advice Domain name theft

[BrandEntrance.com]

I just discovered that one of my domain names has been stolen (for want of a better word) and I just need to know what to do in this event.

The name was moved from one registrar to another without my permission and is under someone else's name.

The website is under my control and I have left some info there for the IIS (Swedish ICANN Country Reps) to see.

Any advice would be appreciated. I have a site under development there as I stated. This word is a hype word and was recently added to the Official Swedish Dictionary. I don't want to say the name of the site.

I know there are domain registrars here and I would really like to know how they deal with this.

 

[dirk]

That is redirecting to FSData... it's looking for home becuase it can't find an index.php file there for a site, because I hadn't built it yet, and therefore redirects to the registrars main page. That is how that is set up with them. Proof that I had it registered there. They only removed the domainname yesterday and with that... access to the site. They have log files. I have screen dumps witnesses, support errands with them and others regarding the site, database software incompatibility and upgrades etc. and an installation from a 3rd party company. Plus my payments, registration emails etc.

About 50 emails on the subject of this site beck and forth with their support.

ok, well as there's publicly no data to support this and there are no trails to be found I'm not sure what you can do. Archive.org only indexed one page which is late 2018. If the website was developed I find it hard to believe there's only one indexed page.

Anyway, as you seem to be certain of your case and it hasn't been regged before 2018 all I can suggest to you is to get in touch with the ombudsman and maybe a lawyer.

Like I said, I have been dealing with IIS as a registry for like 2 decades and never had any issues. If what you're claiming is true it would be a big deal as they have a proven track record of reliability.

also, you sent me some screenshots where you were the domain was using a SSL cert. in order for that to work there must have been some domains verification against an ip address. see if you can find that in your browser and save it for future reference. it may act as proof.

 

[dirk]

the weird part is, you apparently have been able to control the domain without owning it. My best guess is the registrar messed up. allowed you to register the domain while it has already been in possession of another client. maybe due to a merge of databases after the ownership change of the company.

there simply has to be more to the story. Your screens seem legit but I find it hard to believe IIS got hacked to this degree for this particular domain.

Anyway. I don't think there is anything others can do for you. You should definitely press your registrar for further explanation if you have proof of billing etc etc.

 

[BrandEntrance.com]

there simply has to be more to the story. Your screens seem legit but I find it hard to believe IIS got hacked to this degree for this particular domain.

Never underestimate thieves ... or the stupidity of thieves.

 

[xynames]

My best guess is the registrar messed up. allowed you to register the domain while it has already been in possession of another client.

there simply has to be more to the story.

So is this another @ my domain was stolen @ thread at NP where nothing was stolen and in fact there is an alternate explanation? In this case here is the explanation that the OP never had clear title to it in the first place? he was never the bona fide owner?

 

[BrandEntrance.com]

So is this another @ my domain was stolen@ thread at NP where nothing was stolen and in fact there is an alternate explanation? In this case here is the explanation that the OP never had clear title to it in the first place? he was never the bona fide owner?

Because nothing ever got stolen before right?

 

[xynames]

Who has been paying the renewal fees each year since 2016?

 

[IPBFlippers]

If 2016 is showing as the date for registration and you bought the domain in 2018, then it might be an expired domain.

I bought one of my domain names in 2015 and it shows 2011 as the registration date on the whois record and way back machine.

This seems like an interesting case to follow up with since the name in question is a dictionary name.

 

[dirk]

So is this another @ my domain was stolen @ thread at NP where nothing was stolen and in fact there is an alternate explanation? In this case here is the explanation that the OP never had clear title to it in the first place? he was never the bona fide owner?

Yeah that's probably the case. I definitely feel for him but if you weigh all options the most likely one is the registrar screwing up on their database allowing him to reg it and make changes to DNS while it was already regged by anotyer client of theirs. They probably merged clients after the ownership change which may have caused the issue.

If we'd look at this from a 'hackers' perspective, it would be way less trouble to hack a registrar compared to hacking the registry. I doubt going through the trouble of hacking IIS would be worth it for this particular domain.

@jamesall did you reach out to loopia to verify if they indeed have the name registered there since 2016?

 

[BrandEntrance.com]

Who has been paying the renewal fees each year since 2016?

You guys don't comprehend well.

The name can't have been registered at 2 DIFFERENT registrars and 2 DIFFERENT owners at the same time. (Src ICANN who I have a dialogue with).

