After losing a UDRP, the cybersquatter managed to get the domain back when the complainant transferred the domain to another registrar.
UDRP Decision Reversed by Subsequent Registrar Transfer Mistake
An unusual turn of events in a recent UDRP dispute highlights the operational pitfalls that can undermine enforcement of domain dispute decisions. The case involved a domain originally subject to a successful complaint brought by the law firm Gibson, Dunn & Crutcher LLP. The law firm prevailed in the UDRP proceeding and the domain was transferred to it from the prior registrant at Namecheap. However, a later transfer by the law firm back to a different registrar exposed the domain to a new ownership change by the original registrant.
When Namecheap processed the initial transfer to the complainant, it included a clear instruction addressing the domain privacy settings and EPP code handling: registrants should update the privacy email or disable Domain Privacy before initiating a transfer request to prevent the transfer authorization code (EPP code) from being sent to the prior registrant. That guidance exists precisely because EPP codes can enable an unauthorized transfer if they fall into the wrong hands.
In this matter, the complainant did not follow that precaution. Approximately five months after the domain had been transferred to Gibson, Dunn & Crutcher LLP, the firm sought to move the domain to another registrar. The firm failed to update or disable domain privacy and the EPP code was sent to the previous registrant. The prior owner used the EPP code to initiate and complete a transfer that reclaimed the domain.
The prior registrant’s action effectively reversed the outcome of the original UDRP, prompting the law firm to seek relief. A three-person panel convened under the World Intellectual Property Organization (WIPO) considered the circumstances. The panel recognized the unusual procedural interplay: a successful UDRP decision followed by an apparently authorized transfer due to operational oversights related to registrar transfer procedures and domain privacy settings.
The WIPO panel expressed sympathy for the law firm’s oversight but concluded that the transfer back to the complainant was appropriate given the facts and the policies at issue. In its decision, the panel ordered the domain be transferred back to Gibson, Dunn & Crutcher LLP.
Panel Observations on Registrar Procedures and Post-Decision Transfers
Beyond resolving the dispute between the parties, the panel used the case to emphasize broader procedural vulnerabilities in how registrars handle transfers following UDRP decisions. It noted that the transfer process can create opportunities for former registrants to regain domains if transfer-related communications—such as EPP codes—are routed to the wrong email addresses or remain accessible through privacy services.
The panel recommended clearer, standardized practices for post-decision transfers to reduce the risk of unintended reversals. This observation echoed recent industry discussions and reports exploring how registrars and dispute providers should coordinate after decisions. Those reports, produced through collaborative efforts by domain stakeholders including industry associations and WIPO, have examined ways to make post-decision transfer workflows more secure and predictable.
Key Takeaways for Domain Owners and Practitioners
- After a successful UDRP or other dispute-based transfer, domain owners should immediately confirm and, if needed, disable or update domain privacy settings before initiating any further transfers.
- Ensure that the registrant email and administrative contacts are current and controlled by the rightful owner; otherwise, EPP codes or other transfer communications can be intercepted.
- Registrars should consider adopting explicit, standardized procedures for handling domains that are transferred as the result of dispute decisions, to prevent inadvertent re-transfer to prior registrants.
- Dispute practitioners should advise clients on operational follow-up steps after a decision, including registrar-level checklist items to secure ownership and prevent reversal through routine transfer mechanisms.
This case serves as a reminder that resolving a domain dispute through policy mechanisms is only part of the journey. Proper post-decision operational hygiene and registrar coordination are essential to maintain the result and prevent a return to prior status through procedural oversights.