Two-thirds of security breaches can be attributed to human error, according to Verizon’s 2024 DBIR. Cyber attackers are quite adept at capitalizing on the human element to breach and take control of target resources.

One asset attackers are likely to target is your domain name, as it can be more than just your web address, especially if you’re a software-as-a-service (SaaS) provider. Very often, a domain name represents a business’s digital essence, the key to customer relationships and revenue.

It is also more prone to human error than you think. Simply overlooking a domain’s expiration date can lead to missed renewal and, ultimately, hijacking.

What Is Domain Hijacking and How Does It Work?

Domain hijacking is a cyber attack where an unauthorized individual gains control of a domain name without its owner’s consent.

The attackers may have various intentions. They may want to launch phishing attacks using the hijacked domain, redirect traffic to another website, gather personally identifiable information (PII), or extort the original domain owner. Whatever their motives, threat actors commonly use the methods below to hijack domains.

Breach the Source

Attackers can take control of your organization’s domain by exploiting vulnerabilities in the domain registrar’s system. Since registrars are institutions that safeguard hundreds of thousands, if not millions, of domain names, these breaches can lead to a mass hijacking.

In fact, threat actors have demonstrated that it’s possible to compromise an entire registrar’s database, as seen in the Epik data breach, where they accessed massive amounts of data belonging to 15 million individuals. The exposed data included credit registered names, usernames, email addresses, and passwords. This data can be enough for cybercriminals to gain control of a domain name if they use the credentials to access the domain registrar account or associated email, allowing them to transfer or modify domain settings.

Social Engineering

Threat actors may trick domain owners or administrators into giving out their passwords and other important account information. They can do so through tactics like phishing and pretexting.

A likely scenario involves attackers posing as legitimate individuals or organizations to gain a victim’s trust. For example, they may pose as technical support personnel and request for login credentials to “troubleshoot” a problem.

Once they obtain your login credentials, they can modify your domain’s DNS settings and transfer domain ownership.

Missed Domain Renewals

Waiting for domains to expire is perhaps the easiest way to hijack domains with a high chance of “legally” keeping them afterward. Even after the owner files a domain name dispute with the World Intellectual Property Organization (WIPO), there’s no guarantee they can retrieve their domains. There have been several cases that resulted in the new owners keeping disputed domain names.

For example, Deckers Outdoor Corporation, the owner of the AHNU brand and trademark, allowed the registration of ahnu[.]com to lapse in 2021 since they discontinued the brand. When the company decided to relaunch the brand in 2024, they found that a new owner registered their old domain. They filed a Uniform Domain-Name Dispute-Resolution Policy (UDRP) case to take back ownership. However, despite their 15 years of continuous use, the WIPO panel denied that the new owner registered the domain in bad faith.

WIPO arrived at the same decision regarding foodandwinetravel[.]com. This time, however, the original domain owner accidentally failed to renew the domain.

Given these real-life cases, it’s clear that failing to renew domain names, whether intentional or not, exposes your organization to the risk of losing them.

What Happens after Your Domain Expires?

When a domain name expires, it goes through a series of stages. Security professionals need to understand these to avoid confusion and protect their organizations’ domain assets.

Grace period: This stage typically occurs 30–45 days after expiration. During this period, you can still renew the domain without additional fees.

Redemption period: If you miss the grace period, you can still redeem the domain within 30 days, but you will have to pay a higher fee.

Pending delete: Around 5–10 days after the redemption period, the domain enters a pending delete stage. During this time, it will not be available for registration.

Deletion: If the domain isn’t renewed or redeemed, it is eventually deleted and becomes available for anyone to register.

At a glance, you may think you have enough time to retrieve your domains after they expire, given the number of days between each period. However, the duration of these stages varies from one registrar to another. Some registrars also don’t offer a grace period at all.

Repercussions of Missing Domain Renewals

Overlooking domain renewal dates can lead to operational disruption and loss of revenue since users can no longer access your website when your domain expires. They will see an error message or, worse, may be redirected to another website if the domain was hijacked and another person has taken control.

Visitors of the hijacked domain can suffer, too, primarily when it is used to redirect them to phishing or malware-laden sites. They may end up providing their sensitive information to the hijackers, which can ultimately reflect on your company, whether you regain control of your domain or not.

Failing to renew domain registrations may further lead to costly disputes with unguaranteed wins. As pointed out in the previous section, UDRP cases are not a silver bullet for addressing a failure to renew your domain. Additionally, whether you recover your domain or not, you must shell out as much as US$4,000 per domain for initiating UDRP proceedings.