Held for Ransom: Recovering a Domain Name a Web Developer Refuses to Release -

Skip to content

At DNAccess, a large share of the recovery cases that come to us do not begin with a sophisticated hacker in another country. They begin with a vendor the business already knew and trusted — a web developer, a designer, a marketing agency, or a freelancer who built the website and, somewhere along the way, ended up holding the keys to the company’s domain name. When the working relationship breaks down, usually over money, that vendor stops being a partner and starts being an obstacle: the domain is moved into an account the business cannot access, the website goes dark or stays frozen, and the owner is told the domain will be released only when a payment demand is met.

We handle this category of matter often enough that we can describe the pattern in our sleep. What surprises most business owners is not that it happened to them, but how clearly the law and the dispute-resolution system come down on the side of the rightful owner — and how recoverable these domains usually are once the situation is approached correctly. This article explains what this kind of domain hijacking actually is, why the "you still owe me money" justification does not hold up, and the specific paths we use to get a client’s domain back.

What "Ransoming a Domain" Really Means

Jump To

Toggle

The scenario has a deceptively ordinary beginning. A business hires someone to build a website. As a convenience, that person registers the domain name — typically the exact-match domain built around the company’s own name — and is listed as the registrant of record in the WHOIS (the public registration record that identifies who controls a domain). For as long as everyone is getting along, no one thinks about it.

The problem surfaces when there is a falling-out. The vendor, still holding the registrar account or the registrant listing, changes the account credentials, updates the contact details, or transfers the domain to a registrar or account the client cannot reach. From that moment the business is locked out of one of its most important assets. Email may stop. The website may be replaced with a payment notice. Renewal, DNS changes, and transfers all sit behind a login the owner does not have.

This is not a gray area of "who technically registered it." In substance, it is the taking of property that belongs to the business and the use of that property as leverage. In our field, the plain word for it is hijacking, and when it is paired with a payment demand, it is a ransom.

Why Owners Feel Stuck — and Why They Usually Are Not

The reason these cases are so effective at intimidating owners is that the vendor almost always has a story. Sometimes the story is an unpaid invoice. Sometimes it is a signed agreement containing a clause that says the vendor may retain the domain until the client pays. Frequently the amount claimed is disputed, inflated, or — as in a matter we reviewed recently — already paid in full, with the final payment sitting in a PayPal record the vendor conveniently ignores.

The owner hears "you signed this" or "you owe me," assumes the vendor must have some right to the domain, and either pays a ransom that may not be owed or gives up on a domain that is rightfully theirs. Both reactions are usually mistakes. The vendor’s story about money and the question of who owns the domain are two entirely different things, and the dispute system is built to keep them apart.

The Evidence That Decides These Cases

Domain recovery is, at its core, an evidence exercise, and the good news for legitimate owners is that the evidence almost always favors them. When we take one of these matters, the first thing we do is assemble the record that establishes ownership and reconstructs what happened.

The WHOIS history is the backbone. It typically shows a continuous chain of registration tied to the business, often stretching back years, which establishes that the domain has always belonged to the company rather than the vendor. The transfer and DNS records show precisely when and how control was moved, which matters both for registrar disputes and for any criminal referral. The payment trail — invoices, contracts, bank records, and PayPal receipts — resolves the money question independently of the domain, and often demonstrates that the alleged debt does not exist. And the communications, including the demand itself, frequently contain the vendor’s own admission that the domain is being withheld until payment, which is powerful evidence of bad faith.

Assembling this record early is far more persuasive than reconstructing it later, and it is the single most valuable thing an owner can do the moment they realize their domain has been taken.

What the Record Consistently Shows: Ransoming a Domain Does Not Work

Vendors who do this often believe, sincerely, that they will prevail if the matter is ever formally challenged. In our experience,...