Someone's stolen my domain name

[sonnas]

My web guy has just informed me someone has hijacked my domian name, and that i nolonger own it. the only reason we didnt find out earlier is that they still had the domain pointing at the right places..

123 REG has been of no help, saying i had authorised the transfer which i didnt.
according toWHOIS the domain is now owned by some Russian.

Anyone help??

 

[cmcp]

Is it possible the domain expired and was regsitered after it dropped?

Who has access to your 123reg account?

Is it possible the email linked with it was compromised?

 

[sonnas]

domain name expires in 2011.. the only other person with access to 123 reg a/c is the developer, who is also a close friend.

my friend reckons its to do with the domain having to be unlocked for a period of time durin ghte inital setting up hosting etc.

apparently it happens- been reading up about it on the web, but wondering if anyone here has had a similar experience and is os what they did about it...

 

[cmcp]

Is it a .co.uk domain name?

EDIT: post the address here but separate the letters with "*" so it can't be crawled.

 

[sonnas]

will send you a pm...

thanks for having a look..

 

[cmcp]

Well the domain was only registered in dec 08

Creation date: 13 Dec 2008 18:57:00
Expiration date: 13 Dec 2011 18:57:00

So that rules out what I was thinking. (The initial year hasn't expired at all).

It looks to have definitely been transferred from your 123 account. Can you go back to them and request details of the transfer? What email address is associated with the 123reg account?

What is your web developer saying about all this? Does he know how it all works, and did he register the domain for you?

 

[sonnas]

whoever transfered the domian has set up WHOIS PRIVACY, and i cant get access to emails.. and all i know is now its registered enon.com, in bellevue.

123REG wont give me much detail, apart from a email wiht the auth code was sent to my email address and it was used to initate the transfer.

LIES!

 

[cycloneuk]

Someone must of had access to your email to get the auth code, only way it can be done. 123-Reg are a reputable company, ive been with them years.

 

[david8765]

my money is on compromised email account, might be worth asking if they can send you a copy of any corispondance they have had from you

 

[sonnas]

my money is on compromised email account, might be worth asking if they can send you a copy of any corispondance they have had from you

so, for me to have ahem "authorised" this tranfer, i would of have to have asked them and they would have a copy of this correspondence, right? and hopefully shed a bit more light on this matter.

 

[cycloneuk]

Once you request a domain transfer then an email is sent to the whois email on record with a link and auth code. All automatic and they would either of had to get into 123 reg to change the email addy or your email account.

 

[sonnas]

Once you request a domain transfer then an email is sent to the whois email on record with a link and auth code. All automatic and they would either of had to get into 123 reg to change the email addy or your email account.

thats the thing, i remember i recieved a email from some company requesting would i transfer the name to them, and that if i hadnt authorised this i should ignore the email, which i did...

 

[streetslocal]

Would nominet not be able to help you on this as its a .co.uk domain name?

 

[sonnas]

Would nominet not be able to help you on this as its a .co.uk domain name?

its a .com unfortuately

 

[Tommo]

Phone/Email 123 reg and tell them to put a registrar lock on it now. (So it can't be transferred away from them)

If you are happy PM me the domain, I'll look into it as best I can.

I cannot stress the importance of registering names with registrars that have good security and customer care, the ones I have heard used on this forum have neither!

 

[sonnas]

Phone/Email 123 reg and tell them to put a registrar lock on it now. (So it can't be transferred away from them)

If you are happy PM me the domain, I'll look into it as best I can.

I cannot stress the importance of registering names with registrars that have good security and customer care, the ones I have heard used on this forum have neither!

ive been on the phone to 123-REG all day.. cant put registrar lock on it as it has already been transfered away.

il PM u the domain in question, and i appreicate any help you can provide.

 

[Tommo]

Contact Enom, they are pretty good with hijacked domains. (According to WHOIS this is the new registrar)

Let me know what they say.

I'll keep looking into possible solutions

Edit: Oh, and make sure you run a bunch of anti virus/spyware/adware checking using multiple systems (What you have plus AVG, Avast etx etc (free)
Once you've done this change passwords everywhere.

