warning A Cautionary Tale: How Sav.com Allowed My Domain to Be Stolen from Within

[.tv]

Urgent Call for Recovery Advice and Legal Insights

Fellow NamePros members,

In the vast digital landscape where domains are our most cherished assets, gateways to businesses, brands, and dreams, one expects registrars to serve as vigilant guardians. Yet, my recent ordeal with Sav.com has shattered that illusion, revealing a harrowing vulnerability that could ensnare any of us.

What began as a routine registration spiraled into a nightmare of unauthorized theft, bureaucratic stonewalling, and suspected internal collusion. Allow me to recount this saga in detail, not merely to vent my frustration but to warn our community and solicit your collective wisdom on reclaiming what was illicitly taken. If you've navigated similar treacherous waters, your stories and strategies could be my lifeline, and a beacon for others.

The Genesis: A Seemingly Secure Registration

It all started innocently enough on June 9, 2025, when I registered a domain (redacted for privacy) through Sav.com. Secured with two-factor authentication (2FA) and under my sole management, it represented a strategic investment in my portfolio. For months, everything proceeded smoothly, no red flags, no anomalies. That is, until August 22, 2025, when an ominous email arrived from Sav.com: “Transfer of [Domain name redacted for privacy] Complete,” with the body curtly stating, “Your internal transfer of [Domain name redacted for privacy] is complete.”

Panic set in. I hadn't initiated, authorized, or even been notified of any transfer. No login alert. No 2FA prompt. No confirmation email. The domain had vanished from my account, spirited away through what Sav.com termed an "internal transfer", a process that bypassed every security layer I had in place. This wasn't a hack from afar; it felt like an inside job, executed with the precision of someone wielding backend privileges.

The Labyrinth of Support: A Week of Empty Promises

Within minutes, I launched a support ticket via their live chat, detailing the breach and demanding immediate restoration, a thorough investigation, and enhanced safeguards like mandatory 2FA for all transfers. The response? Initial acknowledgment from a support agent, followed by escalation to "advanced support" with assurances of swift resolution. But as hours turned to days, the pattern emerged: rote, copy-pasted replies echoing the same refrain, "We're investigating, but due to high volume, it may take 3-10 business days."

By August 23, frustration boiled over. I pressed for details: the receiving account's identity, transfer logs, and an explanation for the security lapse. Their reply? More delays, no substance. On August 24, I discovered the domain was now resolving to a Vietnamese website, with nameservers altered, clear evidence of tampering post-transfer. Yet, Sav.com's agents claimed helplessness, citing backlogs and lack of authority. Screenshots shared in the ticket underscored the urgency, but to no avail.

The saga dragged into August 26, with yet another generic update: "Escalated and pending." My threats of escalation, to ICANN, forums like this one, and legal counsel, fell on deaf ears. By August 29 (today), a full week later, the silence is deafening. No restoration. No investigation updates. Just platitudes about patience. This isn't service; it's a shield for negligence, if not outright complicity.

The Dark Suspicions: Internal Theft and Registrar Complicity

What elevates this from mishap to malice is the nature of the transfer. Confined within Sav.com's ecosystem, the domain landed in another account on their platform, untouched by external hackers, yet untouchable for me. Despite 2FA, no alerts triggered, suggesting bypassed protocols only insiders could manipulate. The rapid nameserver changes and foreign resolution point to deliberate exploitation, perhaps by rogue backend staff colluding with thieves. Sav.com's refusal to disclose logs or freeze the domain reeks of a cover-up, eroding trust in their stewardship of our digital treasures.

This isn't isolated incompetence; it's a systemic flaw that exposes us all. Shady registrars like Sav.com, with their opaque processes and lethargic support, transform from allies into adversaries. How many valuable domains must vanish before we acknowledge the peril? My experience underscores a stark truth: entrusting high-value assets to such platforms invites disaster. I urge fellow domainers, transfer out now to reputable registrars with proven security and responsive teams. Peace of mind is priceless; lingering with Sav.com is a gamble you can't afford.

Seeking Your Guidance: Paths to Recovery and Justice

NamePros community, you've been my go-to for insights, and now I turn to you in desperation. Has anyone endured a similar internal theft at Sav.com or other dubious registrars, where employees or colluders pilfer domains from under your nose? If you've successfully reclaimed yours, share your playbook: Did ICANN's complaints yield results? Was a UDRP filing through WIPO or NAF the key? What about domain recovery services like Hartzer Consulting or DNAccess, did they trace and retrieve effectively?

