eNom & Possible hacking problem!

[wisconsin]

Hello members,

This is the 5th time, while checking my enom account, I found that some of my domains have been "re-directed" to a "domainsponsor.com affilliate without my knowledge. They are re-directed to this affiliate member:

http://landing.domainsponsor.com/?a_id=1637&domainname


Please note that I have not purchased these domains from anyone and had them re-directed to my site instead, before.

I have not contacted domainsponsor.com nor enom.com , yet!

I went a head and changed my enom account, including passwords.

I was wondering if any of you had experienced anything like this.

Thanks

 

[.edu]

its enoms way of generating a little revenue on the side. if you are using enom name servers and you dont specify a record then thats what ends up happening. I think thats the defaul now on all reg domains. there/

 

[MissFlora]

So enom generate revenue from domainsponsor as well? I didn't know that, seems like it is time to go and check my enom acct.

 

[RJ]

Interesting. Do you have a enom retail or reseller account?

Enom wouldn't (or shouldn't) be changing anything on your domains. I would wonder if it's your parent reseller if you have one.

 

[spikedo]

Yea, I was wondering if he has a reseller account also. If so, the person who created it has access to his account and could change the DNS info.

 

[wisconsin]

Interesting. Do you have a enom retail or reseller account?

Enom wouldn't (or shouldn't) be changing anything on your domains. I would wonder if it's your parent reseller if you have one.

I understand but I am the "reseller" and I don't use and have never used domainsponsor.com

 

[rabid_nerd]

I am an ETP and if I don't set up DNS/forwarding they also go to eNom's revenue generation pages.

I probably can set default DNS but my API script does that for any I sell @ retail.

 

[wisconsin]

I contacted enom support. Here is their anwser:

Hello,
Sorry but there is nothing we can do to track this, if it does happen again please don't correct one of the domains so we can take a look at it. You may want to try contacting domainsponsor.com and try to find out who has the id 1637. It seems that they may be the one responsabe for the changes.

 

[RJ]

I understand but I am the "reseller" and I don't use and have never used domainsponsor.com

Check the default settings for your account.
-> http://www.enom.com/myaccount/Settings.asp?tab=default (must be logged into enom)

Still I would have to wonder who your parent reseller is. Who did you get your account from? Direct from eNom or from somewhere else? Do you have an account where it's requried to deposit $100 to fill your account?

 

[wisconsin]

Check the default settings for your account.
-> http://www.enom.com/myaccount/Settings.asp?tab=default (must be logged into enom)

Still I would have to wonder who your parent reseller is. Who did you get your account from? Direct from eNom or from somewhere else? Do you have an account where it's requried to deposit $100 to fill your account?

Hi Rj,

directly from enom.

 

[wisconsin]

Hi RJ,
I just checked the default settings for my account and the default option is set to address: 63.251.163.115 for all of them!

 

[MissFlora]

Internap Network Services NETBLK-PNAP-11-99 (NET-63-251-0-0-1)
63.251.0.0 - 63.251.255.255
eNom PNAP-SEF-ENOM-RM-03 (NET-63-251-163-96-1)
63.251.163.96 - 63.251.163.127

It is enom's ip. And my account has that as default too. Don't know how come you have domainsponsor..but sure traceable who knows id 1637.

 

[eSology]

eNom does use domainsponsor and another service for default parked domains. Before I changed the default settings anyone who registered a domain through my PDQ site would also have their domains forwarded to a parked PPC page (run by eNom).

 

[MissFlora]

Does that apply to reseller account, retail account or both?

 

[eSology]

Does that apply to reseller account, retail account or both?

I am an ETP and it does it by "default" to my domains as well as those in my PDQ. You need to go in and set a different A record so eNom doesn't benefit by a parked page. In my case I just recently setup a static IP on my server that I use for this vice using eNom's.

 

[Grrilla]

I had the same problem w/ some names that were backordered at Pool, where I did not change the name servers or redirect, (my bad). Additionally, this was a name that was picked up by one of Pools partners and is still w/ that registrar.
One is still there for you to see, although I will be changing it later this afternoon.
http://4md.net/

 

[wisconsin]

I had the same problem w/ some names that were backordered at Pool, where I did not change the name servers or redirect, (my bad). Additionally, this was a name that was picked up by one of Pools partners and is still w/ that registrar.
One is still there for you to see, although I will be changing it later this afternoon.
http://4md.net/

Hi,
I did not buy those domains from someone but directly registered them in my reseller account and changed the DNS to re-direct them to my website.

 

[wisconsin]

eNom does use domainsponsor and another service for default parked domains. Before I changed the default settings anyone who registered a domain through my PDQ site would also have their domains forwarded to a parked PPC page (run by eNom).

I have contacted eNom and and asked if they ever use domainsponsor.com for parking or as an affilliate. I asked them if they ever had a working relationship with them or anything! Here is the answer from enom this morning:

"As far as I can tell wed do not use domainsponsor.com for our parking pages."

 

[Grrilla]

Hi,
I did not buy those domains from someone but directly registered them in my reseller account and changed the DNS to re-direct them to my website.

Oh. That really is bad. Actual hijacking of your redirects.