Domain names are being transfered without consent! This is Big trouble. - GoFuckYourself.com

Blaze · 01-15-2005, 10:39 AM

It happened to sleazydream and it happened to me. One of my high traffic gallery domains was transfered to anouther registrar without so much as a email to me.

This domain was on directnic and it still shows up in my account, but whois lookups show someone else, and all the traffic is being redircted to spyware virus hell. I have tried contacting both registrars but I doubt I will hear anything till monday.

How is this possible? How can domains be stolen like this?

Darkystar · 01-15-2005, 10:42 AM

holy fucking shit, i feel sorry for you
was your domain locked? it should't be transferred anyway without you confirming the transfer, but still?

DarkJedi · 01-15-2005, 10:42 AM

Jews strike again

Vox · 01-15-2005, 10:43 AM

Quote:

Originally Posted by DarkJedi

Jews strike again

You mean russians.

brand0n · 01-15-2005, 10:44 AM

What domains?

Relish XXX · 01-15-2005, 10:45 AM

I have well over 100 domains at directnic, anyone could take one of my small typo based domains and I doubt I would notice.

arg · 01-15-2005, 10:50 AM

Blaze, there are a lot of ways it can be done. Stolen password to your directnic account or to your email, or another way to intercept your email (packet-sniffing on an intermediary network), spyware/remote control on your computer, using a corrupt "receiving" registrar, using an inept "receiving" registrar (one that doesn't verify domain ownership carefully), and so on. Was the domain name "locked" on directnic? If so, then the thief probably had to get into your directnic account somehow...lots of ways to do it, just like breaking into any computer account. Is the "created" date on the domain the same as when you first registered it, or is it now a recent date?

Blaze · 01-15-2005, 10:54 AM

The creation date is the same as when I registared it.

The registrar he transfered it to is www.qnic.com
Anyone know if they are crooked?

David! · 01-15-2005, 10:55 AM

Quote:

Originally Posted by DarkJedi

Jews strike again

Your stupidity seems to be bottomless

Tipsy · 01-15-2005, 10:59 AM

Quote:

Originally Posted by arg

Was the domain name "locked" on directnic? If so, then the thief probably had to get into your directnic account somehow...

I've been wondering much the same.

Vox · 01-15-2005, 11:00 AM

Quote:

Originally Posted by Blaze

The creation date is the same as when I registared it.

The registrar he transfered it to is www.qnic.com
Anyone know if they are crooked?

It's a russian company, does that answer your question?

Dirty F · 01-15-2005, 11:03 AM

Quote:

Originally Posted by Vox

It's a russian company, does that answer your question?

What a fucking suprise.

Honestly, the internet would be a better place if these fuck faces were cut off from the rest of the world. Let them hack their own servers.

Illicit · 01-15-2005, 11:22 AM

People gots to learn to Lock their Domains

directfiesta · 01-15-2005, 11:38 AM

Quote:

Originally Posted by ajpiii

People gots to learn to Lock their Domains

Quote:

The transfer is also affected by the Transfer Security setting of your directNIC account:

Normal Security: This will allow the transfer once you respond to the notification email. If you do not respond, your domain will still be transferred away within 5 days.

///////

SpaceAce · 01-15-2005, 11:44 AM

Quote:

Originally Posted by Blaze

It happened to sleazydream and it happened to me. One of my high traffic gallery domains was transfered to anouther registrar without so much as a email to me.

This domain was on directnic and it still shows up in my account, but whois lookups show someone else, and all the traffic is being redircted to spyware virus hell. I have tried contacting both registrars but I doubt I will hear anything till monday.

How is this possible? How can domains be stolen like this?

I knew some serious shit was up when I hit the link and got the redirect. I just wish you'd woken up when I called so maybe you could have gotten a new link posted. Not only is the putz using Amateur Pages as a sponsor, he's still using Clickthrough Calvin code.

Time to move this thread back to the top. Watch your domains, guys! I encountered at least two hijacks last night, both going to xybererotica.com.

