Work in this order. The first two steps are about stopping the damage; the investigation can follow. 1. Change the password on the account Do it from a device you trust, and use a password you have not used anywhere else. If you cannot sign in at all, open a ticket immediately and say so - do not wait. 2. Change the password on the registrant mailbox This is the one that decides whether a transfer can be approved. While you are there, look at the forwarding rules: attackers commonly add a rule that copies your mail elsewhere and leaves it in place long after the password is changed. 3. Turn two-factor back on, with new codes If it was already on and is now off, that is itself evidence. Re-enable it and store the recovery codes somewhere you can reach if the phone is gone. 4. Look at the domains Check the nameservers on each domain and the DNS records inside them. Look for new A or MX records you did not add. Check the registrar lock is still on. Check the contact records have not been changed to somebody else. 5. Look at the account activity Sign-in history and recent actions show when the access happened. Take screenshots with dates. 6. Tell us Open a ticket describing what you found and when. Attach the screenshots and, if you have them, the original phishing emails with their full headers. If a domain has already been transferred away, say so in the first line - that changes what can be done and how quickly. What we will ask Verifying that you are the account holder. For changes that affect control of the account - the email address, two-factor, unlocking a transfer - we will ask you to prove who you are. This is deliberate and it will not be skipped because it is urgent. How it usually starts Password reuse: the same password appeared in a breach of some other site. Phishing: a page that looked like ours asked for the password or the two-factor code. Mailbox takeover: the registrant address was the weak point. We never ask for your password or a two-factor code by phone, chat or email.