As mentioned in this blog post, the domain transfer was done as part of an international operation against the Avalanche botnet. As such, it was a legal action as opposed to an administrative action. Further, the action was taken at registry level as opposed to registrar level (which is one level lower than the registry). Therefore, no EPP code was necessary and the "clientTransferProhibited" domain transfer record was ignored.

It seems like there should be a notification after the fact so legitimate domain owners have a chance to reach someone who is in the know.

It looks like here the whole domain transfer was bypassed on the pretext of a possible botnet participation. The OP is absolutely right. Domain transfer needs to be much more robust than this.

The FBI and analogous TLAs do this all the time. And generally, there's no recourse.

In many cases, sites have resorted to distributing their IP addresses.

Personally I’d rather deal with the FBI accidentally seizing a domain than some foreign entity.

The National Internet Exchange of India shouldn't be a foreign entity for holders of .in domains.

> Shadowserver Foundation

The Foundation didn't seize the domain, it just suggested to the NIXI that they should do so.

“Why did you seize our domain?”

“Shadowserver said it was bad”

“But it’s not bad”

“Take it up with them. I hope you speak German.”

You'd be in luck, the Shadowserver Foundation is essentially a proxy for the FBI.

They control various seized assets seemingly unrelated to their publicly stated mission, like libertyreserve.com. Shadowserver used to host the seizure page for liberty reserve too.

That’s a pretty big claim. Source?

Here you go https://www.justice.gov/sites/default/files/usao-sdny/legacy...

The Liberty Reserve connection arouses suspicion, no?

.in is a ccTLD, so there are no requirements on its transfer process whatsoever. There are plenty of ccTLDs out there that don't use EPP at all, and simply maintain everything in a hand-edited database or provide a web console (but not programmatic interface). I doubt that .in is one of these ccTLDs that doesn't support EPP, because the big ones tend to support it for obvious scaling reasons, but there's still no protections being offered because the Indian government can always just do what it wants, like provide an API to an anti-botnet company in Germany that can instantly yank any domain name it wants to.

A registry is little more than a DB at heart. In EPP you'd of course send a request with password, it'd go pending Transfer, need to be acked, etc. But nothing stops an employee from just changing things manually, outside of company policy and restrictions. Due to the large amount of immediate domain takedown requests(usually some danger or highly illegal activity involved), there's always a process in place. It sounds like this fault lies on the Gov't agency making the request, for not doing its due diligence prior.