{"id":5044,"date":"2026-10-21T09:37:51","date_gmt":"2026-10-21T07:37:51","guid":{"rendered":"https:\/\/www.domains.co.za\/blog\/?p=5044"},"modified":"2026-10-23T12:32:58","modified_gmt":"2026-10-23T10:32:58","slug":"domain-hijacking","status":"publish","type":"post","link":"https:\/\/www.domains.co.za\/blog\/domain-hijacking\/","title":{"rendered":"Domain Hijacking: How It Happens And How To Protect Your .CO.ZA Domain"},"content":{"rendered":"<div id=\"bsf_rt_marker\"><\/div>\n<p class=\"wp-block-paragraph\"><strong>TL;DR:<\/strong> Domain hijacking happens when someone takes control of your <a alt=\"Link to Domains.co.za - Register Domains\" title=\"Domains.co.za - Register Domains\" href=\"https:\/\/www.domains.co.za\/domain-registration\" target=\"_blank\" rel=\"noopener\">domain name<\/a> without permission, usually by getting into your registrar account through a stolen password, a hijacked contact email address or a fake support request. Prevent it by protecting that account with two-factor authentication (2FA), keeping the contact email on an address you control, turning on the transfer lock and auto-renewal, and checking your details regularly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>RELATED:<\/strong><a alt=\"Link to Domains.co.za - Domain Protection\" title=\"Domains.co.za - Domain Protection\" href=\"https:\/\/www.domains.co.za\/domain-protection\" target=\"_blank\" rel=\"noopener\"> Domains.co.za Launches Complete Domain Protection Package To Safeguard And Boost Domain Performance<\/a><\/p>\n\n\n\n<h4 id=\"key-takeaways\" class=\"wp-block-heading\">KEY TAKEAWAYS<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Most domain hijacks occur through the registrar account. It is not a technical attack on the domain itself.<\/li>\n\n\n\n<li>The email address on your domain account is a master key: whoever controls it can usually reset your password.<\/li>\n\n\n\n<li>A transfer lock stops unauthorised transfers, but anyone inside your account can switch it off. Two Factor Authentication (2FA) on the account together with domain updates closes that gap.<\/li>\n\n\n\n<li>An expired domain can be registered by someone else. Auto-renew and up-to-date payment details prevent this.<\/li>\n\n\n\n<li>If something changes unexpectedly, contact your registrar immediately, secure your email, and keep evidence.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.domains.co.za\/domain-protection\" alt=\"Link to Domains.co.za - Domain Protection\" title=\"Domains.co.za - Domain Protection\" target=\"_blank\" rel=\"noopener\">Domain Protection<\/a> from Domains.co.za adds an extra layer of security every domain name needs.<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h4>TABLE OF CONTENTS<\/h4><nav><ul><li class=\"\"><a href=\"#key-takeaways\">KEY TAKEAWAYS<\/a><\/li><li class=\"\"><a href=\"#what-is-domain-hijacking\">What is Domain Hijacking?<\/a><\/li><li class=\"\"><a href=\"#how-domain-hijacking-happens\">How Domain Hijacking Happens<\/a><ul><li class=\"\"><a href=\"#scenario-1-a-stolen-domain-account-login\">Scenario 1: A stolen domain account login<\/a><\/li><li class=\"\"><a href=\"#scenario-2-a-hijacked-contact-email-address\">Scenario 2:\u00a0 A hijacked contact email address<\/a><\/li><li class=\"\"><a href=\"#scenario-3-a-domain-registered-in-someone-elses-name\">Scenario 3: A domain registered in someone else&#8217;s name<\/a><\/li><li class=\"\"><a href=\"#scenario-4-an-expired-registration\">Scenario 4: An expired registration<\/a><\/li><li class=\"\"><a href=\"#scenario-5-social-engineering-and-fake-requests\">Scenario 5: Social engineering and fake requests<\/a><\/li><\/ul><\/li><li class=\"\"><a href=\"#how-to-prevent-domain-hijacking-a-checklist\">How To Prevent Domain Hijacking: A Checklist<\/a><\/li><li class=\"\"><a href=\"#what-a-transfer-lock-does-and-doesnt-do\">What a Transfer Lock Does and Doesn&#8217;t Do<\/a><\/li><li class=\"\"><a href=\"#warning-signs-your-domain-may-be-under-attack\">Warning Signs Your Domain May Be Under Attack<\/a><\/li><li class=\"\"><a href=\"#what-to-do-if-your-domain-is-hijacked\">What to Do if Your Domain is Hijacked<\/a><\/li><li class=\"\"><a href=\"#how-to-choose-the-perfect-domain-name\">How to Choose &amp; Register the PERFECT Domain Name<\/a><\/li><li class=\"\"><a href=\"#faqs-1\">FAQS<\/a><\/li><li class=\"\"><a href=\"#other-blogs-of-interest\">Other Blogs of Interest<\/a><\/li><\/ul><\/nav><\/div>\n\n\n\n<h3 id=\"what-is-domain-hijacking\" class=\"wp-block-heading\">What is Domain Hijacking?