Best practices for recovering the stolen domain ghh.com?

[Gerard Hughes]

As some may have seen on domaingang, my 19 year old personal website and email domain, ghh.com, was stolen on 4/7/17. (My registration was paid through 2021.) I'm looking for some best practices for getting it returned. I've read the interview with David Weslow on domainsherpa and have been working to get a bit of a crash course on security and domain crime.

The hacker got access to my ICANN account of record, transferred the domain to eNom, and proceeded to attempt to negotiate sales in my name using the hacked account while the domain is on 60 day ICANN lock.

I've since recovered the email account, but getting the registrars to reverse this rather obvious case of transfer fraud is something I'm still working on. It's frustrating that ICANN, in effect, pretends to consider temporary access to, say, my car keys as proof of permanent legal title to my car. That's simply false as a matter of law. So it is surprising to me that the transfer has not been reversed already, especially given that the hacker clearly has violated their terms of service, has no legal title to the domain, cannot indemnify the registrar, and cannot show up in court to defend this fraud. So, from even just an ordinary risk management perspective, I'd have thought the receiving registrar would be eager to avoid the costs and liabilities of not returning the domain.

Does anyone have suggestions on the best was to communicate to the registrars that it will be most cost effective for them to return it without protracting the issue? Or, for that matter, the best way to communication the the registrars? So far, the responses have been less, well, responsive, than I'd hoped.

 

[Gerard Hughes]

Basically - it's a calculated decision on whether it will work to use a process to recover a domain when that process was never really intended for that use. How much of a mark does GHH really have though?

ghh.com as used by me, is not a registered mark. It is, in my opinion, a common law mark. I'm interested into making it into a firm, registered mark going forward. But I haven't really gotten much interest in the thread I started asking about that. Not sure if it is just a dull topic, or if I presented it poorly.

 

[DU]

I'm interested into making it into a firm, registered mark going forward

But you must have a real commercial use or have intent to use (and intent is not open-ended, it has to be real).
The reasons for filing a TM that should be to register a TM - the domain would just come along for the ride if it was associated by name.

personal website and email domain

is not a registered mark. It is, in my opinion, a common law mark

A personal website doesn't sound like any kind of commercial interest.

Not sure if it is just a dull topic, or if I presented it poorly.

Most people are here trying to flog names.

You've found @Kate and @jberryhill who are the two people I would trust most on this forum. Hopefully, you've at least formulated an approach to getting the name back. The whole situation stinks.

 

[Gerard Hughes]

But you must have a real commercial use or have intent to use (and intent is not open-ended, it has to be real).
The reasons for filing a TM that should be to register a TM - the domain would just come along for the ride if it was associated by name.

That was something I didn't fully articulate, I would consider working to emphasize a qualifying commercial use to be part of establishing ghh.com as clear mark going forward.

 

[WalletControl]

Ouch. I wish them well in recovering this as quickly, easily and cheaply as possible. Just a wild guess that recovering from 22net will be a challenge.

Any good news about GHH.com?

 

[Gerard Hughes]

I'll post more on the disposition of ghh.com going forward.

In the meantime...

I'm moving some of my other domains out of the registrar that lacks 2-factor authentication. And as a domain transferring neophyte who has benefited greatly from what I thought was a tough, new mandatory ICANN 60 lock, I came across an "opt out" box for the 60 day lock. Is the 60 day theft prevention lock entirely **voluntary**? If so, what the heck?