Module 7 · 7.1

English ▾

Nederlands English Deutsch Français Dansk Polski Čeština Ελληνικά Hrvatski

Domain hijacking and fake emails

Module 7: Keeping your domain safe and healthy · Reading time: 10 minutes

Learning objective: After this lesson you can recognise the ways in which domains are hijacked or holders are scammed, and you know how to protect your account and your domains against them.

Key concepts: domain hijacking, account with your registrar, two-step verification, access management, fake invoice, registration offer, slamming, fake email on behalf of the registry, registry lock, transfer code as a key

Why your domain is a target

Whoever controls your domain name also receives the email sent to that name. And with that email they can click "forgot password" on almost any other account: your accounting, your bank, your online shop, your social media. So a domain is worth far more than the website that runs on it.

There are four ways things go wrong:

Someone gets into your account with your registrar and changes the nameservers, the DNS or the registrant.
Someone gets hold of your transfer code and takes the domain to another registrar (lesson 6.3).
Your domain expires and someone else registers it (module 5).
You are scammed with a fake invoice or a fake email, without anything technical happening at all.

You can do something about each of these four.

The front door: your account with your registrar

Many hijackings don't start with hacking the registry, but with logging in to the holder's account. A reused password or a click on a fake login page is enough. Once someone is in, they can do everything you can.

This is how you keep that door shut:

A unique, strong password that you don't use anywhere else. A password manager helps.
Two-step verification. Besides your password you then need a second code, from your email or from an authenticator app. An app is stronger: anyone who takes over your mailbox still doesn't have your phone.
A login email address that isn't on the domain itself. If the domain stops working, or has been hijacked, you still want to be able to log in and receive email from your registrar.
Know who has access. Give a colleague or your web developer their own user with limited rights instead of your password. Remove people who no longer belong there, such as a former employee or a previous web developer.

Transfer code, transfer lock and registry lock

The transfer code (verhuiscode) is the key to your domain (lesson 6.3). Only request it when you are transferring the domain yourself, and only give it to the registrar you are moving to.

Where the extension supports it, turn on the transfer lock. The registry then refuses a transfer, even if someone has the code. This is possible with .com and most gTLDs; with .nl, .eu, .be and .nu it usually isn't. There, the code itself is the protection.

For names where a lot really depends on them, there is a registry lock: a lock at the registry itself. SIDN offers this for .nl under the name .nl Control. With it, nobody, not even your registrar, can change anything in the registration without SIDN first checking with the holder that the request is genuine. You apply for it through your registrar. It does mean extra work with every change. For most names the benefit doesn't outweigh that; for the main name of a large organisation or online shop it often does.

Fake invoices and registration offers

Not every attack is technical. A lot of fraud revolves around one thing: getting you to pay.

Fake invoices. SIDN regularly warns about "invoices" for domain names from parties with names such as Domeinregistratie Nederland, DNS Registraties NL or Web Registraties Nederland. Often the small print at the bottom says it isn't an invoice but an offer. The advice: don't pay, and report it to the Fraudehelpdesk (the Dutch fraud help desk).

Registration offers. A well-known variant: you get a message saying that "someone else wants to register your name with a different extension", but that you may go first if you pay quickly. A "right of first registration" does not exist. Check for yourself whether the name is available, ask your own registrar and report it to the Fraudehelpdesk.

Slamming. You receive a letter or email that looks like a renewal invoice, but it is actually an offer to transfer your domain to another party. Anyone who pays and signs suddenly finds themselves with a registrar they don't know.

The defence is the same in all three cases. Know which registrar your domains are with (lesson 7.4) and only pay invoices that you can also find in your own account with that registrar. Also remember: SIDN does not sell .nl names to holders itself. So anyone posing as "the registration authority" and trying to sell you something directly is not SIDN.

Fake emails on behalf of ICANN or the registry

Genuine emails about your domain do exist. With .com and other gTLDs, for example, your registrar may ask you to check your registration details, confirm the registrant's email address or approve a transfer. Precisely because these emails exist, they get imitated.

This is how you spot a fake email:

you have to pay via a link in the email, while your registrar gives you an invoice in your account;
it threatens that your domain will expire or be deleted today;
the link goes to an unknown website, not to your registrar or the registry;
you have to log in via that link, or you get an offer for "search engine registration";
the email is about a domain you don't own, or comes from a company you are not a customer of.

If in doubt, don't click anything. Go to your account with your registrar yourself and check there whether anything is wrong.

If things go wrong anyway

If your website suddenly stops working, or your email no longer arrives, check in your account whether the nameservers or the DNS records have been changed. If the domain is gone or has been transferred, contact your registrar straight away, with proof that you are the holder (lesson 6.3). After that, change your passwords, review the users and above all check the MX records: anyone who changes those can read your email.

