Domain hijacking or domain theft is the act of changing the registration of a

domain name In the Internet, a domain name is a string that identifies a realm of administrative autonomy, authority, or control. Domain names are often used to identify services provided through the Internet, such as websites, email services, and more. ...

without the permission of its original registrant, or by abuse of privileges on domain hosting and registrar software systems. This can be devastating to the original domain name holder, not only financially as they may have derived commercial income from a website hosted at the domain or conducted business through that domain's e-mail accounts, but also in terms of readership and/or audience for non-profit or artistic web addresses. After a successful hijacking, the hijacker can use the domain name to facilitate other illegal activity such as

phishing Phishing is a form of social engineering and a scam where attackers deceive people into revealing sensitive information or installing malware such as viruses, worms, adware, or ransomware. Phishing attacks have become increasingly sophisticate ...

, where a website is replaced by an identical website that records

private information Privacy (, ) is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively. The domain of privacy partially overlaps with security, which can include the concepts of a ...

such as log-in

password A password, sometimes called a passcode, is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of password-protected services t ...

spam Spam most often refers to: * Spam (food), a consumer brand product of canned processed pork of the Hormel Foods Corporation * Spamming, unsolicited or undesired electronic messages ** Email spam, unsolicited, undesired, or illegal email messages ...

, or may distribute

malware Malware (a portmanteau of ''malicious software'')Tahir, R. (2018)A study on malware and malware detection techniques . ''International Journal of Education and Management Engineering'', ''8''(2), 20. is any software intentionally designed to caus ...

from the perceived "trusted" domain.

Description

Domain hijacking can be done in several ways, generally by unauthorized access to, or exploiting a vulnerability in the domain name registrar's system, through social engineering, or getting into the domain owner's email account that is associated with the domain name registration. A frequent tactic used by domain hijackers is to use acquired personal information about the actual domain owner to impersonate them and persuade the domain registrar to modify the registration information and/or transfer the domain to another registrar, a form of

identity theft Identity theft, identity piracy or identity infringement occurs when someone uses another's personal identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes. ...

. Once this has been done, the hijacker has full control of the domain and can use it or sell it to a third party. Other methods include email vulnerability, vulnerability at the domain-registration level, keyloggers, and phishing sites. Responses to discovered hijackings vary; sometimes the registration information can be returned to its original state by the current registrar, but this may be more difficult if the domain name was transferred to another registrar, particularly if that registrar resides in another country. If the stolen domain name has been transferred to another registrar, the losing registrar may invoke ICANN's Registrar Transfer Dispute Resolution Policy to seek the return of the domain. In some cases, the losing registrar for the domain name is not able to regain control over the domain, and the domain name owner may need to pursue legal action to obtain the court ordered return of the domain. In some jurisdictions, police may arrest cybercriminals involved, or prosecutors may file

indictment An indictment ( ) is a formal accusation that a person has committed a crime. In jurisdictions that use the concept of felonies, the most serious criminal offense is a felony; jurisdictions that do not use that concept often use that of an ind ...

s. Although the legal status of domain hijacking was formerly thought to be unclear, certain U.S. federal courts in particular have begun to accept causes of action seeking the return of stolen domain names. Domain hijacking is analogous with theft, in that the original owner is deprived of the benefits of the domain, but

theft Theft (, cognate to ) is the act of taking another person's property or services without that person's permission or consent with the intent to deprive the rightful owner of it. The word ''theft'' is also used as a synonym or informal shor ...

traditionally relates to concrete goods such as jewelry and electronics, whereas domain name ownership is stored only in the digital state of the domain name registry, a network of computers. For this reason, court actions seeking the recovery of stolen domain names are most frequently filed in the location of the relevant domain registry. In some cases, victims have pursued recovery of stolen domain names through ICANN's

Uniform Domain Name Dispute Resolution Policy The Uniform Domain-Name Dispute-Resolution Policy (UDRP) is a process established by the Internet Corporation for Assigned Names and Numbers (ICANN) for the resolution of disputes regarding the registration of internet domain names. The UDRP curre ...

(UDRP), but a number of UDRP panels have ruled that the policy is not appropriate for cases involving domain theft. Additionally, police may arrest cybercriminals involved.

Notable cases

* During the original " dot com boom", there was extensive media coverage of the hijacking of "sex.com". * Basketball player Mark Madsen unknowingly bought a "stolen" (or hijacked) URL by way of eBay auctions. * In 2015 Lenovo's website and Google's main search page for Vietnam were briefly hijacked. * In early 2021, Perl's domain was briefly hijacked, causing a relatively major issue with

CPAN The Comprehensive Perl Archive Network (CPAN) is a software repository of over 220,000 software modules and accompanying documentation for 45,500 distributions, written in the Perl programming language by over 14,500 contributors. ''CPAN'' can de ...

. * On August 19th 2024, FurAffinity's domain was hijacked for over a day, redirecting users to a Washington Post article, then to Kiwi Farms a short time later. * In early 2024, 8,000 domains and 13,000 subdomains of major brands including eBay, Lacoste, Marvel, McAfee, MSN, Pearson, PwC, and The Economist were taken over via a specific form of hijacking called SubdoMailing. This attack focused on spam proliferation and click monetization.

Prevention

ICANN imposes a 60-day waiting period between a change in registration information and a transfer to another registrar. This is intended to make domain hijacking more difficult, since a transferred domain is much more difficult to reclaim, and it is more likely that the original registrant will discover the change in that period and alert the registrar.

Extensible Provisioning Protocol The Extensible Provisioning Protocol (EPP) is a flexible protocol designed for allocating objects within registries over the Internet. The motivation for the creation of EPP was to create a robust and flexible protocol that could provide communic ...

is used for many

TLD A top-level domain (TLD) is one of the domain name, domains at the highest level in the hierarchical Domain Name System of the Internet after the root domain. The top-level domain names are installed in the DNS root zone, root zone of the nam ...

registries, and uses an authorization code issued exclusively to the domain registrant as a security measure to prevent unauthorized transfers.

RFC’s

* - Generic Registry-Registrar Protocol Requirements * - Guidelines for Extending EPP * - Domain Registry Grace Period Mapping (e.g. Add Grace Period, Redemption Grace Period) * - Using EPP for

ENUM Telephone number mapping is a system of unifying the international telephone number system of the public switched telephone network with the Internet addressing and identification name spaces. Internationally, telephone numbers are systematicall ...

addresses * - Domain Name System (DNS) Security Extensions Mapping for the Extensible Provisioning Protocol (EPP) (obsoletes , DNSSEC) * - Extensible Provisioning Protocol (EPP) (obsoletes , which obsoleted ) * - Extensible Provisioning Protocol (EPP) Domain Name Mapping (obsoletes ) * - Extensible Provisioning Protocol (EPP) Host Mapping (obsoletes ) * - Extensible Provisioning Protocol (EPP) Contact Mapping (obsoletes ) * - Extensible Provisioning Protocol (EPP) Transport over TCP (obsoletes )

References

External links