To the legal eagles among us, IP attorneys specializing in domain disputes, your expertise is invaluable. Should I prioritize an ICANN contractual compliance complaint for registrar negligence, or leap to UDRP for bad-faith transfer? With the domain still under Sav.com's umbrella, is there a way to compel disclosure of the thief's account?

And for international angles (like the Vietnamese resolution), how do we involve cybercrime units or Interpol without endless red tape?

Let's transform this ordeal into a collective triumph. Your advice could not only restore my domain but fortify our community against these shadows.

Together, we can unmask the vulnerabilities and demand better from the industry.

Grateful for your support!

 

[draco]

Situations like this rarely offer a fast resolution.

When you logged into your account, did it still require 2FA? Do you have other domains with Sav? If you do, are they all still there?

Have you searched or posted elsewhere to see if anyone had a similar experience? Back in 2013(?), Moniker was hacked. The hackers took domains from multiple accounts (including mine), bypassing all the security and notification protocols. I only found out because I happened to log into my account. It took months and signing some legal paperwork, but I did get my domain back.

Now I'm off to inventory my Sav account, just in case.

@Sav.com hasn't been on here in a few years. But maybe they'll see the notification.

 

[.tv]

Situations like this rarely offer a fast resolution.

When you logged into your account, did it still require 2FA? Do you have other domains with Sav? If you do, are they all still there?

Have you searched or posted elsewhere to see if anyone had a similar experience? Back in 2013(?), Moniker was hacked. The hackers took domains from multiple accounts (including mine), bypassing all the security and notification protocols. I only found out because I happened to log into my account. It took months and signing some legal paperwork, but I did get my domain back.

Now I'm off to inventory my Sav account, just in case.

@Sav.com hasn't been on here in a few years. But maybe they'll see the notification.

Thank you for sharing your experience and for the thoughtful questions. They resonate deeply with my situation and highlight the vulnerabilities we've all faced in this industry.

To address your inquiries directly:

Yes, logging into my Sav.com account continues to require 2FA without exception, and I consistently receive notifications for both successful and failed login attempts. This has been the norm for all routine activities. However, the truly perplexing aspect of this incident is that no such alerts or 2FA prompts were triggered during the unauthorized internal transfer of the domain in question. This anomaly only heightens my suspicions regarding potential backend manipulations by Sav.com staff, as it suggests a deliberate bypass of standard security protocols, much like the bypassing you described in the 2013 Moniker hack. I am sorry that you did not get your domain back, and your account of the Moniker breach is a sobering reminder of how these issues can drag on.

I do maintain a handful of other domains at Sav.com, and fortunately, they remain intact in my account at present. That said, the stolen domain was among my most valuable holdings, making this loss particularly devastating. Your account of the Moniker breach is eerily similar and serves as a stark reminder of how these issues can drag on;

Regarding searches for similar experiences, I've posted on a few other forums and conducted some preliminary research, but haven't uncovered widespread reports of internal transfers at Sav.com specifically, though complaints about their support delays and opacity are plentiful. If you come across any parallels during your inventory check, I'd greatly appreciate any insights. In the meantime, I'm proactively initiating transfers for all my remaining domains to a more reliable registrar to mitigate further risks.

Your cautionary tale is invaluable. Thank you again for weighing in. Let's hope we can collectively pressure for better safeguards in the future.

 

[domainnews]

Perhaps Sav will become the next former Epik.，Ron Monster

I'm experiencing the same issue and disappointed about their services, but with domain registration failure. I've contacted them about 10 or more times, waited for 20 days, and they still haven't resolved my issue yet.

Today, I contacted their support again for a refund or to resolve my issue, but even after 20 days, nothing has been done (the registration fee is a whopping $800).They keep saying words like "sorry," "patience," and "upgrade.""escalation"

I contacted them today again but received the same response.Their support told me they'll escalate to a higher-tier level again today.

If they can't resolve my issue after 25 days, I'll report them here.

 

[MarkedMarket]

Sav seems to have some technical issues recently. Last week I renewed a batch of domains and received a notification the next day that 30% of that batch was not renewed. I then tried to renew those domains again, but it renewed other domains that I had already renewed and not the ones that required renewal. They mentioned that their system faced some technical issues resulting in instability.

