Domain Account Takeover: What Victims Must Do in the First 48 Hours

The Theft Takes 10 Minutes. The Damage Can Last Years.

A domain name is not just a web address.

For most businesses, it is the front door to their entire digital operation — their email infrastructure, customer portal, e-commerce platform, and brand identity, all anchored to a string of characters registered with a hosting provider.

When that domain is stolen, everything connected to it can be weaponized, redirected, or destroyed within hours.

Domain account takeovers are among the fastest-moving cybercrime events that attorneys encounter.

According to the FBI’s IC3, U.S. cybercrime losses hit a record $20.9 billion in 2025, led by business email compromise and account takeover schemes.

Domain hijacking sits at the intersection of both.

What makes domain takeover cases uniquely devastating is the speed.

A skilled attacker with access to a registrar account can transfer a domain, reroute DNS records to offshore servers, and disable two-factor authentication recovery options in under 10 minutes.

Global DNS propagation — the process by which the new, fraudulent routing instructions spread across the internet — can complete within 24 to 48 hours, sometimes sooner.

By the time a business owner realizes what has happened, their domain may already be resolving to a fraudulent website hosted in a jurisdiction with no U.S. law enforcement cooperation.

This is not a hypothetical. It is a documented, repeatable attack pattern that affects thousands of businesses every year.

Who Is Doing This — and How

Federal law enforcement and cybersecurity researchers have identified several well-documented methods attackers use to execute domain account takeovers.

Understanding the attack vector matters because it directly shapes how victims and their attorneys build a legal case and pursue recovery.

SIM-Swap Attacks remain the most prevalent gateway to domain takeover.

The attacker contacts a mobile carrier — Verizon, AT&T, T-Mobile — impersonates the victim, and convinces a customer service representative to port the victim’s phone number to a SIM card under the attacker’s control.

Once they control the phone number, they reset the registrar account password using SMS-based two-factor authentication.

The Federal Communications Commission (FCC) has issued specific consumer guidance on SIM-swapping, acknowledging it as a systemic vulnerability in carrier identity verification protocols.

The FCC’s rules, updated in 2023, now require carriers to implement additional authentication before processing SIM transfers — but enforcement remains inconsistent.

Phishing and Credential Stuffing account for a significant portion of direct registrar account compromises.

The Cybersecurity and Infrastructure Security Agency (CISA) has published advisories specifically warning domain registrants about phishing campaigns that mimic GoDaddy, Namecheap, and Network Solutions login pages.

Credential stuffing — using previously leaked username and password combinations against registrar login portals — is particularly effective against account holders who reuse passwords across platforms.

Social Engineering of Registrar Support Staff is a documented attack vector that has been used against major registrars including GoDaddy.

In 2020, GoDaddy publicly confirmed that a social engineering attack against its customer support staff resulted in unauthorized changes to domain settings for multiple cryptocurrency exchange domains, including liquid.com and NiceHash.

The attackers did not need technical access — they needed a convincing story and a support agent willing to bypass verification protocols.

Insider Threats and Unauthorized Employee Access represent a less frequently discussed but legally significant category.

Former employees with residual access credentials, or third-party IT vendors with administrative access, can execute domain transfers that are indistinguishable from legitimate account activity in the initial logs.

The Major Registrars Where Takeovers Occur

Max Dilendorf and the team at Dilendorf Law Firm represent individuals and businesses who have been victims of domain account takeovers across the largest registrar platforms in the United States, including:

• GoDaddy — the world’s largest domain registrar, hosting over 84 million domain names globally
• Register.com — one of the oldest U.S. registrars, now operated under the Web.com Group
• Namecheap — a major registrar with over 17 million registered domains
• Network Solutions — a legacy registrar widely used by enterprise and government clients
• Cloudflare Registrar — increasingly used by sophisticated businesses for its DNS management capabilities

Each of these platforms maintains its own security protocols, account recovery procedures, and — critically — its own terms of service governing dispute resolution.

GoDaddy and Register.com, for example, include binding mandatory arbitration clauses in their terms of service.

This means disputes between a domain holder and the registrar — over security failures, negligence in identity verification, or unauthorized transfers — may bypass federal and state courts entirely.

Instead, they proceed through private arbitration forums such as the American Arbitration Association (AAA), JAMS, and the National Arbitration and Mediation forum (NAM).

