If your domain has been hijacked, lock down the email account your registrar writes to before anything else, then regain control of the registrar account. Record the current WHOIS data and nameservers, report the incident to your registrar in writing and ask them to freeze transfers. For .com and other gTLDs, an unauthorized transfer can be reversed through ICANN's dispute process.
People rarely notice the domain first. They notice the symptoms: the website shows someone else’s page, customer emails bounce, or an email arrives saying a transfer authorisation code was requested, and nobody on the team asked for one. When a domain is hijacked, the first hours decide how hard recovery will be. So the checklist comes first and the explanations follow.
Domain hijacked: your first 60 minutes
Work through this in order. The order matters, because whoever controls your inbox can reset any password you have just changed.
- Secure the mailbox, not the domain. That means the email address your registrar has on file. New password, two-factor login on, all other sessions signed out, forwarding rules checked. Attackers like to add a quiet forward.
- Log in to the registrar. If you can, change the password and set up 2FA again from scratch. If you can’t, skip to step 4.
- Record what you see. WHOIS output, current nameservers, a screenshot of the website, the time. You will need this evidence.
- Contact the registrar. By phone if they offer it, and in writing to support or the abuse address. Ask explicitly for transfers and data changes on the domain to be locked.
- Report it. In the US, the FBI’s IC3 takes reports of cyber-enabled crime. In England, Wales and Northern Ireland it is Report Fraud. Other countries have their own police channels.
- Contain the fallout. Banks, payment providers and every service that sends password resets to an address on this domain are now at risk.
What WHOIS tells you
A hijack leaves traces in the registry data. For a .com domain, run:
whois example-company.com | grep -iE "registrar:|name server|updated date|domain status"Here is what the status lines look like for a well-protected domain, using google.com as a real example:
Registrar: MarkMonitor Inc.
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibitedThree things matter in your own output. Registrar should be the company you pay. If it isn’t, the domain has been transferred away. Name Server should be the provider you chose. Updated Date shows the last change; a date in the last few days that you can’t explain is your evidence. If clientTransferProhibited is missing, someone may have removed the lock as a first step.
How domains usually get hijacked
The registry itself is almost never breached. The route runs through people and accounts:
| Route | What happens | What helps |
|---|---|---|
| Stolen registrar password | Phishing or a password reused from a breach | Unique password, 2FA |
| Compromised mailbox | Attacker resets the registrar password via email | 2FA on email, contact address on a different domain |
| Social engineering | Someone impersonates you to registrar support | Registry lock, agreed verification steps |
| Expired domain | Missed renewal, deletion, re-registration by a stranger | Auto-renew, current payment details |
| Compromised DNS host | Records change, not the registration | 2FA at the DNS provider, DNSSEC |
The second row is underrated. If the email address on your registrar account lives on the very domain you are protecting, you have a loop: whoever redirects the domain gets your email, and with it the reset link. An address with an unrelated provider breaks the loop.
If the nameservers are correct, look elsewhere. A compromised site is covered in website hacked: what to do, and altered records are covered in DNS hijacking.
Getting the domain back
That depends on where it is now.
Still at your registrar. The best case. Once the registrar is satisfied you are the rightful registrant, it can restore contacts and nameservers. Invoices, earlier confirmation emails and ID help. The account side is covered in registrar account hacked.
Moved to another registrar (gTLD). For .com, .net, .org and the newer gTLDs, ICANN’s Transfer Policy applies. An unauthorised transfer can be reversed through the Transfer Dispute Resolution Policy, which registrars initiate. So your registrar is the right contact, not ICANN. If the registrar stalls, ICANN Contractual Compliance accepts complaints about registrars that ignore their obligations.
Country-code domains. A .co.uk, .de or .fr domain follows its registry’s rules, not ICANN’s. Your registrar remains the first contact, and the registry may have its own dispute or recovery procedure. If the domain is valuable and the registrar can’t help, a short consultation with a lawyer who handles domain disputes is money well spent.
One special case: the domain wasn’t stolen but expired and was deleted. Most gTLDs have a 30-day redemption period in which the former registrant can restore it for a fee. How to avoid that is in prevent domain expiry.
Why email is the real problem
A defaced homepage is embarrassing. The MX record is dangerous. Whoever controls it receives every message sent to your domain, including “reset your password” emails from your bank, accounting software, cloud storage and social accounts.
Once the domain is back, check:
dig MX example-company.com +short
dig NS example-company.com +shortWhen the values are right again, change passwords for every service tied to an address on this domain, and check those services’ security logs for sign-ins during the period the domain was out of your hands.
Stopping it from happening again
Three measures cover the common routes: two-factor login with an app or security key rather than SMS, a transfer lock and, for important domains, a registry lock, and DNSSEC so forged answers get caught. For the last one you need a registrar with DNSSEC support for .com.
If the domain carries your business, register the obvious typo and extension variants too. A search for spellings of your own brand shows what is still free, and betadomain’s fixed yearly prices, renewals included, keep a handful of defensive domains affordable.
Next step: set up two-factor login on your registrar account. The guide is at 2FA for domain accounts.
Step by step
- Secure the mailboxChange the password of the email account linked to your registrar, turn on 2FA and sign out all other sessions.
- Secure the registrar accountReset the password, re-enrol 2FA and remove unknown users, API keys and forwarding rules.
- Document the current stateSave WHOIS output, nameservers and screenshots with timestamps before anything changes again.
- Report to your registrarPhone and write to the registrar's support or abuse address and ask for transfers and changes to be blocked.
- Report the crimeFile a report with the police or national fraud reporting service and pass the reference number to your registrar.
- Restore DNS and reset passwordsPut nameservers and MX records back, then change passwords for every service that sends resets to addresses on the domain.
Found your domain? You can check and register it directly at betadomain – yearly price from €2.99.
FAQ
Can I get a stolen domain back?
Often, yes, especially if you act quickly and can prove you are the rightful registrant with invoices, old WHOIS records or account emails. For gTLDs such as .com, ICANN's Transfer Dispute Resolution Policy gives registrars a defined route to reverse an unauthorised transfer. Country-code domains follow the rules of their own registry.
Should I contact ICANN directly?
ICANN does not handle individual recoveries. Start with your registrar, which can open a dispute with the gaining registrar. If your registrar does not respond or ignores its obligations, you can file a complaint with ICANN Contractual Compliance.
How do I know whether it was the domain or just the website?
Check the nameservers with a WHOIS or dig query. If they are still the ones you set, the domain itself is probably fine and the problem lies with your hosting or DNS provider. Unknown nameservers or a different registrar mean the domain has been taken over.
Is an expired domain the same as a hijacked one?
No. If the domain lapsed and someone registered it after deletion, nobody broke in; a renewal was missed. For most gTLDs there is a 30-day redemption period after deletion in which the previous registrant can still restore it for a fee.