- clientTransferProhibited / locks
- 2FA on registrar login
- Verified contact email
Stops many transfers if you actually enable them.
Theft · DNS and registrar drift
What happens if someone steals my domain?
If someone steals your domain, they either move it to a registrar account they control or change its nameservers so your website and email point at their servers. Both usually start with a stolen registrar login. You recover it through your registrar, faster with timestamped evidence. Aepto Theft Guard alerts you when the registrar or nameservers change.
By Muhammad Hamza, Founder of AeptoPublished Updated
What “stolen” usually looks like
Compromised registrar access or silent DNS moves, not a Hollywood hack.
- Attackers target registrar accounts with weak passwords, reused credentials, phishing, or stale recovery emails.
- Once inside, they may initiate a transfer, change nameservers, or alter DNS so traffic and mail follow them.
- Victims often learn from bounce messages, SEO collapse, or a client asking why the site redirects somewhere else.
- Portfolio owners feel it harder: dozens of names, several registrars, and nobody watching every panel daily.
- The cost is lost mail and traffic, and support queues full of “your site is gone.”
- NS / registrar baseline diff
- Attention + paid webhooks
- DNS history for disputes
Tells you when something moved. Does not replace locks.
What usually happens next
Act in layers. Speed and evidence both matter.
Prevent
Locks and 2FA
Registrar locks, clientTransferProhibited, and verified contacts stop many transfers before they start, if you enable them on every production name.
Detect
Baseline alerts
Theft Guard watches NS and registrar signals against what Aepto learned as normal for that domain, then raises Attention when drift appears.
Respond
Registrar and evidence
Abuse teams move faster with timestamps and history. DNS change logs from monitoring are useful; they are not a substitute for counsel when ownership is contested.
Portfolio reality: many names, one silent move
- The risk is the one production name that moves while everyone is watching another fire.
- Central inventory plus Theft Guard makes that move visible in the same place as uptime and SSL.
Aepto is not a registrar lock and cannot recover a name for you. It shows when control moved and keeps the history your registrar needs.
What should you do in the first 24 hours?
Registrars move faster when you arrive with facts.
- First hourConfirm and contain
Check registrar, nameservers and DNS from two networks. Change the registrar password, remove unknown users, turn on 2FA.
- Hours 1–4Contact the registrar
Open a case with their abuse or security team. Bring timestamps of when the registrar or nameservers changed.
- Same daySecure every other account
Attackers reuse credentials. Rotate passwords and review users on every registrar that holds your names.
- Same dayTell customers once
Post on your status page. Keep detailed triage in a private channel.
- After recoveryRe-lock and reset
Re-enable transfer locks, update the Theft Guard baseline, and find which names were missing locks or monitoring.
If the name was moved to another registrar, act through your registrar quickly. ICANN's Transfer Policy lets registrars refuse a new transfer within 60 days of the last one.
What evidence speeds up recovery?
Collect this before you call. It is the difference between days and weeks.
- Account email, customer ID and order numbers that prove you hold the account.
- Renewal invoices and payment receipts.
- Timestamps of the registrar or nameserver change, from Aepto's alert history.
- Screenshots or exports of your DNS records before the change.
- A list of every user with access to the registrar account.
- Any phishing or "verify your account" emails received in the weeks before.
How can you tell a hijack from a transfer?
The signal tells you whom to contact first.
| What you see | Likely cause | First action |
|---|---|---|
| Site and email go somewhere new, but the registrar still shows you | Nameserver or DNS change | Check the nameservers at your registrar, revert them, and review who has access |
| The registrar account now belongs to someone else, or the domain is at another registrar | Unauthorized transfer | Contact your registrar security team with your evidence, then follow its dispute process |
| You can no longer log in to the registrar | Account takeover | Use account recovery, contact support, and change passwords on every related account |
| Emails asking you to approve a transfer or verify your account | Phishing or an attempt in progress | Do not click. Log in directly, turn on 2FA and check the transfer lock |
Aepto alerts when registrar or nameservers change. It cannot recover a name, so keep your evidence ready.
Common questions
Short answers to what people ask before they start.
Can Aepto prevent domain theft?
Aepto cannot block transfers at the registry. Theft Guard alerts on unexpected nameserver and registrar changes against a learned baseline. It complements locks and 2FA; it does not replace them or guarantee recovery.
What should I do first if I suspect theft?
Secure the registrar account, enable 2FA, contact your registrar abuse team, and document WHOIS/DNS history. Aepto DNS monitoring history helps show when NS or registrar drift started for that conversation.
Is Domain Watch the same as anti-theft?
No. Domain Watch tracks status for names you do not own yet. Theft Guard watches names in your inventory for baseline drift so silent moves surface in Attention.
Do registrar locks make monitoring unnecessary?
No. Locks reduce transfer risk but do not email you when nameservers leave your expected set. Prevention and detection are different layers. You want both.
How fast does recovery take?
It varies by registrar, TLD, and evidence. Early drift detection and documented history usually beat starting from a customer complaint days later. Legal timelines are outside Aepto’s product.
How does Aepto help prevent a long blind window?
Theft Guard alerts on unexpected NS/registrar baseline drift so you may learn about a move before customers do. It does not replace locks, it shortens time-to-notice.
Catch drift before customers do.
Add domains free. Theft Guard checks daily on Free and Starter, twice daily from Professional up.