Domains stolen: 495.com 9985.com 8870.com 8832.com, etc.

[vano]

Hello Members.

It seems the following and maybe other domain (I update here) has just been stolen from our enom.com account by some Chineese guy, i.e. they were pushed to other enom account "womenaini678" and then transfered to Godaddy.

Here they are the stolen domains:

495.com
9985.com
8870.com
8832.com
zrp.com
wmr.com
c5.net
xy.net

and maybe others, I'll update here. Please do not buy domains from this guy.

current whois details at Godaddy are as follows:

Registry Registrant ID:
Registrant Name: HAO REN
Registrant Organization: -
Registrant Street: ZHENDEHAO
Registrant City: REN
Registrant State/Province:
Registrant Postal Code: 421178
Registrant Country: China
Registrant Phone: +1.745434534
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]

so the domains are probably still at the same guy who stolen them.

I appreciate your help and advice to get the domains back, thanks.

Regards,

-Vano

 

[Keith]

Call Enom and Godaddy right away!

 

[tultseo]

Wow that sucks! Yeh contact them asap, anyways I have heard something about the same with the domain
lightly but the ownered recovered it, this might help: http://domaingang.com/domain-news/update-stolen-domain-lightly-com-recovered/

 

[vano]

Both enom and godaddy have been contacted, let see what they reply

-Vano

 

[sofiapartner]

wow - these are really high price domains. wish you luck in taking them back.

 

[vano]

Update 1: It seems we managed to find out how that all happened.

Most likely we had OK protection for the main account at eNom, i.e. a strong enough password, no malware on PC, etc.

However, we probably forgot about a single domain passwords, or whatever they call those passwords that are assigned to each domain.


We bought the mentioned domains from other guys and domain auctions (all about a year and more ago) and all the domains were originally at eNom and thus they were free-pushed to our enom account.


We did not realise that at eNom the single domain passwords might be passed to the destination account when the domain is free-pushed.

So, it seems we passed some easy-to-guess single domain passwords for each of the mentioned domains when we pushed the domains to our enom account, and the thiefs could guess those passwords via access.enom.com, than they changed whois and pushed domains to another enom.com account, and then they immediately transferred to Godaddy.

(it seems everything were completed within few min-hours)


Rhetorical Questions:

1). why enom.com did not put their 7 days hold between push to other account and transfer to other registrar?

2). is access.enom.com protected against password guessing attack?


Unfortunately, no meaningful updates from enom/godaddy so far..


Regards,

-Vano

 

[vano]

Update 2: the stolen domains have been returned back to the rightful owner.

Finally, we managed to get the stolen domains back, so starting from this point of time the mentioned below domains belong to the rightful (original) owner again.

495.com
8832.com
8870.com
9985.com
zrp.com
wmr.com
c5.net
xy.net

That was quite a long process of Domain Transfer dispute that involved working with eNom and Godaddy to have them recognize the fact of domains theft and to have them agree to initiate a transfer back.

So, the domains are finally back, please consider this case to be closed.

Thanks everybody for the assistence!

-Vano

 

[Maxwell]

Update 2: the stolen domains have been returned back to the rightful owner.

Finally, we managed to get the stolen domains back, so starting from this point of time the mentioned below domains belong to the rightful (original) owner again.

495.com
8832.com
8870.com
9985.com
zrp.com
wmr.com
c5.net
xy.net

That was quite a long process of Domain Transfer dispute that involved working with eNom and Godaddy to have them recognize the fact of domains theft and to have them agree to initiate a transfer back.

So, the domains are finally back, please consider this case to be closed.

Thanks everybody for the assistence!

-Vano

Good to hear! That is a valuable bundle of names right there.

 

[laladomains]

Great news vano. Good to hear!