FAQ: recover a stolen .in domain under the applicable domain rules

FAQ: recover a stolen .in domain under the applicable domain rules. UDRP and ccTLD domain recovery and defense across .in. Email the firm to assess your case.

A .in domain you registered and relied on has been transferred to a stranger – perhaps following a phishing email, a registrar account breach, or an unauthorized registry-side change. You need to know whether arbitration, a registrar escalation, or an Indian court is the right path to get it back, and how fast you have to move.

Recovering a stolen .in domain turns on two parallel tracks: the INDRP (the .in Domain Name Dispute Resolution Policy, administered by NIXI), which mirrors the UDRP's three-element test, and direct registrar or court action when the transfer was the result of account compromise rather than a disputed registration claim. Evidence of the breach – login records, email headers, registrar communications – decides which track applies and how quickly a reversal can be sought. Both tracks are time-sensitive; delay compounds the harm.

The questions below address the most common situations we see in .in recovery work: which forum applies, what the registrar-lock mechanics look like, when a court is the better route, and what evidence you need to have ready.

When can I recover a stolen .in domain?

You can pursue recovery as soon as the unauthorized transfer is confirmed – and the earlier you act, the more options remain open. Where the domain was transferred without your authorization (account hijacking, unauthorized registrar-side change), the correct first step is an immediate registrar escalation: report the compromise, request a registrar lock to freeze further transfers, and document every communication in writing. Where the dispute is a trademark-based conflict – someone registered a .in that copies your brand – the INDRP provides a structured arbitration route. The two situations call for different responses, and confusing them costs time.

Who can recover a stolen .in domain?

Any person or entity that can show a prior right in the domain – the original registrant of record, a brand owner with trademark rights, or a legitimate assignee who holds chain-of-title documentation – can pursue recovery. For a straight theft scenario (account compromise, unauthorized outbound transfer), the original registrant's registration agreement with the registrar is itself the foundational right. For an INDRP filing, the complainant must additionally show rights in a corresponding name or mark. Eligibility for .in registration is a separate question: NIXI's eligibility criteria apply to who may hold the domain going forward, so confirming that the intended holder meets those criteria before filing is a necessary early step.

Does INDRP or a court decide a .in dispute?

The INDRP – the .in Domain Name Dispute Resolution Policy operated under NIXI's oversight – is the primary arbitration route for trademark-based .in disputes. Like the UDRP, it requires the complainant to satisfy three elements: the domain is identical or confusingly similar to a name or mark in which the complainant has rights; the registrant has no rights or legitimate interests; and the domain was registered or is being used in bad faith. The only remedies available through INDRP are transfer or cancellation – no damages, no cost awards. A court, by contrast, can award damages, grant injunctions, and order broader relief. Where the domain was stolen through account compromise rather than a disputed claim of right, a court action – handled with local litigation counsel in India – is often the more direct route, because INDRP is designed for name-rights disputes, not for reversing fraudulent transfers. In practice, registrar escalation runs in parallel with whichever formal proceeding is chosen; a registrar lock obtained early prevents a second unauthorized transfer while the case is pending.

For a preliminary read on whether INDRP, registrar escalation, or a court filing fits your situation, contact info@cognomenlaw.com.

What evidence decides the outcome of a .in recovery?

Evidence is the pivot in every .in recovery matter. For a theft-by-account-compromise claim, the essential record is: proof that you were the original registrant (historical WHOIS/RDDS data, registration confirmation emails, renewal receipts); a timeline of the unauthorized transfer (registrar logs, email headers showing phishing or spoofing, access logs showing logins from unfamiliar IP addresses); and contemporaneous communications with the registrar reporting the incident. For an INDRP filing, you additionally need evidence of your trademark or name rights, evidence that the respondent lacks any legitimate interest (no business under that name, no prior use), and bad-faith indicia (parking with pay-per-click links, a demand for payment well above registration cost, a pattern of similar registrations). Missing evidence is rarely fatal if gathered promptly; delayed collection – particularly of server logs, which registrars routinely purge – can be.

What are the registrar-lock and transfer-reversal mechanics for a .in domain?

A registrar lock (sometimes called a transfer prohibition or EPP status code clientTransferProhibited) prevents outbound transfer of the domain to another registrar. Requesting one immediately upon discovering unauthorized activity is the single most important protective step. NIXI and accredited .in registrars have escalation procedures for suspected theft; a written report to the registrar, citing the specific unauthorized transfer and requesting an emergency lock, is the standard opening move. If the domain has already moved to a second registrar, the lock request goes to that registrar. Transfer reversal – actually unwinding a completed transfer – requires the registrar to cooperate or to be compelled to do so by a court or registry directive. Indian courts have issued interim orders restraining registrars from processing further transfers, preserving the status quo while the merits are argued. We coordinate registrar escalation in parallel with any formal proceeding to keep both paths open.

What if the registrant does not respond?

Under INDRP, if the respondent fails to submit a response within the specified period, the arbitration panel decides the dispute on the complainant's submissions alone. A default does not mean automatic transfer. The panel still evaluates whether the three INDRP elements are satisfied on the record presented. That said, a well-constructed complaint supported by clear evidence of rights and bad-faith registration will ordinarily result in transfer or cancellation when the respondent offers nothing to contradict it. Panels have consistently held that default alone cannot substitute for substantive proof by the complainant. For a theft-by-compromise case before a court, default by the defendant leads to an ex parte order, but the same evidentiary standard applies: the court needs to be satisfied by the evidence on record.

Can the INDRP decision be appealed or challenged?

An INDRP decision is not final in the sense that either party may commence court proceedings to challenge the outcome. Where a panel orders transfer and the respondent seeks to contest that order, it must do so in a competent court in India within the period specified in the INDRP rules before the registrar implements the transfer. Courts in India have jurisdiction to review arbitration awards, including domain arbitration decisions, on established grounds under the applicable arbitration law. In practice, challenges to INDRP decisions are uncommon; most disputes are resolved at the panel level. However, if you are a registrant facing an abusive complaint – a complainant with weak trademark rights trying to take a domain you legitimately hold – building a strong response record at the INDRP stage is the surest way to avoid a transfer order, because appellate review of a reasoned panel decision on the merits is a higher bar to clear. Panels under the INDRP, like UDRP panels, also recognize reverse domain name hijacking where a complaint is brought in bad faith to deprive a legitimate registrant.

If you have received an INDRP complaint or face an adverse panel decision, email info@cognomenlaw.com to assess your options before the registrar implements any order.

What is the deadline once a case starts?

Deadlines under the INDRP track closely with UDRP timelines. Once a case commences, the respondent has 20 days to file a response – the same window as under the UDRP. Missing that deadline results in a default, and the panel proceeds on the complainant's record alone. On the complainant side, acting before WHOIS/RDDS data is masked or before server logs are purged is equally time-sensitive; the evidence window does not pause because a dispute has been filed. For court-based theft recovery, the timing of interim relief applications is case-specific, but the general principle holds: earlier action preserves more options. We regularly advise registrants and brand owners who contact us days after discovering a compromise – those are the cases where a prompt registrar lock and a rapid evidence-preservation step make the difference between a recoverable situation and a prolonged dispute.

Related at COGNOMEN

• Court action and domain theft recovery – full service overview for gTLD and ccTLD disputes
• Analysis: recovering a stolen .de domain – how the DENIC dispute entry and German courts compare
• Case study: proving legitimate interest across global zones in a contested UDRP