Domain seizures reveal registrar account security flaws

Recent cases involving the hijacking of domain names belonging to Indian organizations have highlighted security risks associated with domain registrar accounts. Two separate Uniform Domain Name Dispute Resolution Policy (UDRP) proceedings revealed that account security measures, such as two-factor authentication, were inadequate, and credentials had been previously exposed. In these instances, domain names were transferred without the owners' knowledge, yet they continued to redirect to the victims' own websites, making the hijack difficult to detect.

The first case involved Shri Dharmasthala Manjunatheshwara Educational Society, which lost control of its domain, shridharmasthala.org, in June 2026. Logins to the registrar account were detected from Sweden, Switzerland, and Japan. The account lacked two-factor authentication, and the associated email address had appeared in prior data breaches. In September 2026, a UDRP panel ordered the domain's return to its original owner.

The second case concerned Indira IVF Hospital Private Limited, which discovered its domain, indiraivf.com, missing in January 2025, having been transferred out in October 2024. The domain's service provider reported suspicious account activity from an unfamiliar location. The domain had been transferred to Hostinger. The company eventually regained its domain, but the dispute resolution process did not assign responsibility for account security.

Both decisions noted that the continued redirection of hijacked domains to the original website could indicate bad faith, as the hijacker retains control over the redirection, creating an ongoing threat. These cases underscore the critical need for domain registrars and users to strengthen account security measures, particularly concerning credentials and the implementation of robust authentication protocols.