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Domain hijacking is the criminallyl taking of control of a domain name from its rightful owner, according to the Security and Stability Advisory Committee (SSAC) of <a href=\"https:\/\/www.icann.org\/en\/ssac\/publications\/details\/sac-007-domain-name-hijacking-incidents-threats-risks-and-remediation-01-01-2020-en\" alt=\"Link to ICANN - Domain Name Hijacking Threats\" title=\"ICANN - Domain Name Hijacking Threats\" target=\"_blank\" rel=\"noopener\">ICANN<\/a>, the body that coordinates the global domain name system. Your registrar is the company you register and renew the domain with. The registrant is the person or business listed as the domain&#8217;s legal owner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a business, a domain hijack means your website can go offline or be redirected. It also means that emails sent to your addresses can be intercepted, and attackers have the ability to launch phishing attacks on your customers in your name.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two related cyber threats are often confused when it comes to the hijacking of a domain:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>DNS hijacking<\/strong> is when traffic is redirected by changing your DNS records (the settings that point your domain to your website and email). This often occurs without needing to take ownership of the domain as well.<\/li>\n\n\n\n<li><strong>Typosquatting<\/strong> (also known as domain spoofing) is when a cybercriminal registers a look-alike domain, such as a misspelling of your business name, to fool visitors.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>RELATED:<\/strong> <a href=\"https:\/\/www.domains.co.za\/blog\/the-domain-name-scams-guide\/\" alt=\"Link to Domains.co.za Blog - The Domain Name Scams Guide: What To Look Out For And How To Protect Your SME\" title=\"Domains.co.za - The Domain Name Scams Guide: What To Look Out For And How To Protect Your SME\" target=\"_blank\" rel=\"noopener\">The Domain Name Scams Guide: What To Look Out For And How To Protect Your SME<\/a><\/p>\n\n\n\n<h3 id=\"how-domain-hijacking-happens\" class=\"wp-block-heading\">How Domain Hijacking Happens<\/h3>\n\n\n<div class=\"wp-block-image wp-block-image size-full\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.domains.co.za\/blog\/wp-content\/uploads\/2026\/10\/domain-hijacking-05.webp\" alt=\"Strip Banner - Use an email address only you control and lock your domain to prevent unauthorised transfers\" title=\"Strip Banner - Use an email address only you control and lock your domain to prevent unauthorised transfers\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Most domain takeovers occur because a cybercriminal gained access to the domain&#8217;s account. Whoever controls that account controls the domain. ICANN&#8217;s SSAC found that hijacks are commonly caused by flaws in registration processes and poor administration, and they aren&#8217;t part of sophisticated hacking.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Below are five possible scenarios how a domain hijacking takes place and how to protect yourself:<\/p>\n\n\n\n<h4 id=\"scenario-1-a-stolen-domain-account-login\" class=\"wp-block-heading\">Scenario 1: A stolen domain account login<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker gets your Domains.co.za (registrar) username and password, usually through a phishing email that copies your registrar&#8217;s login page, or because you reused a password that leaked in a breach on another site. It works because the password is the only thing standing between the attacker and full control.<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-1 wp-block-paragraph\"><strong>DEFENCE:<\/strong> <\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-2 wp-block-paragraph\">Create a unique password and activate two-factor authentication (2FA), which asks for a second code when you log in.