alert Epik Had A Major Breach

[DaveX]

Just read this. Looks like Epik may have been hacked and sensitive data compromised...

Read here:
https://domainnamewire.com/2021/09/14/hackers-claim-significant-epik-breach/

Thought I would share this.

 

[.X.]

One time I was curious about the process, so I inquired via the landing page about a domain of mine that had expired a few days earlier (meaning, it would still be under my control for several weeks). Rob quickly responded asking if I could pay some $x,xxx price for it. Seemed a little inappropriate to me - I don't know of any other registrar that would do something like that - but what do I know. Technically, the domain was a few days expired.

that is the difference in “Perception” .. remembering most people buy domains to sell them is “Reality” .. i want to sell as soon as i buy lol .. rather that is considered bad .. good .. greedy… that is up to each individual person to decide in their own perception .. I see yellow .. you see green .. that’s human nature .. you like mustard .. I like mayonnaise.. one of us thinks the other one is gross .. while the other has no opinion .. that is life day by day .. it doesn’t mean either you or I either one is wrong .. that’s how we humans roll

 

[Grilled]

https://twitter.com/x/status/1440419663091945484

 

[Grilled]

⚠ RETRACTION ⚠

I have been informed that robmonsterenablesnazis.com was never a confiscated domain. The domain remained in the registrants account for a year, left for non-renewal, and went through the customary grace period. Despite the nature of the domain, free speech prevailed at epik.


I believe I remember reading namePros members questioning epik's expiration process, with expired domains sometimes automatically set to an epik for sale landing page, and/or WHOIS Information changing away from the registrant and to an @Epik.com email address... (@frank-germany -- you may have reported something of this nature, do you recall?)

If you notice closely, all the "nazi domains" were filed under ForSale@EPIK(.)com, and albeit Robs name (He seems to like putting his name on things like another orange fella) was attached to the WHOIS, the domains never reached rob's personal Epik email account. Thus, possibly explaining how robmonsterenablesnazis.com reached the databae of domains filed under Rob Monster || ForSale@epik/com, through an automated expiration cycle of restributing, and offering expired customer names with an epik for sale landing page // changed WHOIS/DBinfo during the expiration cycle.

This also likely means Rob Monster never actually owned NaziHunt.com (or the other nazi domains), and is therefor possibly not the secret Nazi Hunter we were all hoping for. This would also remove Robs direct connection to owning SexyNazis.com as all these domains were apparently dropped by epik customers, and due to epiks questionable expiration practices, might have been placed under [email protected] upon expiry.

....

DISCLAIMER: Please remember most of the information being posted is raw data, and there is a lot of room for misinterpretation, many times depending on company process/policy/procedures. Research and ask questions, just try and stay away from absolute conclusions until full confirmation, not just high speculation.

https://twitter.com/x/status/1440179980365828104

Hey @#EpikFail Twitter --- please get your facts straight. Out of 180GB of data, with so much to offer, why keep reporting fake news?

All these alleged "Rob Monster" owned domains, is due to a questionable domain expiration process that entails epik temporarily taking over an epik.com expired domain, and offering it for sale.

One time I was curious about the process, so I inquired via the landing page about a domain of mine that had expired a few days earlier (meaning, it would still be under my control for several weeks). Rob quickly responded asking if I could pay some $x,xxx price for it. Seemed a little inappropriate to me - I don't know of any other registrar that would do something like that - but what do I know. Technically, the domain was a few days expired.

https://twitter.com/x/status/1440419134617964545

If any of you hardworking/much appreciated #EpikFail twitter folk have any questions, please join namePros! A lot of us would be happy to help decipher things and help stop the spread of misinformation, as we have an interest in finding out the truth, opposed to getting stuck in a twitter echo funnel which can lead to inaccurate reporting.

 

[labrocca]

The owner of Gab is well known. Not sure what sites they outed where the personal identity of someone was exposed. Likely the release of something like a cell phone number would be the most intrusive.

Many of us here would love to help stop the spread of misinformation, as we have an interest in finding out the truth, rather than be stuck in a twitter echo funnel which can lead to inaccurate reporting.

Misinformation is their goal. Using it to embarrass and financially hurt Epik. Probably less then .001% of all domains at Epik are controversial yet every article focuses on those.

Twitter allows the Taliban to have an account and that's okay apparently. Amazing that some of these truths are so washed over as acceptable.

We get it. Rob is bad man for allowing Right-Wing Extremist domains. And the Left believes his punishment should be his utter destruction.

 

[Grilled]

Yeah, because epik once controlled amazon.com... not! Watch out for making false conclusions based on pure raw (possibly inaccurate/mistaken) data entries.

Thanks @JanoschG for pointing this screenshot out.

 

[Lox]

.

Yeah, because epik once controlled amazon.com... not! Watch out for making false conclusions based on pure raw (possibly inaccurate/mistaken) data entries.