Nobody paid any fees except me. The data from IIS looks compromised. Yes they will have to produce proof of renewals. I was going to do my first renewal. The name became a dictionary term AFTER my registratrion.

Put all the above in the hands of some unscrupulous thieves with access to the database at IIS, Loopia and so on with company ownership changing. Do you think there are no elaborate robberies in this country? Something stinks. I give you all my info and you say that I am wrong too. Remember, they are denying all support issues etc which may also have been deleted from their system. I have all the messages (legal documents in this country) saved and even 3rd party software company did an installation on the site.

This is like if someone had their car stolen and you saying... "It probably wasn't his car anyway. Case closed!".

Now I'm done on this subject.

 

[xynames]

Who has been paying the renewal fees each year since 2016?

Nobody paid any fees except me.

Sounds good, until he says

I was going to do my first renewal.

Which means, what? That he hadn’t paid any renewal fees yet (this was his “first renewal”) but was “going to?”

So, again,

Who has been paying the renewal fees each year since 2016?

 

[BrandEntrance.com]

Sounds good, until he says

Which means, what? That he hadn’t paid any renewal fees yet (this was his “first renewal”) but was “going to?”

So, again,

Yes I will try to type this slowly because I know you don't read so fast.

I was expecting a renewal email from the registrar and did not get one. Ok so far?

Then I contacted them to request a bill for the renewal. Keeping up?

Then it unrolled that the domain NEVER was mine, Had never been registered by me. Had never been at this registrar. How's it going? Need a short break?... ... ... ...

Then after 1 year of being the registered OWNER and HAVING AN ACTIVE SITE, the shit hit the fan.

Homework before replying: What is theft? What is changing data (on the inside or through hacking). Did a domain ever get stolen before? Can a domain be registered by 2 different registries and 2 different people at the same time?

If I send repo men to your house to reposess your car, you protest that it is, you paid for it registered it and have been using it all this time... and then the neighbor says to you "It wasn't you car anyway?" ... isn't he a bit like you?

 

[BrandEntrance.com]

Who has been paying the renewal fees each year since 2016?

N O B O D Y ! ! !. That data has been changed at IIS !!! It was never registered then.

Do any of you know what a database is and how to use one?

 

[BrandEntrance.com]

This is frustrating if people just add negative comments without actually reading what has happened.

If one of you get robbed I am not going to jump in and say "well maybe you are a thief and they are just taking back what is theirs!". Keep it real.

I registered a free domain and paid for it. Used it for a year. The whois data was about the day I regd it. Now the data is changed and my site and all that is now closed down. I HAVE LEGAL DOCUMENTS AND RECEIPTS and interactions with companies that prove it was mine.

Now do you understand?

 

[BrandEntrance.com]

Also I was called a thief by the registrar for stealing someone elses traffic.

They sold me the effin domain!!! If I am a thief then you are all theives as well with stolen domains. Every one of you. What do you mean you paid? That makes you a thief too according to the logic of some people replying here. Is this logical to state something like this? No. Now wise up.

Please understand that I came here to get advice not to be treated like a thief again.

Refresher course in simple economics:
https://en.wikipedia.org/wiki/Financial_transaction

 

[dirk]

N O B O D Y ! ! !. That data has been changed at IIS !!! It was never registered then.

Do any of you know what a database is and how to use one?

Uhm yes... I've been working on databases my entire life.

As you're an Linux admin yourself, wouldn't you say it's more likely for the registrar to get hacked than it is for the registry to get hacked if a hack happened?

Anyway, your registrar definitely does have some DB sync issues as I signed up, moved a domain, cancelled an invoice and the domain was still there in my account although it was actually not registered. Couldn't make changes to the DNS though.

They are a namesrs reseller, loopia is not so the issue is probably at your registrar or namesrs.

Unless ofcourse IIS did get hacked but I can see no public trace that supports that statement.

Your generated invoice should be proof of your buy and I think you actually did buy the name but due to a glitch in the back end you were able to reg it.

Where did you perform the domain check when you ordered it? At the registrar?

Glitches like this do happen. I once ended up with a single letter .org on namecheap. In cases like this the domain is not actually registered by 2 people at the same time.

I also remember that case where someone owned google.com for a short while due to a backend glitch.

 

[dirk]

This is frustrating if people just add negative comments without actually reading what has happened.