 

[bestforsextoys]

Hello

If it is a .co.uk domain you need to get intocuh with nominet and they will fight the case you need to open a dispute on nominets site please let me know how you get on..

Thanks
Austin

 

[nextec]

when a transfer is done on a .com domain, the auth code is sent to the administrative email address on file. Not everyone realises that there are more than 1 email address registered to a domain name.
I have come across domains before that have the email address set up for the technical but not for the admin. Ask 123-reg for the email address that was registered as the admin address for the transfer, it may well be different to the technical contact.

 

[mke]

123-reg use Tucows/OpenSRS for global tlds (usually .com, .net, .org, info, .biz).. Use their (Tucows) complaints procedure. You can view them here: Link to TC but if it's a .uk then you will find it very easy to ask Nominet UK to transfer your domain to a tag holder of your choice. Nominet tend to be very responsive to protection from fraudulent ownership prevention. As morphmaster says, Enom and other registrars are likely to be helpful if a fraudulent reseller is pinpointed so tell OpenSRS where it is currently lodged.

It should be possible to recover your domain but each registrar has its own regulations. You can see the ICANN, the supreme body over all domain names worldwide, domain resolution policy too. Sadly, there remain a few tld registrars who are less helpful.

Good luck. PM me if you think I can help.

 

[nextec]

I was thinking about this last night. Getting into your emails or changing the admin email on the domain so they could fraudulently transfer the domain away from 123-reg would explain how they transferred the domain to another registrar.

But that would not allow them to change the ownership of the domain, it would still have shown as being registered to you.
The bigger question is how and when did they transfer the ownership and registered details of the domain.

If it was me I would go straight to ICANN and open a dispute, they are normally very helpful.

How important to your business is the domain name and what is the new owner doing with it?

 

[sonnas]

thanks everyone for your help so far...

this is what my web guy sent enon..

"This domain does not belong to you and has been transferred illegally without permission. We will be happy to provide any proof you require of these allegations. We will contact your support team when your office opens. You will see the domain clearly pointing to a UK hosting provider, ie OUR provider, you will also see that it was transferred by you or one of your clients on March 8th 2009. If someone could contact myself on +00 44 ********** or +0044 ********** I would be grateful."

Their response:

"
Hello,

If you believe that domains registered here have been transferred to eNom without proper authorization, please contact your registrar and have them initiate a transfer dispute investigation. We will work with them to determine the validity of the transfers and what options there may be for their return.

Regards,

Jason | Compliance/Risk Management
__________________________________
eNom, Inc., a Demand Media company

so.... im getting back to 123 as enom are suggesting...

 

[logicfusion]

Can you afford to instruct solicitors to take aggressive action against your domain host? (I assume they are a UK company).

I'm certain a strongly worded letter from a top law firm would change their stance.

Thats what I would be thinking if it was my business.

 

[nextec]

I would be interested in 123-reg's response.
My experience of their support system has left something to be desired on occasions I have needed them in the past.
I may have just been unlucky as other people have no problems with them.

Please keep us informed on how this progresses and if I can do anything to help let me know.

 

[GeorgeM]

thats the thing, i remember i recieved a email from some company requesting would i transfer the name to them, and that if i hadnt authorised this i should ignore the email, which i did...

Does anyone else get copied in on your emails ? If so is it possible someone else clicked on the 'authorise transfer' link - was there one in the email you received ?

Possible I guess if your email account had been compromised, as discussed earlier ?

 

[nextec]

Clicking on the authorise transfer link would not have allowed the transfer on its own. The person attempting to make the transfer would still need the reference number and that is only sent to the admin email address registered to the domain when a transfer is requested.

And as I said before that would only transfer the registrar for the domain, not the ownership as well.

I fear that there is more to this than meets the eye

 

[cmcp]

A friendly pointer, I appreciate you're both strung up about this but I'd keep your cool when talking to the providers.

Remember the providers (especially Enom) seem to have done nothing wrong at the moment.

