Domain Slamming: What it is & How To Protect Against It?

Domain slamming is a deceptive practice that targets domain owners. It tricks them into transferring their domain names to another registrar, or paying for services they don't need, without realizing what they agreed to.

In this article, we explain what domain slamming is, how it works, and the practical steps you can take to protect your domain, including account security and registry-level locks.

What is Domain Slamming?

Domain slamming involves sending misleading notices to domain owners that make it look as if they must renew their registration, usually with a different company. The goal is to get owners to approve a transfer or pay an invoice without understanding it. The result is often higher fees and, in the worst cases, loss of control over the domain.

Losing control of a domain is serious. Your domain runs your website and usually your business email. Whoever controls it can redirect visitors, intercept emails or hold the name to ransom.

How Does Domain Slamming Work?

Domain slammers use various tactics to deceive domain owners:

1. Deceptive Emails or Letters: Owners receive emails or letters that look like renewal notices from their current registrar. They often use official-looking logos, a fake deadline and urgent wording to push an immediate payment.

2. Misleading Forms: The notice may include a form or a "renew now" link. By completing it, the owner unknowingly authorizes a transfer to another registrar or signs up for an overpriced service.

3. Confusing Language: The wording is deliberately confusing, so it is hard to tell that you are approving a transfer rather than a simple renewal. Small print may describe the notice as a "solicitation", not an invoice.

4. Look-Alike Scams: A related scam warns that "someone is trying to register your brand name" in another country or extension, and pressures you to buy those domains quickly at a high price.

How to Protect Against Domain Slamming

Protecting your domain requires vigilance and a few simple settings. Here are the steps we recommend:

1. Educate Yourself and Your Team: Know who your registrar is and when your domains expire. Tell your accounts team to forward any domain-related invoices for checking before paying.

2. Verify Communications: Always check the legitimacy of any message about your domain. Log in to your registrar's account directly, or contact them using details from their official website, never the contact details in the suspicious message.

3. Lock Your Domain: Most registrars offer a transfer lock (often shown as "clientTransferProhibited"), which blocks transfers until you unlock it. Keep it switched on at all times except when you intentionally move registrars.

4. Consider Registry Lock for Critical Domains: Some registries and registrars offer registry lock, a stronger, paid protection. Changes to the domain's name servers, contacts or transfer status require a manual verification process with the registry, so a compromised registrar account alone is not enough to hijack the domain. It is worth considering for domains your business depends on.

5. Secure Your Registrar Account: Turn on two-factor authentication (2FA), use a unique strong password, and make sure the account email is one you actively monitor and that is itself protected with 2FA. Many domain hijacks start with a compromised email or registrar login, not a clever technical attack.

6. Monitor Domain Status: Regularly check your domain's status, expiry date and name servers. Enable auto-renewal with a valid payment method, and act immediately on any transfer confirmation email you did not expect.

7. Use RDAP to Check Registration Data: Registration data for generic domains such as .com now comes from RDAP (Registration Data Access Protocol). ICANN sunset WHOIS for gTLDs on 28 January 2025, making RDAP the authoritative source. You can look up your domain's registrar, status and expiry through ICANN Lookup to confirm who really holds your registration.

8. Use Privacy Protection: Registration data privacy (often called WHOIS privacy) hides your personal contact details from public lookups. This reduces the chance of being targeted by slammers and spammers. Many registrars now include it free.

9. Keep Domains Consolidated: Keep all your domains with one or two reputable registrars. That way, any notice from an unfamiliar company is instantly suspicious.

10. Report Suspicious Activity: If you receive a suspicious notice, report it to your registrar. You can also file a complaint with ICANN Contractual Compliance for gTLD registrar issues. Reporting helps protect other businesses from the same scam.

What to Do If Your Domain Was Transferred Without Consent

• Contact your original registrar immediately: Explain that the transfer was unauthorized and ask about their dispute process. Speed matters.
• Secure your accounts: Change passwords and enable 2FA on your registrar and email accounts in case they were compromised.
• Collect evidence: Keep the misleading notice, emails, invoices and any transfer confirmations.
• Check your DNS: Confirm your website and email records still point to the right servers, and warn customers if emails or the website could be affected.

For .pk domains, contact your registrar or PKNIC, the .pk registry, directly. Learn more about how domains connect to your website in our guide to the Domain Name System (DNS).

Safeguard Your Domain with Our Expertise

Your domain is the foundation of your website and business email. Softhat helps businesses across Pakistan set up domains, DNS and hosting securely, with locks, 2FA and renewals handled properly. Explore our web development services, or book a free strategy call to review your domain security.