domains How Xlinesoft (almost) lost domain name

[Lox]

External Article

Our website xlinesoft.com was down from May 24, 2019 to May 30, 2019.

First, I noticed that I cannot logon to our online helpdesk. Then the website itself started showing ads that we never had. We assumed that our server was hacked but it turned out it simply points to a different IP address now. Hacker downloaded a static copy of our website, added some ads and tried to make some money via AdSense.

I tried to logon to GoDaddy account and check DNS settings. The login didn’t work and the password reset email never arrived. Our account at GoDaddy was hacked and attackers сhanged domain name ownership data. I was relieved though, dealing with GoDaddy should be easier than negotiating with a hacker, right?

GODADDY SAGA​

Over these six days, I spent a dozen of hours on the phone with GoDaddy. Unfortunately, the only way to contact their fraud department is via the form on the website and they will take up to 72 hours to get back to you. So every time I submitted supporting documents I would call a regular support line and I ask them to contact someone from the fraud department and check the status of our case.

I have got exactly two one-liner replies from the fraud department over these six days and they were nothing but a joke.

read more

 

[Yanosh]

So i’m not the only one godaddy messed up his account
1 month and still waiting to get back my account

 

[MadAboutDomains]

This emphasises the importance of automated checks.

They should have a check for the nameservers on the site, DNS entries and also a check on their homepage to detect issues like these.

Also, wherever the site was hosted should have traffic flow monitoring. Any dips in usual traffic would tell them that traffic is no longer going through the intended infrastructure.

 

[draco]

I'm surprised GoDaddy didn't send confirmation emails when the password was changed, when their account email was changed (if it was), and when the domains were moved (unless the account email was changed and it was sent to the new email).

As mentioned in the article, everyone should use 2 factor authentication (if available) and strong, different passwords.