Are you sure you have all the details of this?/ Can you see any action in your email inbox that was associated with the 123 account?

 

[sonnas]

Can you afford to instruct solicitors to take aggressive action against your domain host? (I assume they are a UK company).

I'm certain a strongly worded letter from a top law firm would change their stance.

Thats what I would be thinking if it was my business.

legal action isnt really an option due to lack of funds...

I would be interested in 123-reg's response.
My experience of their support system has left something to be desired on occasions I have needed them in the past.
I may have just been unlucky as other people have no problems with them.

Please keep us informed on how this progresses and if I can do anything to help let me know.

not the kinda report of 123-reg's customer service i was hoping for lol.
have been on the phone to them, after reading them eNom's reply to my email concerning this unauthorised transfer. the man on the phone said he is invesitagting and will email me back within 48 hours......hhmmmm

Does anyone else get copied in on your emails ? If so is it possible someone else clicked on the 'authorise transfer' link - was there one in the email you received ?

Possible I guess if your email account had been compromised, as discussed earlier ?

well i hope not, thou going by the next quote this shouldnt be a problem? or it could be- any how, i have changed all passwords..

Clicking on the authorise transfer link would not have allowed the transfer on its own. The person attempting to make the transfer would still need the reference number and that is only sent to the admin email address registered to the domain when a transfer is requested.

And as I said before that would only transfer the registrar for the domain, not the ownership as well.

I fear that there is more to this than meets the eye

A friendly pointer, I appreciate you're both strung up about this but I'd keep your cool when talking to the providers.

Remember the providers (especially Enom) seem to have done nothing wrong at the moment.

Are you sure you have all the details of this?/ Can you see any action in your email inbox that was associated with the 123 account?

i agree...getting mad at the guy on the other end of the phone will most likely get me the worst kind of customer service in a time when i need them to be helpful...

will keep everyone posted on any news i get.

 

[nextec]

Another thing I don't understand about this is the fact (if I am correct) that the domain name is still pointing to your web site.

If someone had gone through all the effort of fraudulently obtaining your domain name I would have assumed that they had a good reason to want it (to steal your business, destroy your business credibility etc).

To go to all the effort and then keep it pointing at your web site makes no sense to me. If they wanted to send out emails that appear to come from you this can be done easily without having to resort to taking the domain name and anyone with the know how to take it would know this.

As I said before I am sure that there is more to this / another piece of the puzzle that has not yet been discovered.

The other thought is that it is a genuine mistake and the transfer / registration system has got screwed up somewhere.

 

[mke]

eNon is the receiving registrar. 123-reg is the approved reseller and OpenSRS is the releasing registrar. Your argument is with them. Why and how did they let it go? 123-reg has given sterling service for years but has changed hands twice in recent times and questions are there to be asked. Follow my earlier advice and I have every confidence Tucows/OpenSRS will follow it through.

Sorry guys, I don't visit often these days, just plain too busy. But get back to me if needed. A PM produces an email notification.

 

[nextec]

so what was the outcome from 123-reg? Has this moved on any further?

 

[cmcp]

update please!

 

[thedesigntailor]

123-reg - I dread that name every time I ask a client who they bought their domain from,

 

[sonnas]

I was thinking about this last night. Getting into your emails or changing the admin email on the domain so they could fraudulently transfer the domain away from 123-reg would explain how they transferred the domain to another registrar.

But that would not allow them to change the ownership of the domain, it would still have shown as being registered to you.
The bigger question is how and when did they transfer the ownership and registered details of the domain.

If it was me I would go straight to ICANN and open a dispute, they are normally very helpful.

How important to your business is the domain name and what is the new owner doing with it?

Hi everyone, sorry there hasnt been a update recently.

So, i got on to 123-Reg as advised by eNom, i told 123 to investigate this matter and after i gave them the "48 hours they require, and we will get straight back to you" i still have no answers.

Im guessing i will have to go to ICANN...anyone got any tips on how to put the dispute to them?

im currently emailing Tucows, see how if anything come out of that...fingers crossed.