Domain hijacking is one of the most serious threats facing UK businesses and individuals with online presence. Unlike domain squatting, which involves registering unclaimed domains, hijacking means criminals actively steal domains that already belong to someone else.

How Hijacking Happens

The most common method is through weak passwords. Scammers use brute force attacks or credential stuffing—trying thousands of common password combinations—to break into domain accounts. Once inside, they change the password, lock you out, and transfer the domain to another registrar where they sell it or hold it for ransom.

Another method involves social engineering. Attackers call your registrar, pretending to be you, claiming you've lost access to your account. If they can answer security questions (often using information found on social media), they can convince support staff to reset your password.

Email compromise is equally dangerous. If scammers access the email address associated with your domain account, they can request password resets and gain full control. This is why using a strong, unique email address for domain management is crucial.

Recent UK Cases

Several high-profile hijackings have affected UK businesses. Small companies have lost their domains overnight, sometimes losing years of search engine rankings and customer trust. The financial and reputational damage can be devastating.

Immediate Protection Steps

• Use a strong, unique password—at least 16 characters with mixed case, numbers, and symbols
• Enable two-factor authentication on your registrar account
• Use a dedicated email address for domain management
• Keep that email account secure with strong passwords and 2FA
• Register a privacy-protected domain so your contact details aren't publicly visible
• Add an additional layer by requesting a PIN or security code for changes

If You're Hijacked

Act immediately. Contact your registrar's abuse team with proof of ownership. Document everything. If you have regular backups of your website, you can restore it quickly once you regain control. Many registrars have hijacking recovery procedures, but they can take time.

Domain hijacking is preventable. Take these security measures seriously—your online identity depends on it.