Incident response playbooks share a hidden assumption: that you still control your own infrastructure. Isolate the host, reset the credentials, restore from backup. A domain hijacking breaks the assumption. The attacker holds the account that decides what your domain even is, and every hour it stays theirs, your members see their content at your URL and your inbound mail is theirs to read. This summer we spent days in exactly that fight on behalf of a credit union. Here is the escalation ladder, in the order that actually works.
First, understand who controls what
A hijacked domain involves up to six independent parties, and mixing them up wastes hours you don't have. The hosting provider runs the physical server behind the attacker's content. A CDN or proxy service often sits in front of it, hiding that server's address. The DNS host publishes the zone. The registrar holds the domain account. The registry operates the top-level domain itself and outranks every registrar in it. And certificate authorities issued whatever certificates the attacker minted. Each has its own abuse process, its own SLA, and its own leverage. Work them in parallel, not in sequence.
The ladder, fastest lever first
1. The hosting provider's abuse desk. Counterintuitively, the fastest takedown is usually the least glamorous one. If you can identify the true origin server (its MX record often de-cloaks it, since mail can't hide behind a web proxy), the hosting provider can null the account within hours, killing the phishing content and the mail interception in one stroke, regardless of who holds the domain. Financial-fraud phishing against a regulated institution is exactly what abuse desks act fastest on. Send evidence, not adjectives.
2. The registrar the domain was stolen from, and the one it was moved to. The losing registrar can initiate transfer disputes; the gaining registrar can suspend the domain for fraudulent registration. A suspension (the domain goes dark) is not recovery, but dark beats weaponized, and in our incident a registrar suspension was what first took the phishing infrastructure offline.
3. The registry, where the fight is actually won. Registrar-level actions kept getting reversed; the attacker was contesting that layer in real time. What held was action at the registry: statuses no registrar account can undo, and formal transfer-dispute mechanisms. Two acronyms to know before you need them: TDRP, the Transfer Dispute Resolution Policy, the formal process for reversing a fraudulent transfer, and TEAC, the Transfer Emergency Action Contact, a 24/7 channel between registrars for exactly this scenario. The TEAC path has a critical property: it is designed for action within days of the fraudulent transfer. If your team spends the first week arguing with a support queue, you burn the emergency window.
4. The proxy and the certificates. File abuse with the CDN fronting the attacker (phishing against a financial institution, include the URLs), and request revocation of every certificate issued during the compromise window from the issuing CAs, on fraud grounds. Certificate transparency logs give you the complete list; you do not need to control the domain to request revocation, you need to prove you are the rightful registrant.
5. Law enforcement and your regulator. IC3 at minimum; for a credit union this is also squarely inside the NCUA's 72-hour reporting rule, and FS-ISAC membership earns its dues on exactly this day. (The 72-hour analysis itself is a muscle worth building before the incident, not during.) A law-enforcement case number changes the tone of every abuse conversation above.
Evidence: collect it like it's day one of litigation
Every ladder rung asks you to prove two things: what the attacker changed, and that you are the rightful owner. From the first hour, snapshot everything, timestamped: WHOIS and RDAP output, DNS answers from multiple public resolvers, certificate transparency entries, screenshots, and your own registration records, invoices, and historical DNS. Keep a single running case file with a timeline. You will retell this story to a dozen different abuse desks, and the institutions that can hand over a clean evidence package get moved to the front of every queue.
The uncomfortable summary
Recovery works, but it is measured in days, and every one of those days your members are exposed. The entire ladder above is the expensive substitute for controls that cost almost nothing in advance: registry lock, hardware-key MFA on the registrar and DNS accounts, CAA and DNSSEC, and external monitoring of delegation, certificates, and MX. Print the contact ladder, put it in the incident plan, and then make the plan something you never open. If you want a partner who has run this ladder for real, that is what we do. That is the whole play.
