Domain Hijacking Explained
What Domain Hijacking Is
Domain hijacking is the unauthorized takeover of a domain name, usually by moving it to another registrar or changing its contact details without the owner's consent. The thief then controls the domain, along with any website, email and services that depend on its DNS settings.
The harm can be serious. A hijacked business domain can disappear from its website and email within hours, and getting it back can take a lot of time and proof of ownership.
Common Ways Hijacking Happens
Several methods are common. The first is account takeover: an attacker gets into the owner's registrar account through a weak or reused password, or through a fake login page. The second is social engineering, where someone impersonates the owner to a registrar's support team and asks for changes.
A third method exploits contact details. Many registrations rely on a contact email to confirm changes and receive notices. If that address belongs to a domain that has expired or is no longer watched, someone may buy the old domain and use it to reset passwords or approve transfers. A stolen auth code can also start an unwanted transfer, which is why the code should stay private.
Protective Steps That Reduce Risk
Owners can lower the risk in a few ways. Keep the registrar account protected with a strong, unique password and the strongest login protection the registrar offers. Keep the contact email addresses on domains you control and renew, and make sure someone watches the notices sent to them.
Registrar locks block transfers, and some registries offer an extra manual check called registry lock for high-value names. Read more about locks in registrar lock. Keep auth codes private and treat any unexpected request for one as suspicious.
Example: The Expired Contact Email
A family business uses a contact email on a domain that belongs to a former employee. When that small domain expires, a stranger buys it. The stranger uses the email to reset the registrar password, moves the business domain to a new registrar and changes the nameservers. The business loses its website and email until it proves ownership and recovers the domain through the registrar's process.
Frequently asked questions
How can I tell if my domain was hijacked?
Warning signs include unexpected notices of a transfer, a changed registrar or nameservers, a website or email that suddenly stops working, and contact details you do not recognize. Log in to your registrar account and check the domain's details directly, not through links in an email.
Is domain hijacking the same as phishing?
Not exactly. Phishing is a method of tricking people into giving up login details, often through fake emails or pages. Hijacking is the result, a domain taken over without consent. Phishing is one of several ways a hijacking can happen.
What should I do if my domain is hijacked?
Contact your registrar immediately and explain what happened, and ask for the domain to be reviewed and secured. Keep records such as dates, emails and proof of ownership. If the registrar cannot help, legal advice and a court order may be needed.