WHOIS or RDAP change signals a possible domain hijack

curl -s -L "https://rdap.org/domain/example.com" \
  | jq '{status, nameservers: [.nameservers[].ldhName], entities: [.entities[].roles], events}'

whois example.com

dig +short NS example.com @a.gtld-servers.net
dig +short NS example.com

# Locks should be back
curl -s -L "https://rdap.org/domain/example.com" | jq '.status'

# Nameservers should only list your own
curl -s -L "https://rdap.org/domain/example.com" | jq '[.nameservers[].ldhName]'

# Delegation should trace to your legitimate authoritative servers
dig +trace example.com

# Registrar-of-record and expiry should be unchanged
whois example.com

"""Poll RDAP for a domain and diff it against a stored known-good snapshot to
catch the early signal of a hijack: a lost transfer lock, a nameserver you did
not configure, or a registrant/registrar change. Detect only: re-locking the
domain, resetting registrar credentials, or halting a transfer are registrar
and EPP-level actions this script cannot perform through the Cloudflare DNS
API, so it never writes anything, it only reports what it finds.
"""
import os
import json
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("check_rdap_hijack_signal")

DNS_DOMAIN = os.environ.get("DNS_DOMAIN", "example.com")
CLOUDFLARE_API_TOKEN = os.environ.get("CLOUDFLARE_API_TOKEN", "")
CLOUDFLARE_ZONE_ID = os.environ.get("CLOUDFLARE_ZONE_ID", "")
DRY_RUN = os.environ.get("DRY_RUN", "true").lower() == "true"
SNAPSHOT_PATH = os.environ.get("SNAPSHOT_PATH", "rdap_snapshot.json")


def diff_rdap_snapshot(baseline, current):
    """Pure function, no I/O. baseline/current are shaped as:
    {"status": list[str], "nameservers": list[str], "registrant_handle": str,
     "registrar_handle": str, "last_changed": str}
    Returns a list of human-readable alert strings. An empty list means no
    hijack signal was detected.
    """
    alerts = []

    baseline_status = set(baseline.get("status", []))
    current_status = set(current.get("status", []))
    lost_locks = baseline_status - current_status
    for lock in sorted(lost_locks):
        alerts.append(f"status lost {lock}")

    baseline_ns = baseline.get("nameservers", [])
    current_ns = current.get("nameservers", [])
    if set(baseline_ns) != set(current_ns):
        alerts.append(f"nameservers changed: {baseline_ns} -> {current_ns}")

    if baseline.get("registrant_handle") != current.get("registrant_handle"):
        alerts.append("registrant_handle changed")

    if baseline.get("registrar_handle") != current.get("registrar_handle"):
        alerts.append("registrar_handle changed")

    if baseline.get("last_changed") != current.get("last_changed"):
        alerts.append(
            f"last_changed event moved: {baseline.get('last_changed')} -> {current.get('last_changed')}"
        )

    return alerts


def normalize_rdap(data):
    """Turn a raw RDAP JSON document into the flat shape diff_rdap_snapshot expects."""
    status = list(data.get("status", []))
    nameservers = sorted(
        ns["ldhName"] for ns in data.get("nameservers", []) if ns.get("ldhName")
    )

    registrant_handle = None
    registrar_handle = None
    for entity in data.get("entities", []):
        roles = entity.get("roles", [])
        if "registrant" in roles and registrant_handle is None:
            registrant_handle = entity.get("handle")
        if "registrar" in roles and registrar_handle is None:
            registrar_handle = entity.get("handle")

    last_changed = None
    for event in data.get("events", []):
        if event.get("eventAction") in ("last changed", "transfer"):
            last_changed = event.get("eventDate")

    return {
        "status": sorted(status),
        "nameservers": nameservers,
        "registrant_handle": registrant_handle,
        "registrar_handle": registrar_handle,
        "last_changed": last_changed,
    }


def fetch_rdap(domain):
    """RDAP over HTTP via ICANN's public bootstrap redirector (RFC 9082 / 9083)."""
    import requests

    r = requests.get(f"https://rdap.org/domain/{domain}", timeout=15, allow_redirects=True)
    r.raise_for_status()
    return r.json()


def load_baseline(path):
    if not os.path.exists(path):
        return None
    with open(path, "r", encoding="utf-8") as f:
        return json.load(f)


