Domain Auction Security

[LucidDomains]

Someone just tried to add a very nice domain to GoDaddy Auctions. I received an auction authorization link asking me to confirm. But what I'm a little concerned with is the email I received from GoDaddy.


To avoid this confirmation step on future auction listings, transfer your domains to GoDaddy. You'll get:

• Automatic approval when listing your domain names at auction
• Simple, one-step transfer of sold domains to the auction winner
• Free one-year extension on each domain name you transfer

So someone fraudulently added my domain to auction but thankfully my domain is located at NameSilo but if my domain was located at GoDaddy, this domain could have been auto added to auction without my consent just because some idiot on the other side of the world decides to add it? And if they set a BIN of $1 and they can buy it?

I don't understand what's going on here. This can't be how it is.

This ability for GoDaddy to act on your behalf by removing domains out of your account and auto authorizing domain auctions is the one of the main reasons I'm moving away from them.

Is it possible if this domain was at GD, this idiot could set up an auction, GoDaddy auto approves, idiot buys it for $1, GD automatically moves the domain into his account. Idiot transfers away.

This can't be how it is right?

Can you shed any light on this, @Joe Styler, it would be appreciated.

 

[MasterOfMyDomains]

Very concerning, thanks for bringing this to attention, looking forward to Joe's reply

 

[Joe Styler]

When you list a domain name for sale we verify ownership of the domain. If you have the domain name registered at GoDaddy it is easy enough to do that. If you have the domain name registered elsewhere using privacy say, we do not know who the owner is. If you are trying to list the domain for sale we email the whois contact and ask, is this you trying to list this domain? If you answer that it is you then we list it. It would be possible for you to agree to list a domain name for sale if you are just clicking through screens and not reading what we sent you and are asking you to do, but as you did read it you didn't list it for sale. We don't have people randomly agreeing to sell their domains that they don't want to list for sale. We also would not be able to automatically move a domain name that someone tries to pretend is theirs. The only names we are not sure of ownership on are those not registered with GoDaddy, we cannot move domains from other companies to us with out the owner's transferring them into us any more than you could. We only auto move names registered with us, which we verify ownership of in a completely different way.
So the only way for this to work would be you agreeing to sell your name without reading any of what you are clicking, the name to sell and then you unlocking the domain where it is, and sending the buyer transfer codes.

 

[LucidDomains]

When you list a domain name for sale we verify ownership of the domain. If you have the domain name registered at GoDaddy it is easy enough to do that. If you have the domain name registered elsewhere using privacy say, we do not know who the owner is. If you are trying to list the domain for sale we email the whois contact and ask, is this you trying to list this domain? If you answer that it is you then we list it. It would be possible for you to agree to list a domain name for sale if you are just clicking through screens and not reading what we sent you and are asking you to do, but as you did read it you didn't list it for sale. We don't have people randomly agreeing to sell their domains that they don't want to list for sale. We also would not be able to automatically move a domain name that someone tries to pretend is theirs. The only names we are not sure of ownership on are those not registered with GoDaddy, we cannot move domains from other companies to us with out the owner's transferring them into us any more than you could. We only auto move names registered with us, which we verify ownership of in a completely different way.
So the only way for this to work would be you agreeing to sell your name without reading any of what you are clicking, the name to sell and then you unlocking the domain where it is, and sending the buyer transfer codes.

Hi Joe, thanks for the reply. You basically talk a lot around the question but only vaguely answered the question in one sentence bit like a politician.

We only auto move names registered with us, which we verify ownership of in a completely different way.

So if I have a domain with you, lets say Cars.com and someone else adds this to auction. You system will auto add this domain to auction without my permission. Is this correct?

What is the auto-verification check if some random person adds Cars.com to GoDaddy Auction?

Thanks

 

[Joe Styler]

Incorrect, if you have cars.com registered with us and someone else tried to list it it would not allow them to. That was my point you cannot list a name for sale on auctions if it is registered at GoDaddy and you do not own it. Those are the only names sold at auction to auto move to the buyer. Names registered with GoDaddy.
Names registered elsewhere, like your name at Namesilo cannot auto move to the buyer. Those names the owner would have to both OK via opting them in through the email you received, and then after a sale unlock and provide transfer codes. I am unaware of this ever happening in my 8 years in the Aftermarket at GoDaddy. Most people won't opt in a name they didn't list for sale in the first place, and even if they made that mistake will not just unlock the domain and move it to someone else.

 

[LucidDomains]

Okay thanks, in the event I accidently click this link and the domain (located at GD) then sells for $1. You would then auto move the domain into the buyer's account.

Is that correct?

 

[LucidDomains]

Afternic calls it "Fast Transfer", I'm sure it's the same thing.

Is their a way of opting out of it for my entire account?

 

[Joe Styler]

Okay thanks, in the event I accidently click this link and the domain (located at GD) then sells for $1. You would then auto move the domain into the buyer's account. Is that correct?

No that is incorrect. A domain name registered at GoDaddy will not send you a link to click to activate it on the auctions. We don't need to take an extra step to have you verify you are listing the domain name for sale if it is with us, we know who owns it, we don't have to ask the owner on the whois.

 

[LucidDomains]

Okay thank you.

I may try listing someone else's GoDaddy domain on GoDaddy auctions and seeing what error message I get.

Thanks for your assistance on this matter.

 

[Bram C.]

As @Joe Styler already pointed out it's really simple:

1. If the domain is not registered at Godaddy and you wish to list in on Godaddy auctions Godaddy will send a confirmation link to the owner of the domain. If you're the owner then clicking the link will activate the listing. If you're not the owner you will never get the confirmation link and you won't be able to list the domain (unless of course you hacked into this email account).

2. If the domain is registered at Godaddy and you wish to list it on Godaddy auction it can only be done if you're the owner of the domain (Godaddy will auto-verify that you're the owner). If you're not the owner and you try to list a domain that is registered at Godaddy you will get a nice error message such as "Domain is not allowed for Premium Listing."

 

[LucidDomains]

Thanks for reiterating it @Bram C.

 

[LucidDomains]

So from what I gathered it is...

You need to be logged in to list an domain auction. Then GD checks which domains you have in your account and when you try to add a domain, it performs an auto-verification check then and there to see if the requested domain is actually in your account. If the domain is not in your account, you get an error message.

I haven't seen this error message, but I'll take you word on it for now.

Thank you all for putting my mind at ease.