In practice: how it works at WebOké

In My WebOké you log in with your password and a login code sent by email (WebOké manual 3.2). You can also set up an authenticator app (3.3). You manage who has access under My Administration › Users (11.3). You will find the transfer lock on the domain page in the Advanced card, under Transfer lock. Other registrars work in a similar way: look for two-step verification, users or team members, and a transfer or domain lock.

The Advanced card on the domain page with the transfer code, DNSSEC, the transfer lock, WHOIS privacy, cancelling and transferring — The Advanced card

Summary

Whoever controls your domain also controls your email, and with it the password recovery of your other accounts.
Protect your registrar account with a strong password, two-step verification and separate users for others.
Turn on the transfer lock where possible; for important .nl names there is .nl Control.
Fake invoices, registration offers and slamming: only pay what you can find in your own account.
Don't click links in emails about your domain; check your account yourself.

Quiz

1. You receive an "invoice" for the registration of your .nl name from a party you don't know. The small print at the bottom says it is an offer. What do you do? Pay it, otherwise you lose the name
Forward it to SIDN so they pay it
Don't pay and report it to the Fraudehelpdesk
Cancel your domain with your own registrar

This is a well-known form of fake invoice. Only pay invoices that you can find in the account with your own registrar.

2. Why is an authenticator app stronger than a login code sent by email? Anyone who takes over your mailbox still doesn't have your phone
An app works without a password
An app also turns on the transfer lock automatically
An app also receives the email from your registrar

With a code sent by email, your mailbox is the second key. An app uses a separate device.

3. What does .nl Control do? It renews your .nl name automatically
It hides your details in the WHOIS
It only blocks transfers, not other changes
It has SIDN check with the holder that a change is genuine

With this registry lock, nobody, not even your registrar, can change anything without a check with the holder.

4. Someone tells you that "another company wants to register your name with a different extension" and that you may go first if you pay today. What is true? You have a right of first registration, so paying quickly is wise
A right of first registration doesn't exist; check yourself if the name is free
Only SIDN is allowed to send messages like this
You must register your trademark first before you may respond

This is a well-known trick. Check for yourself whether the name is available and ask your own registrar.

Exercise

Exercise D7.1: Your account locked down. Review the account you use to manage your domains, at WebOké or at another registrar. Turn on what is still off and clear out what no longer belongs there.

Tick off:

Two-step verification is on (at WebOké: login code by email or an authenticator app, manual 3.2 and 3.3).
You have checked who has access and removed former employees or previous web developers (manual 11.3).
The transfer lock is on for every domain where that is possible.
The login email address of your account is not on a domain you manage through that account.
You know how to recognise a genuine invoice from your registrar and where to find it in your account.

Answer:

Which form of two-step verification do you use, and on which other accounts related to your domain (email, DNS, hosting) is it not yet turned on?
Who had access to your account, and whom have you removed or restricted?
For which of your domains is a transfer lock possible, and is it on now? For which is it not possible, and why?
From now on, how will you check whether an invoice or email about your domain is genuine?

Exercise D7.1: Your account locked down

You do this exercise yourself; no one checks it. Tick off what you've done and mark the exercise as done.

Two-step verification is on (at WebOké: login code by email or an authenticator app, manual 3.2 and 3.3).
You have checked who has access and removed former employees or previous web builders (manual 11.3).
The transfer lock is on for every domain where that is possible.
The login address of your account is not on a domain that you manage through that account.
You know how to recognise a genuine invoice from your registrar and where to find it in your account.

Which form of two-step verification do you use, and on which other accounts around your domain (mail, DNS, hosting) is it not yet on?

Who had access to your account, and who have you removed or restricted?

Which of your domains can have a transfer lock, and is it on now? Which cannot, and why?

How will you check from now on whether an invoice or email about your domain is genuine?

Also save my answers in My courses (so you can view and download them on any device). Don't include any passwords or other secrets.

Here's how you could approach this

1. A concrete method (code by email or authenticator app, preferably the app) and a list of other accounts (mailbox, DNS service, hosting) with what still needs doing there. 2. Names or roles of who had access, and who was removed or given their own limited rights instead of a shared password. 3. Domains with .com or other gTLDs: lock on. Domains with .nl, .eu, .be or .nu: no transfer lock, there the transfer code (verhuiscode) is the protection (possibly .nl Control for an important .nl name). 4. Do not click links in the email; log in to your own registrar yourself and only pay what is listed there as an invoice; if in doubt, ask the registrar and report fake invoices to the Fraudehelpdesk (the Dutch fraud helpdesk).

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing