[domain name stolen]

Questions on how we spend our money and our time - consumer goods and services, home and vehicle, leisure and recreational activities
Post Reply
dumbmoney
Posts: 2292
Joined: Sun Mar 16, 2008 8:58 pm

[domain name stolen]

Post by dumbmoney » Sat Feb 16, 2013 1:15 am

Due to a combination of inattention and poor security on the part of Network Solutions, I had a domain name stolen. It was a 4-letter .com name, which made it just valuable enough to be worth stealing.

How it happened: I used a Yahoo email address to register the domain. Big mistake. Since Yahoo deletes email accounts after a period of inactivity, the thief only had to sign up for the same Yahoo email address (which is public information!) and direct Network Solutions to transfer the domain. Network Solutions uses email as the sole method of identity confirmation. Even though my phone number and home address were valid and up to date, that did no good since Network Solutions never contacts the domain holder by phone or mail.

As far as I know, there is no way to recover a stolen domain name, with one exception: if the domain is a registered trademark, then you can dispute the ownership and/or sue to recover it (in fact you can do those things even if you never owned the domain).

The current owner is unlikely to be the thief. No doubt the thief immediately sold it.
I am pleased to report that the invisible forces of destruction have been unmasked, marking a turning point chapter when the fraudulent and speculative winds are cast into the inferno of extinction.

User avatar
mike143
Posts: 1332
Joined: Thu Feb 02, 2012 8:55 pm

Re: How to steal a domain name

Post by mike143 » Sat Feb 16, 2013 8:17 am

Here is a pretty popular domain that was stolen: http://www.howardforums.com/content.php ... was-stolen

You might read into what they had to do.
Nothing is free, someone pays...You can't spend your way to financial freedom.

User avatar
Kenkat
Posts: 4442
Joined: Thu Mar 01, 2007 11:18 am
Location: Cincinnati, OH

Re: How to steal a domain name

Post by Kenkat » Sat Feb 16, 2013 10:23 am

How did the thief connect the domain at Network Solutions to the Yahoo email address that had been deleted to know to re-register that email address at Yahoo? If Network Solutions uses email address as the sole means of communication, I hope they don't ever expose that address to the public.

User avatar
SSSS
Posts: 1890
Joined: Fri Jun 18, 2010 11:50 am

Re: How to steal a domain name

Post by SSSS » Sat Feb 16, 2013 11:03 am

kenschmidt wrote:How did the thief connect the domain at Network Solutions to the Yahoo email address that had been deleted to know to re-register that email address at Yahoo? If Network Solutions uses email address as the sole means of communication, I hope they don't ever expose that address to the public.
Whois. All domain registration information is publicly accessible with extreme ease. Every computer has a program to pull the information (just go to a command prompt and do a "whois bogleheads.org" for Mr. Frakt's contact info, as an example) or use http://whois.net/ or http://whois.com/ or a thousand other sites.

That's just how the Internet works, and one of the risks of owning a domain. Registering with false contact information isn't viable because anybody can dispute your registration and get your domain cancelled.

You can use a proxy registration service, such as Domains By Proxy (https://www.domainsbyproxy.com/Default.aspx) but I don't think any of them are free, you have to trust them not to shut down and walk away with your domain (since they're the true registered owners), and they can be compelled to release your information in some cases.

KyleAAA
Posts: 6800
Joined: Wed Jul 01, 2009 5:35 pm
Contact:

Re: How to steal a domain name

Post by KyleAAA » Sat Feb 16, 2013 11:08 am

kenschmidt wrote:How did the thief connect the domain at Network Solutions to the Yahoo email address that had been deleted to know to re-register that email address at Yahoo? If Network Solutions uses email address as the sole means of communication, I hope they don't ever expose that address to the public.
By law, those email contacts are public. Anybody can see the email of the administrative contact of any domain by doing a whois. You can do private registration, which is either free (depending on who you register with) or extremely cheap, to prevent this. Also, you should be checking your email. You can usually get back a stolen domain by contacting the involved registrars. Very rarely will this not work.

