and a takedown request with the hosting provider, in parallel with a formal ADNDRC proceeding, is usually the best strategy for limiting immediate harm while the administrative case runs its course.

In another recent matter (a .cn phishing campaign targeting an international financial-services brand, autumn 2024), we coordinated an abuse takedown of the fraudulent site within days of discovery, then filed the ADNDRC complaint with a complete evidence package. The domain was transferred approximately nine weeks after filing.

To assess the three UDRP elements for your .cn domain and plan the recovery route, email info@cognomenlaw.com.

What if the registrant files a response — or files in a Chinese court?

A phishing operator rarely files a substantive response, because the fraudulent use is difficult to explain. Default is common. When a response does arrive, it typically challenges the complainant's trademark rights (claiming the mark is descriptive or unregistered in China), denies the phishing allegation (asserting the site was merely under construction or never live), or raises procedural objections to the complaint form.

Each of these responses can be anticipated and addressed in a well-constructed complaint. Chinese trademark records, dated screenshots, and third-party threat-intelligence reports foreclose most of the factual rebuttals before they are made. Procedural objections are managed through compliance with the ADNDRC rules at the filing stage.

The court-interference tactic — filing a lawsuit in a Chinese court to suspend the ADNDRC proceeding — is less common in phishing cases, because the registrant's fraudulent use makes the litigation exposure symmetrical: a court proceeding forces the registrant to defend the same conduct on the merits. In our practice, we have seen this tactic used more often against legitimate domain investors than against brand-recovery complainants. Nonetheless, speed matters: filing the ADNDRC complaint promptly, before the registrant can organize a pre-emptive court filing, is generally the right posture.

Does the complainant risk a finding of reverse domain name hijacking?

Reverse domain name hijacking (RDNH) — a panel finding that the complaint was brought in bad faith to strip a legitimate registrant of its domain — is a real risk in any domain dispute. In a phishing case, however, the risk is extremely low when the complaint is filed on proper evidence. Panels reserve RDNH findings for complainants who brought meritless cases despite knowing the registrant's rights, or who used the proceeding as a tactical weapon against a legitimate owner.

A well-documented phishing complaint — with archived fraudulent pages, threat-intelligence corroboration, and a valid trademark predating the registration — presents no realistic RDNH exposure. The myth that any domain dispute risks an RDNH finding against the brand owner is exactly that: a myth that occasionally causes brand owners to delay filing when delay compounds the harm. We regularly advise complainants on the genuine RDNH risk profile before filing; in phishing cases, the risk is typically low enough to be a non-issue.

The more relevant risk in a .cn phishing case is filing a complaint that is technically deficient — the wrong respondent named, evidence not properly authenticated, or the trademark rights inadequately established — and losing on the merits. That is where preparation and language capability matter most.

Related at COGNOMEN

• UDRP domain recovery — recover domains across all gTLDs and selected ccTLDs
• Case study: recovering a phishing domain in a new-zone ccTLD
• Verify chain of title for a domain acquisition — due diligence before you buy

Author: Cordelia Roe — UDRP complainant practice & gTLD recovery; domain transactions and brand protection. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.