How to properly safeguard a valuable domain

[ichudov]

I have a few domains, none really valuable, except one, which is worth perhaps $3-4k or so.

I have been reading about socially engineered domain thefts and I am now thinking, how to properly secure my domain names, so that my registrations would be secure even if someone decides to "game the system" and try to steal my domains.

To that end, I have come up with the following approach.

1. Register a gmail account that will be used only for domain management.
2. Secure said gmail account with two factor authentication and a unique password.
3. Change admin and tech contacts on all registrations to point to that gmail address.
4. Change all registrations to "private" in order not to expose that email address.
5. Set up a whois watch, that would "notice" any changes in registrations and alert me.

The reason why I want to go through the trouble of having a separate gmail address for domains, is to hide from thieves the email address used on registrations. The obvious drawback of this, is that a separate and unused email address will make it more challenging to check messages on a regular basis.

Any thinking on this? Thanks!

 

[Atomic Domains]

Yeah, that would help prevent theft... But, if real hackers really wanted to take domain names there would be little we could do about it.... They rather rip off banks, steal identities, etc... Not enough money in it for them to waste time taking domains....

That should be enough to safeguard against wannabe hackers though....

 

[Name Trader]

How do you do #5?

 

[ichudov]

How do you do #5?

I am a computer programmer. I use Linux. I have a script that I wrote that watches output of a given command, and alerts me via email when the output changes.

 

[N-A]

Moniker doesn't give a crap about #4. They will release info in a "good" email sent to them if the respondent (you) do not reply in 5 days (even then, would they care about you if it's sent from a lawyer representing a firm?).

That's why I chose Moniker for 1 of my domains ("privacy" is in their name), but they undid protection and all hell broke loose.

Good info to follow, but if someone wants those names, they'll find a way to get them. Then it's a battle you're going to have to fight.

As far as #5, there's little to do when the whois information doesn't update because the hacker didn't remove whois privacy protection (not alerting you of changes). Not fail safe unless you try to login to the accounts and find out that you can't anymore.

 

[AEProgram]

godaddy monitorin

How do you do #5?

godaddy monitoring is a free easy way, issue is by the time you get the notice the damage is done, its better than nothing but the key is not to be a fool in the first place

also make sure ur computer is always free of viruses, keyloggers etc

 

[buyselldoms]

Your logic is a bit flawed... the gmail two factor authentication seems a good idea... but you are overlooking the fact that:
1) if whois privacy (don't get privacy and security mixed up) wasn't active on your domain until recently, the old record could possibly be stored (you know, one of the hundreds of DNS records and whois services that you can go back many years) .. so changing your email before setting privacy might be pointless, and as stated the privacy services aren't always all they are cracked up to be;
2) You talk about domain thefts... but in your solution you didn't mention about locking the domain (where applicable) which is of vital importance; and
3) You make no mention about your domain registrar user account... if someone gets in and changes your password... there is a problem right there...

Just to recap, your email address on whois is just a correspondence address and should not be the email associated with any domain or hosting accounts. Everyone knows how to do a whois search these days, literally everyone.

Whois privacy is about buying time by adding a barrier.. it wont shield you long term. Whether its nominet opt-out for UK domains or a privacy service for other domains... its not particular difficult for someone to persuade either a disclosure or removal of a service (i.e. if its a registrar's service)

$3-4k domain is NOT that valuable, its too much to be stolen of course but its not very valuable.

 

[cdboard]

the email address that you use to access your registrar account should NOT be used for whois - even behind privacy