<\/p>\n\n\n\n<h4 id=\"scenario-2-a-hijacked-contact-email-address\" class=\"wp-block-heading\">Scenario 2:&nbsp; A hijacked contact email address<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">All password resets go to the email address on a registrar (Domains.co.za) account. If that address sits on a domain that has expired, in a former employee&#8217;s mailbox or in an old free Webmail account, someone else can take it over and reset your password. ICANN&#8217;s SSAC says attackers are collecting contact details through WHOIS (the public record of who registered a domain) and then registering the expired domains those email addresses are dependent on.<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-3 wp-block-paragraph\"><strong>DEFENCE:<\/strong> <\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-4 wp-block-paragraph\">Register your domain account using a current email address on a domain you control and monitor regularly.<\/p>\n\n\n<div class=\"wp-block-image wp-block-image size-full\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.domains.co.za\/blog\/wp-content\/uploads\/2026\/10\/domain-hijacking-02.webp\" alt=\"Strip Banner - Enable 2FA to make it harder for hackers to access your domain account\" title=\"Strip Banner -Enable 2FA to make it harder for hackers to access your domain account\"\/><\/figure>\n<\/div>\n\n\n<h4 id=\"scenario-3-a-domain-registered-in-someone-elses-name\" class=\"wp-block-heading\">Scenario 3: A domain registered in someone else&#8217;s name<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Many small business domains were registered by a web designer, agency or staff member who is still listed as the registrant. This isn&#8217;t always malicious. But if that person leaves, falls out with you or cannot be reached, you may be unable to prove ownership or act quickly enough when something goes wrong.<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-5 wp-block-paragraph\"><strong>DEFENCE:<\/strong> <\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-6 wp-block-paragraph\">Always ensure your business is the registrant.<\/p>\n\n\n\n<h4 id=\"scenario-4-an-expired-registration\" class=\"wp-block-heading\">Scenario 4: An expired registration<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">A missed domain renewal or an expired card on file could let a domain lapse. Once it&#8217;s released back into circulation, anyone can register it, and your website and email can go with it. This often happens because renewal reminders go to an inbox nobody monitors.<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-7 wp-block-paragraph\"><strong>DEFENCE:<\/strong> <\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-8 wp-block-paragraph\">Enable <a>Auto-Renewal<\/a>, keep your payment details up to date, and make sure th email renewal notifications reach someone who will act on them.<\/p>\n\n\n\n<h4 id=\"scenario-5-social-engineering-and-fake-requests\" class=\"wp-block-heading\">Scenario 5: Social engineering and fake requests<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers often send fake renewal invoices or &#8220;verify your domain&#8221; emails, or phone domain owners pretending to be the registrar (i.e. Domains.co.za). The goal: to obtain your login details or your EPP Code (also called an Auth Code). If they have the EPP Code, they have the transfer password another registrar needs before it can move your domain. These requests work because they look routine and urgent.<\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-9 wp-block-paragraph\"><strong>DEFENCE:<\/strong> <\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-link-color wp-elements-10 wp-block-paragraph\">Never share your EPP code or login details. Verify requests by logging in directly to the Domains.co.za (your registrar) website and avoid clicking links in unexpected emails.<\/p>\n\n\n\n<h3 id=\"how-to-prevent-domain-hijacking-a-checklist\" class=\"wp-block-heading\">How To Prevent Domain Hijacking: A Checklist<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Your domain is a critical part of your business, so protecting it should be part of your regular security routine.