Domain theft is the unauthorized transfer or control of a registered domain name, and it rarely looks like hacking in the movie sense. In the files we reviewed, domain names were lost because someone got into the registrar account, deceived a support desk, or was trusted with access and kept the keys. This Domain Theft Report 2026 analyzes nine documented matters involving more than a dozen domain names, drawn from the case files of DNAccess and of DNProtect, where our founder handled stolen domain recoveries before DNAccess was formed in 2023. It is a qualitative case review, not a statistical survey. It shows how domain theft happens, what follows, and which remedies fit which facts, not how often it occurs. Where public research measures the same problem at scale, we pair our observations with that data.
Key findings
Seven findings stand out, each pairing what we saw in the files with public data where it exists.
Account access was the dominant path to theft
In six of the nine matters, the owner lost control after someone gained access to the registrar account and made an unauthorized transfer or change. The defense against this kind of domain theft exists but remains uncommon: only 24% of Forbes Global 2000 companies use registry lock (a registry-level hold that blocks changes until the registrar verifies the request out of band), up from 17% in 2020, according to the CSC 2024 Domain Security Report.
Vendors and developers are a distinct risk
Two of the nine matters involved no outside attacker. A web developer in one and a publishing services vendor in the other used legitimate access to move domain names into their own accounts and refused to return them. In DSPT International v. Nahum (9th Cir. 2010), the Ninth Circuit held that holding a domain name for ransom can be bad-faith use under the Anticybersquatting Consumer Protection Act, as the court’s opinion explains.
Stolen names often moved to a registrar in another country
In four of the nine matters, the domain was moved to a registrar in another country. That adds a language and a legal system the owner does not know, and leaves the gaining registrar deciding whether the domain comes back.
Monetization followed quickly
In three matters, the nameservers (the servers that tell the internet where a domain’s website and email live) were pointed at parking or pay-per-click advertising, and in three the domain was offered for sale or resold. Nameserver control is a hijacking vector at internet scale: researchers found that 163,827 domains, 31.95% of those exposed through so-called sacrificial nameservers, were hijacked between 2011 and 2020, as reported in Risky BIZness (ACM IMC 2021).
Registrar disputes decide procedure, not ownership
In two matters, a registrar-level dispute concluded without settling who owned the domain. That is by design. Under ICANN’s Transfer Dispute Resolution Policy, only the gaining or losing registrar may file, the deadline is twelve months after the alleged violation, and the remedy is limited to approving or denying the transfer, according to the ICANN Transfer Dispute Resolution Policy text.
The UDRP works when the facts fit it
The one UDRP complaint filed and decided in these files, for Patterns.com, succeeded because the panel treated the fraudulent acquisition itself as bad-faith registration and accepted documented common-law rights. Complainants obtained the disputed domain in about 78% of UDRP cases from 2013 through 2020, according to ICANN’s UDRP Status Report, but that rate covers cybersquatting generally, not theft, which is why fit matters.
Recovery is not the end of the matter
Patterns.com was recovered and then stolen again, and Make a Home Foundation’s domains remain with the web developer who took them. Both argue for prevention, not only remedies.
Methodology
The sample consists of nine matters: two named case studies, Patterns.com and Make a Home Foundation, and seven anonymized matters we call cases A through G. Patterns.com was handled in 2021 and 2022 by Bill Hartzer, then Director of DNProtect and now founder of DNAccess; the other matters date from 2023 onward and were handled by DNAccess.
For each matter we recorded one primary method of loss, the signals visible afterward, and the remedies used or prepared. A matter can appear in more than one signal count. Anonymized matters are described by type only; we do not identify their domains, owners, or anyone who took or holds a domain, and we make no claims about their outcomes. Narratives are on our domain recovery case studies page.
The limits are real. Matters brought to a recovery firm over-represent difficult facts and say nothing about thefts a registrar reversed within hours. The public statistics come from separate studies with their own methods.
How domains are taken
Every matter fell into one of three patterns, and each pattern leaves different evidence and points to a different remedy. The mechanics are explained in our guide to domain hijacking.
Account access followed by an unauthorized transfer or change (6 of 9)
This was the most common route to domain theft, seen in cases A, B, C, D, E and G. In case C, a four-letter .com held at one registrar since 2013, two-step verification was disabled and the registrant changed before the domain went to a European registrar. In case B, a foundation’s domain after its founder’s death, WHOIS history (the archived record of a domain’s past registration data) showed the registrant data switched to privacy about 18 months before the transfer, a common sign that an account has been accessed and prepared. In case G, a domain that seemed to have expired had in fact been renewed, pointing to account access and deletion. Whoever controls the login controls the domain. Our guide to domain transfers explains why a transfer carrying a valid authorization code is processed as legitimate.
