What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To check whether a domain may have been hijacked, compare its current registration and DNS settings with records you know are legitimate, then ask the registrar and DNS provider to verify their change histories. ICANN Lookup is a useful starting point, but it shows a current snapshot—not who authorized a change or whether an account was compromised. A changed website, mail outage, or certificate warning is a reason to investigate, not proof of hijacking.
What to check first
Domain hijacking can involve a change in registration control, registrant information, or DNS configuration. These are related but distinct problems: someone may take control of the registration, or traffic may be redirected while the registration remains with its owner. Begin by documenting the symptoms and comparing provider records before drawing a conclusion.
As an Amazon Associate I earn from qualifying purchases.
Record the symptom and when it began
Note what changed, when it was first noticed, which services or subdomains are affected, and whether the issue appears from multiple networks or devices. Preserve browser warnings, unexpected page content, redirects, mail-delivery failures, renewal notices, provider alerts, and support messages with their original timestamps. Do not edit the original evidence.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check the current registration record
Use ICANN Lookup to view current RDAP registration data. Record the listed registrar, domain status, nameservers, and any visible registration fields. Compare these details with the registrar account, renewal records, and prior records held by your organization or provider.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Some registration fields may be private or redacted. A public record is only a snapshot, so an unchanged record does not rule out account compromise, and a changed field alone does not show who authorized the change. If an unexpected transfer or registrant update appears, ask the registrar to confirm it against its records.
Compare nameservers and DNS answers
Compare the current nameserver delegation and DNS answers with a known-good configuration from the domain owner or DNS provider. Look for an unapproved delegation to an unfamiliar provider or unexpected web and mail destinations. A DNS change can redirect visitors or disrupt email without transferring registration control.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Before treating a difference as malicious, confirm whether a planned deployment, hosting or DNS-provider migration, failover, expiration, or restoration explains it. ICANN identifies unauthorized DNS configuration as one possible consequence of hijacking, but an observed difference needs corroboration from provider history and the people responsible for the domain.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Ask the registrar and providers to check change history
Contact the registrar through a support channel you verify independently, and ask it to review the sponsoring registrar, transfer events, registrant or contact changes, account access and recovery events, and any available change history. Ask the DNS provider to check when relevant nameserver or record changes were made and which account made them.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
An unexpected transfer or registrant update is a stronger indication of a registration-control problem than a site rendering change by itself. Also review the security of the email account used for registrar recovery and any cloud or DNS-management account that can change the domain. A compromised linked account may enable unauthorized changes even when public registration data does not clearly reveal them.
Distinguish hijacking from similar problems
| Condition | What may have changed | What to verify |
|---|---|---|
| Registration hijacking | Registration control or the registrar; the name may have been transferred without authorization. | Ask the registrar to confirm transfer and account history, and compare registrant details and ownership records. |
| Unauthorized DNS change | Nameservers or DNS records may route traffic elsewhere while registration remains with the owner. | Compare current delegation and answers with known-good settings and ask the DNS provider to confirm its change history. |
| Subdomain takeover | A DNS record may point to a deprovisioned service that someone else can claim. | Check whether the affected hostname points to a resource that is no longer configured or controlled by the organization. CISA describes this separately from domain registration hijacking: Domains (T1584.001). |
| Expiration or ordinary migration | Expiration, renewal problems, hosting changes, or DNS migration may disrupt service without an attacker taking control. | Check domain status and renewal records, then confirm timing and intent with the registrar, hosting provider, or DNS provider. ICANN distinguishes these lost-domain scenarios from unauthorized transfer and registration-data change: About Lost Domain Names. |
A certificate warning, changed page, redirect, or mail failure can help identify what to investigate, but none of these symptoms by itself establishes that a domain was hijacked.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Escalate and preserve recovery evidence
If a transfer or account change appears unauthorized, contact the current or previous registrar promptly. ICANN advises registrants who believe a domain was transferred or registrant information changed without authorization to contact the registrar immediately: About Unauthorized Transfers and Changes of Registrant. Secure the email account used for recovery and any DNS or cloud account that controls the domain. Preserve evidence of ownership, dated notices, provider correspondence, and the case numbers or replies you receive.
Recommended Free Tools
Recovery may require demonstrating to the sponsoring registrar that you are entitled to use the domain. ICANN’s guidance on documentation for recovering hijacked domain names underscores why ownership records and correspondence matter. ICANN cannot directly compel a registrar to return a name or change registration data, though a registrar may be able to pursue a dispute in some circumstances.
If you have a legitimate need for nonpublic gTLD registration data, first check what is publicly available in ICANN Lookup. ICANN’s Registration Data Request Service is an option for requesting nonpublic data; it does not replace contacting the registrar about an urgent unauthorized change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
