Domain hijacking is the unauthorized change of control of a registered domain name. A person who is not the rightful registrant gains the ability to transfer the domain to another registrar or account, change its nameservers, or alter its registration record, and the legitimate owner loses the website, the email, and every service that depends on the name. Domain theft and stolen domain are the common synonyms. In every case the domain itself still exists in the registry; what has changed is who controls it.
That definition is narrower than the way the phrase is often used, and the distinctions matter, because the remedy for each situation is different. A business that reports a hijacking when its domain has in fact expired will file the wrong paperwork with the wrong party. This page sets out what domain hijacking is, what it is not, and the real-world cases that defined it. Our pillar guide to domain hijacking covers the attack paths, the law, and the recovery process in full.
What domain hijacking looks like in practice
A domain is controlled through a registrar account, and that account is controlled through an email address and a password. Domain hijacking almost always begins with one of those two credentials. The thief takes over the registrant’s email account through a reused password or a phishing message, resets the registrar password, removes the transfer lock, and moves the domain to another registrar or to a second account at the same one. In other cases a former employee or web developer who registered the domain in his own name simply refuses to hand it over. The result is the same: the registration record names someone other than the rightful owner, and the owner cannot get back in.
Domain hijacking versus DNS hijacking
DNS hijacking is the unauthorized change of a domain’s nameserver or DNS records without taking the registration itself. The attacker alters where the domain resolves, so that visitors and email are routed to servers he controls, but the registrant of record stays the same. The attack may come through a compromised DNS hosting account or a registrar account used only to change nameservers. DNS hijacking is often quieter, because the WHOIS (the public registration record for a domain name) still shows the rightful owner and nothing looks wrong until the website or the mail goes to the wrong place. The fix is also different: the owner can usually restore the records himself once he regains control of the DNS account, without any transfer reversal. We treat the subject in depth on our DNS hijacking page.
Domain hijacking versus reverse domain name hijacking
Reverse domain name hijacking (RDNH) is a finding made by a UDRP panel (under the Uniform Domain-Name Dispute-Resolution Policy, ICANN’s arbitration procedure for trademark-based domain disputes) that a trademark owner filed a complaint in bad faith to take a domain that the registrant holds legitimately. It is an abuse of the dispute process rather than a theft. The complainant typically wants a domain that predates its trademark, or a generic word it cannot own, and uses the UDRP as a lever to acquire it cheaply. The term confuses people because the “hijacker” is the trademark owner, and the victim is a registrant who did nothing wrong. Panels made reverse domain name hijacking findings involving 917 complainants between January 2013 and December 2020, about 2 percent of all cases, according to the ICANN GNSO’s revised UDRP status report. We explain how those findings are made, and how a registrant defends against an abusive complaint, on our page on reverse domain name hijacking.
Domain hijacking versus expiration and re-registration
The scenario most often mistaken for theft is the lapsed registration. A domain that is not renewed passes through a grace period, a redemption period, and a pending-delete period, and then becomes available to anyone. Drop-catching services register valuable names within seconds of release. It feels like a hijacking, but no one broke in and no rule was broken: the registration ended, and a new registrant acquired the name lawfully. There is no transfer to reverse. The remedies are negotiation with the new holder, a UDRP complaint if a trademark is involved and the new registrant acted in bad faith, or purchase on the aftermarket. Our expired domain name recovery service handles that situation, and it is a different engagement from a theft recovery.
Real-world examples of domain hijacking
The case that defined domain theft in American law is sex.com. Gary Kremen registered the domain, and Stephen Cohen stole it. In its January 2003 order in Kremen v. Cohen, the Ninth Circuit noted that the district court had already entered a judgment of $65 million in Kremen’s favor against Cohen for the theft. In its published July 2003 opinion in Kremen v. Network Solutions, Inc., 337 F.3d 1024 (9th Cir. 2003), the court held that a registrant has “an intangible property right in his domain name,” which meant that the civil claim of conversion (taking or exercising control over someone else’s property) applies to a domain. The court described the award against Cohen as $40 million in compensatory and $25 million in punitive damages.
The ICANN SSAC’s first hijacking report, SAC007, Domain Name Hijacking: Incidents, Threats, Risks, and Remedial Actions, documented the operational side. In January 2005 the domain panix.com was transferred from Dotster to Melbourne IT and its DNS changed, and it took “a period of over 40 hours before the DNS information was corrected.” The report also recorded that Directi found “about 80 additional (presumably hijacked) domain names” sharing the same registrant data as the stolen HZ.com. These are 2005 cases, and we cite them as the origin of ICANN’s transfer-policy safeguards rather than as current statistics, but the pattern they describe, an unauthorized inter-registrar transfer followed by a scramble between two registrars, is the same one we see today.
The insider version was settled in DSPT International, Inc. v. Nahum (9th Cir. 2010), where a former employee registered his employer’s domain and withheld it to extract disputed commissions. The Ninth Circuit affirmed a $152,000 jury verdict against him under the Anticybersquatting Consumer Protection Act, holding that a person is liable “if he subsequently uses the domain name with a bad faith intent to profit from the protected mark by holding the domain name for ransom.”
Why the distinction matters for recovery
A true domain hijacking is reversed through the registrars: the losing registrar contacts the gaining registrar’s Transfer Emergency Action Contact, and the two can return the domain through a Transfer Undo Request Form or, failing that, through ICANN’s Transfer Dispute Resolution Policy. DNS hijacking is fixed by regaining control of the DNS account and restoring the records. Reverse domain name hijacking is defended inside the UDRP proceeding. Expiration is resolved through negotiation or purchase. Naming the problem correctly on the first day determines which path opens. Preventing it is easier than any of them, and our guide on how to prevent domain hijacking sets out the controls layer by layer.
How DNAccess helps with hijacked domain names
DNAccess has recovered hundreds of stolen domain names. Our first step in any engagement is to establish which of the four situations on this page the client is actually in, because the evidence and the procedure differ for each. Where the domain was hijacked, we take the case to the registrars, invoke the emergency transfer contacts, and pursue a reversal, a TDRP filing, a UDRP complaint where a trademark exists, or litigation with counsel where nothing else will work. Our stolen domain name recovery service explains how an engagement proceeds, and you can reach us through our contact page.