def save_baseline(path, snapshot):
    with open(path, "w", encoding="utf-8") as f:
        json.dump(snapshot, f, indent=2, sort_keys=True)


def run():
    log.info("Polling RDAP for %s (DRY_RUN=%s)", DNS_DOMAIN, DRY_RUN)

    raw = fetch_rdap(DNS_DOMAIN)
    current = normalize_rdap(raw)
    baseline = load_baseline(SNAPSHOT_PATH)

    if baseline is None:
        log.info("No baseline snapshot yet. Saving current RDAP state as the trusted baseline.")
        save_baseline(SNAPSHOT_PATH, current)
        return

    alerts = diff_rdap_snapshot(baseline, current)

    if not alerts:
        log.info("OK: RDAP record matches the trusted baseline. No hijack signal.")
        return

    log.warning("HIJACK SIGNAL for %s:", DNS_DOMAIN)
    for alert in alerts:
        log.warning("  - %s", alert)
    log.warning(
        "This is a registrar-side action, not something the Cloudflare DNS API can fix. "
        "Re-lock the domain, reset registrar credentials and MFA, or contact the registrar's "
        "abuse team / ICANN's Transfer Emergency Action Contact (TEAC)."
    )

    # Note for future readers: CLOUDFLARE_API_TOKEN and CLOUDFLARE_ZONE_ID are
    # accepted for consistency with the other fixes in this repo, and would be
    # used to manage records inside a zone already delegated to Cloudflare via
    # https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records, but
    # that endpoint has no way to re-lock a domain or change registrar-level
    # ownership fields, so this script never calls it.
    if not DRY_RUN:
        log.info("DRY_RUN is false, but this check never writes. Fix the registrar by hand.")


if __name__ == "__main__":
    run()

/**
 * Poll RDAP for a domain and diff it against a stored known-good snapshot to
 * catch the early signal of a hijack: a lost transfer lock, a nameserver you
 * did not configure, or a registrant/registrar change. Detect only:
 * re-locking the domain, resetting registrar credentials, or halting a
 * transfer are registrar and EPP-level actions this script cannot perform
 * through the Cloudflare DNS API, so it never writes anything, it only
 * reports what it finds.
 */
import { pathToFileURL } from "node:url";

const DNS_DOMAIN = process.env.DNS_DOMAIN || "example.com";
const CLOUDFLARE_API_TOKEN = process.env.CLOUDFLARE_API_TOKEN || "";
const CLOUDFLARE_ZONE_ID = process.env.CLOUDFLARE_ZONE_ID || "";
const DRY_RUN = (process.env.DRY_RUN || "true").toLowerCase() === "true";
const SNAPSHOT_PATH = process.env.SNAPSHOT_PATH || "rdap_snapshot.json";

/**
 * Pure function, no I/O. baseline/current are shaped as:
 * { status: string[], nameservers: string[], registrant_handle: string,
 *   registrar_handle: string, last_changed: string }
 * Returns a list of human-readable alert strings. An empty array means no
 * hijack signal was detected.
 */
export function diffRdapSnapshot(baseline, current) {
  const alerts = [];

  const baselineStatus = new Set(baseline.status || []);
  const currentStatus = new Set(current.status || []);
  const lostLocks = [...baselineStatus].filter((s) => !currentStatus.has(s)).sort();
  for (const lock of lostLocks) {
    alerts.push(`status lost ${lock}`);
  }

  const baselineNs = baseline.nameservers || [];
  const currentNs = current.nameservers || [];
  const nsBaselineSet = new Set(baselineNs);
  const nsCurrentSet = new Set(currentNs);
  const nsEqual =
    nsBaselineSet.size === nsCurrentSet.size &&
    [...nsBaselineSet].every((ns) => nsCurrentSet.has(ns));
  if (!nsEqual) {
    alerts.push(`nameservers changed: ${JSON.stringify(baselineNs)} -> ${JSON.stringify(currentNs)}`);
  }

  if (baseline.registrant_handle !== current.registrant_handle) {
    alerts.push("registrant_handle changed");
  }

  if (baseline.registrar_handle !== current.registrar_handle) {
    alerts.push("registrar_handle changed");
  }