I would therefore be cautious to suggest it's a theft. You mentioned that you registered the domain recently (so it can't really be that valuable ) and it could well be a technical issue. For example a fast transfer from a previous registrant that was inadvertedly activated from a marketplace where it was still listed.

 

[domainnews]

Sav seems to have some technical issues recently. Last week I renewed a batch of domains and received a notification the next day that 30% of that batch was not renewed. I then tried to renew those domains again, but it renewed other domains that I had already renewed and not the ones that required renewal. They mentioned that their system faced some technical issues resulting in instability.

I would therefore be cautious to suggest it's a theft. You mentioned that you registered the domain recently (so it can't really be that valuable ) and it could well be a technical issue. For example a fast transfer from a previous registrant that was inadvertedly activated from a marketplace where it was still listed.

No， This domain is available for registration at that time ， I chosen Sav is that because of the cheapest among other registrars through V2 interface but their system shows that I have another domain didn't pay ，thefore， the registration amounts are not Insuffient， as a matter of fact ，the previous domain mentioned by the system I have registered Several days ago which means The funds in my account was enough to cover the new order.

BTW ，some problem with Sav backorder ， I First backordered a domain with Sav and the system didn't operate to catch domain for me although it was available at that time and then I hand registration it then I reported the issues to their staffs.

after several days ， I backordered another domain which is the same extension as before ，again， Their system didn't active to catch it as it available ，then I hand registration again， I kept an eye on this issue due to happen last time，2 times hand reg.

I hate to say but although I'm a veteran member of Sav when their company founded ，I think they offered poor and poor services and are lower and lower in working efficiency and not professional than ever before.

Actually ， I don't know why is that?

 

[william]

I have experienced ZERO issues with Sav.com since its inception and about 5 serious issues in the last few months. Something is going on with their system. Could be related to their new dashboard, management, lack of staff, I'm not sure. But anyone with seriously valuable names should start migrating them elsewhere ASAP.

 

[Altetra]

There are many things in your post which does not add up!
And I will not waste my time to describe them.

 

[Mkt Sales Leads]

No， This domain is available for registration at that time ， I chosen Sav is that because of the cheapest among other registrars through V2 interface but their system shows that I have another domain didn't pay ，thefore， the registration amounts are not Insuffient， as a matter of fact ，the previous domain mentioned by the system I have registered Several days ago which means The funds in my account was enough to cover the new order.

BTW ，some problem with Sav backorder ， I First backordered a domain with Sav and the system didn't operate to catch domain for me although it was available at that time and then I hand registration it then I reported the issues to their staffs.

after several days ， I backordered another domain which is the same extension as before ，again， Their system didn't active to catch it as it available ，then I hand registration again， I kept an eye on this issue due to happen last time，2 times hand reg.

I hate to say but although I'm a veteran member of Sav when their company founded ，I think they offered poor and poor services and are lower and lower in working efficiency and not professional than ever before.

Actually ， I don't know why is that?

They're probably one of those registrars (along with Godaddy) where domain searches are tracked - I've had instances of not acting immediately after seeing a name I was interested in, only to find it was registered by someone else hours to a day later.

As such I only use Dynadot and Spaceship to search for domains, due to their anti-snooping ethics.

 

[.tv]

Update: From the very beginning, Sav.com support team has done nothing but parrot the exact same copy‑and‑paste responses, completely ignoring the urgency and seriousness of my repeated attempts to get help. It’s as if they couldn’t care less, shamelessly sending the same hollow replies over and over while my stolen domain issue remains unresolved.


--- August 29, 2025 ---

01:55 AM | <Name Redacted>: Mr. <Name Redacted>,
Is anyone at Sav.com actually doing anything? It's been over two days since you guaranteed me a solution, and you've delivered nothing.
A week. It has been a full week since my domain was stolen, and the inaction from your company is insulting. I have no answers, no updates, and my stolen domain is still in the hands of thieves. This level of incompetence is staggering.
Explain to me right now what is going on. This is your last chance to respond to me before I make this a much larger, public issue for Sav.com today.

03:00 AM | <Name Redacted> from Sav: We recognize the frustration of this situation and sincerely sympathize with your circumstances. I have given your case top priority and notified the development team to resolve the issue.

