Whenever there is a problem with a stolen domain, it always seems to be Godaddy that has the problems...
GoDaddy's basic security is no worse than many others. However, GoDaddy is among the world's most popular registrars - hence more stories of quality domains being "stolen" there. Statistically speaking, one's domains at GoDaddy are likely as safe as most elsewhere.
Point is that for someone to steal a domain at GoDaddy, they would need to compromise the user's GoDaddy account. Doesn't GoDaddy email account changes get sent to the last email on file? They always have for me.
If so, the xserver should have received at least one email saying that their account email was being changed and/or domains were being transferred out ... or does GoDaddy's email notifications not always work?
EDIT 1: according to xserver he received an email notice - so GoDaddy's security worked as intended. One can debate whether GoDaddy should include more security to all accounts, but their default is similar to that of many other registrars.
Of course if a person's GoDaddy account
and email account are both hacked, well then, to put it bluntly, the user is SOL ... unless they use one of the few registrars that supports extra security such as an encryption token, manual updates such as over the phone, and/or VeriSign RegisTRY Lock (far as I know, only MarkMonitor offers that).
xserver- email
[email protected] at once. And, if you can, call them too. Don't wait. In the meantime, keep warning people on the forums to avoid those domains until you get them back.
EDIT 2: As of this moment, the domains are still at GoDaddy. Email [email protected] - they can help! ...
And for anyone thinking of buying these and transferring them out - the losing registrar, GoDaddy, has the right to get those domains transferred back.
And anyone unfortunate enough to buy "stolen" domains, upon reversal, is, effectively, no longer a customer of either registrar - has little to no effective recourse. Search old threads here for buyers who lost tens of thousands buying domains without doing due diligence; overly trusting Sedo and similar places - such services don't guarantee the seller has ownership.
Ron