New Delhi: In a ruling that could reset the rules of online brand protection, the Delhi High Court last week empowered FMCG major Dabur to shut down new fake websites impersonating its brand without filing a fresh lawsuit for each infringement.
In another step aimed at curbing online fraud, it also directed banks, domain name registrars and the government to take steps to close loopholes that allow the proliferation of such scams.
For years, online brand protection has been losing what critics have called a “battle of whack-a-mole”—courts have routinely ordered infringing domains to be taken down, only for near-identical websites to reappear within days, often with the same content. For brand owners, enforcement has meant chasing URLs one by one, while fraudsters stay a step ahead.
This cycle was at the heart of Dabur’s plea before the high court, where it argued that conventional trademark remedies were failing in the face of the new online fraud model.
In a 248-page verdict in Dabur’s case, the high court allowed Dabur to file simple affidavits for new domains as what are known as “dynamic” or “dynamic plus” injunctions, thereby blocking similar domain names as they surface under existing court orders.
Unlike static injunctions, dynamic injunctions block current fake websites and their mirrors, while dynamic-plus injunctions go further, allowing rights holders to proactively block future works to provide anticipatory protection against piracy.
The court examined how fake websites are enabled by domain name registrars, privacy-protection services, and delays in banking responses, and how these gaps together allow fraud to scale.
ThePrint explains what the ruling means.
The ‘whack-a-mole’ problem
Dabur first approached the high court in 2022 after discovering websites, such as daburdistributor.com and dabur distributorship.in, that falsely claimed to offer official Dabur distributorships and franchises.
These websites imitated Dabur’s branding and, in some cases, even displayed the company’s real office address. Prospective applicants were asked to deposit registration fees into bank accounts that had no connection with the brand.
Although the court passed interim injunctions blocking these websites, it noted that new websites continued to appear. As soon as an injunction was issued against one site, mirror websites with similar names and layouts would spring up.
The registrants behind these domains could not be identified as WHOIS records disclosed masked or fictitious details. WHOIS is a public database used to trace the ownership and tenure of a domain name.
Dabur’s case was heard along with a batch of similar matters relating to domain names facing comparable fraud.
The court noted that ordinary trademark remedies had failed because fake domain names were registered quickly, used to collect money for a short period, and abandoned once complaints were raised.
“Even before the trademark owner is able to take action, the bank account is almost empty… Thereafter… further domain names/websites [are] registered and opened,” the court observed.
Justice Prathiba M. Singh noted that this repetitive cycle made it impossible for brand owners to chase every new URL individually.
Also Read: Why HC registry refused to delete names of Akshay Kumar, PVR & INOX from Bata’s Jolly LLB 2 suit
Cracking down on banks and regulators
To break this cycle, the court said that registrars must disclose registrant details and payment trails for a domain or domain-related services. This is intended to enable law enforcement agencies to trace financial trails linked to fake websites.
Crucially, the court mandated that domain name registrars (DNRs) must provide this data within 72 hours of a request from law enforcement or courts.
The court also noted delays by banks in responding to law enforcement requests, observing that victims often lose money irreversibly within hours. It said that “innocent customers [are] being duped of substantial sums of money” due to these slow responses.
Banks were directed to comply strictly with Reserve Bank of India-backed standard operating procedures, appoint nodal officers, and act promptly on requests to freeze suspect accounts.
The high court also reiterated that banks must implement the RBI’s “Beneficiary Bank Account Name Lookup” facility, allowing payers to verify the actual name of the account holder before transferring money.
It also directed the IT ministry, the home affairs ministry, and other authorities to hold stakeholder consultations to frame a policy for accrediting domain name registrars and consider a nodal agency to blacklist registrars that fail to comply with orders.
It further said that the government could enforce Section 69A of the IT Act, which allows the government to block not just individual infringing websites, but also the platforms themselves, such as DNRs, if they continue to facilitate fraud.
Dynamic shields, limitations to privacy protections
To deal with the recurring registration of fake domains, the court endorsed the use of “dynamic” and “dynamic plus” injunctions.
Unlike standard orders, these allow brand owners to extend existing injunctions to newly discovered infringing domains through simple affidavits, without the need for filing fresh suits for each new domain registered.
The HC noted that without such mechanisms, enforcement would remain perpetually behind fraudsters.
Domain name registrars argued that they are neutral technical “intermediaries” with no role beyond registering domains.
However, the court rejected this position, referring to it as unsatisfactory, particularly in cases involving well-known trademarks such as Dabur.
“Such DNRs may, therefore, not merely be considered as intermediaries but as complicit in actively enabling infringement,” the court noted.
It said registrars cannot remain passive once infringement or fraud is brought to their notice. They can be directed to lock or suspend infringing domains, maintain the status quo, and prevent transfers that would defeat court orders.
One major issue before the high court was the use of “privacy protect” services by such registrants to protect their details, which allows them to evade responsibility for immediate action against fraudulent domains.
Privacy protection is an add-on service that hides the registrant’s personal details (name, address, email, phone) from the public WHOIS database, replacing those details with proxy information. It is often available for a small fee.
The court acknowledged that privacy protection has legitimate uses but noted that such features are increasingly being exploited by fraudsters.
“The privacy protect feature extended by DNRs is acting as a cloak to hide the identity of those perpetrating illegal and unlawful acts on the internet,” the court observed.
The court warned that privacy protection cannot override enforcement, and where a prima facie case of impersonation or fraud exists, registrars must disclose whatever registrant information they possess.
(Edited by Sugita Katyal)