However, at this point, we can only wait, as I do not have the resources or authority to resolve this matter independently. I apologize for any inconvenience and kindly request your patience.

03:08 AM | <Name Redacted>: Thank you for your response, but it’s utterly deplorable that this has been escalated for days with no resolution in sight! A full week has passed, and your team has neither transferred this critical issue to the technical experts nor provided a single meaningful update. I am beyond disappointed. Your repeated, robotic excuse of "we can only wait" is an insult to my patience and a disgrace to your company’s integrity. Tell Sav.com that I have already initiated legal proceedings against you, and frankly, I’m not surprised by this tired, stereotypical response. It’s clear you’re more interested in playing games than protecting your customers’ assets. The clock is ticking, and your negligence will face the full force of the law. Good luck with your ongoing charade!

04:18 AM | <Name Redacted> from Sav: I sincerely apologize that I can't assist you further at this point. I have marked the ticket as high priority and asked the development team to take an immediate look at it. Now, we can only wait, as I do not have the resources or authority to resolve this matter independently.

I completely understand, and I apologize for the slow resolution of this ticket. Once again, I regret that I can't assist you further. We will reach out once dev team has provided update to us on this ticket.

--- September 6, 2025 ---

03:55 PM | <Name Redacted>: Hi <Name Redacted>,
The registry has already contacted me requesting your latest update on the illicit internal transfer of my stolen domain name, a transfer that your so-called “development team” at the notorious registrar Sav.com is well aware of.

Let me be absolutely clear, your repetitive, canned, and empty responses since August 22 have been nothing but stalling tactics. It is becoming painfully obvious that your team has no genuine intention of assisting customers, let alone addressing this blatant theft that happened under your watch.

Do you even have a legitimate development team, or is Sav.com simply staffed with thieves disguised as employees, profiting off of stolen assets? The way this matter is being handled, or rather, not handled, reflects an alarming level of negligence, incompetence, and quite possibly complicity.

I am already in close contact with a leading IP attorney and an ICANN board member, both of whom have requested a complete record of Sav’s deliberate inaction and lethargic attitude in this case. Believe me, your long silence and refusal to provide answers form an incriminating narrative on their own.

Here is what I demand immediately:
Full restoration of my stolen domain name to my account without further delay.
A formal, written apology from the entire Sav.com team acknowledging this failure.
A complete and transparent explanation of how this illicit transfer was executed and why your so-called “development team” has chosen to sit on their hands in the face of such a sensitive and urgent issue.

This is not merely a customer complaint, this is a demand for accountability in a matter that involves serious misconduct and possible criminal activity inside your company. Failure to act now will only escalate the legal and regulatory consequences you are already facing.
You have exhausted any goodwill by remaining silent for this long. Return the stolen domain, explain the breach, and make this right, now.

03:55 PM | <Name Redacted> from Sav: I regret to inform you that I am unable to provide further assistance at this time. I have designated the ticket as high priority and have requested the development team to address it promptly.

Unfortunately, I do not have the means or authority to resolve this issue on my own. I understand your frustration and apologize for the delay in resolving this matter. We will contact you as soon as the development team provides an update on this ticket.

 

[NicTraders]

Update: From the very beginning, Sav.com support team has done nothing but parrot the exact same copy‑and‑paste responses, completely ignoring the urgency and seriousness of my repeated attempts to get help. It’s as if they couldn’t care less, shamelessly sending the same hollow replies over and over while my stolen domain issue remains unresolved.


--- August 29, 2025 ---

01:55 AM | <Name Redacted>: Mr. <Name Redacted>,
Is anyone at Sav.com actually doing anything? It's been over two days since you guaranteed me a solution, and you've delivered nothing.
A week. It has been a full week since my domain was stolen, and the inaction from your company is insulting. I have no answers, no updates, and my stolen domain is still in the hands of thieves. This level of incompetence is staggering.
Explain to me right now what is going on. This is your last chance to respond to me before I make this a much larger, public issue for Sav.com today.

03:00 AM | <Name Redacted> from Sav: We recognize the frustration of this situation and sincerely sympathize with your circumstances. I have given your case top priority and notified the development team to resolve the issue.

However, at this point, we can only wait, as I do not have the resources or authority to resolve this matter independently. I apologize for any inconvenience and kindly request your patience.