Thanks @JanoschG for pointing this screenshot out.

Show attachment 199957

You can't win a fight with Decentralized/Zero Campaigns, any counter you do come up with, just causes more rebellion (confusion, disbelief). The only way is to write a clear introduction and procedures @ E (registrar), quotes from ToS/Privacy etc. (Explaining why and what).

 

[Grilled]

Hellooooo #EpikFail YouTube Coverage...
Remember to read the comments

...

...

 

[bmugford]

To show you how much traction this story has now, someone setup a Twitter handle -

https://twitter.com/epikfailsnippet

Snippets from the #EpikFail Hack. DMs are open for questions or insights!

It already has more followers than Rob's Twitter account.

Brad

 

[Molly White]

Rob imho needs to hire someone really competent as CTO. Current CTO has to take the hit for this imho. Sorry to whoever you are dude but let's face it, unless Rob specifically told you to leave it that way it was up to you to ensure the PW's were encrypted. Also up to you was to make sure the backup location was secured. You do know that you could have put a password on the downloaded archive file too right? Create dumps, zip and archive, add password protection (256 character) and upload to backup site.

From the videoconference: "In fact, because of this incident we formed a technical core team. I’ve been kind of the acting CTO if you look at the org chart, well, it’s not public."

 

[Grilled]

who is epiks CTO now?

Interesting find @Molly White !!

https://twitter.com/molly0xFFF/status/1440483654233309191

https://youtu .be/aZ9MFts28XI?t=565

...

I own the domain KillCops.com, I am not for killing cops, I have never used the domain and likely never will. Just something I bought for $10 years ago.

In other #EpikFail twitter news...

https://twitter.com/x/status/1440485749875359750

 

[franka46]

Probably would have been better without the last paragraph - God, prayer, evil, enemies. That is not usually the type of wording you see about a hack.

All people care about is what happened.

At Epik, we take security and the privacy of your information very seriously. Therefore as a precautionary measure, I am writing to inform you of an alleged security incident involving Epik.

Our internal team, working with external experts, have been working diligently to address the situation. We are taking proactive steps to resolve the issue. We will update you on our progress. In the meantime please let us know if you detect any unusual account activity. I am proud of our team’s efforts as we do our part to empower a thriving internet for the benefit of our customers around the world.

You are in our prayers today. We are grateful for your support and prayer. When situations arise where individuals might not have honorable intentions, I pray for them. I believe that what the enemy intends for evil, God invariably transforms into good.

Blessings to you all.

Regards,

Rob Monster
Founder and CEO
Epik Holdings Inc

sucks.. still got a bunch of domains there.. been too busy to move them.. now i suffer like the other lazy people.. we're punished by Rob's god... you know gods never help the little people

sucks.. still got a bunch of domains there.. been too busy to move them.. now i suffer like the other lazy people.. we're punished by Rob's god... you know gods never help the little people

sucks.. still got a bunch of domains there.. been too busy to move them.. now i suffer like the other lazy people.. we're punished by Rob's god... you know gods never help the little people

sucks.. still got a bunch of domains there.. been too busy to move them.. now i suffer like the other lazy people.. we're punished by Rob's god... you know gods never help the little people

 

[Grilled]

Breaking News: The #EpikFail breach just hit CNN!!
+420 to team #epikfail 🎩

Read HERE https://www.cnn.com/2021/09/21/politics/anonymous-epik-hack/index.html

https://twitter.com/x/status/1440530339013664772

...

But also apparently reddit.com/r/EpikFail/ has been banned from reddit due to being unmoderated?
+1 to the other guys/gals

https://www.reddit.com/r/EpikFail/

https://twitter.com/x/status/1440398982333693958

 

[Grilled]

Historical Breakdown of these Hitler domains: rooting out any misinformation.as a reminder to fact check ✔

https://twitter.com/x/status/1440419134617964545

1. HitlerNews.com looks to be under Epiks brief control during the expiration period of BellNames,

Based on previous amateur research in the Epik/BC30.com thread HERE <see quoted snippet below> Epik might have inherited the customers of BellNames registrar but not registrar IANA itself> in part of epik's 27,000 customer account acquisition of Intrust Domains.. which explains why/how HitlerNews.com briefly went under epik nameservers after expiration, and why it was still legacy included in the leaked DB with Rob Monster as the default placeholder.

