advice Domain name theft

[BrandEntrance.com]

I just discovered that one of my domain names has been stolen (for want of a better word) and I just need to know what to do in this event.

The name was moved from one registrar to another without my permission and is under someone else's name.

The website is under my control and I have left some info there for the IIS (Swedish ICANN Country Reps) to see.

Any advice would be appreciated. I have a site under development there as I stated. This word is a hype word and was recently added to the Official Swedish Dictionary. I don't want to say the name of the site.

I know there are domain registrars here and I would really like to know how they deal with this.

 

[xynames]

Who has been paying the renewal fees each year since 2016?

 

[IPBFlippers]

If 2016 is showing as the date for registration and you bought the domain in 2018, then it might be an expired domain.

I bought one of my domain names in 2015 and it shows 2011 as the registration date on the whois record and way back machine.

This seems like an interesting case to follow up with since the name in question is a dictionary name.

 

[branding]

So is this another @ my domain was stolen @ thread at NP where nothing was stolen and in fact there is an alternate explanation? In this case here is the explanation that the OP never had clear title to it in the first place? he was never the bona fide owner?

Yeah that's probably the case. I definitely feel for him but if you weigh all options the most likely one is the registrar screwing up on their database allowing him to reg it and make changes to DNS while it was already regged by anotyer client of theirs. They probably merged clients after the ownership change which may have caused the issue.

If we'd look at this from a 'hackers' perspective, it would be way less trouble to hack a registrar compared to hacking the registry. I doubt going through the trouble of hacking IIS would be worth it for this particular domain.

@jamesall did you reach out to loopia to verify if they indeed have the name registered there since 2016?

 

[BrandEntrance.com]

Who has been paying the renewal fees each year since 2016?

You guys don't comprehend well.

The name can't have been registered at 2 DIFFERENT registrars and 2 DIFFERENT owners at the same time. (Src ICANN who I have a dialogue with).

Nobody paid any fees except me. The data from IIS looks compromised. Yes they will have to produce proof of renewals. I was going to do my first renewal. The name became a dictionary term AFTER my registratrion.

Put all the above in the hands of some unscrupulous thieves with access to the database at IIS, Loopia and so on with company ownership changing. Do you think there are no elaborate robberies in this country? Something stinks. I give you all my info and you say that I am wrong too. Remember, they are denying all support issues etc which may also have been deleted from their system. I have all the messages (legal documents in this country) saved and even 3rd party software company did an installation on the site.

This is like if someone had their car stolen and you saying... "It probably wasn't his car anyway. Case closed!".

Now I'm done on this subject.

 

[xynames]

Who has been paying the renewal fees each year since 2016?

Nobody paid any fees except me.

Sounds good, until he says

I was going to do my first renewal.

Which means, what? That he hadn’t paid any renewal fees yet (this was his “first renewal”) but was “going to?”

So, again,

Who has been paying the renewal fees each year since 2016?

 

[BrandEntrance.com]

Sounds good, until he says

Which means, what? That he hadn’t paid any renewal fees yet (this was his “first renewal”) but was “going to?”

So, again,

Yes I will try to type this slowly because I know you don't read so fast.

I was expecting a renewal email from the registrar and did not get one. Ok so far?

Then I contacted them to request a bill for the renewal. Keeping up?

Then it unrolled that the domain NEVER was mine, Had never been registered by me. Had never been at this registrar. How's it going? Need a short break?... ... ... ...

Then after 1 year of being the registered OWNER and HAVING AN ACTIVE SITE, the shit hit the fan.

Homework before replying: What is theft? What is changing data (on the inside or through hacking). Did a domain ever get stolen before? Can a domain be registered by 2 different registries and 2 different people at the same time?

If I send repo men to your house to reposess your car, you protest that it is, you paid for it registered it and have been using it all this time... and then the neighbor says to you "It wasn't you car anyway?" ... isn't he a bit like you?