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Follow the checklist below for every domain your business owns. Each one closes at least one of the security breaches mentioned in the scenarios above.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Use a unique password and turn on 2FA for your registrar (Domains.co.za) account:<\/strong> The US Cybersecurity and Infrastructure Security Agency (<a href=\"https:\/\/www.cisa.gov\/resources-tools\/resources\/mitigate-dns-infrastructure-tampering\" alt=\"Link to CISA.gov - Mitigate DNS Infrastructure Tampering\" title=\"CISA.gov - Mitigate DNS Infrastructure Tampering\" target=\"_blank\" rel=\"noopener\">CISA<\/a>) recommend multi-factor authentication on all registrar and DNS accounts.<\/li>\n\n\n\n<li><strong>Double check registrant names and contact emails:<\/strong> Log in to your account to double-check the information. Your business should be the owner, and the email should be one you control.<\/li>\n\n\n\n<li><strong>Make sure the transfer lock is on:<\/strong> Domains.co.za customers can check this in the Customer Portal.<\/li>\n\n\n\n<li><strong>Add 2FA on domain updates<\/strong>: With 2FA any change requires a second confirmation. With <a href=\"https:\/\/www.domains.co.za\/domain-protection\" alt=\"Link to Domains.co.za - Domain Protection\" title=\"Domains.co.za - Domain Protection\" target=\"_blank\" rel=\"noopener\">Domain Protection<\/a>, an Authorisation Code is emailed to you before any change is applied.<\/li>\n\n\n\n<li><strong>Turn on auto-renew and keep payment details up to date:<\/strong> This helps prevent your domain from expiring because of a missed renewal or failed payment.<\/li>\n\n\n\n<li><strong>Keep your EPP Code private:<\/strong> Only request an EPP when you&#8217;re transferring the domain yourself and keep it private.<\/li>\n\n\n\n<li><strong>Keep a list of every domain the business owns:<\/strong> Also indicate who can access each one. CISA recommends this inventory, and it brings forgotten domains and old logins to light.<\/li>\n\n\n\n<li><strong>Use WHOIS Privacy:<\/strong> WHOIS Privacy reduces the contact details attackers can collect.<\/li>\n<\/ol>\n\n\n<div class=\"wp-block-image wp-block-image size-full\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.domains.co.za\/blog\/wp-content\/uploads\/2026\/10\/domain-hijacking-03.webp\" alt=\"Strip Banner - Use an email address only you control and lock your domain to prevent unauthorised transfers\" title=\"Strip Banner - Use an email address only you control and lock your domain to prevent unauthorised transfers\"\/><\/figure>\n<\/div>\n\n\n<h3 id=\"what-a-transfer-lock-does-and-doesnt-do\" class=\"wp-block-heading\">What a Transfer Lock Does and Doesn&#8217;t Do<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A transfer lock (also called a registrar lock) blocks your domain from being moved to another registrar while it is switched on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For .co.za, .org.za, .net.za and .web.za domains, the lock has only been available since 1 April 2025, when the ZA Registry Consortium (ZARC), which runs these extensions, introduced it. Domains.co.za automatically has locks switched on for active and new domains on those extensions. Read more about <a href=\"https:\/\/www.domains.co.za\/blog\/domain-transfer-lock\/\" alt=\"Link to Domains.co.za Blog - Domain Transfer Lock: Domains.co.za Becomes First Registrar To Offer Free .co.za Security Feature\" title=\"Domains.co.za - Domain Transfer Lock: Domains.co.za Becomes First Registrar To Offer Free .co.za Security Feature\" target=\"_blank\" rel=\"noopener\">Transfer Lock for .co.za domains<\/a>. International extensions such as .com have their own lock settings at their relevant registrar.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The lock doesn&#8217;t stop anyone who is already inside your account. They can switch it off, change your nameservers (the servers that tell the internet where your DNS records are) or edit DNS records directly, without transferring anything. That&#8217;s why 2FA on the account and on domain updates matter as much as the lock.