If one of you get robbed I am not going to jump in and say "well maybe you are a thief and they are just taking back what is theirs!". Keep it real.

I registered a free domain and paid for it. Used it for a year. The whois data was about the day I regd it. Now the data is changed and my site and all that is now closed down. I HAVE LEGAL DOCUMENTS AND RECEIPTS and interactions with companies that prove it was mine.

Now do you understand?

Chill man. Like I said. There's a good possibility you actually did reg it due to a back end error. So I can get you're pissed off.

Nobody's calling you a thief though. Maybe the registrar did but over here nobody is accusing you of anything. I actually spend some cash to check out your story as if what you claim is to be true the entire .se root would be compromised and that would put over 1K of domains I handle at danger.

 

[xynames]

What you’re saying NameDeck, which is same thing I’m getting at, is that he possibly never had clear title to the domain. He never paid any fees (even though he keeps talking about “payments”). Apparently, he doesn’t have “receipts” (plural) because all that happened was one single transaction where he received control of the domain.

As far as that the domain didn’t exist other than for the one year that he had control of it, that’s conjecture not fact.

Anyway the simple explanation is that the domain belongs to someone else that someone being whoever registered it at some prior date - apparently 2016 - and OP’s “registration” wasn’t a registration of a new domain but rather his picking up what was already registered but not actually expired.

The other explanation is the one offered by OP that there was some vast conspiracy to backdate creation date of the domain and that no one has been paying fees or holding title on the domain since 2016.

 

[dirk]

What you’re saying NameDeck, which is same thing I’m getting at, is that he possibly never had clear title to the domain. He never paid any fees (even though he keeps talking about “payments”). Apparently, he doesn’t have “receipts” (plural) because all that happened was one single transaction where he received control of the domain.

As far as that the domain didn’t exist other than for the one year that he had control of it, that’s conjecture not fact.

Anyway the simple explanation is that the domain belongs to someone else that someone being whoever registered it at some prior date - apparently 2016 - and OP’s “registration” wasn’t a registration of a new domain but rather his picking up what was already registered but not actually expired.

The other explanation is the one offered by OP that there was some vast conspiracy to backdate creation date of the domain and that no one has been paying fees or holding title on the domain since 2016.

Yes, we're on the same page here. I'm not saying the OP has no reason to be pissed off, I know I would be in this scenario but just like you I tend to be looking for the easiest, more logical explanation.

I also take into account the value of the name. If I were to run some elaborate scheme to hack a registry I sure as hell wouldn't target this domain. It's not worth the risk. It might have been the case if I targeted a fair lot of good (not amazing, super premium as that wouldn't go unnoticed) but eventually it would get noticed and I'm sure any registry that would be compromised to this extend would be trending news in no time, especially if it concerns a well established ccTLD like .se.

Op sent me some screenshots from a chat he had with the support. They basically accused him, which usually a support guy won't degrade himself too. I was a pain in the ass this day to their support (same people) and they have been nothing but friendly and accommodating.

I'd love to see a full transcript of that chat to know on what facts their support based their claims so if OP is willing to share them in private I'm willing to review their stance.

Thing is, there's no real solution to this case that OP may find to be satisfactory.

If IIS really was hacked and there's some elaborate scheme going on, suing seems to be the only option. If OP really has the proof he claims he has it's an easy win though and would 100% result in him getting the domain back. Any sane lawyer would take that case. If OP really has the proof he claims he has that is.

If it was registered to him in error while already registered by someone else, sure, the registrar is to blame but he would not have any legal claim to the name, just like xynames stated before.

 

[Brian L.]

I just discovered that one of my domain names has been stolen (for want of a better word) and I just need to know what to do in this event.

The name was moved from one registrar to another without my permission and is under someone else's name.

The website is under my control and I have left some info there for the IIS (Swedish ICANN Country Reps) to see.

Any advice would be appreciated. I have a site under development there as I stated. This word is a hype word and was recently added to the Official Swedish Dictionary. I don't want to say the name of the site.

I know there are domain registrars here and I would really like to know how they deal with this.

Did you ever figure out what happened?

 

[BrandEntrance.com]

Update:

I got the domain name back again!

And... yes I paid all fees for the domain when I had it originally etc. What the heck do you guys expect? Anyway I got it back and the matter is closed.

It is my domain!!!