question Domain got put on hold by Verisign without a single email

[PAKB]

Hello , I hand regged a domain EXXEE.com on 2019-10-21 at dynadot , Same domain was approved on SH as premium listing , I changed NS to SH back then but today when my domain got delisted at Squadhelp (Due to changed nameservers) , I contacted dynadot immediately and asked how my NS were changed without my permission.
Dynadot let me know that domain got on hold by verisign , I didn't got any email from registery or dynadot before about this ...What could be issue and how can i get domain back ?

Here is reply from dynadot

 

[Silentptnr]

Only thing I see is that the domain was owned by Huge Domains..
https://web.archive.org/web/2018011...edomains.com/domain_profile.cfm?d=exxee&e=com

Dynadot and others currently show it as a premium for sale at $4999

Maybe read this...
https://domainnamewire.com/2018/09/18/domain-name-sinkhole/

 

[jmcc]

According to your stats - where are most victims, can you post TOP5 registrars?

The historical stats are hoster based rather than registrar based. Would have to go back over the transfers from other hosters for the inbound transfers.

Regards...jmcc

 

[jmcc]

Only thing I see is that the domain was owned by Huge Domains..
https://web.archive.org/web/2018011...edomains.com/domain_profile.cfm?d=exxee&e=com

Dynadot and others currently show it as a premium for sale at $4999

Maybe read this...
https://domainnamewire.com/2018/09/18/domain-name-sinkhole/

It is an unusual domain name. It was tasted in the past but had been relatively stable (hosted on the same hoster for a few years (1&1). Then it appeared on a Chinese hoster and then Namebright. Huge Domains has its own nameservers but has also used those of other registrars.

http://www.hosterstats.com/historicaldns.php?domain=EXXEE.com

The longevity of the registrations prior to the domain name appearing on the Squad Help nameservers is unusual for an intentional malware registration (dom regged purely for malware with stolen cc details) unless the domain name was a long-term Wordpress link injection compromise (I've seen some compromised WP sites go for five years or more with the same compromise in various web usage surveys. This registration looks like it could have been sinkholed on detection. There is a lag between registration and sinkholing which is quite odd but if there's any underlying legal action, that would introduce a delay.

Regards...jmcc

 

[Jurgen Wolf]

https://www.shadowserver.org/common-questions/
OP, here it is stated that they provide reports for the domain owners - so contact them...

 

[jmcc]

These are the top December 2019 transfers (first of month):
| DOMAINCONTROL.COM | 139 |
| DNS.COM | 120 |
| HICHINA.COM | 57 |
| DNSPOD.NET | 30 |
| DNSDUN.COM | 26 |
| DNSDUN.NET | 26 |
| BUYDOMAINS.COM | 23 |
| THIS-DOMAIN-FOR-SALE.COM | 23 |
| WORLDNIC.COM | 20 |
| UNIREGISTRYMARKET.LINK | 18 |
| REGISTRAR-SERVERS.COM | 18 |
| AFTERNIC.COM | 15 |
| CLOUDFLARE.COM | 15 |
| DNSOWL.COM | 14 |
| NAMEFIND.COM | 13 |
| UI-DNS.DE | 10 |

There's 468 5L .COM, 70 .NET, domain names in the transfers list so the exxee.com sinkholding was not an isolated incident. There are also 316 new .COM registrations and 24 of them are 5L.

Regards...jmcc

 

[Jurgen Wolf]

Looks that GoDaddy and CN registrars are leading...

 

[jmcc]

Looks that GoDaddy and CN registrars are leaders...

Yep. Apart from the 5Ls and obvious random strings, there seems to be some ordinary looking domain names too.

Regards...jmcc

 

[ksusha64]

May need a lawyer for this one. Good luck!