User avatar
Kenkat
Posts: 4442
Joined: Thu Mar 01, 2007 11:18 am
Location: Cincinnati, OH

Re: How to steal a domain name

Post by Kenkat » Sat Feb 16, 2013 2:24 pm

Pretty poor security by Network Solutions to tie your authentication to a third party email system which they have absolutely no control over. Are they going to get your domain back for you?

dumbmoney
Posts: 2292
Joined: Sun Mar 16, 2008 8:58 pm

Re: How to steal a domain name

Post by dumbmoney » Sat Feb 16, 2013 3:39 pm

kenschmidt wrote:Pretty poor security by Network Solutions to tie your authentication to a third party email system which they have absolutely no control over. Are they going to get your domain back for you?
Nope. No refund on the registration fee either. As far as Network Solutions is concerned, it was an authorized transfer.
I am pleased to report that the invisible forces of destruction have been unmasked, marking a turning point chapter when the fraudulent and speculative winds are cast into the inferno of extinction.

sdrone
Posts: 108
Joined: Wed Jun 10, 2009 11:17 pm

Re: How to steal a domain name

Post by sdrone » Sat Feb 16, 2013 3:49 pm

That's odd. I don't use my Yahoo email account for years at a time, and it's always there when I login. But to be honest, it wasn't stolen. If something expires without your renewal........

Alex Frakt
Founder
Posts: 10853
Joined: Fri Feb 23, 2007 1:06 pm
Location: Chicago
Contact:

Re: How to steal a domain name

Post by Alex Frakt » Sat Feb 16, 2013 6:30 pm

sdrone wrote:That's odd. I don't use my Yahoo email account for years at a time, and it's always there when I login.
If you login, you are using it.
sdrone wrote:But to be honest, it wasn't stolen. If something expires without your renewal........
He said they transferred it, which could only have happened while he still owned it. That's completely different from picking it up when it expired.

To the OP,

If it's valuable enough, it would be worth suing to recover it or for monetary damages. Whether you win will probably depend on the exact wording of the agreement with Network Solutions. It might be worth the cost of a consultation with the right specialist attorney to find out. Finding the right lawyer might be tricky though.

Edit: On further thought, Network Solutions isn't the only target. Once you file a case, you should be able to use the judicial process to uncover the actual thief. It won't be cheap though.

KyleAAA
Posts: 6800
Joined: Wed Jul 01, 2009 5:35 pm
Contact:

Re: How to steal a domain name

Post by KyleAAA » Sat Feb 16, 2013 7:24 pm

dumbmoney wrote:
kenschmidt wrote:Pretty poor security by Network Solutions to tie your authentication to a third party email system which they have absolutely no control over. Are they going to get your domain back for you?
Nope. No refund on the registration fee either. As far as Network Solutions is concerned, it was an authorized transfer.
Was it transferred to another registrar? If so, get them involved. I've heard of this happening plenty of times before, but I've never heard of a case where a registrar refused to help at all.

User avatar
magellan
Posts: 3469
Joined: Fri Mar 09, 2007 4:12 pm

Re: [domain name stolen]

Post by magellan » Sun Feb 17, 2013 2:04 pm

The OP doesn't say how long it's been since the transfer, but as long as it was within 6 months, apparently ICANN has an official dispute resolution process that registrars have to follow.

Even if you're outside the statute of limitations, if the perpetrator of the fraud is in the US, you still may have recourse. This is a form of identity theft so it may be covered under both civil and criminal law. I guess the best case would be to somehow get law enforcement interested, though that seems tough to impossible. If you're on your own and past the ICANN statute of limitations, it does seem like the cost to pursue this would be prohibitive.

From what you describe, Network Solutions did make this especially easy for the fraudster. With GoDaddy, they'd need to break into my GoDaddy account, which has its own username/password. Maybe they could trick GoDaddy with some password reset games. One thing that's nice with GoDaddy is that each domain has separately stored contact info (including email) that doesn't automatically change when the account contact info is changed. For fun, I just changed the registered email on a domain I own and GoDaddy sent a message to both the old and new email addresses. Of course, in your case that wouldn't have helped you since the old email was compromised, but it was reassuring just the same.

Jim

tylerherman
Posts: 65
Joined: Tue Feb 19, 2013 7:07 pm

Re: [domain name stolen]

Post by tylerherman » Tue Feb 19, 2013 7:47 pm

There are a number of domain registrars with much better fraud prevention if you're willing to pay a little extra. Some require a phone confirmation to transfer a domain, and so on, depending on how paranoid/careful you need to be.

Gmail has 2-step verification for email. Use it. Someone getting access to your email account is serious business. More serious than losing your wallet IMO, so you might want to be careful with the accounts you have and are using.

Whois privacy is also like $3 at most for a domain. Buy it.

Post Reply