Last updated: October 27, 2026
DNS hijacking is when attackers change where a website's name points — by breaking into the domain registrar or DNS account, or by poisoning DNS answers — so visitors typing the correct address land on a perfect copy that steals seeds, logins or redirects deposits. Crypto sites are prime targets because one hijacked hour can drain many users. Site owners defend with registrar locks, 2FA and DNSSEC; users defend with bookmarks, onion mirrors, wallet-side address checks and never entering a seed on a website. notkyc.life, for example, signs its DNS with DNSSEC and offers an onion mirror.
- Correct URL, wrong site — the danger
- DNSSEC signs DNS answers
- Onion addresses can't be DNS-hijacked
- 0 reasons to type a seed on a site
How DNS hijacking happens
| Attack | How it works | Defense |
|---|---|---|
| Registrar account takeover | Attacker logs into the domain registrar and changes nameservers | Strong 2FA, registrar lock, unique email |
| DNS provider takeover | Attacker edits records at the DNS host | 2FA, limited API tokens, change alerts |
| Social engineering the registrar | Support is tricked into moving the domain | Transfer lock, registry lock where available |
| DNS cache poisoning / spoofing | Fake answers injected into resolvers or local networks | DNSSEC on the domain; validating resolvers |
| Expired domain | Owner forgets to renew; scammers register it | Auto-renew, long registration |
What DNSSEC does
DNSSEC adds cryptographic signatures to DNS records. A validating resolver checks the chain from the root down to the domain; if an answer was forged in transit, validation fails and the fake address is rejected. It doesn't stop an attacker who controls the registrar or DNS account — that's why account security matters just as much. notkyc.life enabled DNSSEC in October 2026, alongside DMARC for its email.
How users can protect themselves (step by step)
- Bookmark the sites you use and open them from bookmarks.
- Use the onion mirror in Tor Browser when available — onion addresses are derived from the service's key and can't be redirected via DNS. See exchanges over Tor.
- Never enter a seed phrase on any website — phishing patterns.
- Check deposit addresses on the order page and in your wallet before sending — address safety.
- Use a DNS resolver that validates DNSSEC — most major public resolvers do.
- Do a small test before large swaps — test transactions.
Signs a site may be hijacked
- A sudden request to "verify" your wallet or re-enter a seed.
- A browser certificate warning on a site that never had one.
- Deposit addresses that differ from what you saw minutes ago.
- Official social channels warning about an incident.
If in doubt, stop and check the service's official channels, and read how to spot a fake exchange.
Frequently asked questions
What is DNS hijacking?
An attack that changes where a domain points, so visitors typing the correct address reach a site controlled by the attacker.
Does HTTPS protect against DNS hijacking?
Partly: an attacker usually can't present a valid certificate for the real domain, so browsers warn. But if they control the domain's DNS fully, they may obtain a certificate — account security and DNSSEC both matter.
What is DNSSEC?
A system of cryptographic signatures for DNS records that lets resolvers verify answers are authentic and reject forged ones.
Can onion sites be DNS-hijacked?
No. Onion addresses aren't resolved through DNS; they're derived from the service's cryptographic key.
Is notkyc.life protected with DNSSEC?
Yes, since October 2026. It also publishes DMARC for email and offers an onion mirror.
Swap from a verified address: BTC → XMR, USDT → XMR or are no-KYC swaps safe. No account, no ID, no logs.