Delhi HC HBO order: mirror blocking, technically verified

On 27 July 2026 Justice Anup Jairam Bhambhani granted Home Box Office and its co-plaintiffs an ex-parte ad-interim injunction against 30 “rogue website” operations in Home Box Office Inc & Ors v. Streamzy.to & Ors, CS(COMM) 740/2026 (Delhi High Court). Schedule A to the order runs to entry 139 and lists the domains behind Streamzy, KissKH, LordFlix, FMovies, YTS, MoviesMod, VegaMovies, 5MovieRulz, FilmyZilla, UHDMovies and others; twenty domain-name registrars (Dynadot, NameCheap, Tucows, Key-Systems, Porkbun, NameSilo, IONOS, Spaceship and more), nine ISPs and the Department of Telecommunications and MeitY are joined as defendants 31–61 and directed to suspend, block and notify.

The part worth reading is what happened next. Counsel for two registrars accepted they had “no hesitation” blocking the listed sites, but objected to the blanket dynamic relief sought: extending the injunction to any future mirror on the plaintiffs’ say-so would force a neutral intermediary to adjudicate. The court agreed with the principle, invoking s. 79 of the IT Act and Shreya Singhal: an ISP or registrar “is not equipped nor authorised in law” to decide what is a rogue website, and plaintiffs “cannot be permitted to assume unto themselves the authority to identify and disable websites”.

So the order splits the task (para 21). Plaintiffs who find a mirror/alphanumeric/redirect site furnish the registrar or ISP with an affidavit and supporting evidence; the intermediary then performs a purely technical verification that the domain is in fact a mirror of an enjoined defendant, and if so enforces the existing injunction as a pro-tem measure. Simultaneously the plaintiffs must file an Order I Rule 10 CPC application to implead the new site. Baseless or non-bona-fide assertions “invite appropriate orders from the court”, and the intermediary keeps liberty to come back and ask not to block. Pleadings go before the Joint Registrar on 28 October 2026.

Why it matters

Dynamic and “dynamic+” injunctions have become the standard Indian answer to whack-a-mole piracy, and the open question was never whether mirrors get blocked — it was who decides. This order answers it: the intermediary’s role is technical, the court’s role is adjudicatory, and the rights-holder’s affidavit is the operative instrument that carries the risk. It is also a map of the infrastructure: nearly every domain in Schedule A resolves to the same 104.21.x.x / 172.67.x.x Cloudflare ranges that sit in front of the clone networks in our own verticals.

Counsel’s note

Ihor Makushinsky · senior counsel

Studios get the headlines from these orders, but the mechanism is the one brand owners need. Enforcement against a single domain is a receipt, not a remedy: the operator moves to a mirror before the block propagates. An order that reaches the next domain — without a fresh hearing each time — is the only version that changes the economics.

The price of that reach is evidence discipline, and this order makes it explicit. What the registrar’s technician can act on is narrow and factual: shared branding and content source, the same operator fingerprints, overlapping IP and DNS records, redirect chains from the enjoined domain. If your monitoring stack cannot produce that on affidavit for each new domain, you do not have a dynamic remedy — you have a list. And because false assertions now carry a stated cost, automated mirror detection needs a human pass before anything is sworn.

Note the venue point too: the registrars in Schedule B are US and EU companies, and cooperation was obtained through an Indian court on the strength of Indian traffic. Where clones target a market, that market’s courts are worth pricing before defaulting to the registrar’s home jurisdiction.

What this means for you

If clone or mirror sites are your problem, build the evidence pipeline before the pleading: preserve WHOIS and DNS history, capture the redirect chain, and keep the mirror-identity proof in a form a third party can verify in minutes. Our guides on taking down a casino clone and finding the real host behind Cloudflare cover the groundwork this kind of order runs on.