 

[BrandEntrance.com]

Who has been paying the renewal fees each year since 2016?

N O B O D Y ! ! !. That data has been changed at IIS !!! It was never registered then.

Do any of you know what a database is and how to use one?

 

[BrandEntrance.com]

This is frustrating if people just add negative comments without actually reading what has happened.

If one of you get robbed I am not going to jump in and say "well maybe you are a thief and they are just taking back what is theirs!". Keep it real.

I registered a free domain and paid for it. Used it for a year. The whois data was about the day I regd it. Now the data is changed and my site and all that is now closed down. I HAVE LEGAL DOCUMENTS AND RECEIPTS and interactions with companies that prove it was mine.

Now do you understand?

 

[BrandEntrance.com]

Also I was called a thief by the registrar for stealing someone elses traffic.

They sold me the effin domain!!! If I am a thief then you are all theives as well with stolen domains. Every one of you. What do you mean you paid? That makes you a thief too according to the logic of some people replying here. Is this logical to state something like this? No. Now wise up.

Please understand that I came here to get advice not to be treated like a thief again.

Refresher course in simple economics:
https://en.wikipedia.org/wiki/Financial_transaction

 

[branding]

N O B O D Y ! ! !. That data has been changed at IIS !!! It was never registered then.

Do any of you know what a database is and how to use one?

Uhm yes... I've been working on databases my entire life.

As you're an Linux admin yourself, wouldn't you say it's more likely for the registrar to get hacked than it is for the registry to get hacked if a hack happened?

Anyway, your registrar definitely does have some DB sync issues as I signed up, moved a domain, cancelled an invoice and the domain was still there in my account although it was actually not registered. Couldn't make changes to the DNS though.

They are a namesrs reseller, loopia is not so the issue is probably at your registrar or namesrs.

Unless ofcourse IIS did get hacked but I can see no public trace that supports that statement.

Your generated invoice should be proof of your buy and I think you actually did buy the name but due to a glitch in the back end you were able to reg it.

Where did you perform the domain check when you ordered it? At the registrar?

Glitches like this do happen. I once ended up with a single letter .org on namecheap. In cases like this the domain is not actually registered by 2 people at the same time.

I also remember that case where someone owned google.com for a short while due to a backend glitch.

 

[branding]

This is frustrating if people just add negative comments without actually reading what has happened.

If one of you get robbed I am not going to jump in and say "well maybe you are a thief and they are just taking back what is theirs!". Keep it real.

I registered a free domain and paid for it. Used it for a year. The whois data was about the day I regd it. Now the data is changed and my site and all that is now closed down. I HAVE LEGAL DOCUMENTS AND RECEIPTS and interactions with companies that prove it was mine.

Now do you understand?

Chill man. Like I said. There's a good possibility you actually did reg it due to a back end error. So I can get you're pissed off.

Nobody's calling you a thief though. Maybe the registrar did but over here nobody is accusing you of anything. I actually spend some cash to check out your story as if what you claim is to be true the entire .se root would be compromised and that would put over 1K of domains I handle at danger.

 

[xynames]

What you’re saying NameDeck, which is same thing I’m getting at, is that he possibly never had clear title to the domain. He never paid any fees (even though he keeps talking about “payments”). Apparently, he doesn’t have “receipts” (plural) because all that happened was one single transaction where he received control of the domain.

As far as that the domain didn’t exist other than for the one year that he had control of it, that’s conjecture not fact.

Anyway the simple explanation is that the domain belongs to someone else that someone being whoever registered it at some prior date - apparently 2016 - and OP’s “registration” wasn’t a registration of a new domain but rather his picking up what was already registered but not actually expired.

The other explanation is the one offered by OP that there was some vast conspiracy to backdate creation date of the domain and that no one has been paying fees or holding title on the domain since 2016.

