On June 10, 2026, the domain name that takes accommodation bookings, seva reservations and online donations for Shri Dharmasthala was transferred out of its owner’s registrar account without the owner knowing, but the website kept working.
Eight weeks later, the Shri Dharmasthala Manjunatheshwara Educational Society filed a complaint under the Uniform Domain Name Dispute Resolution Policy (UDRP). On September 14, a panellist at the Czech Arbitration Court ordered shridharmasthala.org transferred back and this decision records what the registrar told the society afterwards. They shared that logins to the account had been coming from Sweden, Switzerland and, after the transfer from Japan since March 11. Also, two-factor authentication “was not activated on the account at the time of the incident”, and the account’s email address “appeared in publicly reported data breaches”.
This is the second time in 18 months that a well-known Indian institution has used a trademark dispute process to get back a domain taken from its own account. Indira IVF Hospital Private Limited, which describes itself in its complaint as India’s largest fertility service provider, lost indiraivf.com on October 31, 2024, and had not noticed until January 2025. In both the cases the party that took the domains left it still directing towards the owner’s own website, so nothing could be detected by the owners. Both organisations, however, did get their domains back. The decisions that accompanied their return do not mention anything about who is responsible for securing the account that controls a domain, and the route they used is open only to organisations that can prove a trademark.
What the two decisions record
The Dharmasthala decision sets out facts that the respondent, named as Chen Jia, did not contest because no response was filed.
The domain had been “in the possession and under control of the Complainant” since October 26, 2001 and had been renewed throughout. Then, the decision says, “On June 10, 2026 the disputed domain name had been fraudulently transferred without the Complainant’s knowledge, authorization, or consent.”
The registrar’s account of the breach is reproduced in one sentence:
“The registrar informed Complainant that from March 11, 2026 account logins were registered from Ip addresses in Sweden, Switzerland, and after the transfer from Japan.”
The decision also records that an authorisation email for the transfer “was sent to the registered e-mail address, a Gmail account that the Complainant submits was itself compromised as part of the same coordinated attack”. The society’s own email address on the account had turned up in breach data before the incident, “indicating that credentials had been exposed prior to the incident”. The panel, Dietrich Beier, found that the society holds common law rights in SHRI DHARMASTHALA and ordered the transfer.
The Indira IVF decision is longer because the respondent, Saurav Shinde, did reply. The company’s domain had been registered in 2010 by one of its shareholders and renewed for five years on August 28, 2024. In January 2025 “it was discovered … that the disputed domain name was missing from the Complainant’s domain name control panel”.
The company’s domain service provider, Global IT Providers of Jaipur, told it that the control panel “was accessed from an unfamiliar location in October 2024” and that the domain “was transferred away on October 31, 2024, without the Complainant’s authorization”.
A notification had been sent, the provider said, “however, it may have gone unnoticed due to the large volume of emails received at that address.” The domain had moved to Hostinger, which disclosed the registrant’s details on February 25, 2025.
Shinde’s response was that he had bought the domain on October 26, 2024 “through a peer-to-peer (P2P) transaction after finding a post in a Facebook group”, completing the deal on Telegram, and that he “is now unsure about what is happening and does not know what to do next”.
Indira IVF replied that the sale story “lacks credibility”, that the price paid for two domains was “suspiciously low”, and that one of those domains “was linked to the original registrar of the Complainant’s domain, suggesting unauthorized access at the reseller level”.
The panellist, Darius Sauliūnas, did not decide who the hacker was.
He held that the Facebook purchase “does not negate the fact that this domain name was acquired as a result of the Complainant’s domain names’ management account being previously hacked”, and that under “the general legal principle that no right can arise from illegality (ex injuria jus non oritur)”, the explanation could not help the respondent.
Why the websites kept working, and why that is the danger
Both panels treated the fact that the stolen domains still pointed to the owner’s own website as evidence of bad faith rather than good. They relied on section 3.1.4 of the WIPO Overview, the compilation of panel views that UDRP decisions draw on, which says that redirecting a domain to the complainant’s site can establish bad faith “insofar as the respondent retains control over the redirection thus creating a real or implied ongoing threat to the complainant”.
The Dharmasthala decision records that the domain “has served since its launch as the primary commercial platform for the Complainant’s paid services”, including “Razorpay-integrated payment gateway services”.
In Indira IVF’s case the threat materialised, as the decision records that “the take-over of the disputed domain name resulted in the short suspension of the Complainant’s website for several hours which forced the Complainant to intervene and restore access to its official website in order to prevent reputational and business damage”.
For a hospital chain, the complaint noted, a domain in a stranger’s hands carries “a risk of misuse, phishing, and consumer deception”.