SpaceAce

arg · 01-15-2005, 11:49 AM

I haven't heard of qnic before, but qnic.com lists their authoritative whois server as whois.wildwestdomains.com, which I *think* is related (alias/subsidiary/sibling/partner) to godaddy. Qnic seems US-based to me. Maybe a reseller for wildwestdomains, rather than an ICANN-accredited registrar themselves.

If you haven't checked on the registration info in a while, it's possible that the domain was hijacked months ago. The hijackers could maintain most the same DNS servers for the domain, so that it would operate normally, while transferring the domain between one or more intermediary registrars, before it wound up at qnic. (ICANN limits transfers to I think once every 30 days, 60 days for a new registration). Multiple transfers can make it harder to resolve a hijacking.

Are you pretty sure your contact info (email address in particular) was correct in the whois info for the domain? Theoretically DirectNIC should have mailed that address when a transfer request was made, to let you know it was going to be done unless you canceled it.

It is not uncommon for registrars to list domains in your account even after legitimate transfers away from the registrar.

It sounds like you're going to need to rely on DirectNIC for some investigation and help on this. I would guess they'll be able to resolve the issue. A lot of people on GFY do a lot of business with DirectNIC, and if this goes unresolved, it would tarnish their reputation.

SmokeyTheBear · 01-15-2005, 11:54 AM

Im pretty sure if it was transferred recently you can login to directnic and reverse the transfer

Dax · 01-15-2005, 12:02 PM

Lock Your Shit!!

BlueWire · 01-15-2005, 12:13 PM

Well...did you make sure they were locked in the CP? if they were then i feel bad....if they weren't then i dont know what to tell ya man cuz god knows i got a reminder every 5 minutes about that new rule

DEA - banned for life · 01-15-2005, 12:16 PM

Fuckin theives man..stealing from the rich and giving it to the richer!!

DaddyHalbucks · 01-15-2005, 12:27 PM

ICANN rules changed recently.

As I understand it, registrars now have to automatically approve ("ACK") all transfer requests. It is the responsibility of the receiving registrar to authenticate before initiating the request. All submitted requests are deemed valid.

The only exception is if your domain is on LOCK status. So, lock your domains! And use a good registrar such as Moniker!

This new policy is to prevent crappy registrars such as ItsYourDomain and TotalNIC from holding your domains hostage.

However, it appears that the pendulum has now swung the other way.

01-15-2005, 10:39 AM	#1
Blaze Confirmed User Join Date: Oct 2001 Location: Ohio Posts: 298	Domain names are being transfered without consent! This is Big trouble. It happened to sleazydream and it happened to me. One of my high traffic gallery domains was transfered to anouther registrar without so much as a email to me. This domain was on directnic and it still shows up in my account, but whois lookups show someone else, and all the traffic is being redircted to spyware virus hell. I have tried contacting both registrars but I doubt I will hear anything till monday. How is this possible? How can domains be stolen like this?

01-15-2005, 10:44 AM	#5
brand0n been very busy Join Date: Nov 2002 Location: the queen city Posts: 26,983	What domains? __________________ want to buy this spot for cheap? it is of course for sale. long term deals are always the best bet. brand0n/ at/ a o l dot commies.

01-15-2005, 10:45 AM	#6
Relish XXX Confirmed User Join Date: Dec 2004 Location: www.adultlabel.com Posts: 4,904	I have well over 100 domains at directnic, anyone could take one of my small typo based domains and I doubt I would notice. __________________

01-15-2005, 11:22 AM	#13
Illicit wtf ? Join Date: Dec 2003 Location: GFY Posts: 11,895	People gots to learn to Lock their Domains __________________ Insert Sig Here

01-15-2005, 11:54 AM	#17
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	Im pretty sure if it was transferred recently you can login to directnic and reverse the transfer __________________ hatisblack at yahoo.com

01-15-2005, 10:42 AM	#2
Darkystar Confirmed User Join Date: Jan 2002 Posts: 273	holy fucking shit, i feel sorry for you was your domain locked? it should't be transferred anyway without you confirming the transfer, but still?

