DNS hijacking can send users to malicious sites through legit domains

At a glance

What this is: NHI Mgmt Group's analysis, drawing on MarkMonitor's report: DNS hijacking can redirect users from a legitimate domain to a malicious site even when the backend stays intact.

Why it matters: This matters because identity and access controls around domains, registrars, and DNS changes determine whether customer trust can be silently rerouted without warning.

By the numbers:

• ICANN said its enforcement of DNS abuse mitigation requirements from April 2024 to August 2025 directly mitigated nearly 20,000 malicious domain names.

Context

DNS hijacking is a domain-layer compromise, not a backend outage. The application may still be running normally while the domain resolves users to a hostile destination, which makes the attack easy to miss until customers report it.

For organisations that rely on domains for transactions, authentication, email, or regulated communications, the control problem is who can change resolution and under what approval path. Registrar and authoritative DNS security becomes a governance issue when a valid account can still be used to redirect trust.

This risk is most visible in larger domain portfolios, where inherited accounts, multiple registrars, and unclear ownership create weak points that are operationally common rather than exceptional.

Key questions

Q: How do DNS hijacks redirect users without breaking the site?

A: A DNS hijack changes the resolution layer, so the browser still reaches what looks like the expected domain while the request is sent to a different destination. The application can remain online and appear legitimate because the attack does not need to break the backend. The risk is that users trust the domain name, not the hidden routing decision behind it.

Q: Why does registrar access create domain hijack risk?

A: Registrar access can change a domain’s nameservers, contact details, or transfer status, so a compromised registrar account can redirect traffic or enable an unauthorised transfer. A strong approval model, MFA, and separate privileged registrar roles reduce that risk by limiting who can approve or execute high-impact DNS changes.

Q: What is the difference between registrar lock and registry lock?

A: Registrar lock is a status at the domain registrar that blocks routine transfers, while registry lock is a stronger control at the domain registry that prevents changes such as transfer, deletion, or nameserver updates until out-of-band verification. Registry lock usually protects against registrar account compromise as well as direct registrar misuse.

Technical breakdown

How DNS resolution becomes the attack path

DNS hijacking works by changing the record or resolution path that turns a domain name into the destination a browser or client reaches. The attacker does not need to break the application itself. If the resolution layer is altered, the user receives a legitimate-looking response from a different endpoint, which is why the compromise can be invisible to casual inspection. The security failure is governance over the domain namespace, not software execution inside the site. See the DNS Security Guide.

Practical implication: Treat DNS changes as high-risk authorisations, not routine administration, and require review before they can alter customer-facing traffic.

Why registry-level controls matter when registrar access is compromised

A registrar account can be protected and still leave room for abuse if change authority is too broad or too easy to exercise. Registry-level locking adds a separate approval layer for record edits, transfers, and ownership changes, which breaks the usual attacker path from stolen credentials to immediate domain impact. The key point is that the control assumes account compromise is possible and makes the resulting change expensive to execute. See the Domain Registrar Compromise Playbook.

Practical implication: Use registry-level approval gates on critical domains so a stolen account cannot immediately rewrite customer routing or ownership.

How fragmented domain portfolios increase exposure

A fragmented portfolio spreads domains across teams, registrars, and approval chains, which makes it harder to see who owns what and which controls are actually in place. That fragmentation creates blind spots in renewal, access review, monitoring, and escalation. It also gives attackers more places to find a weaker process, especially where inherited or inactive domains are still connected to production trust or brand value. See the Domain Portfolio and Lookalike Domain Management Guide.

Practical implication: Inventory all business-critical domains and consolidate governance where fragmented ownership prevents consistent control.

Threat narrative

Attacker objective: The attacker wants to redirect trusted users to a convincing malicious destination while preserving the appearance of normal service.

1. Entry occurs when an attacker gains or abuses control over a domain or DNS management path rather than compromising the application backend.
2. Escalation happens when the attacker changes resolution so legitimate traffic is sent to a malicious front end that mirrors the real site.
3. Impact follows when users interact with the fake destination, exposing credentials, wallet actions, or other sensitive activity during the hijack window.

