A hijacked domain is one of the most damaging incidents a business can suffer. The attacker can redirect your website, read your incoming email, reset passwords on other services and send messages that look exactly like yours.
How domains get stolen
- Compromised registrar account: a reused or phished password gives the attacker the keys.
- Expired contact email: if the email on the account belongs to an expired domain or a former employee, an attacker can take it over and reset the registrar password.
- Social engineering: someone calls or emails support pretending to be you.
- Unlocked domain: without a registrar lock, a transfer can be started more easily.
The controls that matter
- Use a unique, strong password and two-factor authentication on the registrar account.
- Keep registrar lock on at all times, and unlock only during a transfer you started.
- Use a contact email on a different domain from the one it protects, or a well-protected shared address.
- Limit who has access to the account, and remove people who leave.
- Store the authorisation code only when you need it, and never send it by chat.
Watch for warning signs
Unexpected emails about transfers, contact changes or nameserver updates deserve immediate attention. So do sudden changes in your DNS records, which you can check with our DNS checker.
If it happens
Contact your registrar immediately, change the account password, and document everything. The faster the registrar is told, the better the chance of reversing the change.
At IDX
Domains at IDX have registrar lock turned on by default, and the client area supports two-factor authentication. If anything looks wrong with your domain, contact our team straight away.
IDX on digital infrastructure
Back to blog →