03:08 AM | <Name Redacted>: Thank you for your response, but it’s utterly deplorable that this has been escalated for days with no resolution in sight! A full week has passed, and your team has neither transferred this critical issue to the technical experts nor provided a single meaningful update. I am beyond disappointed. Your repeated, robotic excuse of "we can only wait" is an insult to my patience and a disgrace to your company’s integrity. Tell Sav.com that I have already initiated legal proceedings against you, and frankly, I’m not surprised by this tired, stereotypical response. It’s clear you’re more interested in playing games than protecting your customers’ assets. The clock is ticking, and your negligence will face the full force of the law. Good luck with your ongoing charade!

04:18 AM | <Name Redacted> from Sav: I sincerely apologize that I can't assist you further at this point. I have marked the ticket as high priority and asked the development team to take an immediate look at it. Now, we can only wait, as I do not have the resources or authority to resolve this matter independently.

I completely understand, and I apologize for the slow resolution of this ticket. Once again, I regret that I can't assist you further. We will reach out once dev team has provided update to us on this ticket.

--- September 6, 2025 ---

03:55 PM | <Name Redacted>: Hi <Name Redacted>,
The registry has already contacted me requesting your latest update on the illicit internal transfer of my stolen domain name, a transfer that your so-called “development team” at the notorious registrar Sav.com is well aware of.

Let me be absolutely clear, your repetitive, canned, and empty responses since August 22 have been nothing but stalling tactics. It is becoming painfully obvious that your team has no genuine intention of assisting customers, let alone addressing this blatant theft that happened under your watch.

Do you even have a legitimate development team, or is Sav.com simply staffed with thieves disguised as employees, profiting off of stolen assets? The way this matter is being handled, or rather, not handled, reflects an alarming level of negligence, incompetence, and quite possibly complicity.

I am already in close contact with a leading IP attorney and an ICANN board member, both of whom have requested a complete record of Sav’s deliberate inaction and lethargic attitude in this case. Believe me, your long silence and refusal to provide answers form an incriminating narrative on their own.

Here is what I demand immediately:
Full restoration of my stolen domain name to my account without further delay.
A formal, written apology from the entire Sav.com team acknowledging this failure.
A complete and transparent explanation of how this illicit transfer was executed and why your so-called “development team” has chosen to sit on their hands in the face of such a sensitive and urgent issue.

This is not merely a customer complaint, this is a demand for accountability in a matter that involves serious misconduct and possible criminal activity inside your company. Failure to act now will only escalate the legal and regulatory consequences you are already facing.
You have exhausted any goodwill by remaining silent for this long. Return the stolen domain, explain the breach, and make this right, now.

03:55 PM | <Name Redacted> from Sav: I regret to inform you that I am unable to provide further assistance at this time. I have designated the ticket as high priority and have requested the development team to address it promptly.

Unfortunately, I do not have the means or authority to resolve this issue on my own. I understand your frustration and apologize for the delay in resolving this matter. We will contact you as soon as the development team provides an update on this ticket.

Well done for taking further action. I hope you get some joy in due course, though it might be a while away...

At this stage, I honestly think Sav consists of a marketing department, and that's all. Clearly the support department is a bot, and the engineering department must be outsourced, since they haven't managed to do anything in the last week (and it is common for them to take weeks to address issues). I fear for anyone with domains still at Sav as the writing is on the wall...

 

[Mkt Sales Leads]

Well done for taking further action. I hope you get some joy in due course, though it might be a while away...

At this stage, I honestly think Sav consists of a marketing department, and that's all. Clearly the support department is a bot, and the engineering department must be outsourced, since they haven't managed to do anything in the last week (and it is common for them to take weeks to address issues). I fear for anyone with domains still at Sav as the writing is on the wall...

They rely on newbies naive enough to register names with them as it seems they're happy to run their sham on a churn and burn model where domainers eventually see sense and move their names away.

 

[yb1313]

It'd be useful to have a summarized tldr of the above post, but even a glance and a bit of domaining experience is enough to know that SAV is the worst registrar in the world. So many domainers got their domains stolen in different ways by SAV's system, and more recently I saw a SAV hosted domain which was clearly abusive/phishy but their abuse report form doesn't even work i.e. it can't receive submissions due to an error on their end! So SAV clearly doesn't care, and should be reported to the organizations governing domain registrars and then probably outlawed...