Skip to content

Domain Hijacking: How Domain Names Are Stolen and How to Get Them Back

Domain hijacking is the unauthorized change of control of a registered domain name. Someone who is not the rightful registrant gains the ability to transfer the domain, change its nameservers, or alter the registration record, and the legitimate owner loses the website, the email, and every system that depends on the name. The terms domain theft, stolen domain, and domain hijacking describe the same event.

We have recovered hundreds of stolen domain names at DNAccess, and the pattern repeats with remarkable consistency. The theft is almost never a technical attack on the registry. It is an attack on the people, the email accounts, and the registrar accounts that stand between the domain and the outside world. This page explains how domain names are stolen, what ICANN’s advisory committee and academic researchers have measured, how the courts treat a stolen domain, how recovery works in practice, and what to do in the first day after you discover that a domain is gone.

Why domain names are stolen

A domain name is an asset with a market value, and for many small businesses it is the single most valuable intangible asset they own. Short, memorable, or aged domains sell for sums that justify a thief’s effort. The thief does not need to use the domain; he needs only to sell it quickly to a buyer who does not check the registration history.

Resale is the most common motive, but not the only one. Some hijackings are sabotage by a competitor or a former partner. Others are extortion: the thief holds the domain and offers to return it for a payment, or a former employee who registered the domain in his own name refuses to release it until a disputed invoice is paid. And some hijackings are a step toward a larger crime, because a domain that handles corporate email can be used to intercept messages, reset passwords on other services, and obtain certificates that make a fraudulent site look genuine.

Four common ways domain names are lost: account takeover, support-desk fraud, vendor pushes and expiration lapses
Four ways domain names are lost

How domain hijacking happens

Every registered domain is controlled through a chain of credentials: the registrar account that holds the domain, the email address on that account, and the people authorized to speak for the registrant. Domain hijacking attacks one of those links. The paths below account for nearly every theft we have investigated.

Compromise of the registrant’s email account

The email address on file with the registrar is the master key to the domain. Registrars send password resets, transfer authorizations, and change confirmations to that address. If a thief takes over the email account, whether through a password reused from an unrelated data breach, a phishing message, or a weak recovery question, he can reset the registrar password, approve his own transfer, and lock the rightful owner out. In the cases we handle, this is the most frequent root cause.

Registrar account takeover

Registrar accounts are attacked directly as well. Credential stuffing (the automated testing of username and password pairs leaked from other sites) defeats any registrar account that reuses a password. Once inside, the thief changes the account email, removes the transfer lock, requests the authorization code (the EPP code, a transfer password that the losing registrar issues to the registrant), and initiates a transfer to a registrar of his choosing.

Phishing and fake renewal or ICANN notices

Phishing messages aimed at domain owners imitate a registrar’s renewal reminder or ICANN’s mandatory contact verification notice, and the link leads to a page that captures the registrar login. Fake ICANN verification emails are a recurring campaign.

Social engineering of registrar support staff

Not every hijacking involves a password. A thief who has gathered enough public and breached information about a registrant can contact registrar support, claim to have lost access, and talk an agent into resetting the account email. A convincing story with a copy of an identity document obtained elsewhere is often enough.

Insiders, former employees, and web developers

Many disputes that reach us are not break-ins at all. The domain was registered years ago by a web developer, an agency, or an employee who has since left, and it sits in an account the company does not control. When the relationship ends badly, the domain becomes a bargaining chip. This is domain hijacking by someone who already had the keys, and the Ninth Circuit addressed it in DSPT International v. Nahum, discussed below.

Unauthorized registrar transfer or account push

The final step of most thefts is moving the domain out of reach. An inter-registrar transfer takes the domain to a different registrar, often in a different country, where the losing registrar has no direct control. An account push (a move between two accounts at the same registrar) is faster and leaves fewer traces, and a thief will often push the domain to a throwaway account and then transfer it out from there.

Expired-domain sniping, the look-alike that is not theft

One scenario resembles hijacking but is not. A domain that expires and is not renewed passes through a grace period, a redemption period, and a pending-delete period, and then becomes available to anyone, and drop-catching services register valuable names within seconds of release. The former owner feels robbed, but no theft has occurred: the registration lapsed, and the new registrant acquired it lawfully. Distinguishing a true hijacking from a lapsed registration is the first task in any recovery, because the paperwork, the timelines, and the legal theories do not overlap.

What the SSAC reports and the research show

ICANN’s Security and Stability Advisory Committee (SSAC) has studied domain hijacking since 2005, and its reports remain the reference documents for the policy framework that governs recovery. Its first hijacking report, SAC007, Domain Name Hijacking: Incidents, Threats, Risks, and Remedial Actions, documented the January 2005 theft of panix.com, in which the domain was transferred from Dotster to Melbourne IT and its DNS changed, and it took “a period of over 40 hours before the DNS information was corrected.” These are 2005 figures, cited here as the origin of ICANN’s hijacking policy work rather than as current incidence data, but the recovery times they document are still typical when a victim must work through registrars on two continents.

SAC007 also made a point we repeat to every client: the UDRP is the wrong tool for a stolen domain. The SSAC observed that a UDRP proceeding at that time cost approximately USD 2,000 and took “at least two months” to reach a decision, while a losing registrar had five days to cancel a pending transfer. Theft recovery is a race measured in hours and days, and the mechanisms that run at that speed are registrar escalation and transfer reversal.

The committee’s more recent work shows that hijacking also happens silently, without any thief touching the registrar account. In SAC125, the 2024 SSAC Report on Registrar Nameserver Management, the SSAC found that registrar nameserver renaming practices had exposed “over 500,000 domains within generic top-level domains (gTLDs) to resolution hijacking risk” as of September 2020, and that unauthorized parties had gained control of more than 163,000 gTLD domains through that weakness. The mechanism is a stale delegation: a domain’s nameserver records point to a hostname under a domain that has since expired, an attacker registers that expired domain, and from that moment he answers DNS queries for every domain that still points at it. The underlying study, Risky BIZness by researchers at UC San Diego and Stanford, examined nine years of zone-file data and found that 512,715 domains were exposed and 163,827 of them, 31.95 percent, were hijacked.

How the courts treat a stolen domain

For years it was unclear whether a domain name was property at all, and a theft victim who went to court risked being told he had lost nothing but a contractual right to a registrar’s services. The sex.com litigation settled that question in the United States. In its January 2003 order in Kremen v. Cohen, the Ninth Circuit noted that the district court had already entered a judgment of $65 million in Kremen’s favor against Cohen for the theft, and certified to the California Supreme Court the question of whether an internet domain name is property subject to the tort of conversion.

In its published July 2003 opinion in Kremen v. Network Solutions, Inc., 337 F.3d 1024 (9th Cir. 2003), the court answered the question itself. A registrant has “an intangible property right in his domain name” under a three-part test: the interest must be “capable of precise definition,” it must be “capable of exclusive possession or control,” and the owner must have “a legitimate claim to exclusivity.” A domain name meets all three. The opinion described the award against Cohen as $40 million in compensatory and $25 million in punitive damages. Conversion (the civil wrong of taking or exercising control over someone else’s property) therefore applies to a domain name, and a registrar that hands a domain to a thief can be liable for it.

The second foundational case concerns the insider who holds a domain hostage. In DSPT International, Inc. v. Nahum (9th Cir. 2010), a former employee had registered his employer’s domain and withheld it to extract disputed commissions. The Ninth Circuit affirmed a $152,000 jury verdict against him under the Anticybersquatting Consumer Protection Act (ACPA, the federal statute at 15 U.S.C. 1125(d) that prohibits registering or using a domain with a bad-faith intent to profit from a trademark), holding that a person is liable “if he subsequently uses the domain name with a bad faith intent to profit from the protected mark by holding the domain name for ransom.” The award included roughly $31,572 the company spent rebuilding its website. The decision reaches the developer or employee who registered the domain lawfully and only later turned it into a ransom demand; bad faith can arise after registration.

Beyond these two cases, a victim can pursue fraud, breach of contract against a registrar, and state computer-crime claims. We summarize the options in our post on legal options for domain theft victims. Where the stolen domain matches a trademark the victim owns, the UDRP (Uniform Domain-Name Dispute-Resolution Policy, the ICANN arbitration procedure for trademark-based domain disputes) becomes available as well, and our UDRP hub explains how that procedure works.

How recovery works in practice

Recovery follows the same chain the theft did, in reverse. The sequence depends on where the domain is, how long ago it moved, and whether the victim holds a trademark.

Registrar escalation

The first call is to the losing registrar, the one that held the domain before the theft. The request must reach the registrar’s security team with evidence: the account history, the dates and times of the unauthorized changes, the original registration records, and proof of identity matching the registrant on file before the theft. The losing registrar can then contact the gaining registrar. ICANN’s Transfer Policy requires every registrar to maintain a Transfer Emergency Action Contact (TEAC), and a TEAC response must come from a human at the gaining registrar “within 4 hours, although final resolution of the incident may take longer,” as ICANN’s Transfer Policy Review working group summarized in its February 2023 briefing. That four-hour rule is the fastest obligation in the whole framework, and it only works when the losing registrar invokes it with a complete record.

Reversal between registrars through TURF

When both registrars agree that the transfer was unauthorized, the gaining registrar returns the domain through a Transfer Undo Request Form (TURF), a registry-level procedure under which the gaining and losing registrars jointly ask the registry to reverse the transfer. The victim regains access through the original account. In our experience a TURF reversal is achievable when the theft is caught within days and the gaining registrar is reputable. Our explainer on the TURF agreement as a rescue path for hijacked domain names walks through the form and the evidence it requires.