Seeing how Epik is <IANA ID# 617>, not <IANA ID# 653> does the non-compliance notice apply to epik, given epik had allegedly acquired Intrusts 27,000 customer accounts and registry business? And what happened to the customer accounts after the registry connection lease expired and when the registrars were sold to other entities?
History of IANA #653 <eg. Registrar: Intrust Domains, Inc>
August 2004: That Darn Name, Inc <[email protected]>
June 2009: That Darn Name, Inc <[email protected]>
June 2010 - October 2012: Intrust Domains, Inc** <[email protected]>
January 2013 - July 2014: YourJungle, Inc. <[email protected]>
March 2015 - June 2016: NamePal.com #8028 <[email protected]>
September 2016 - Current: NamePal.com #8028 <[email protected]>

Further, since the expiration of HitlerNews.com had briefly appeared as 2015, that was likely a temporary renewal credit during the courtesy renewal period, which epik was refunded when the registrant didn't renew the domain. Supplementing this is the below 2015 domain WHOIS registration of HitlerNews.com at Network Solutions.

When HitlerNews.com hit epik nameservers in 2014, the whois was extended to July 2015. Since HitlerNews.com was later registered in November 2015, below is the nameserver history to corroborate the domain was dropped and not retained by rob / epik after their brief hold of the domain during the point between expired and deleted.

Additionally since there is leftover voodoo.com name servers prior to the 2015 wix nameserver/ netsol registration/addition, namedog.com had cached HitlerNews.com as being included in the September 28th, 2014 available to the public dropped and newly available for anybody to register status.. https://data.namedog.com/Dropped/COM/2014/09-28-2014-COM.php

Sources:
Historical WHOIS powered by DomainIQ.com
Historical NameServer records powered by SecurityTrails.com

 

[Grilled]

Historical Breakdown of these Hitler domains: rooting out any misinformation.as a reminder to fact check ✔

https://twitter.com/x/status/1440419134617964545

2. HitlerDidNothingWrong.com expired on November 14th, 2014, at what looks to be a domain that might have been apart of the 27,000 intrust customer acquisition.

...

Notice, the nameservers change to epik 3 days after expiration?

....

On January 29th, 2015 it looks like now defunt dropcatching registrar pheenix had caught the domain on the day went through full expiration, and was made available to the general public:

....

So like domain #1, domain #2 looks to be a legacy carry over from possibly epiks intrust customer acquisition, of domains held under epik control / assumingly given the Rob Monster DB placeholder during the brief expiration period.

...

Not going to do the full list, but I just upped my DomainIQ.com membership so I can help out where needed, or if anybody wants to send over any fact checking requests.

*** I have no affiliations with DomainIQ.com, just a happy customer who would recommend other domainers/journalists/researchers to check out their services..

 

[Grilled]

https://twitter.com/x/status/1440550336796655627

 

[Grilled]

Sup @ThatNotoriousK WelcomeToNamePros!



To anyone still following along 47 pages in... the below video featuring @ThatNotoriousK is worth a ..

https://twitter.com/x/status/1440361643381198858

 

[NicTraders]

https://archive.is/2021.09.21-18243...ogy/2021/09/21/epik-far-right-hack-anonymous/

I really get sick of some of this inflammatory reporting. They make it sound as if Epik’s sole purpose is to harbour far-right criminals, which really is so far from the truth. In fact he just doesn’t sensor everything like the others do. I’m sure there are websites that are run but left-wingers too. And I don’t like it being implied that I am guilty by association just because Epik is my domain registrar of choice.

In any case it’s a bit sad that this thread seems to just go round and round in circles now as people try and dig up some bit of dirt on Rob or Epik’s practices. There is very little new news at all – just lots of re-posting from Twitter. And much of that is totally out of context or incorrect, as pointed out here:

Hey @#EpikFail Twitter --- please get your facts straight. Out of 180GB of data, with so much to offer, why keep reporting fake news?

All these alleged "Rob Monster" owned domains, is due to a questionable domain expiration process that entails epik temporarily taking over an epik.com expired domain, and offering it for sale.

Breaking News: The #EpikFail breach just hit CNN!!

Means nothing IMHO. This whole situation has created so much hype because people report people who reported someone who read something some other person read on Twitter.... Clear!?... It's self-sustaining. Sadly there is very little actual journalism these days in reporting such things. 90% (or more) of it is a rehash of a report they read somewhere else (or a syndication of same). It's a bit depressing really, if you care about hearing actual facts in your news.

 

[FernandoBMS]

I'm new here too from the Epik Fail aftermath and just want to thank and congratulate the NamePros community for all the information and analysis shared in this thread.

 

[FernandoBMS]

It's a bit depressing really, if you care about hearing actual facts in your news.

As seen earlier in the case of Le Monde's Epik Fail report this community has the power to correct factual errors in the press about this topic, so if you've seen any factual errors in the Whashington Post story just show me where the factual error is so I can make them issue a correction.

(PS: All this is done without harassing or doxxing any reporter)

 

[tonyk2000]

so if you've seen any factual errors in the Whashington Post story

Domain registrar is a company providing domain registrations. Not a webhost. The ICANN-accredited registrar EPIK is no different from GoDaddy etc. in this aspect. A lot of Epik account holders never heard about proud boys and all this stuff. Most notably, non-U.S. based customers (there are a lot).
- May be a good start