Understanding the contractual framework governing your registrar relationship is not optional. It is the foundation of your legal strategy.

Max Dilendorf: Digital Asset and Cybercrime Attorney Since 2017

Max Dilendorf has represented digital asset holders, businesses, and high-net-worth individuals in cybercrime and account takeover matters since 2017.

He is among the earliest U.S. attorneys to practice at the intersection of digital asset law and cybercrime enforcement.

His arbitration experience spans some of the most complex digital asset loss cases in the United States.

He has arbitrated 130+ matters at AAA, JAMS, and NAM against financial institutions, digital asset custodians, and telecommunications carriers for breach of contract, gross negligence, and breach of fiduciary duty.

These cases share a common thread: an institution’s failure to implement adequate security controls resulted in a victim’s irreversible financial loss — and the victim’s only path to recovery ran through a binding arbitration clause buried in a terms of service agreement.

Domain account takeover cases follow the same legal architecture.

GoDaddy’s support staff is required to verify identity before making any account changes. Register.com’s authentication systems are expected to flag unauthorized logins from anomalous IP addresses.

When either fails, those failures may constitute actionable breaches of the registrar’s contractual obligations and duty of care to the account holder.

What separates successful recovery cases from failed ones is almost always the same factor: how quickly the victim engaged qualified legal counsel and how completely the evidentiary record was preserved in the hours and days immediately following the attack.

Dilendorf’s Team Behind the Investigation

Dilendorf Law Firm’s domain takeover practice is supported by a team that includes retired FBI and Department of Justice cybercrime enforcement agents who bring direct investigative experience to private matters.

This matters for several reasons that go beyond legal credentials.

Former federal agents know exactly how law enforcement triages cybercrime complaints.

That experience matters when filing your IC3 report. A properly structured report significantly increases the probability that the FBI’s Cyber Division or a regional USSS Electronic Crimes Task Force will open an active investigation.

They understand the investigative timelines, the evidentiary standards that federal prosecutors require, and the specific technical documentation that makes a case actionable.

They also understand what registrars and hosting providers are capable of producing — and what they will resist producing without legal compulsion.

Account access logs, login IP history, security audit logs, and internal support ticket records are critical evidence in domain takeover cases.

These records are not always preserved indefinitely.

Engaging counsel immediately creates the legal basis for a preservation demand letter — a formal written instruction to the registrar requiring them to preserve all relevant records pending litigation or arbitration.

The First 48 Hours: A Step-by-Step Response Framework

The actions a victim takes — or fails to take — in the first 48 hours after a domain takeover are the single most determinative factor in whether recovery is possible.

Here is the framework Max Dilendorf’s team follows with new clients:

Hour 1–2: Confirm and Document the Takeover

Do not attempt to log into your registrar account repeatedly.

Failed login attempts can trigger account lockouts that complicate recovery.

Instead, use a WHOIS lookup tool — ICANN’s WHOIS database is publicly accessible at lookup.icann.org — to confirm whether the registrant information on your domain has been changed. Screenshot everything.

Document the current DNS records. Note the exact time you discovered the compromise.

Hour 2–4: Contact the Registrar’s Abuse and Security Team

Every major registrar maintains a separate abuse or security escalation contact that operates independently from standard customer support.

Do not call the general customer service line.

For GoDaddy, the relevant contact is their abuse reporting channel.

For Network Solutions and Register.com, escalation paths exist through their legal and security departments.

Request an immediate account freeze and preservation of all account activity logs. Put this request in writing — email creates a timestamped record.

Hour 4–6: File an IC3 Report

The FBI’s Internet Crime Complaint Center at ic3.gov is the mandatory first step for federal law enforcement engagement.

Filing takes under 10 minutes if you have your documentation prepared.

The report should include: your domain name, the registrar, the approximate time of the compromise, any known attack vector (SIM-swap, phishing, etc.), estimated financial damages, and any associated business email compromise.

The quality and completeness of your IC3 report directly affects whether the FBI’s Cyber Division assigns an agent to your case.

A vague, incomplete report is far less likely to generate active federal investigation.

Hour 6–12: File with CISA and FTC

CISA maintains a reporting portal at cisa.gov/report for cybersecurity incidents.