The Transfer Dispute Resolution Policy

If the gaining registrar will not cooperate, the losing registrar can file under the Transfer Dispute Resolution Policy (TDRP), ICANN’s procedure for disputes between registrars over inter-registrar transfers. The TDRP has strict limits. According to the policy text, “a dispute must be filed no later than twelve (12) months after the alleged violation,” only the gaining or losing registrar may file, and the panel’s remedy is limited to approving or denying the transfer, including returning the domain to the registrar of record before an invalid transfer. The registrant cannot file a TDRP complaint directly, which is why the relationship with the losing registrar matters so much, and a theft discovered more than a year after the fact is outside the procedure entirely.

UDRP where a trademark exists

When the stolen domain corresponds to a trademark the victim owns, and the thief is using or offering it in bad faith, the UDRP can order a transfer regardless of how many registrars the domain has passed through. It is slower than TURF, but it reaches domains that the inter-registrar procedures cannot. We used it to recover Patterns.com after it was stolen from a Network Solutions account, and the panel ordered the domain returned. The domain was later stolen a second time through an unauthorized sale, as our Patterns.com case study explains. The UDRP remains a trademark remedy, not a theft remedy, and a stolen domain that is not also a trademark needs a different path.

Litigation and court orders to registries

Where the thief is identifiable, where the domain has been sold to a buyer who refuses to return it, or where no registrar will act, litigation is the remaining route. The claims are conversion under Kremen, cybersquatting under the ACPA where a mark is involved, and fraud. A domain in a top-level domain whose registry is located in the United States can be reached by an in rem action (a suit against the domain itself rather than its holder) and by a court order directing the registry to transfer it. A judgment against the domain does not depend on finding the thief. The cost and time are substantial, which is why litigation is the last step rather than the first.

What to do in the first 24 hours

Speed decides most recoveries, because the thief is trying to move the domain beyond reach while the victim is still working out what happened. Our step-by-step guide to recovering a stolen domain name covers each action in detail.

First, preserve evidence. Save the WHOIS (the public registration record for a domain name) and RDAP (Registration Data Access Protocol, the structured successor to WHOIS) output as it stands now, screenshots of the registrar account, and every email the registrar sent during the attack window. Then secure what remains: change the password on the registrant email account, enable multi-factor authentication on it, review its forwarding rules and recovery addresses for anything the thief added, and do the same for the registrar account if you can still reach it. Once those are secured, open a ticket with the losing registrar’s security team, state plainly that the domain was transferred without authorization, and ask them to invoke the TEAC contact with the gaining registrar. If you hold a registered trademark that matches the domain, say so. Finally, document the business impact as it accrues: lost sales, rebuilt systems, diverted email. Those figures become damages if the matter goes to court.

Avoid two mistakes. Do not contact the thief before the registrars are engaged, because it often prompts another transfer, and do not pay a ransom without advice, because payment rarely ends the matter.

Preventing domain hijacking

Nearly every theft we see would have been stopped by a short list of controls: a dedicated, hardware-key-protected email account for registrar correspondence; multi-factor authentication on the registrar account; transfer lock on every domain; registry lock (a registry-level hold that blocks transfers and nameserver changes until the registrar verifies the request out of band) on the domains the business cannot live without; and monitoring that raises an alarm when a registrant, nameserver, or status field changes. The ICANN SSAC’s registrant guidance, SAC044, recommends setting the clientTransferProhibited, clientUpdateProhibited, and clientDeleteProhibited status codes with registry lock as an additional layer. That guidance dates from 2010, but the controls it describes are still the ones that work.

Adoption remains poor even among the largest companies. CSC’s 2024 Domain Security Report found that only 24 percent of Forbes Global 2000 companies use registry lock, up from 17 percent in 2020, and that 68 percent of those companies had adopted less than half of the recommended domain security measures. Our guide on how to prevent domain hijacking sets out the controls layer by layer, and our domain security hub covers registry lock, DNSSEC, registrar account security, and the related threats in depth. For a shorter treatment of the definitions, including the difference between domain hijacking, DNS hijacking, and reverse domain name hijacking, see our explainer on what domain hijacking is.

Guides in the domain hijacking hub

The pages below go deeper on the subjects covered here, and we add to this list as new guides are published.

How DNAccess recovers hijacked domain names

DNAccess has recovered hundreds of stolen domain names for businesses, domain investors, and individuals, and the work follows the sequence described on this page. We begin with a forensic review of the registration history, the DNS history, and the registrar’s records to establish exactly when and how control changed hands, because registrars and panels act on evidence. We then take the case to the losing registrar’s security team, invoke the TEAC process with the gaining registrar, and pursue a TURF reversal where the facts support it. When a registrar will not act, we prepare the TDRP filing with the losing registrar, or a UDRP complaint where a trademark exists, and we work alongside counsel when the matter requires litigation. Bill Hartzer has testified as an expert witness in domain name and internet marketing litigation, and that experience shapes how we build the record from the first day.

If your domain has been hijacked, our stolen domain name recovery service explains how an engagement works, and you can reach us through our contact page.