How to recover a stolen .in domain under the applicable domain rules

How to recover a stolen .in domain under the applicable domain rules. UDRP and ccTLD domain recovery and defense across .in. Email the firm to assess your case.

Your .in domain disappears overnight. The registrar account shows a transfer you never authorized, the registrant contact has changed, and the domain is pointing somewhere else entirely. That is domain theft – and it requires a fast, sequenced response before the trail goes cold or a second transfer carries the domain out of reach.

To recover a stolen .in domain you have two primary routes: emergency registrar escalation to lock and reverse the unauthorized transfer, and a formal dispute under India's INDRP (the .in Domain Name Dispute Resolution Policy), which mirrors the core UDRP three-element test. Where those routes cannot reach – because the registrant is uncooperative, the transfer chain is complex, or you need an injunction – Indian court proceedings are the remaining path. Speed matters: most registrar lock mechanisms work only within a narrow post-transfer window.

This page covers the registrar mechanics, the INDRP process, the court route, the evidence that decides outcomes, and the realistic next step for a brand owner or registrant who has just discovered the theft.

What does "stolen .in domain" actually mean – and which rule governs?

A stolen .in domain is one transferred away from its legitimate registrant without authorization – through account compromise, phishing, social-engineering of the registrar, or fraudulent transfer requests. The term covers two distinct situations that call for different legal tools.

The first is pure theft: no dispute about ownership, but someone used a technical exploit or social manipulation to move the domain. Here, the primary remedy is the registrar escalation and transfer-reversal path, with court injunction available if the registrar does not cooperate.

The second overlaps with cybersquatting: a party registered or obtained the .in domain in bad faith, invoking your trademark or brand name. Here, the INDRP is the structured route. The INDRP is India's national dispute policy, maintained by the .IN Registry (NIXI) and administered through the INDRP Arbitration Centre. It closely tracks the UDRP: the complainant must prove all three elements of the applicable test – confusing similarity to a name or mark, no legitimate interest in the registrant, and registration or use in bad faith. The conjunctive burden is the same as under the UDRP's Paragraph 4(a), though practitioners should note that INDRP rules and NIXI's current procedural requirements should be confirmed with counsel at the time of filing, as registry procedures in smaller ccTLDs can change.

In our practice, we regularly see both situations in the same matter: an account compromise that transfers the domain to a registrant who then monetizes it. That combination requires both the theft-recovery track and, if the transfer reversal fails, a formal INDRP or court filing.

How does the registrar-lock and transfer-reversal process work?

The fastest and least expensive first step is a registrar escalation to freeze the domain and, where possible, reverse the unauthorized transfer – but it must happen quickly.

The first action is to contact both the losing registrar (where the domain was held before the theft) and the gaining registrar (where it now sits). Most ICANN-accredited registrars have an abuse or transfers team. The complaint must document: the account breach (server logs, phishing emails, unauthorized password-reset requests), the timeline of the transfer (WHOIS history, registrar transfer confirmation emails), and proof of your prior ownership (registration confirmations, DNS records, historical invoices, prior WHOIS screenshots).

ICANN's transfer policy provides a mechanism for disputed transfers: the losing registrar can raise a dispute with the gaining registrar. If the transfer was completed using a fraudulently obtained authorization code (auth code), most registrars will cooperate with a reversal on documented evidence. The practical window for this is narrow – act within days, not weeks.

Registrar lock is the parallel step. Request that the gaining registrar place a hold on any outbound transfer while the dispute is pending. Without a lock, a second transfer can carry the domain to a third party, who may then claim good-faith purchaser status. That is the scenario that most complicates recovery.

Where the registrar declines to act – or where the gaining registrar is uncooperative – a court order compelling the lock is the next escalation. Indian courts have issued interim injunctions in domain theft matters, freezing the domain pending trial. We coordinate that step through local litigation counsel in the relevant jurisdiction.

If you have just discovered the theft, the registrar escalation window is open now. To start the lock and reversal process for your .in domain, contact info@cognomenlaw.com immediately – we will assess your evidence and reach the relevant registrar contacts without delay.

When does the INDRP apply, and what must you prove?

The INDRP applies when the dispute concerns a .in domain and the complainant can demonstrate rights in a name or mark that the registrant is exploiting. It is administered through NIXI's designated arbitration centre and follows a process broadly analogous to the UDRP.

The three elements the complainant must establish are: (1) the domain name is identical or confusingly similar to a name, trademark, or service mark in which the complainant has rights; (2) the registrant has no rights or legitimate interests in the domain; and (3) the domain was registered or is being used in bad faith. Note that the INDRP, like the UDRP, requires demonstrating each element separately. Bad faith under the INDRP includes circumstances analogous to those in UDRP Paragraph 4(b): registration to sell to the mark owner, registration to disrupt a competitor, and use of the domain to attract users for commercial gain through confusion.

Safe harbors for the registrant mirror UDRP Paragraph 4(c): bona fide offering of goods or services before notice of the dispute, being commonly known by the domain name, and legitimate noncommercial or fair use.

