Domain hijacking, also known as domain theft, is the act of gaining unauthorized control over a domain name without the consent of its legitimate owner. This typically involves changing the domain’s registration details, DNS records, or transferring the domain to another registrar, effectively locking out the original owner and granting the attacker full control of the domain and all its associated services.
Domain hijacking can occur through several methods, often exploiting technical vulnerabilities or human error. With Social Engineering, attackers use deception—such as phishing emails, fake phone calls, or fraudulent websites—to trick domain administrators or registrar support staff into revealing login credentials or authorizing changes to domain registration details. With Credential Compromise, attackers obtain the username and password for the domain registrar account—often through phishing, malware, or data breaches. A domain may be hijacked through Email Account Takeover since most domain registrars use email verification for account changes. Via Exploiting Registrar or DNS Vulnerabilities, attackers may exploit software vulnerabilities in the registrar’s systems or DNS infrastructure to gain unauthorized access to domain management functions. Finally, through Forged Transfers, attackers may initiate unauthorized domain transfers by impersonating the legitimate owner or exploiting weaknesses in registrar transfer procedures.