  if (baseline.last_changed !== current.last_changed) {
    alerts.push(`last_changed event moved: ${baseline.last_changed} -> ${current.last_changed}`);
  }

  return alerts;
}

/** Turn a raw RDAP JSON document into the flat shape diffRdapSnapshot expects. */
export function normalizeRdap(data) {
  const status = [...(data.status || [])].sort();
  const nameservers = (data.nameservers || [])
    .map((ns) => ns.ldhName)
    .filter(Boolean)
    .sort();

  let registrantHandle = null;
  let registrarHandle = null;
  for (const entity of data.entities || []) {
    const roles = entity.roles || [];
    if (roles.includes("registrant") && registrantHandle === null) {
      registrantHandle = entity.handle || null;
    }
    if (roles.includes("registrar") && registrarHandle === null) {
      registrarHandle = entity.handle || null;
    }
  }

  let lastChanged = null;
  for (const event of data.events || []) {
    if (event.eventAction === "last changed" || event.eventAction === "transfer") {
      lastChanged = event.eventDate || null;
    }
  }

  return {
    status,
    nameservers,
    registrant_handle: registrantHandle,
    registrar_handle: registrarHandle,
    last_changed: lastChanged,
  };
}

async function fetchRdap(domain) {
  // RDAP over HTTP via ICANN's public bootstrap redirector (RFC 9082 / 9083).
  const res = await fetch(`https://rdap.org/domain/${domain}`, { redirect: "follow" });
  if (!res.ok) throw new Error(`RDAP lookup failed: ${res.status}`);
  return res.json();
}

async function loadBaseline(path) {
  const fs = await import("node:fs/promises");
  try {
    const text = await fs.readFile(path, "utf-8");
    return JSON.parse(text);
  } catch (err) {
    if (err.code === "ENOENT") return null;
    throw err;
  }
}

async function saveBaseline(path, snapshot) {
  const fs = await import("node:fs/promises");
  await fs.writeFile(path, JSON.stringify(snapshot, null, 2), "utf-8");
}

export async function run() {
  console.log(`Polling RDAP for ${DNS_DOMAIN} (DRY_RUN=${DRY_RUN})`);

  const raw = await fetchRdap(DNS_DOMAIN);
  const current = normalizeRdap(raw);
  const baseline = await loadBaseline(SNAPSHOT_PATH);

  if (baseline === null) {
    console.log("No baseline snapshot yet. Saving current RDAP state as the trusted baseline.");
    await saveBaseline(SNAPSHOT_PATH, current);
    return;
  }

  const alerts = diffRdapSnapshot(baseline, current);

  if (alerts.length === 0) {
    console.log("OK: RDAP record matches the trusted baseline. No hijack signal.");
    return;
  }

  console.warn(`HIJACK SIGNAL for ${DNS_DOMAIN}:`);
  for (const alert of alerts) {
    console.warn(`  - ${alert}`);
  }
  console.warn(
    "This is a registrar-side action, not something the Cloudflare DNS API can fix. " +
    "Re-lock the domain, reset registrar credentials and MFA, or contact the registrar's " +
    "abuse team / ICANN's Transfer Emergency Action Contact (TEAC)."
  );

  // Note for future readers: CLOUDFLARE_API_TOKEN and CLOUDFLARE_ZONE_ID are
  // accepted for consistency with the other fixes in this repo, and would be
  // used to manage records inside a zone already delegated to Cloudflare via
  // https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records, but
  // that endpoint has no way to re-lock a domain or change registrar-level
  // ownership fields, so this script never calls it.
  if (!DRY_RUN) {
    console.log("DRY_RUN is false, but this check never writes. Fix the registrar by hand.");
  }
}

if (import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((e) => { console.error(e); process.exit(1); });
}

from check_rdap_hijack_signal import diff_rdap_snapshot


def snapshot(**over):
    base = {
        "status": ["clientTransferProhibited", "clientUpdateProhibited"],
        "nameservers": ["ns1.cf.com", "ns2.cf.com"],
        "registrant_handle": "REG-1",
        "registrar_handle": "REGR-1",
        "last_changed": "2026-01-01T00:00:00Z",
    }
    base.update(over)
    return base


def test_no_alerts_when_nothing_changed():
    baseline = snapshot()
    current = snapshot()
    assert diff_rdap_snapshot(baseline, current) == []


