Domain Name Hijacking

From ICANNWiki
Jump to: navigation, search

Domain Name Hijacking or Domain Hijacking refers to the security breach that occurs when an outside agent, such as a hacker, gains control over a domain registered to another individual or organization.[1][2] Hijacking can be accomplished via various practices and often results in domain name registrants losing control of their domains as traffic is redirected to a different site, the content of the original site is changed, or the outside agent switches the control of the name through the registrar. [2] This practice has reportedly tripled since 2005 and is related to Reverse Domain Name Hijacking[3]

Public Perception

Domain name hijacking is viewed negatively by most people and can be referred to as domain theft.[2]


The broader outcome of this behavior is that users' domain names are at risk from predatory parties. Individuals can lose control of their domain names and larger organizations can face major losses, monetarily and in consumer confidence.

Historical Use

Domain name hijacking has been used for a number of purposes, such as "malice and monetary gain."[1] If the hijacked site deals with Internet commerce or retail, for example, its users may be redirected to a phishing webpage designed to steal their financial information.[3] A domain name is vulnerable to hijacking through a number of different avenues:

  • DNS Servers: if the DNS is hijacked or poisoned, people typing in a domain name may be redirected to another page without their knowledge.[3] This method does not require any registrant account information to be compromised or readily available. See DNS Hijacking for more information.
  • Registrar Security: if a registrar's security is compromised and a domain name is not locked, it could be transferred to a different user and registrar before the owner is notified.[4]
  • Email Security: a third party can use WHOIS to find information about a registrant, such as a personal email account, and once the email account is compromised, use it to request a new password from the registrar.[2][3] If the third party gains access to the registrant's account with its registrar, it can change primary ownership and notification information.
  • Phishing: an outside agent can pose as a representative of the registrar and ask for log-in information directly.[5]

ICANN Policy

  • Registrar Transfer Dispute Resolution Policy: This policy outlines how registrars deal with transfer disputes, including unauthorized transfers.[7]
    • Note: It can be challenging to prove to registrars that a domain name has been hijacked as "Registrars are often skeptical of claims of domain hijacking."[8]


There is no U.S. legislation that directly addresses domain name hijacking. However, as it potentially can involve theft, fraud, identity theft, and phishing, there are avenues for legal redress. It is worth noting that proving domain name ownership after being hijacked can be difficult.[8]

Additional Resources and Tips

Related Articles


  1. 1.0 1.1 Domain Name Hijacking: Incidents, Threats, Risks, and Remedial Actions (PDF), ICANN's SSAC
  2. 2.0 2.1 2.2 2.3 How a Domain Name is Hijacked and How to Protect it by Srikanth Ramesh,
  3. 3.0 3.1 3.2 3.3 4 Ways to Prevent Domain Name Hijacking by Meridith Levinson (February 1, 2012), CIO
  4. ICANN warns world of domain hijacking by Kieren McCarthy (July 12, 2005), The Register
  5. How to Recover a Hijacked Domain by James Johnson,
  6. Policy on Transfer of Registrations between Registrars | In effect until 31 May 2012, Internet Corporation for Assigned Names and Numbers (ICANN)
  7. Registrar Transfer Dispute Resolution Policy, Internet Corporation for Assigned Names and Numbers (ICANN)
  8. 8.0 8.1 Help! My Domain Name Has Been Hijacked! by Brett Lewis (January 12, 2007), CircleID