The timelines help show how Indira IVF’s domain was gone for roughly three months before anyone looked at the control panel. And, Dharmasthala’s account had been logged into from outside the country for three months before the transfer, which the society learnt from the registrar only afterwards. This helps highlight the crucial point that a working website is not evidence that the domain behind it is still the website owner’s.
What UDRP does, and where it stops
UDRP is the dispute policy that the Internet Corporation for Assigned Names and Numbers (ICANN) attaches to every .com, .org and similar registration. A complainant has to show that the domain is identical or confusingly similar to a trademark in which it has rights. It must also show that the registrant has no rights or legitimate interests in the domain, and that it was registered and is being used in bad faith. The policy was written for issues like cybersquatting, and nothing in those tests asks how an account was accessed.
Both complainants cleared the first test, but in different ways. Indira IVF holds registered marks; the decision cites Indian trademark application No. 2566949 for INDIRA, applied for on July 19, 2013 and registered on April 26, 2018. Dharmasthala holds no registered mark for its name and had to establish common law rights, which it did on evidence of use since 2003, media coverage and visitor numbers that the panel accepted as uncontested. An institution without this kind of a record may not have access to this route at all.
Both panels also had to stretch the word “registered” like Dharmasthala’s panel treated “the (fraudulent) acquisition of the domain name” as “equivalent to an initial registration”, citing an earlier WIPO decision, Worldcom Exchange v. Wei.com. The policy returns just the domain and seems to do nothing else, since it identifies no culprit, awards no costs or damages, and makes no finding about the registrar or the reseller whose account was used.
Indira IVF’s decision records that the company “informed about the cyber incident to the Indian enforcement authorities”; what came of that is not in the decision. ICANN’s own transfer rules provide for notice to the registrant when a domain changes hands, and in both cases that notice went to an inbox that was either compromised or too full to be read.
Where Indian regulation sits
The Delhi High Court’s directions of December 2025 on domain name registrars, which MediaNama reported, require e-KYC verification of registrants at registration and periodically afterwards. It also restrict privacy masking of registrant details, and make Indian court orders binding on registrars served by email.
These directions are about who registers a domain and how fraudulent domains are taken down but nothing in them, as reported, deals with how a registrar or reseller secures an existing customer’s account. They do not mention whether a two-factor authentication must be offered or enforced, or what a registrar must do when a customer reports a transfer it did not authorise.
The reseller layer in the Indira IVF case is where this gap is seen most clearly. Here, Global IT Providers operated the control panel from which the domain was taken, and Indira IVF’s complaint suggested the unauthorised access was “at the reseller level”. But, resellers operate under a registrar’s contract rather than directly under ICANN’s accreditation, so whatever obligations exist sit one step further from the customer. MediaNama could not identify any Indian rule or advisory that sets a security standard for registrar or reseller accounts.
Disclosure and sourcing
Ankur Raheja, an advocate and UDRP panellist who practises as UDRPKing.com, represented both complainants and brought the two decisions to MediaNama’s attention. Domain Name Wire reported the Indira IVF decision in April 2025 and the facts above are as the panels recorded them; in the Dharmasthala matter they are the complainant’s uncontested assertions.
Questions MediaNama has sent
MediaNama has written to the Shri Dharmasthala Manjunatheshwara Educational Society, Indira IVF, Global IT Providers, Hostinger and the registrar in the Dharmasthala matter, and has asked NIXI and CERT-In about the position for .in domains and incident reporting. This story will be updated with responses.
To the two complainants:
- How the transfer was discovered, and how long after it took place?
- What the registrar or reseller told them about the access to the account, and whether any record of logins was shared?
- Whether a police complaint or a CERT-In report was filed, and its status?
- What account security changes were made after recovery?
To Global IT Providers and the registrars:
- What authentication was available on the account at the time, and whether two-factor authentication was offered or required?
- How an inter-registrar transfer request is verified when logins come from an unfamiliar location?
- What the procedure is when a customer reports an unauthorised transfer, and whether the transfer dispute route under ICANN’s policy was used?
To NIXI and CERT-In:
- Whether any security standard applies to registrar or reseller accounts for .in domains?
- How many unauthorised domain transfers or domain hijacking incidents have been reported to CERT-In since 2024?
Also read:
- How Delhi HC’s e-KYC Mandate For Domain Name Registration Reshapes India’s Online Ecosystem
- Here’s why Namecheap and four other domain registrars are blocked in India
- Net 4 India domains transferred to US-registered company, details next week on how to access domains
The post Stolen domains: what two UDRP decisions reveal about registrar account security appeared first on MEDIANAMA.