[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Attack Surface Management](/category/attack-surface-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Domain Hijacking?](/blog/domain-hijacking) Publish date July 4, 2025 {x} minute read # What is Domain Hijacking? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Domain hijacking is the act of changing the registration of a domain name without the permission of the original owner, or by abuse of privileges on domain hosting and domain registrar systems.   Domain name hijacking is devastating to the original domain name owner's business with wide ranging effects including: * **Financial damages:** Companies who rely on their website for business, such as ecommerce companies and SaaS companies, can lose millions of dollars when they lose control of the domain, their domain is one of their most valuable assets. Domain hijacking is one of the largest [cybersecurity risks](https://www.upguard.com/blog/cybersecurity-risk) online businesses have. * **Reputational damages: **Domain hijackers can take control of a hijacked domain's email accounts and use the domain name to facilitate additional [cyber attacks](https://www.upguard.com/blog/cyber-attack) such as installing [malware](/blog/malware) or [social engineering](/blog/social-engineering) attacks. * **Regulatory damages: **By gaining access to a domain name, hijackers can replace the real web page with an identical web page designed to capture [sensitive data](https://www.upguard.com/blog/sensitive-data) or [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii), this is known as [phishing](/blog/phishing). Account information, contact information (email addresses and phone numbers), social media accounts, personal information, IP addresses or any other information that could be used in identity theft or gaining unauthorized access to customer accounts is the target.  Note many countries (and/or customers) will hold your organization responsible for [data breaches](https://www.upguard.com/blog/data-breach) or [data leaks](https://www.upguard.com/blog/data-leak), regardless of whether they result from a cyber attack like domain hijacking or misconfiguration. Domain hijacking is a real [cyber threat](https://www.upguard.com/blog/cyber-threat), preventing it must be part of your [cybersecurity](https://www.upguard.com/blog/cyber-security) efforts.  Before we dive into the details of domain hijacking, it's helpful to understand how the domain name system (DNS) works and its limitations. ## How Does the Domain Name System (DNS) Work? Each top-level domain (TLD) is managed by an organization called a domain name registry, which is appointed by the Internet Corporation for Assigned Names and Numbers (ICANN). The most popular TLDs are managed by large organizations such as Verisign (.com and .net) or Public Interest Registry (.org). National domains like .io or .com.au are managed by organizations in their respective countries.  One important thing to understand is registries do not always manage domain name registration. Companies that handle domain registration are called domain name registrars (versus domain name registries) and are usually accredited by registries. Accredited registrars may then subcontract to non-accredited registrars, increasing third-party risks and [fourth-party risks](https://www.upguard.com/blog/what-is-fourth-party-risk) and lengthening the time to resolve potential domain name disputes. This is because each registrar has its own rules and requirements for proving domain ownership and approving domain transfers. That said, most TLDS allow anyone to register the domain on one registrar and transfer control of the domain to another registrar (such as from Namecheap to Google domains) for any reason, such as better pricing, better security measures or a better customer experience.  This has its benefits but also makes domain hijacking possible. Domain hijacking is a risk to your business even if it's not your domain that is hijacked. Any third-party vendor you regularly communicate with or that handles your or your customer's data could have its domain hijacked.   Domain hijacking prevention controls must be part of your [Vendor Risk Management](https://www.upguard.com/blog/vendor-risk-management) and [Third-Party Risk Management frameworks](https://www.upguard.com/blog/third-party-risk-management-framework). While transferring domains is a little more complicated than registering a new domain, in practice it is a very simple process. ## How Does Domain Hijacking Work? Generally domain hijacking occurs from unauthorized access to, or exploitation of a [vulnerability](https://www.upguard.com/blog/vulnerability) in a domain name registrar, through [social engineering](/blog/social-engineering), or by gaining access to the domain name owner's email address and then resetting the password to their domain name registrar.  Another common tactic is to gather personal information about the actual domain name owner to impersonate them and persuade the domain registrar to modify registration information or transfer the domain to another registrar they control.  Other methods include email vulnerability, vulnerability at the domain-registration level,[ keyloggers to steal login credentials](https://www.upguard.com/blog/what-is-a-keylogger) and [phishing](/blog/phishing) attacks.  ## How to Recover Hijacked Domains Your ability to recover a hijacked domain will largely depend on what your registrar can do to reverse the attack. Sometimes registration information can be returned to the original owner.  This becomes more difficult when the hijacker was able to transfer to another registrar, particularly if the registrar operates in a different jurisdiction.  When a stolen domain is transferred to another registrar, ask your registrar to invoke ICANN's Registrar Transfer Dispute Resolution Policy to try regain control of the domain. Another option is to pursue recovery of stolen domain names through ICANN's Uniform Domain Dispute Resolution Policy (UDRP) but the policy may not be appropriate for cases involving domain theft. In some cases, this won't work and you will need to pursue legal action from the courts to reclaim the domain. This can be a lengthy process that doesn't immediately fix the real issue (lose of website and/or email accounts), which is why preventing domain hijacking is the most important thing. ## Is Domain Hijacking Illegal? The legal status of domain hijacking remains unclear but certain U.S. federal courts have begun to accept causes of action that seek to return stole domain names to the original owners. Domain hijacking is no different to theft, the original owner is deprived of the benefits of the domain and cannot conduct business as usual. The legal status is due to theft traditionally being associated with physical goods like jewelry, electronics or money.  