The INDRP remedy, if the complainant succeeds, is transfer or cancellation – the same as the UDRP. No monetary award is available under the INDRP. Critically, the INDRP does not deliver the emergency interim relief that a theft situation demands. It is a structured proceeding with its own timeline. For pure theft – where speed is the governing factor – the registrar escalation and court injunction routes remain essential complements to an INDRP filing.

What evidence decides whether you recover the domain?

Evidence is the difference between a successful transfer reversal and a stalled dispute. Panels and courts look at the same core record: proof of prior ownership, proof of the compromise, and proof of what happened to the domain after the theft.

For the registrar escalation and court route, the critical documents are:

• Original domain registration confirmation and any renewal receipts, timestamped
• WHOIS screenshots showing your contact details before the transfer
• Email logs showing a phishing attempt, a social-engineering communication, or an unauthorized password-reset request
• Registrar transfer-confirmation email (typically sent to the registrant's email address; if your email was also compromised, document that separately)
• Server or web-hosting records showing continuous use of the domain up to the point of theft
• Any communication from the new registrant demanding payment or offering to sell the domain back

For the INDRP, the record also needs to establish your trademark or brand rights. Registered trademark certificates are the strongest foundation. Unregistered marks are cognizable, but you will need substantial evidence of reputation, use in commerce, and public recognition. In our experience, the cases that stall are those where the complainant has a strong mark but weak documentation of continuous use – a domain pointing to a live website with dated analytics exports, invoices, and press coverage is far more compelling than a certificate alone.

The registrant's conduct after the transfer is also evidence. Parking pages with pay-per-click advertising that trade on your brand's traffic, ransom-demand emails, or immediate redirection of your customers to a competitor – each of those patterns maps to a recognized bad-faith indicator and should be documented in screenshots with timestamps as soon as you discover them.

What the record must not contain is unsupported assertion. Panels deciding INDRP cases, like UDRP panels, apply the balance-of-probabilities standard. A credible, documented timeline of ownership followed by a documented breach carries the day. Vague claims of "hacking" without corroborating technical evidence do not.

When does a court route beat arbitration for a stolen .in domain?

Arbitration under the INDRP is the right tool when the dispute is about rights and use – a cybersquatting scenario where someone registered the domain in bad faith. It is not always the right tool for theft.

The court route becomes the better choice in four situations. First, where you need an emergency injunction to freeze the domain before a second transfer removes it from INDRP's reach. The INDRP has no interim-relief mechanism; an Indian court can issue an interim injunction within days on an ex parte application if the urgency is demonstrated. Second, where the theft involved criminal conduct – unauthorized computer access or fraud – that also warrants a police or cybercrime complaint running in parallel. Third, where you want damages in addition to recovery: the INDRP, like the UDRP, awards no monetary relief. A court action can pursue damages and costs. Fourth, where the domain is now held by a third party who claims to have purchased it in good faith. That party cannot be brought into an INDRP proceeding in the same way it can be joined as a defendant in court.

The trade-off is cost and time. Court proceedings in India are substantially more expensive than an INDRP filing, and the timeline is measured in months rather than weeks. The filing fee for the INDRP itself is a relatively modest official charge, compared with the legal fees and court costs of litigation. For most straightforward theft matters where the registrar cooperates, the escalation-plus-INDRP path is faster and less expensive. For high-value domains where the registrar will not lock and a second transfer is imminent, court action is the only reliable tool.

We handle the strategic assessment of which route fits and, where Indian court proceedings are required, coordinate with local litigation counsel in the relevant jurisdiction.

If a court injunction is needed to stop a second transfer, time is critical. To weigh INDRP against a court action for your .in domain, email info@cognomenlaw.com.

How does the INDRP compare with the UDRP for cross-border situations?

A brand owner protecting a name across both a global .com and an Indian .in faces two parallel rulebooks. Understanding the differences is essential to running an efficient multi-zone recovery.

The core test under the INDRP mirrors the UDRP, so the evidence file you build for one largely serves the other. The forum structure differs. WIPO and the Forum administer the vast majority of UDRP cases – together, they account for roughly 97% of all UDRP proceedings. The INDRP has its own dedicated arbitration centre under NIXI, with its own procedural rules and fee schedule. Filing a UDRP complaint for the .com and a separate INDRP complaint for the .in is standard practice in cross-border brand enforcement; the two proceedings run concurrently and are not mutually exclusive.

One practical difference: the UDRP has a well-developed body of published decisions and a WIPO Overview that gives practitioners reliable guidance on how panels apply each element. The INDRP has a smaller decision corpus, which means outcomes carry somewhat more variance at the margins. Where a .com UDRP case involves a well-settled fact pattern – classic parking page, obvious trademark match, no plausible legitimate use – the INDRP equivalent should follow similar reasoning, but the degree of published consensus is lower.

The remedies are identical: transfer or cancellation, no damages. The URS, which applies to new gTLDs and delivers suspension rather than transfer, has no direct equivalent in the .in zone. If the theft extends to new-gTLD domains registered at the same time, a URS filing at the relevant provider handles those; the .in domain is addressed separately through the INDRP or court.

