What to Do If You Suspect Unauthorized Domain or Account Changes

Contents

If you suspect unauthorized domain changes or access to your Register.ly account, secure the email account connected to Register.ly, change your Client Area password, preserve evidence and contact Register.ly support immediately.

Do not send passwords, two-factor codes, full payment details or EPP/Auth codes to anyone claiming to investigate the incident.

Signs that require immediate review

A password-reset or sign-in notice you did not request.
An unknown user, contact or email address in the account.
Nameservers, DNS records, DNSSEC or domain contacts changed without approval.
A domain was unlocked or an EPP/Auth code was requested unexpectedly.
An unfamiliar transfer, order, invoice or payment appears.
A domain is missing from the account or shows an unexpected registrar/status.
Website or email traffic suddenly points to an unfamiliar service.

Take these steps now

1. Secure your email account

From a trusted device, change the password for the email account linked to Register.ly. Review its recovery methods, forwarding rules and active sessions, and enable two-factor authentication where available.

If an attacker controls your email, changing only the Register.ly password may not prevent another reset.

2. Secure your Register.ly account

Go directly to the Register.ly Client Area rather than using a link from an unexpected message.
Change your password to a unique value not used elsewhere.
Enable or review two-factor authentication.
Review account information, contacts, payment methods and authorized users.
Remove access you do not recognize only after recording what you found.

If you cannot sign in, use Client Area password recovery or the Register.ly contact page.

3. Record the current state

Before making broad changes, record:

The affected domain or service.
Current status, registrar, contacts, nameservers and expiry date.
Unexpected users, orders, invoices or tickets.
Dates and times of notices or changes.
Exact non-sensitive error messages.

Screenshots may help, but remove passwords, EPP codes, full payment details, identity numbers and recovery codes.

4. Review each affected domain

Check the domain through Register.ly status guidance and NIC.LY WHOIS when applicable.
Compare nameservers and DNS records with the last known correct configuration.
Check whether registrar lock is enabled where supported.
Review contact information and the registrant email.
Check for an unexpected transfer or EPP-code request.
Verify DNSSEC before changing nameservers or DS information.

Do not make speculative DNS changes. An incorrect emergency change can create a second outage and remove useful evidence.

5. Contact Register.ly support

Open a support ticket from the affected account when possible. Use a clear subject such as Urgent: suspected unauthorized account or domain changes.

Include:

The affected account and domain names.
The unauthorized actions you observed.
When you first noticed them.
Whether you still control the account and registrant email.
The steps already taken.
Relevant order, invoice or ticket numbers.

If you cannot access the account, use the official Register.ly contact page from a secure email address.

After the incident is contained

Confirm that account, registrant and recovery emails are correct.
Review and remove unneeded users and contacts.
Confirm domain lock, nameservers, DNS records and DNSSEC.
Verify website and email routing.
Review invoices, payment methods and automatic-payment settings.
Replace any password reused on another service.
Keep the support confirmation and incident timeline.

Frequently asked questions

Should I unlock the domain to fix an incident?

No, not unless Register.ly instructs you to do so for a verified recovery step. Registrar lock helps prevent an external transfer where supported.

Should I request a new EPP code?

Not as a general containment step. Tell support about an unexpected EPP request and follow the verified recovery process.

Is a hacked website the same as a compromised domain account?

No. Website files, hosting access, DNS/domain controls and the Register.ly account are separate layers. Review each affected layer and avoid assuming one password change fixes all of them.