What Is Domain Hijacking?
Domain hijacking is the unauthorized takeover or attempted takeover of control over a registered domain name. It can involve unauthorized registrar transfers, changes to registrant information, compromised registrar accounts or changes to the DNS configuration that directs the domain.
What Does Domain Hijacking Mean?
A domain is normally controlled through a registrar account and the registration information associated with the domain. If an attacker gains access to the relevant account, email address or other authorization mechanism, they may attempt to transfer the domain, change ownership-related information or alter the services associated with it.
How Can a Domain Be Hijacked?
Compromised Registrar Account
An attacker who obtains access to a registrar account may be able to change domain settings or initiate actions affecting the registration.
Unauthorized Transfer
A domain may be transferred to another registrar without the registered holder’s authorization. ICANN transfer rules include authorization and transfer-control mechanisms intended to prevent unauthorized transfers.
Unauthorized Registrant Changes
Changing important registered-holder information without authorization can affect control over the domain and can also trigger transfer restrictions under applicable registrar and registry policies.
DNS Changes
An attacker does not always need to transfer the domain itself. If they can change nameservers or DNS records, they may redirect the domain to infrastructure they control while the registration remains at the original registrar.
What Should Domain Owners Monitor?
Registrar
Monitor for unexpected changes to the registrar associated with the domain. A registrar change that you did not authorize deserves immediate investigation.
Transfer Activity
Unexpected transfer or transfer-related status changes should be investigated quickly, especially when you did not initiate a transfer.
Domain Expiration
Monitor the registration expiration date so a missed renewal does not become a separate path to losing control of the domain.
DNS and Nameservers
Monitor important DNS records and nameserver configuration because domain ownership can remain unchanged while DNS is redirected to an unauthorized destination.
What Is Registrar Lock?
Many domains can be placed in a transfer-prohibited status at the registrar. For gTLDs covered by ICANN policy, this may appear as ClientTransferProhibited or a similar registrar lock. The purpose is to prevent transfers unless the required conditions are met.
ClientTransferProhibited
The exact status and transfer rules depend on the registry, registrar and applicable policy. ICANN’s current Transfer Policy defines requirements for ClientTransferProhibited and AuthInfo handling for covered transfers.
What Is an Auth-Code?
An Auth-Code, also called an Authorization Code, AuthInfo Code or transfer code, is a code created by a registrar to help authorize and protect a domain name transfer. Under ICANN policy, it is required for an inter-registrar transfer of a covered gTLD.
Auth-Code / AuthInfo / EPP transfer code
Is an Expired Domain the Same as a Hijacked Domain?
No. Expiration and hijacking are different situations. A domain can be lost because it was not renewed, while a hijacking involves unauthorized control or attempted control. An expired domain may still be recoverable depending on its lifecycle and registrar or registry status.
Domain Hijacking vs. DNS Hijacking
The terms are related but describe different layers. Domain hijacking concerns control of the domain registration itself or its management. DNS hijacking concerns unauthorized changes to DNS information that redirect traffic or services. A DNS compromise can therefore affect a domain without transferring the registration to another registrar.
What Should You Do If You Notice an Unauthorized Change?
Contact your registrar immediately and secure the account associated with the domain. Review recent account activity, transfer status and changes to registrant or DNS information. If the domain was transferred or registrant information was changed without authorization, ICANN provides complaint procedures for certain covered domains, but the registrar should be contacted first.
How Can You Reduce the Risk?
Protect the registrar account and the email address used for domain administration with strong, unique credentials and available multi-factor authentication. Keep registration information current, use transfer-lock features where appropriate, monitor expiration dates and investigate unexpected registrar, transfer or DNS changes promptly.
How Viglar Helps Monitor Domain Hijacking Signals
Viglar monitors externally visible domain information and can alert you to important changes such as registrar changes, transfer-related events, domain expiration problems and DNS changes. The goal is to give you an external signal when something affecting control of your domain changes.
Want to check your domain?
Run a quick external check with Viglar and inspect the domain and DNS signals currently visible from the internet.
Check Your Domain