Breaches seen in the wild

• Massive Docker Hub Secrets Leak: 10,000+ Docker Hub container images expose hardcoded secrets and authentication keys.
• Secrets in Docker Hub images (RWTH Aachen study): A 2023 RWTH Aachen study found secrets in 8.5% of container images, and 275,269 internet hosts still using the leaked private keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

DNS hijacking succeeds because trust is anchored too high in the stack. Organisations often harden applications, cloud services, and backend infrastructure while treating the domain layer as routine administration. That leaves the resolution path as the weakest trust point, even though customers experience the domain name first. The governance lesson is that domain control is part of identity and trust, not just internet plumbing.

Registry Lock is a governance control, not a convenience feature. The attack pattern here is fast abuse of authorised change paths, so the important question is whether a single credential can trigger irreversible customer-facing impact. A separate approval layer forces the organisation to assume compromise and still block abuse. That is a materially different control posture from simple account hardening.

Fragmented domain ownership creates security debt. Split registrars, inherited domains, and unclear approval chains make it difficult to prove who can change what. That is where lookalike domains, parked domains, and defensive redirects become part of the same governance problem. A domain portfolio that cannot be governed coherently will eventually be exploited coherently by an attacker.

Domain layer trust gap: the core failure mode is not application compromise but unauthorised control over name resolution, which bypasses normal user suspicion and many detection assumptions. This is especially relevant for brands whose revenue, authentication, or customer trust depends on domains staying stable. Practitioners need to treat resolution authority as a controlled asset, not an administrative afterthought.

Corporate registrar discipline has become part of brand security. The more a business depends on online trust, the more its registrar model matters. Retail-style convenience can be acceptable for low-risk holdings, but business-critical domains need stricter verification, escalation, and approval paths. The practical conclusion is that registrar governance now sits alongside access governance as a frontline control.

What this signals

Domain-layer trust needs its own control model. The lesson for practitioners is that DNS change authority should be governed like privileged access, not treated as a low-risk operational task. When resolution can be altered without strong verification, every customer-facing service inherits a hidden redirection risk.

Brand protection now depends on governance speed as much as technical hardening. Teams need portfolio-level visibility into which domains are critical, which are dormant, and which are exposed to impersonation. The organisations that can answer those questions quickly will be better positioned to contain both hijack attempts and lookalike abuse.

For practitioners

• Audit critical domains for change authority Map every business-critical domain to the person or team that can change records, transfers, and ownership, then identify where approval paths are informal or undocumented.
• Apply registry-level locking to crown-jewel domains Use registry lock or an equivalent approval model on domains that support authentication, customer journeys, email, or regulated communications.
• Reduce registrar sprawl and inherited ownership Consolidate domains where possible so security, legal, and IT can govern renewals, locks, and DNS settings from one operating model.
• Monitor lookalike registrations and impersonation paths Track typo variants, homoglyphs, brand-plus-keyword domains, and suspicious TLDs so phishing and fraud can be contained before users are reached.
• Review DNS change logging and escalation procedures Record who requested a change, who approved it, what changed, and how emergency recovery would work if the registry or registrar path is abused.

Key takeaways

• DNS hijacking is a domain-layer trust failure, so a healthy backend does not eliminate the customer risk.
• The core exposure is unauthorised control over DNS resolution, which can redirect users without visible service breakage.
• Registry-level approvals, portfolio governance, and lookalike monitoring are the controls that reduce the practical attack surface.

Related NHI Mgmt Group resources: Authoritative DNS and Registrar Account Security Guide · Domain Registrar Compromise Playbook · Domain Portfolio and Lookalike Domain Management Guide · DNS Security Guide

Key terms

• DNS Hijacking: DNS hijacking is the manipulation of DNS records, resolution paths, or upstream infrastructure so traffic is sent to an unintended destination. It can be used for fraud, malware delivery, or service disruption, and it is especially damaging when it affects domains that users already trust.
• DNS Resolution Path: DNS Resolution Path is the sequence of lookups a client follows to turn a domain name into an IP address. It typically involves cached answers, recursive resolvers, and authoritative name servers, and each step can affect availability, integrity, and where traffic is directed.
• Registry Lock: Registry Lock is a domain registration control that adds extra approval steps before critical changes can be made to a domain name. It usually blocks updates such as registrar transfer, nameserver changes, or deletions unless the registry or registrar unlocks the domain through a separate authenticated process.
• Lookalike Domain: A lookalike domain is a web address designed to resemble a trusted brand closely enough to trick users into believing it is legitimate. In identity attacks, the domain becomes part of the deception layer, letting attackers capture credentials, identity details, or payments through a counterfeit flow.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.