Domain Hijacking: How Attackers Steal Business Domains, and 6 Ways to Lock Yours Down

Domain hijacking is when someone takes control of your domain name, usually by getting into your registrar account or the email address on the domain. Once they have it, they control your website, your email and every password reset sent to your business address. Six simple defences stop almost every attempt: two-factor login, a registrar lock, clean contact details, a guarded transfer code, sensible renewals and a habit of checking.

What is domain hijacking?

Domain hijacking means losing control of a domain name you hold, without agreeing to it. The attacker might change where your domain points, move it to another registrar or change the registrant details so it looks like theirs.

ICANN’s security committee describes the usual aim: to change the DNS so visitors land on an impersonation site, a phishing page or malware, or to route your email through someone else’s server (ICANN SSAC, SAC044). For a small business, the damage is wider than the website.

What does a hijacker get when they take your domain?

Your domain is the root of almost everything your business does online. Whoever controls it controls all of this at once.

The third box is the one owners overlook. If an attacker receives your email, they can click “forgot password” on your other accounts and reset them one by one.

How do attackers steal business domains?

ICANN’s guide for registrants lists the usual routes. Most rely on people and processes, not clever technology.

They get into your registrar account

Attackers guess or reuse passwords leaked from other sites, steal them with malware, or trick you with a phishing email that looks like your registrar. Small businesses are an easy target here. auDA’s 2026 research found that 38% of small businesses think they’re “too small to be targeted”, and that this group is less likely to use multi-factor authentication (38% compared with 57%) (auDA Digital Lives of Australians 2026).

They take over the contact email

Registrars send account resets and transfer codes to the contact email. If that address belongs to a former staff member, an old web designer or a domain you’ve let lapse, whoever controls it can take your domain too.

They talk their way in

Some attackers phone or email a registrar’s support team, pretending to be you. Others send fake renewal or transfer notices hoping you’ll pay, sign or hand over a code. The ACCC took action against two companies that sent about 300,000 notices that looked like renewal invoices, and businesses paid about $2.3 million (ACCC).

They wait for it to expire

No hacking needed. If a .au domain isn’t renewed, it enters a 30-day grace period when your website and email stop working, and is then released for anyone to register (auDA).

What are the 6 ways to lock your domain down?

Each of these takes minutes. Do them in this order.

1. Turn on two-factor login at your registrar. Use an authenticator app rather than text messages where you can. Do the same on the email account that receives registrar notices, because it’s the back door to the front door.
2. Keep the registrar lock on. ICANN calls these statuses registrar locks. With clientTransferProhibited set, the registry won’t let the domain move to another registrar (ICANN). Only remove it when you’re moving the domain yourself.
3. Fix your contact details. Make sure the registrant is your business and the contact email is a shared address you control. ICANN recommends using an email address on a different domain from the one it protects, so an attacker who changes your DNS can’t also block the warning emails.
4. Guard the transfer code. For a .au domain, your registrar sends the transfer authorisation code to the registrant contact email in the .au registry (auDA). Never send it to anyone who asks for it unprompted.
5. Renew for longer, and automatically. Renew for the longest term that suits you, turn on auto-renew and keep the card on file current. Put the expiry date in your calendar as a backstop.
6. Check regularly. Look up your domain in auDA’s WHOIS every few months, and read every email from your registrar. An unexpected “transfer requested” or “contact details changed” email is your early warning.

Does a business need a registry lock?

A registry lock goes a step further than a registrar lock. Changes then need the registrar to contact the registry, and both check the request before anything moves. An active lock shows in WHOIS as serverUpdateProhibited, serverTransferProhibited and serverDeleteProhibited (Identity Digital). Not every registrar offers it, and it suits high-value domains, such as a busy online store, more than a small brochure site.

Does DNSSEC stop hijacking?

No. DNSSEC protects against forged DNS answers on the internet. It can’t help if an attacker logs in to your registrar account and changes the records legitimately. Do the six steps above first.

What should you do if your domain has been hijacked?

1. Call your registrar straight away. Ask them to freeze changes and reverse any transfer. Speed matters.
2. Secure your email. Change the passwords on your email accounts and turn on two-factor login, so the attacker can’t use them to reset other accounts.
3. Change your other passwords. Start with banking, accounting and anything else that recovers through your business email.
4. Gather proof you hold the licence. Your ABN or ACN, invoices and old WHOIS records all help.
5. Warn customers and suppliers. Tell them not to act on payment changes or unusual emails from your domain.
6. Report it. Report cybercrime at cyber.gov.au or call 1300 CYBER1 (1300 292 371) (ASD).

A hijacked domain often comes with a tampered website. Our website security monitoring watches for the changes that follow, such as injected redirects.

How do we protect domains we look after?

Our domain security page sets out how we help keep domains in the right hands. If you’re choosing a new name, start with a domain name search, then register your domain with WMS. A .com.au is $80 + GST for two years. If you’re not sure whose name is on your current domain, our guide to who owns your domain shows you how to check.

Frequently asked questions

Can a domain be stolen while the registrar lock is on?

The lock stops transfers to another registrar, but someone logged in to your account can still change your DNS records, or switch the lock off. That’s why two-factor login on the registrar account matters even more than the lock.

How do I know if my domain has a registrar lock?

Look it up in a WHOIS tool. A status of clientTransferProhibited means the registrar lock is on. You can also check the domain’s settings in your registrar account, where it’s often called transfer lock or domain lock.

Is my domain at risk if my web designer manages it?

Only if they’re the registrant or their email is the contact. If they leave the industry, or their account is breached, your domain goes with it. Make sure your business is the registrant and you control the contact email.

Can I get a hijacked .au domain back?

Often, yes, if you act quickly and can prove your business holds the licence. Contact your registrar first. For disputes where someone else has registered a name in bad faith, auDA’s dispute process may help.

Does domain privacy prevent hijacking?

Not much. .au WHOIS already hides the street address and phone number. Hijackers mostly go after your registrar login and email, which privacy settings don’t protect. Two-factor login and a lock do far more.

Sources

1. SAC044: A Registrant’s Guide to Protecting Domain Name Registration Accounts, ICANN SSAC, 5 November 2010
2. Digital Lives of Australians 2026, auDA
3. Domain Name Corp and Domain Name Agency to pay $1.95 million in penalties, ACCC, 15 June 2018
4. Renewing your domain licence, auDA
5. EPP status codes: what do they mean, and why should I know?, ICANN
6. Transferring a .au domain name to another registrar, auDA
7. What is Registry Lock?, Identity Digital, September 2021
8. Annual Cyber Threat Report 2024–25, Australian Signals Directorate