A registrar account takeover occurs when an unauthorized person gains access to an account used to manage a domain. Depending on the account’s permissions, an intruder may change DNS records, nameservers, or other domain settings, redirecting visitors or disrupting access to legitimate services.
Because registrar accounts control a key part of the internet’s trust and routing chain, compromise can cause outages or send users to attacker-controlled destinations without proving that the website’s backend or data was breached. Defenses include phishing-resistant multifactor authentication, strong unique credentials, restricted account access, registrar transfer locks, and alerts for account or DNS changes. If a takeover is suspected, secure the account and verify domain settings through a trusted channel.