Domain ownership is only stored in a digital state on the domain registry, there is no real physical presence.  This is further complicated because court actions are generally filed in the location of the relevant domain registry, rather than where the victim is located. In some jurisdictions, police may arrest domain hijackers. ## How to Prevent Domain Hijacking To reduce the prevent of successful domain hijacking, ICANN imposes a 60-day waiting period between a change in registration information and a registrar transfer. Transferred domains are more difficult to reclaim and it is thought the original registrant will discover the changes in the 60 days and alert their registrar.   Extensible Provisioning Protocol (EPP) is used by many TLD registries as it provides an authorization code exclusively to the domain registrant as a security measure to prevent unauthorized transfers.  Prior to EPP, registries had no uniform approach and many different proprietary interfaces existed, EPP provides a more robust and flexible way to provide communication between domain name registries and domain name registrars.   Additionally, the following steps may help to prevent unwanted domain transfers: 1. **Choose a reputable domain registrar company: **Use an accredited registrar and avoid working with non-accredited (second-hand) registrars. Reputable domain registrars will also allow you to [enable two-factor authentication](https://www.upguard.com/blog/two-factor-authentication), have secure DNS management and have 24x7 technical support. 2. **Enable two-factor authentication: **All accounts that have two-factor authentication available should have it enabled. If someone is able to gain access to one of your accounts, a second layer of authentication can help protect you against unauthorized access. 3. **Enable domain registry lock: **Domain locking is a common security enhancement offered by domain name registrars, it allows you to prevent unauthorized domain name transfers to another registrar.  4. **Enable account lock:** To block [brute force attacks](/blog/brute-force-attack), use a registrar that limits the amount of invalid password attempts, locks the account and notifies you by email once unusual activity has been identified. 5. **Enable WHOIS protection: **WHOIS protection reduces the amount of [sensitive data](https://www.upguard.com/blog/sensitive-data) you expose to the Internet including address (street address, city, state and country), telephone number and email address. WHOIS information can assist cyber criminals in [social engineering](/blog/social-engineering) attacks. 6. **Enable auto-renewal: **Not all domains are hijacked, your domain registration can expire and someone else can then register your domain name.   7. **Use strong passwords: **Strong passwords can prevent brute force attacks. [Read our strong password checklist here](/blog/the-password-security-checklist). 8. **Change password if other sites have been breached: **Data breaches can expose common passwords shared across services, whenever any service is breached ensure the exposed password is only used once.** ** 9. **Keep domain contact details up-to-date: **Many domain hijacking attacks are successful because the contact information for the domain included old, expired domain email addresses that are then registered by the attacker. Contact information must be kept up-to-date otherwise your domain may be compromised. 10. **Never share domain registrar credentials: **Don't give out domain registrar credentials or access to your domain control panel. This can allow the person to change DNS records, change the domain owner, update [DNSSEC](https://www.upguard.com/blog/dnssec) settings and change name servers. When you give someone access to your registrar, you are handing them control of your domain and enabling potential domain and/or DNS hijacking. 11. **Pay attention to emails requesting registrar login details: **[Phishing](/blog/phishing) attacks happen each day. Scam and phishing attacks are often sent by forging a trusted sender's email address or from a domain name similar to your real registrar company. Always contact your domain registrar via an official web page and forward the email onto them to determine if it is real. 12. **Don't use the same company for domain registration and web hosting: **Don't put all your eggs in one basket. You don't want an attacker to gain access to your domain and your sensitive files that may be on your hosting provider.  ## What is Reverse Domain Hijacking? Reverse domain hijacking (or reverse cybersquatting) is when a registered trade mark owner attempts to secure a domain name by making false [typosquatting](https://www.upguard.com/blog/typosquatting) claims against a domain name's rightful registrant.  ## What are Notable Cases of Domain Hijacking? * Sex.com hijacker Stephen M. Cohen was taken into custody by U.S. enforcement officials, ending four years spent on the run after a court ordered him to pay $65 million in restitution. * Mark Madsen, a former NBA player, unknowingly bought a hijacked domain in an eBay auction.  * Google's Vietnam search page was briefly hijacked in 2015. * Lenovo's Vietnam domain was briefly hijacked in 2015.  ## How UpGuard Can Protect Your Organization from Domain Hijacking Whether your organization has one domain or thousands, our platform can monitor your organization's and its vendor's websites for susceptibility to domain hijacking, [DNSSEC](https://www.upguard.com/blog/dnssec) issues, [typosquatting](https://www.upguard.com/blog/typosquatting), [man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack) and other [vulnerabilities](https://www.upguard.com/blog/vulnerability).  [UpGuard Breach Risk](https://www.upguard.com/product/breach-risk) can also help prevent [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak) of [sensitive data](https://www.upguard.com/blog/sensitive-data) and [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii), protecting your customer's trust through cyber security ratings and continuous exposure detection.  eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)