def test_alerts_when_transfer_lock_lost():
    baseline = snapshot()
    current = snapshot(status=["clientUpdateProhibited"])
    alerts = diff_rdap_snapshot(baseline, current)
    assert "status lost clientTransferProhibited" in alerts


def test_alerts_when_nameservers_change():
    baseline = snapshot()
    current = snapshot(nameservers=["ns1.evil.net"])
    alerts = diff_rdap_snapshot(baseline, current)
    assert any("nameservers changed" in a for a in alerts)


def test_alerts_when_registrant_handle_changes():
    baseline = snapshot()
    current = snapshot(registrant_handle="REG-2")
    assert "registrant_handle changed" in diff_rdap_snapshot(baseline, current)


def test_alerts_when_registrar_handle_changes():
    baseline = snapshot()
    current = snapshot(registrar_handle="REGR-2")
    assert "registrar_handle changed" in diff_rdap_snapshot(baseline, current)


def test_alerts_when_last_changed_moves():
    baseline = snapshot()
    current = snapshot(last_changed="2026-06-01T00:00:00Z")
    alerts = diff_rdap_snapshot(baseline, current)
    assert any("last_changed event moved" in a for a in alerts)


def test_nameserver_order_does_not_trigger_a_false_alert():
    baseline = snapshot(nameservers=["ns1.cf.com", "ns2.cf.com"])
    current = snapshot(nameservers=["ns2.cf.com", "ns1.cf.com"])
    assert diff_rdap_snapshot(baseline, current) == []


def test_multiple_changes_all_reported():
    baseline = snapshot()
    current = snapshot(status=[], nameservers=["ns1.evil.net"], registrant_handle="REG-2")
    alerts = diff_rdap_snapshot(baseline, current)
    assert len(alerts) >= 3

import { test } from "node:test";
import assert from "node:assert/strict";
import { diffRdapSnapshot } from "./check-rdap-hijack-signal.js";

const snapshot = (over = {}) => ({
  status: ["clientTransferProhibited", "clientUpdateProhibited"],
  nameservers: ["ns1.cf.com", "ns2.cf.com"],
  registrant_handle: "REG-1",
  registrar_handle: "REGR-1",
  last_changed: "2026-01-01T00:00:00Z",
  ...over,
});

test("no alerts when nothing changed", () => {
  assert.deepEqual(diffRdapSnapshot(snapshot(), snapshot()), []);
});

test("alerts when transfer lock lost", () => {
  const alerts = diffRdapSnapshot(snapshot(), snapshot({ status: ["clientUpdateProhibited"] }));
  assert.ok(alerts.includes("status lost clientTransferProhibited"));
});

test("alerts when nameservers change", () => {
  const alerts = diffRdapSnapshot(snapshot(), snapshot({ nameservers: ["ns1.evil.net"] }));
  assert.ok(alerts.some((a) => a.includes("nameservers changed")));
});

test("alerts when registrant handle changes", () => {
  const alerts = diffRdapSnapshot(snapshot(), snapshot({ registrant_handle: "REG-2" }));
  assert.ok(alerts.includes("registrant_handle changed"));
});

test("alerts when registrar handle changes", () => {
  const alerts = diffRdapSnapshot(snapshot(), snapshot({ registrar_handle: "REGR-2" }));
  assert.ok(alerts.includes("registrar_handle changed"));
});

test("alerts when last_changed moves", () => {
  const alerts = diffRdapSnapshot(snapshot(), snapshot({ last_changed: "2026-06-01T00:00:00Z" }));
  assert.ok(alerts.some((a) => a.includes("last_changed event moved")));
});

test("nameserver order does not trigger a false alert", () => {
  const baseline = snapshot({ nameservers: ["ns1.cf.com", "ns2.cf.com"] });
  const current = snapshot({ nameservers: ["ns2.cf.com", "ns1.cf.com"] });
  assert.deepEqual(diffRdapSnapshot(baseline, current), []);
});

test("multiple changes all reported", () => {
  const baseline = snapshot();
  const current = snapshot({ status: [], nameservers: ["ns1.evil.net"], registrant_handle: "REG-2" });
  const alerts = diffRdapSnapshot(baseline, current);
  assert.ok(alerts.length >= 3);
});