<\/p>\n\n\n\n<h3 id=\"warning-signs-your-domain-may-be-under-attack\" class=\"wp-block-heading\">Warning Signs Your Domain May Be Under Attack<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Domain hijacking isn&#8217;t always obvious at first. You might receive a suspicious email, notice an unexpected change to your domain settings, or find that your website or email is no longer working as it should. The sooner you spot the signs, the better your chances are of limiting the damage and regaining control.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Act straight away if you notice any of these:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Emails about transfer requests, EPP codes, or contact changes you didn&#8217;t make.<\/li>\n\n\n\n<li>You suddenly can&#8217;t log in to your Domains.co.za (registrar\u2019s) account.<\/li>\n\n\n\n<li>Your website or email stops working, or visitors land somewhere unexpected.<\/li>\n\n\n\n<li>Your nameservers or DNS records have changed. Learn how to <a href=\"https:\/\/www.domains.co.za\/knowledgebase\/domains\/manage-dns-records\/\" alt=\"Link to Knowledgebase - How To Manage DNS Records For A Domain\" title=\"Domains.co.za - How To Manage DNS Records For A Domain\" target=\"_blank\" rel=\"noopener\">check your DNS records<\/a>.<\/li>\n\n\n\n<li>A WHOIS lookup shows a different owner or contact.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>RELATED:<\/strong><a alt=\"Link to Domains.co.za Blog - 7 Top Cyber Threats In South Africa &amp; How To Defend Your SME\" title=\"Domains.co.za - 7 Top Cyber Threats In South Africa &amp; How To Defend Your SME\" href=\"https:\/\/www.domains.co.za\/blog\/cyber-threats-in-south-africa\/\" target=\"_blank\" rel=\"noopener\"> 7 Top Cyber Threats In South Africa &amp; How To Defend Your SME<\/a><\/p>\n\n\n\n<h3 id=\"what-to-do-if-your-domain-is-hijacked\" class=\"wp-block-heading\">What to Do if Your Domain is Hijacked<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Speed matters. The sooner you inform your registrar (Domains.co.za), the more options you have.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Contact your registrar immediately<\/strong>. Contact by phone and log a support ticket, so there is a written record as well.<\/li>\n\n\n\n<li><strong>Secure the contact email account.<\/strong> Change its password, turn on 2FA, and change every password linked to the domain and registrar account.<\/li>\n\n\n\n<li><strong>Check and restore your DNS and nameserver settings.<\/strong> Once you regain access,check and restore your DNS and nameserver settings so your website and email point to the right place.<\/li>\n\n\n\n<li><strong>Provide proof.<\/strong> Gather evidence that the domain belongs to your business: invoices, registration records, emails, and screenshots.<\/li>\n\n\n\n<li><strong>If the domain was moved to another registrar, contact the registry&#8217;s legal department.<\/strong><\/li>\n\n\n\n<li><strong>Warn customers and suppliers.<\/strong> Send out warnings to your customers and suppliers that they may receive phishing emails using your domain and ask them to confirm any payment requests by phone.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">No single security measure can guarantee your domain is safe from hijacking, but a few practical steps can make it much harder for attackers to gain control and limit the damage if they try.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Start with the basics: enable 2FA on your registrar account and make sure your contact email is secure and monitored.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For an extra layer of protection, <a href=\"https:\/\/www.domains.co.za\/domain-protection\" alt=\"Link to Domains.co.za - Domain Protection\" title=\"Domains.co.za - Domain Protection\" target=\"_blank\" rel=\"noopener\">Domain Protection<\/a> adds 2FA for domain updates, WHOIS Privacy and a transfer lock in one add-on. You can <a href=\"https:\/\/www.domains.co.za\/knowledgebase\/domains\/add-domain-protection\/\" alt=\"Link to Knowledgebase - How to Add Domain Protection to a Domain\" title=\"Domains.co.za - How to Add Domain Protection to a Domain\" target=\"_blank\" rel=\"noopener\">add Domain Protection to your domain<\/a> when you register it or at any time afterwards.