Support-desk fraud with forged identification (1 of 9)
Patterns.com was taken without a password. In September 2020, according to the transfer dispute decision, the registrar received an email-change request supported by identification documents later found to be fake. The account email was changed on September 12, a password reset on September 14 gave the requester control, and the domain was transferred to a registrar in China on September 21. Strong passwords do nothing against this kind of help-desk deception; registry lock and account-level verification do, because they require a confirmation the impostor cannot provide.
A vendor or developer moving domains into its own account (2 of 9)
In Make a Home Foundation’s matter, a web developer hired to build a new site used access to the registrar account to transfer the foundation’s domains to himself, then demanded additional payment for their return. In case F, an author and publisher gave a publishing services vendor access to her hosting account, and the vendor pushed all four of her domains into its own account, citing a billing dispute. Nothing was hacked. The access was given willingly, and the owner often has no separate login to fall back on.
What happens after a theft
A stolen domain does not sit idle. The signals below recurred across the files, and each is visible in public records.
A move to a registrar in another country (4 of 9)
Patterns.com went to a registrar in China, case A to a registrar in Asia on a Saturday in December 2023, case C to a European registrar, and one of the case E domains from a large US retail registrar to a European registrar. In each, the owner’s registrar could ask, escalate and file, but the gaining registrar decided whether to cooperate.
Nameservers pointed at parking or pay-per-click (3 of 9)
In Patterns.com, case B and case D, the nameservers were changed to send visitors to parking or pay-per-click pages. In case B this happened on the day the transfer completed. In case D, a parking change came two weeks before the domain was resold. A parking change is often the first public sign of a theft, which is why nameserver and DNS records deserve the same watch as the registration. Our explainer on domain parking covers how these pages earn money.
Offered for sale or resold (3 of 9)
Patterns.com was offered for sale after the first theft, case C later appeared listed for sale, and case D was resold to a third party. Each resale adds a party who may claim to be an innocent buyer, which complicates recovery.
A registrar-level dispute that did not settle ownership (2 of 9)
In Patterns.com, Network Solutions filed a Transfer Dispute Resolution Policy complaint, and the panel approved the transfer because the gaining registrar had followed the normal process; fraud on the registrant was not a breach of the Transfer Policy. In case C, the losing registrar’s dispute was closed in May 2020 after the gaining registrar concluded the transfer was valid. Both outcomes addressed procedure, not ownership.
Remedies, and why registrar-level routes have limits
The files used six remedies, and choosing the wrong one first can cost weeks. Start with the fastest cooperative route, then escalate to one that decides ownership.
Registrar escalation and the TDRP
When a transfer is fresh, the losing registrar is the first call. In case A, monitoring alerted the owner the same day, the losing registrar advised a transfer dispute, and DNAccess helped prepare the unauthorized-transfer statement and evidence. ICANN’s Transfer Policy requires a human response from the gaining registrar’s Transfer Emergency Action Contact within four hours, as noted in the ICANN Transfer Policy Review working group materials. The limit is structural. The TDRP asks whether the transfer rules were followed, and when a thief holds a valid login and authorization code, they usually were.
TURF affidavits
The Transfer Undo Request Form, or TURF, reverses an unauthorized transfer when the gaining registrar cooperates. In both case E matters, DNAccess prepared TURF affidavits stating ownership and non-authorization, to be notarized with photo identification. When the gaining registrar is willing, this is the fastest path; our TURF guide explains the sworn statement.
The UDRP
The UDRP (Uniform Domain-Name Dispute-Resolution Policy) is an administrative proceeding for domains registered and used in bad faith against a complainant’s trademark rights. It was filed and won in Patterns.com, prepared in Make a Home Foundation’s matter, and outlined as the next step in case B. Unlike the TDRP, it can order the domain transferred to the owner, but it requires trademark rights, registered or common-law, and evidence of bad faith. WIPO received a record 6,282 UDRP-based complaints in 2025, according to the WIPO Standing Committee on Trademarks update SCT/49/2.
Negotiation through counsel, cease-and-desist letters and opinion letters
Once a registrar dispute is closed, as in case C, the remaining paths are negotiation, the UDRP or court. In case C, DNAccess’s forensic research identified the current registrant, and outreach began through counsel familiar with that registrant. In case D, fraud cases were opened with ICANN and the registrar, and a cease-and-desist letter went to the party that received the domain, backed by renewal receipts, DNS history and archived pages. In case F, a written opinion letter documented that the four domains were registered before any business with the vendor and that no permission to move them was given, separating the billing question from the ownership question.
