CybersecurityWebsites

How to Lock Your Business Domain After 15 Web Addresses Were Hijacked

Attackers redirected 15 domains at one registrar to fake sites on Oct. 30. How a small business checks who controls its domain and locks it down this week.

By Cybercave Technologies, LLC · Nov 1, 2026

Blue network cables plugged into a rack-mounted network switch with lit status lights — Network cables in a switch. Illustration only, not equipment from any company named here. Credit: Photo by Brett Sayles via Pexels (Pexels License).

Short answer: Yes, someone can send your customers to a fake website without breaking into your website at all. They only need the account that controls your domain name. Late on Oct. 30, 2026, that happened to 15 domains at one registrar. Turn on two-step login wherever your domain is managed, and ask for update and transfer locks.

Key points

Late on Oct. 30, 2026, the security firm Blockaid flagged 12 crypto-finance websites whose real web addresses were sending visitors to copycat pages built to empty crypto wallets, The Block reported.
All 12 domains were registered through Name.com, according to registry records reviewed by The Block and a separate analysis by the blockchain data firm Bitquery. Name.com later said 15 customer domains were affected and that all of them had been restored.
Loss estimates differ. As of Oct. 31, The Block had followed about $138,000 into wallets the attackers controlled, while Bitquery counted $202,386 taken from 32 wallets, valued at the moment of each theft.
As of Nov. 1, 2026, neither the registrar nor anyone else had publicly confirmed how the domain settings were changed.

What to do this week: log in to the company that holds your business domain, turn on two-step login, and ask whether your domain has update, transfer and delete locks turned on.

What happened in the Oct. 30 domain hijack?

People who typed the correct address for about a dozen crypto-finance apps landed on look-alike pages. Those pages asked visitors to connect a crypto wallet and approve what looked like a routine request; the approval let the attacker move the visitor's funds. The projects said their blockchain contracts weren't touched; what changed was where their web addresses pointed, according to The Block and Bitquery.

Name.com told The Block it found "unauthorized activity late Friday, October 30," had put every affected domain back and locked down the accounts involved; TokenPost reported the same count of 15 restored domains. The web platform Vercel, whose domain service uses Name.com as its registrar, said in its security bulletin that 10 of the affected domains came from its platform and had been restored.

Who or what made the changes is still open. Two of the affected projects pointed at Vercel's side, and Bitquery noted that neither company had explained the cause when it checked. We're reporting what each party has said, not assigning fault.

What is DNS hijacking, in plain words?

DNS, the Domain Name System, is the internet's address book. It turns your domain name into the address of the server that shows your website and the server that receives your email. Your registrar is the company you rent the name from, and your DNS host answers those address lookups; sometimes they're the same company.

Think of it as someone filing a change-of-address form for your shop. The building is untouched, but the mail and the visitors go somewhere else, and the sign over the door still shows your name. In a hijack, visitors still see your real domain in the address bar.

A Nov. 1 write-up by the security firm Yaamlabs explains why the registrar layer matters: whoever changes which name servers a domain uses controls every lookup for it, no matter which DNS host the owner picked.

Why should a business that doesn't touch crypto care?

Because the same trick works on any website and on email. In a 2019 emergency directive, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) described attackers who got the login for an account that could edit DNS records, pointed web and mail traffic to their own servers, and then got valid security certificates, so visitors saw no browser warning. CISA has since closed that directive, saying its purpose was met, but its steps still work as a checklist for any business.

Our example (hypothetical): a Holland bakery takes online orders on its own website. If someone changed where its domain points, customers could land on a fake checkout, and password-reset emails sent to the bakery's address could go to a stranger.

How do I lock down my business domain?

Start with the login, then add locks. Most of this takes one sitting with your registrar's settings page.

Find out where your domain lives and who has the login. A free whois lookup shows your registrar and your domain's status codes, ICANN explains. If a former web designer or a hosting platform holds the account, get it into your company's name.
Turn on two-step login everywhere the domain can be changed: the registrar, the DNS host and any platform that manages the domain for you. CISA recommends phishing-resistant options such as security keys and advises against text-message codes, and it told agencies whose registrar had no multi-factor option to move the domain to one that does.
Use a strong, unique password for each of those accounts, saved in a password manager, as CISA advised.
Ask for update, transfer and delete locks. ICANN says the clientUpdateProhibited, clientTransferProhibited and clientDeleteProhibited statuses help block unauthorized changes. A transfer lock alone doesn't stop someone from changing your name servers, Yaamlabs notes. Some registries also offer a stronger "Registry Lock" through your registrar, which takes longer to undo.
Save a copy of your correct settings and check them. Write down your name server (NS), website (A or CNAME) and email (MX) records. CISA told agencies to audit their records and start with name server and mail records.
Watch for surprise certificates. Public Certificate Transparency logs list every certificate issued for your domain, and CISA notes that free or paid monitoring services can watch those logs for you, so you hear about one you didn't request.

What if I think my domain was changed?

Call your registrar using the phone number on its own website, not one from an email, and ask it to restore your settings. The Block reported that Name.com told its customers to review their DNS settings and switch on two-factor sign-in. Then change the passwords on your registrar and DNS host accounts. If you find a certificate you didn't request, CISA's advice was to report it to the company that issued it.

What should you tell your IT provider?

Ask them to confirm, in writing, five things for your main domain: which registrar and DNS host you use and who can log in to each; that every one of those logins has multi-factor sign-in; that the domain's status shows clientUpdateProhibited, clientTransferProhibited and clientDeleteProhibited; whether a Registry Lock is worth it for a domain that takes payments; and that someone gets alerted to new certificates and to any change in NS or MX records.

What should you do this week?

Find the login for your business domain, turn on two-step login there, and ask your registrar which locks are on. If nobody at your business knows where the domain is registered, that's the first thing to fix.

For more, see our guides to moving your team to stronger sign-ins, spotting phishing aimed at your business logins, and checking a security alert safely.

FAQ

Can someone take over my website without hacking it? They can redirect it. By changing your domain's settings at the registrar or DNS host, an attacker can send visitors to a server they control while your real site sits untouched.

Will the padlock in the browser warn my customers? Not always. CISA said attackers who control DNS records can get valid certificates for the domain, so visitors may see no error.

Is a transfer lock enough? No. A transfer lock stops the domain from being moved to another registrar. Ask for the update lock too, which blocks changes such as new name servers.

Was Name.com hacked? That hadn't been confirmed as of Nov. 1, 2026. Name.com said it found unauthorized activity, restored the affected domains and secured the accounts involved, and it is still investigating.

Disclosure: No company named in this article paid for it, reviewed it or saw it before publication. Bitquery, cited for its loss count, sells blockchain data and investigation services; Yaamlabs is a security company. Details are as published by each source and were checked on Nov. 1, 2026. Not sponsored.