Losing control of your own domain is one of the worst days an online business can have. The store disappears or, worse, starts serving something else. Email stops arriving, or starts arriving somewhere you cannot see. And because almost every account you own resets its password through email on that domain, the attacker who holds it can work through your payment provider, your platform and your ad accounts one by one.
The good news is that most hijacked domains are recovered, usually through the registrars rather than through a dispute. The bad news is that speed matters a great deal. This piece covers the first hours, the routes that actually reverse a transfer, and the setup that stops it happening again.
How domains get stolen
Understanding the route in shapes the response. Domain theft rarely involves breaking the domain system itself. It almost always goes through an account.
A compromised registrar login. A reused password, a phished login or a missing second factor lets someone into the account that controls the domain. From there they can change name servers, change contacts, or start a transfer to another registrar.
A compromised email account. If the registrar account resets through an email address, and that email is taken over, the registrar account follows. When the email address sits on the domain itself, the attacker can sometimes lock the owner out of both at once.
An abandoned or personal account. Domains registered years ago by a founder, a former employee or an agency, under a personal email nobody monitors, are easy targets and hard to prove ownership of.
Social engineering. Attackers sometimes persuade registrar support staff to change account details, using information gathered from public sources.
An expired domain. Not theft in the strict sense, but a lapsed domain can be registered by someone else, with your brand’s links and reputation attached.
The first hours
The order matters, because the attacker may still have access while you are trying to recover.
| When | Action | Why |
|---|---|---|
| First hour | Secure the registrar account and every email tied to the domain | Stops further changes and password resets |
| First hour | Record the RDAP record, DNS and site state | Evidence of what changed and when |
| First hours | Contact your registrar’s security or abuse team | They can freeze, restore or start recovery |
| Same day | Warn customers, payment providers and partners | Limits fraud using your domain and email |
| Same day | Check connected accounts for new logins and changes | The domain is often a step toward something else |
| First days | Escalate formally if the registrars cannot resolve it | Transfer disputes or legal action |
Secure the accounts first. Change the registrar password, turn on two-factor authentication, and do the same for every email account associated with the domain. Look for forwarding rules, recovery addresses and app passwords the attacker may have added; these are how access survives a password change.
Record the current state. Look the domain up in ICANN’s registration data lookup and save the registrar, the status codes, the name servers and the dates. Screenshot what the site now shows. If the domain was moved to another registrar, the record shows which one, and that is who your registrar will need to talk to.
Contact your registrar’s security team. Use the abuse or security contact rather than general support, say clearly that the domain was changed or transferred without authorisation, and send proof that it is yours: invoices, renewal receipts, account history, your trademark registration, prior DNS records, business documents in the registrant’s name. Registrars are required to maintain abuse contacts under their accreditation agreement, and ICANN describes how abuse reports to registrars work.
How a transfer gets reversed
Most recoveries happen between the two registrars. Your registrar contacts the gaining registrar, shows that the transfer was not authorised by the true registrant, and the gaining registrar reverses it or locks the domain while the matter is resolved. Where both registrars are reputable and the evidence is clear, this can take days rather than weeks.
The rules for moving domains between registrars are set out in ICANN’s Transfer Policy. The 2016 version, since revised, required the gaining registrar to obtain the registrant’s authorisation, let registrars deny transfers in listed situations such as within 60 days of a domain’s creation or a previous transfer, and required a 60-day transfer lock after a change of registrant unless the registrant opted out in advance. Check the current version before relying on any specific provision, because the policy has been under review and was updated in 2024.
When the registrars cannot agree, the policy points to the Transfer Dispute Resolution Policy. It is a process between registrars: your registrar files, the question is whether the transfer followed the rules, and if it did not, the transfer can be undone. As a registrant you cannot file it yourself, but you can ask your registrar to.
When the registrar route is not enough
Some cases need more.
The domain has moved to an uncooperative registrar, sometimes in another jurisdiction, chosen precisely because it ignores requests. A court order directed at the registry or registrar is then often the most reliable route, and it is worth taking legal advice early rather than after weeks of unanswered emails.
The hijacker is using the domain against your brand, for example running a fake store or phishing your customers. The usual takedown levers apply in parallel: the host, browser safe-browsing reports and the payment processor, as described in our guide to taking down an impostor storefront. If the registrar route fails and the use is clearly abusive, a trademark-based dispute may also be available; our comparison of UDRP, URS and ACPA explains the options.
You cannot easily prove ownership. If the domain sat in a former employee’s or agency’s personal account, gather everything that ties it to the business: invoices, board minutes, the trademark, years of use on the site, archived copies. The stronger the paper trail, the faster any registrar will act.
Protect customers while you recover
While someone else controls your domain, anything sent from it may be fraudulent. Tell customers through every other channel you control, social accounts, a status page on another domain, order confirmation emails already in their inboxes, that they should not trust messages from the domain until further notice. Alert your payment provider and platform so they can watch for changes to payout details. If the attacker changed MX records, mail sent to you is going to them: assume anything sensitive sent in that window is exposed.
Search the connected accounts too. Check your ecommerce platform, payment provider, ad accounts, analytics and social profiles for new logins, new users and changed recovery details. The domain is often the first step, not the goal.
Locking it down afterwards
Once the domain is back, the priority is making sure it cannot happen the same way again.
- Use an organisation-owned account. The registrar account should belong to the company, with a shared administrative address that is not on the domain itself, so a domain outage does not lock you out of the account that fixes it.
- Turn on two-factor authentication for every person with access, preferably with an authenticator app or security key rather than SMS.
- Keep the registrar lock on. The transfer-prohibited status stops transfers until you deliberately remove it.
- Consider a registry lock for your most important domains. Offered by some registries through registrars, it requires a manual, verified process to change name servers or transfer the domain, which defeats most account takeovers.
- Limit and review access. Remove former staff and agencies, and review the list every quarter.
- Consolidate. Bring scattered domains into one account with auto-renewal and current payment details, so nothing lapses quietly.
- Monitor changes. Alerts on DNS, contact and status changes tell you within minutes instead of when customers complain.
The same discipline protects the defensive domains you hold; our guide to which domains a brand should register defensively covers which ones belong in that account.
What not to do
Do not negotiate with the hijacker before talking to your registrar. Paying a ransom for your own domain encourages repeat attempts and may not even return control.
Do not wait to see if it resolves itself. Every hour gives the attacker more time to reset connected accounts and to move the domain again.
Do not rely on the UDRP as the first move. It takes weeks, it answers a trademark question rather than an unauthorised-transfer question, and the registrar route is usually faster for a clear hijacking.
Do not leave the old weak points in place. Recovering the domain without fixing the account that let the attacker in invites a second attempt.
The short version
A stolen domain takes your site, your email and every account that resets through it. In the first hour, secure the registrar and email accounts, record the domain’s current state, and contact your registrar’s security team with proof of ownership. Most hijackings are reversed between registrars, with ICANN’s Transfer Dispute Resolution Policy as the formal route when they disagree, and a court order when the domain has moved somewhere uncooperative. Warn customers while you recover, check every connected account, then move to an organisation-owned account with two-factor authentication, registrar and registry locks, and change monitoring. If the domain is being used against your brand meanwhile, a confidential review maps the takedown and recovery in one pass.