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.domains.co.za\/domain-protection\" alt=\"Link to Domains.co.za - Domain Protection\" title=\"Domains.co.za - Domain Protection\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" src=\"https:\/\/www.domains.co.za\/blog\/wp-content\/uploads\/2026\/10\/domain-hijacking-04.webp\" alt=\"Strip Banner - Switch on Auto-Renewal and keep your information up to date. [Get Domain Protection]\" title=\" Switch on Auto-Renewal and keep your information up to date. [Get Domain Protection]\"><\/a><\/figure>\n\n\n\n<h4 id=\"how-to-choose-the-perfect-domain-name\" class=\"wp-block-heading\">How to Choose &amp; Register the PERFECT Domain Name<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>VIDEO:<\/strong> <a href=\"https:\/\/www.youtube.com\/watch?v=RHCJNdsqf9E\" alt=\"Link to Domains.co.za - How to Choose &amp; Register the PERFECT Domain Name\" title=\"Domains.co.za - How to Choose &amp; Register the PERFECT Domain Name\" target=\"_blank\" rel=\"noopener\">How to Choose &amp; Register the PERFECT Domain Name<\/a><\/p>\n\n\n\n<iframe loading=\"lazy\" width=\"560\" height=\"315\" src=\"https:\/\/www.youtube.com\/embed\/RHCJNdsqf9E\" alt=\"Domains.co.za YouTube - How to Choose &#038; Register the PERFECT Domain Name\" title=\"Domains.co.za YouTube - How to Choose &#038; Register the PERFECT Domain Name\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen=\"\"><\/iframe>\n\n\n\n<h4 id=\"faqs-1\" class=\"wp-block-heading\">FAQS<\/h4>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1792563305838\" class=\"rank-math-list-item\">\n<h6 class=\"rank-math-question \">Can a .co.za domain be hijacked?<\/h6>\n<div class=\"rank-math-answer \">\n\n<p>Yes. The same attack routes apply to .co.za as to .com, because most hijacks go through the registrar account rather than the extension. Since 1 April 2025, .co.za, .org.za, .net.za and .web.za domains can also be protected with a transfer lock.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1792563316968\" class=\"rank-math-list-item\">\n<h6 class=\"rank-math-question \">What&#8217;s the difference between domain hijacking and DNS hijacking?<\/h6>\n<div class=\"rank-math-answer \">\n\n<p>Domain hijacking takes control of the domain registration itself, so the attacker can change the owner or move the domain. DNS hijacking redirects your website or email traffic by changing DNS settings or records, often after an account has been compromised.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1792563327289\" class=\"rank-math-list-item\">\n<h6 class=\"rank-math-question \">Does WHOIS Privacy prevent domain hijacking?<\/h6>\n<div class=\"rank-math-answer \">\n\n<p>Not on its own. It hides contact details attackers could use for phishing or impersonation, but it doesn&#8217;t stop someone who has your login. Your registrar account still needs a strong, unique password and 2FA.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1792563337779\" class=\"rank-math-list-item\">\n<h6 class=\"rank-math-question \">Can I get a hijacked domain back?<\/h6>\n<div class=\"rank-math-answer \">\n\n<p>Often, if you act quickly and can prove ownership with invoices, registration records, and emails. Recovery isn&#8217;t guaranteed and can take time, which is why preventing a hijack is far easier than reversing one.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1792563466357\" class=\"rank-math-list-item\">\n<h6 class=\"rank-math-question \">Should my web developer register the domain for me?<\/h6>\n<div class=\"rank-math-answer \">\n\n<p>They can help, but the business should ALWAYS be listed as the registrant, with a contact email that the business controls. Give the developer access to manage the domain rather than ownership and remove that access when the work ends.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1792563475302\" class=\"rank-math-list-item\">\n<h6 class=\"rank-math-question \">How do I check who&#8217;s listed as the owner of my domain?<\/h6>\n<div class=\"rank-math-answer \">\n\n<p>Log in to your registrar (Domains.co.za) account or use a WHOIS lookup. If privacy is turned on, the public record hides the details, so check your account. If your registrar lacks protections like 2FA and a transfer lock, you can transfer your domain to Domains.co.za.