I'd change the registration info at the registrar - park the zone if you must. That would at least stop the attack from continuing (caches would still have the

I'd change the registration info at the registrar - park the zone if you must. That would at least stop the attack from continuing (caches would still have the attacker's responses). The best defense is to set up the delegation at the host first, then set up the delegation information at the registrar. A stub zone is could be run indefinitely (as long as there were no name collisions) before a formal delegation from a TLD is set up. Gives you time to set things up the way you want before it is reachable from global DNS tree.