Every remedy depends on evidence. Renewal receipts decided whether case G was an expiration case or a theft case, and the old registrant email address on file was the key evidence in case B. In Kremen v. Network Solutions, 337 F.3d 1024 (9th Cir. 2003), the Ninth Circuit held that a registrant has an intangible property right in a domain name, as set out in the Kremen v. Network Solutions opinion.
The case for prevention
Every remedy above starts after the loss. The controls that would have stopped most of these thefts are well understood and still underused.
Registry lock remains a minority practice
Registry lock works because the registry will not process a transfer, deletion or contact change until the registrar confirms the request through a separate, verified channel. A stolen password or a forged ID does not satisfy that check. CSC reported registry lock use at 24% among the Global 2000, rising to 45% among companies using enterprise-class registrars, in the CSC 2024 Domain Security Report. If adoption is that low among the largest companies, smaller owners should not assume their domains have it.
The DNSSEC gap
DNSSEC (Domain Name System Security Extensions, which cryptographically sign DNS data so forged answers can be detected) is common at the top of the hierarchy and thin below it. About 92.2% of TLDs in the root zone were signed as of October 2021, but only about 5% of second-level domains, according to the European Commission Joint Research Centre DNSSEC analysis; CSC put Global 2000 adoption at 9%. It does not stop an account takeover, but it lets validating resolvers reject forged DNS answers.
Redacted registration data makes theft harder to see and prove
Public registration data used to show who held a domain. Interisle found that publicly available contact data fell from 82% of gTLD records in 2010 to 13.5% in 2020, in its WHOIS Contact Data Availability and Registrant Classification Study. Since the WHOIS sunset, gTLD data is served over RDAP (Registration Data Access Protocol), much of it redacted. For a theft victim, the registrant record captured before the hijack, from your own files or from archives, may be the only proof of what the record used to say. Cases B and G both turned on archived records of that kind.
Lookalike and phishing domains extend the threat
Not every attack takes the real domain. Many attackers register a near-copy and rely on visitors not noticing. New gTLDs hold 11% of the domain market but 51% of phishing domains, and 77% of phishing domains were maliciously registered rather than compromised, according to Interisle Consulting Group’s 2025 phishing study. Monitoring for lookalike domains belongs in the same program as monitoring the real one.
Recovery is not the end: two named cases
Patterns.com has been stolen twice. After the 2022 UDRP decision returned it to its owner, the owner and Epik, Inc. agreed that when the domain was sold, the profit would be split between them. It was never sold under that agreement. Instead, it was sold without the owner’s permission when Epik’s domain portfolio was liquidated. As of November 2026, Patterns.com remains a stolen domain name, and anyone acquiring it would be acquiring a stolen domain. A UDRP win restores control; it does not protect the name from what happens next.
Make a Home Foundation, a Connecticut nonprofit that furnishes homes for veterans, domestic violence survivors and people leaving homelessness, registered its domains in 2010 and used them for more than a decade. As of November 6, 2026, the web developer who moved them into his own account still controls them, and the case is open, despite documented registrations, repeated conversations with the developer and a prepared UDRP route. Neither named case has a clean ending. The cheapest recovery is the one that never has to happen.
Recommendations for domain owners
Each control below addresses a specific way domains were lost in this review.
- Put registry lock on any domain that carries your website, email or brand, so that a stolen login or a forged ID cannot move it.
- Turn on multi-factor authentication at the registrar, and treat any notice that it was disabled as an emergency.
- Keep domains in an account your organization owns, give vendors DNS access only, and state in writing that the domain is your property.
- Monitor registration, nameserver and status changes so that a transfer is discovered the same day, as it was in case A.
- Keep renewal receipts, a copy of the registrant record and archived snapshots of your site, because that evidence decides every remedy.
- Plan registrar access for estates and leadership changes, so that a death or departure does not leave the account unattended.
Our guide to domain status codes shows the locks a protected domain should carry.
How to cite this report
Journalists, researchers and counsel are welcome to cite the DNAccess Domain Theft Report 2026, linking to https://www.dnaccess.com/domain-theft-report/.
How DNAccess helps with domain theft
DNAccess investigates and recovers stolen domain names using the evidence work described here: registration and DNS history, registrar escalation, TURF and TDRP support, and UDRP preparation with counsel. If a domain has been taken, start with our stolen domain recovery service. DNShield domain name monitoring watches registration, nameserver and status changes so a theft is seen the day it happens, and we help owners put registry lock and account controls in place before anything goes wrong. To discuss a stolen domain or a prevention plan, contact DNAccess for a confidential review and a quote.