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<h4 id=\"other-blogs-of-interest\" class=\"wp-block-heading\">Other Blogs of Interest<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a alt=\"Link to Domains.co.za Blog - Domains.co.za Launches Complete Domain Protection Package To Safeguard And Boost Domain Performance\" title=\"Domains.co.za - Domains.co.za Launches Complete Domain Protection Package To Safeguard And Boost Domain Performance\" href=\"https:\/\/www.domains.co.za\/blog\/domain-protection\/\" target=\"_blank\" rel=\"noopener\">Domains.co.za Launches Complete Domain Protection Package To Safeguard And Boost Domain Performance<\/a><\/li>\n\n\n\n<li><a alt=\"Link to Domains.co.za Blog - How To Register Or Transfer Your Domain Name\" title=\"Domains.co.za - How To Register Or Transfer Your Domain Name\" href=\"https:\/\/www.domains.co.za\/blog\/transfer-your-domain-name\/\" target=\"_blank\" rel=\"noopener\">How To Register Or Transfer Your Domain Name<\/a><\/li>\n\n\n\n<li><a alt=\"Link to Domains.co.za Blog - Register A .AI Domain Name &amp; Position Your Tech Brand For The AI Era\" title=\"Domains.co.za - Register A .AI Domain Name &amp; Position Your Tech Brand For The AI Era\" href=\"https:\/\/www.domains.co.za\/blog\/register-a-ai-domain-name\/\" target=\"_blank\" rel=\"noopener\">Register A .AI Domain Name &amp; Position Your Tech Brand For The AI Era<\/a><\/li>\n\n\n\n<li><a alt=\"Link to Domains.co.za Blog - How long does it take to Register a Domain Name and Hosting with Domains.co.za?\" title=\"Domains.co.za - How long does it take to Register a Domain Name and Hosting with Domains.co.za?\" href=\"https:\/\/www.domains.co.za\/knowledgebase\/domains\/to-register-a-domain-name\/\" target=\"_blank\" rel=\"noopener\">How long does it take to Register a Domain Name and Hosting with Domains.co.za?<\/a><\/li>\n\n\n\n<li><a alt=\"Link to Domains.co.za Blog - 4 of the Best Website Ideas for a .love Domain Name\" title=\"Domains.co.za - 4 of the Best Website Ideas for a .love Domain Name\" href=\"https:\/\/www.domains.co.za\/blog\/website-ideas-for-a-love-domain-name\/\" target=\"_blank\" rel=\"noopener\">4 of the Best Website Ideas for a .love Domain Name<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR: Domain hijacking happens when someone takes control of your domain name without permission, usually by getting into your registrar account through a stolen password, a hijacked contact email address or a fake support request. Prevent it by protecting that account with two-factor authentication (2FA), keeping the contact email on an address you control, turning on the transfer lock and auto-renewal, and checking your details regularly. RELATED: Domains.co.za Launches Complete Domain Protection Package To Safeguard And Boost Domain Performance KEY TAKEAWAYS Most domain hijacks occur through the registrar account. It is not a technical attack on the domain itself. The email address on your domain account is a master key: <a alt='Domain Hijacking: How It Happens And How To Protect Your .CO.ZA Domain' title='Domain Hijacking: How It Happens And How To Protect Your .CO.ZA Domain' href='https:\/\/www.domains.co.za\/blog\/domain-hijacking\/' class='moreElipsis'>[&#8230;]<\/a><\/p>\n","protected":false},"author":5,"featured_media":5053,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1009],"tags":[1900],"class_list":["post-5044","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-domain-tips","tag-domain-hijacking"],"_links":{"self":[{"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/posts\/5044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/comments?post=5044"}],"version-history":[{"count":6,"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/posts\/5044\/revisions"}],"predecessor-version":[{"id":5081,"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/posts\/5044\/revisions\/5081"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/media\/5053"}],"wp:attachment":[{"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/media?parent=5044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/categories?post=5044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.domains.co.za\/blog\/wp-json\/wp\/v2\/tags?post=5044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}