 

[branding]

What you’re saying NameDeck, which is same thing I’m getting at, is that he possibly never had clear title to the domain. He never paid any fees (even though he keeps talking about “payments”). Apparently, he doesn’t have “receipts” (plural) because all that happened was one single transaction where he received control of the domain.

As far as that the domain didn’t exist other than for the one year that he had control of it, that’s conjecture not fact.

Anyway the simple explanation is that the domain belongs to someone else that someone being whoever registered it at some prior date - apparently 2016 - and OP’s “registration” wasn’t a registration of a new domain but rather his picking up what was already registered but not actually expired.

The other explanation is the one offered by OP that there was some vast conspiracy to backdate creation date of the domain and that no one has been paying fees or holding title on the domain since 2016.

Yes, we're on the same page here. I'm not saying the OP has no reason to be pissed off, I know I would be in this scenario but just like you I tend to be looking for the easiest, more logical explanation.

I also take into account the value of the name. If I were to run some elaborate scheme to hack a registry I sure as hell wouldn't target this domain. It's not worth the risk. It might have been the case if I targeted a fair lot of good (not amazing, super premium as that wouldn't go unnoticed) but eventually it would get noticed and I'm sure any registry that would be compromised to this extend would be trending news in no time, especially if it concerns a well established ccTLD like .se.

Op sent me some screenshots from a chat he had with the support. They basically accused him, which usually a support guy won't degrade himself too. I was a pain in the ass this day to their support (same people) and they have been nothing but friendly and accommodating.

I'd love to see a full transcript of that chat to know on what facts their support based their claims so if OP is willing to share them in private I'm willing to review their stance.

Thing is, there's no real solution to this case that OP may find to be satisfactory.

If IIS really was hacked and there's some elaborate scheme going on, suing seems to be the only option. If OP really has the proof he claims he has it's an easy win though and would 100% result in him getting the domain back. Any sane lawyer would take that case. If OP really has the proof he claims he has that is.

If it was registered to him in error while already registered by someone else, sure, the registrar is to blame but he would not have any legal claim to the name, just like xynames stated before.

 

[Brian L.]

I just discovered that one of my domain names has been stolen (for want of a better word) and I just need to know what to do in this event.

The name was moved from one registrar to another without my permission and is under someone else's name.

The website is under my control and I have left some info there for the IIS (Swedish ICANN Country Reps) to see.

Any advice would be appreciated. I have a site under development there as I stated. This word is a hype word and was recently added to the Official Swedish Dictionary. I don't want to say the name of the site.

I know there are domain registrars here and I would really like to know how they deal with this.

Did you ever figure out what happened?

 

[BrandEntrance.com]

Update:

I got the domain name back again!

And... yes I paid all fees for the domain when I had it originally etc. What the heck do you guys expect? Anyway I got it back and the matter is closed.

It is my domain!!!

 

[branding]

Update:

I got the domain name back again!

And... yes I paid all fees for the domain when I had it originally etc. What the heck do you guys expect? Anyway I got it back and the matter is closed.

It is my domain!!!

Glad it worked out. Hope you don't mind me asking... What happened that caused this mess?

Whois shows it was dropped and re-registered...

 

[BrandEntrance.com]

Glad it worked out. Hope you don't mind me asking... What happened that caused this mess?

Whois shows it was dropped and re-registered...

PM

 

[Sheogorath]

Update:

I got the domain name back again!

And... yes I paid all fees for the domain when I had it originally etc. What the heck do you guys expect? Anyway I got it back and the matter is closed.

It is my domain!!!

Congratulations
It is a sad truth that domains are not 100% safe and there is the possibility that they can be stolen.
Hopefully, such a thing will not occur again.

Note: It is always great to have two factor authentication enabled as a second layer of security.
This can dramatically lower the chances of someone hacking to registrant's account.

 

[lock]

I seen this before..... Move your domains to a company that will stick around eg godaddy. This sounds like a total stitch up had domains transferred to another yup been there lost that.