Domain hijacking is the theft of a domain name registration, in which an attacker takes control of the domain at the registrar and can change its owner, DNS servers or transfer it elsewhere.
How domain hijacking works
Whoever controls a domain’s registrar account decides where the domain points. Attackers gain that control through:
- Account takeover – phishing, password reuse or a compromised email inbox used to reset the registrar password.
- Social engineering of registrar support staff to change contact details or disable protections.
- Compromise of the registrar itself or its reseller.
- Expired domains – registering a domain the owner forgot to renew, then reusing its reputation and email.
- Fraudulent transfer requests using a stolen authorisation (EPP) code.
Once in control, the attacker changes nameservers, which amounts to DNS hijacking of all services on the domain. In 2015 the Lizard Squad group redirected lenovo.com by compromising its registrar, and in 2021 the perl.com domain was stolen through a registrar account and moved to another provider before it was recovered.
Why domain hijacking matters
A hijacked domain gives attackers the organisation’s website, email and trust: they can host phishing pages on the genuine name, receive password-reset emails for linked accounts, obtain TLS certificates and redirect software update servers. Recovery may take days or weeks and often requires the registrar’s or ICANN’s dispute processes. It differs from cybersquatting, where the attacker registers a new, similar domain rather than stealing the real one.
How to prevent domain hijacking
- Protect registrar accounts with strong unique passwords and phishing-resistant MFA.
- Enable registrar lock and, for critical domains, registry lock.
- Turn on auto-renewal and keep contact email addresses on a different domain.
- Monitor WHOIS/RDAP data, nameserver changes and Certificate Transparency logs.