In a recent cross-zone matter (a .com and a .in cybersquatting pattern, spring 2025), we filed concurrent proceedings and secured transfer orders across both zones within a single quarter, with the documentary record assembled once and adapted for each forum's procedural requirements.

What are the practical steps and realistic timeline?

The sequence matters as much as the strategy. Here is how a .in domain theft recovery typically moves.

Step 1: Document the breach immediately. Capture WHOIS records, DNS records, email logs, and screenshots of any changed registration data before anything else changes. This record is the foundation of every subsequent step.

Step 2: Escalate to the registrar within days. File a formal abuse complaint with both the losing and gaining registrars, enclosing your documentation. Request a transfer lock on any outbound movements. If the registrar confirms the transfer was unauthorized and reverses it, the matter may resolve at this stage.

Step 3: Assess the need for an emergency court order. If the domain is at imminent risk of a second transfer, or if the gaining registrar is uncooperative, the court injunction route opens. We assess this in the first 24–48 hours of engagement.

Step 4: Prepare and file the INDRP complaint (if registrar reversal is unavailable or incomplete). The complaint must satisfy the three-element test set out above, with the full documentary record attached. The INDRP process proceeds through the NIXI arbitration centre; the respondent has a set period to file a response, after which a sole arbitrator or panel is appointed and issues a decision. Verify the current procedural timeline with the Registry at the time of filing, as INDRP timelines should be confirmed against the Registry's current published rules.

Step 5: Registrar implementation. Once an INDRP transfer order or a court order is issued, the registrar is required to implement it. Allow additional time for the registrar to process and execute the transfer back to your account.

Realistic total timeline: where the registrar cooperates and reverses the transfer, resolution can come within days. An INDRP proceeding adds weeks. A contested court action adds months. The case that moves fastest is the one with complete, organized documentation presented at the first escalation.

How should you defend against an INDRP complaint if you are the registrant?

Not every INDRP complaint describes a genuine theft. Reverse domain name hijacking – an abusive complaint filed by a complainant who knows the registrant has legitimate rights – exists under the INDRP as it does under the UDRP. The INDRP recognizes that a finding of RDNH is available where the complaint was brought in bad faith to deprive a legitimate registrant.

If you hold a .in domain in good faith – you registered it before the complainant's mark existed, or you use it for a legitimate business that has nothing to do with the complainant's brand – the response must document that record clearly: registration date, business use, communications history, and any evidence that the complainant approached you seeking to purchase the domain before filing. That last fact is a significant RDNH indicator.

The INDRP respondent has a set period to file a response after commencement, broadly analogous to the UDRP's 20-day response window (confirm the current INDRP deadline with the Registry at the time of the complaint). Missing that window means a default, and defaults under the INDRP, as under the UDRP, typically result in transfer. Do not wait.

In a recent matter (a .in domain registered in good faith for a small regional business, autumn 2024), we built the legitimate-interest record, documented the registration date against the complainant's trademark filing, and secured a denial of transfer – establishing that the complainant had not met its burden on the bad-faith element.

If you have received an INDRP complaint and believe your registration is legitimate, contact info@cognomenlaw.com to build the response record without delay.

What is the cost structure for recovering a stolen .in domain?

Cost splits across three layers: registrar escalation fees, INDRP arbitration fees, and legal fees. Each is distinct and should be budgeted separately.

Registrar escalation is typically low-cost at the official level: most registrars process abuse complaints without a filing fee. Legal fees for preparing the escalation documentation and correspondence are the main cost at this stage.

The INDRP official arbitration fee is a relatively modest charge set by NIXI – confirm the current fee schedule with the Registry at the time of filing, as official fees in national procedures can change. It is substantially below the WIPO filing fee of USD 1,500 for a single-member UDRP panel (which applies to .com and other gTLDs, not .in). Legal fees for the INDRP complaint – preparing the complaint, assembling the evidence record, and managing the proceeding – typically fall in a range comparable to a straightforward UDRP matter, though the INDRP-specific procedural requirements and the theft documentation layer make the evidence preparation more intensive than a standard cybersquatting filing.

If the court route is required, the fee structure shifts substantially. Court filing fees in India are set by statute on a claim-value basis, and legal fees for contested proceedings are both higher and time-based rather than flat. We provide an estimate at the assessment stage once the scope is clear.

COGNOMEN publishes transparent price ranges rather than requiring a discovery call to learn what a matter costs. For .in domain theft recovery, the range depends on whether the matter resolves at the registrar stage, proceeds through the INDRP, or requires court action – and on the volume and complexity of the evidence record. Email us for a scoped estimate based on your specific facts.

Related at COGNOMEN

• Court action and domain theft recovery – overview of all routes where arbitration cannot reach
• Guide: recovering a hijacked .io domain – registrar escalation and transfer-reversal mechanics in detail
• Analysis: filing a UDRP complaint globally – cross-zone strategy and forum selection across gTLD zones