The Federal Trade Commission accepts identity theft and account takeover reports at reportfraud.ftc.gov.

These filings create additional federal records and may trigger parallel agency involvement, particularly if the attack involved a telecommunications carrier in a SIM-swap.

Hour 12–24: Engage Cybercrime Counsel and Issue Preservation Demands

This is where legal counsel becomes not just advisable but essential.

An experienced cybercrime attorney can immediately issue preservation demand letters to the registrar, any involved telecommunications carrier, and any hosting provider where DNS records were redirected.

These letters are legally significant — they place the recipient on formal notice that litigation or arbitration is anticipated and that destruction of relevant records may constitute spoliation of evidence.

Hour 24–48: Evaluate Emergency Relief Options

Depending on the circumstances, emergency legal relief may be available through federal court in the form of a temporary restraining order (TRO) compelling the registrar to freeze the domain transfer and restore access pending a full hearing.

These applications are time-sensitive, fact-intensive, and require experienced counsel to execute effectively. Not every case qualifies — but for high-value domains where irreparable harm can be demonstrated, emergency injunctive relief can be the fastest path to restoration.

The Evidence That Wins These Cases

Experienced cybercrime attorneys know that domain takeover cases are built on technical evidence that most victims do not know exists — and that registrars do not volunteer.

The critical evidence categories include:

Account Access Logs — A timestamped record of every login, failed login, and session initiation associated with the registrar account.

These logs can establish exactly when unauthorized access occurred and from which IP address.

Login IP History — The specific IP addresses used to access the account before, during, and after the takeover.

Anomalous IP addresses — particularly those geolocated to foreign jurisdictions or associated with known VPN or proxy services — are powerful evidence of unauthorized access.

Security Audit Logs — Records of every security-relevant action taken on the account: password changes, two-factor authentication modifications, authorized contact updates, and domain transfer initiations.

These logs tell the story of the attack in sequential detail.

Support Ticket and Chat Records — Internal records of any customer support interactions associated with the account during the attack window.

In social engineering cases, these records may directly capture the fraudulent representations made by the attacker to support staff.

DNS Change Logs — Records showing when DNS records were modified and what values were substituted.

These logs establish where the domain was redirected and provide technical evidence for tracing the attacker’s infrastructure.

Obtaining these records requires formal legal process — either a preservation and production demand backed by arbitration or litigation authority, or a subpoena issued through federal court in connection with an active criminal investigation.

This is why engaging counsel in the first 48 hours is not a recommendation. It is a requirement.

Most domain registrar agreements — including GoDaddy and Register.com — contain mandatory binding arbitration clauses that require disputes to be resolved through private arbitration rather than civil litigation.

For victims, this has both advantages and disadvantages.

The advantage is speed.

Why Arbitration Changes Everything

Arbitration proceedings at AAA, JAMS, and NAM move significantly faster than federal court litigation.

Emergency relief mechanisms exist within arbitration frameworks that can be invoked quickly.

Arbitration also tends to produce less public exposure — a consideration for businesses concerned about reputational harm from a publicly filed lawsuit.

The disadvantage is that arbitration requires experienced counsel who understands the procedural rules of each forum, the discovery mechanisms available within arbitration, and the specific claims — breach of contract, gross negligence, violations of federal and state consumer protection laws — that registrar defendants are most vulnerable to.

Filing an arbitration claim without this expertise is likely to result in dismissal or an inadequate award.

Max Dilendorf has arbitrated complex cybercrime cases across all three major forums — AAA, JAMS, and NAM — against financial institutions, digital asset custodians, and telecommunications carriers.

His team understands the precise legal architecture of these cases and how to build the evidentiary record that arbitration panels find compelling.

Contact Dilendorf Law Firm

If your domain has been compromised, or if you believe you are at risk, time is the most critical variable in your case.

The longer evidence goes unpreserved, the narrower your legal options become.

Max Dilendorf, Esq. Dilendorf Law Firm, PLLC 115 Broadway, 5th Floor New York, NY 10006 📞 212.457.9797 📧 max@dilendorf.com 🌐 dilendorf.com

This article is for informational purposes only and does not constitute legal advice. Reading this article does not create an attorney-client relationship. If you have experienced a domain account takeover, contact a qualified cybercrime attorney immediately.

[Attorney Advertising]