01-15-2005, 10:42 AM	#3
DarkJedi No Refunds Issued. Industry Role: Join Date: Feb 2001 Location: GFY Posts: 28,300	Jews strike again

01-15-2005, 10:50 AM	#7
arg Confirmed User Join Date: Feb 2003 Posts: 1,164	Blaze, there are a lot of ways it can be done. Stolen password to your directnic account or to your email, or another way to intercept your email (packet-sniffing on an intermediary network), spyware/remote control on your computer, using a corrupt "receiving" registrar, using an inept "receiving" registrar (one that doesn't verify domain ownership carefully), and so on. Was the domain name "locked" on directnic? If so, then the thief probably had to get into your directnic account somehow...lots of ways to do it, just like breaking into any computer account. Is the "created" date on the domain the same as when you first registered it, or is it now a recent date?

01-15-2005, 10:54 AM	#8
Blaze Confirmed User Join Date: Oct 2001 Location: Ohio Posts: 298	The creation date is the same as when I registared it. The registrar he transfered it to is www.qnic.com Anyone know if they are crooked?

01-15-2005, 11:49 AM	#16
arg Confirmed User Join Date: Feb 2003 Posts: 1,164	I haven't heard of qnic before, but qnic.com lists their authoritative whois server as whois.wildwestdomains.com, which I think is related (alias/subsidiary/sibling/partner) to godaddy. Qnic seems US-based to me. Maybe a reseller for wildwestdomains, rather than an ICANN-accredited registrar themselves. If you haven't checked on the registration info in a while, it's possible that the domain was hijacked months ago. The hijackers could maintain most the same DNS servers for the domain, so that it would operate normally, while transferring the domain between one or more intermediary registrars, before it wound up at qnic. (ICANN limits transfers to I think once every 30 days, 60 days for a new registration). Multiple transfers can make it harder to resolve a hijacking. Are you pretty sure your contact info (email address in particular) was correct in the whois info for the domain? Theoretically DirectNIC should have mailed that address when a transfer request was made, to let you know it was going to be done unless you canceled it. It is not uncommon for registrars to list domains in your account even after legitimate transfers away from the registrar. It sounds like you're going to need to rely on DirectNIC for some investigation and help on this. I would guess they'll be able to resolve the issue. A lot of people on GFY do a lot of business with DirectNIC, and if this goes unresolved, it would tarnish their reputation.

01-15-2005, 12:02 PM	#18
Dax Confirmed User Industry Role: Join Date: Apr 2002 Location: USA Posts: 3,161	Lock Your Shit!!

01-15-2005, 12:13 PM	#19
BlueWire Confirmed User Join Date: Nov 2004 Posts: 4,628	Well...did you make sure they were locked in the CP? if they were then i feel bad....if they weren't then i dont know what to tell ya man cuz god knows i got a reminder every 5 minutes about that new rule

01-15-2005, 12:16 PM	#20
DEA - banned for life V.I.P. Join Date: Nov 2004 Location: InYour Head Posts: 7,886	Fuckin theives man..stealing from the rich and giving it to the richer!!

01-15-2005, 12:27 PM	#21
DaddyHalbucks A freakin' legend! Industry Role: Join Date: Feb 2004 Location: Las Vegas, Nevada USA Posts: 18,975	ICANN rules changed recently. As I understand it, registrars now have to automatically approve ("ACK") all transfer requests. It is the responsibility of the receiving registrar to authenticate before initiating the request. All submitted requests are deemed valid. The only exception is if your domain is on LOCK status. So, lock your domains! And use a good registrar such as Moniker! This new policy is to prevent crappy registrars such as ItsYourDomain and TotalNIC from holding your domains hostage. However, it appears that the pendulum has now swung the other way. __________________ Boner Money