[RESOLVED] - Did someone stole my domain?

[justlife]

Hi everyone. I received an email from Namecheap about domain contact update. It has changed to someone I don't know:

New Registrant
First Name:Hassan
Last Name:Taha
Email Address:[email protected]

I didn't sell the domain or push the domain. And the domain is not in my account anymore.
I've submit a ticket to Namecheap, but still have to wait for them to check.
I'm just freaking out. The domain is hioy.com. Any idea?

 

[tamar]

All right, Namepros has finally added the badge after verifying I represent Namecheap. So you can have me help you here, if you'd like - otherwise, it will take longer.

Since I am US based and the holiday is on Thursday, I will be traveling, so I was hoping to help you beforehand. It's up to you. I'm here to help if you let me.

 

[justlife]

A good ending...

I sincerely Thank each and everyone of you for looking into this matter. Thanks to @tamar and your team for speeding up the process.

I've learned my lesson - upgraded my antivirus, use unique password and activated 2fa.

Thanks everyone I'm really grateful

 

[Bob Hawkes]

Great to have a Namecheap rep officially certified on NPs, @tamar. I guess you have been on NPs for awhile, but look forward to your official role now recognized. I hope that @justlife responds to you and the issue will be resolved.

Happy forthcoming July 4th everyone (Canada had our holiday yesterday).

-Bob

 

[tamar]

I've been trying for awhile now. Hopefully the OP takes me up on it!

 

[tamar]

Again, if you DM me the ticket number, I can have this issue resolved in hours rather than days.

When one of my colleagues replies within the hour, you'll know I'm legitimately representing Namecheap.

 

[Bob Hawkes]

If possible can you give us an update on what NameCheap said?

Usually I get registrant change like that after a sale on NameCheap Marketplace (where they automatically sell domain and transfer it). For those an additional approval is not required (it is like a fast transfer but only for domains registered at NC), but that would only apply if you had it on the NC Marketplace, which I assume from your comments that you did not.

I am sure you have thought of this, but probably good to change your PW just in case your account was somehow hacked.

The fact that the domain is still at NameCheap means that it should be possible to reverse if you can establish that the transfer was by error or misdeed. I am not sure if they will do anything since you are not listed as owner, but try to get the for sale listings at Afternic and Undeveloped (and anywhere else) put on hold as a further sale would complicate recovery.

Dofo last show a sale in 2018 (perhaps when you bought it) but there could well be a later sale at a venue that do not report.

When you can, please update us on the situation. Hope it resolves.

Bob

 

[carob]

If someone has hacked your email account they could do this without you knowing - just create a filter to hide the relevant emails from you, and possibly forward all emails to them.

You need to be sure you have 2FA on your email account, and that there are no unknown filters or forwarders. there.

 

[tldboss]

If you haven't already done, change your passwords for namecheap and email, also enable 2FA as suggested earlier.

 

[tamar]

Do you have an open ticket, and if so, can you DM it to me?

I will look into this, but bear with me, I'm going to be a little unreachable over the next two days.

Tamar from Namecheap

 

[tamar]

Are you sure, you are from namecheap?

Yes, I'm awaiting my badge from Namepros.

A ticket number isn't private, so you can share it here if you wish, but I suggest DMing me. I'll be able to look into this later this weekend. I'm not going to be reachable until late tomorrow night or Sunday.

 

[HSNZ]

Nice Tamar good to see someone front up.

 

[justlife]

Great to have a Namecheap rep officially certified on NPs, @tamar. I guess you have been on NPs for awhile, but look forward to your official role now recognized. I hope that @justlife responds to you and the issue will be resolved.

Happy forthcoming July 4th everyone (Canada had our holiday yesterday).

-Bob

I've DM Tamar the ticket number. I've apologized to her for not contacting her earlier because I'm feeling really confused. At the mean time, I'm still working with Namecheap team answering questions etc. Will update again... Thanks

 

[gilescoley]

Are you 100% sure you didnt let it expire.

 

[justlife]

I've just transfer it to namecheap during the recent transfer sales

 

[loredan]

Do you have Fast Transfer enabled? It might have been sold at Afternic

 

[justlife]

no, it's not sold at afternic, no email from them. I've checked my afternic dashboard, nothing.

 

[Silentptnr]

I see Undeveloped nameservers. It may have sold there.

Did you approve the registrant change email?

 

[slader23]

Do you have 2FA enabled with namecheap?

 

[justlife]

I see Undeveloped nameservers. It may have sold there.

Did you approve the registrant change email?

I think he hasn't changed the nameserver. I listed the domain at undeveloped. No sales on that domain.

I didn't receive any email to approve the registrant change

 

[justlife]

Do you have 2FA enabled with namecheap?

No. I'm too negligent on this. Din't expect to happen.

 

[ultradog]

I'd check with Undeveloped again too. See if it sold.

 

[WhoaDomain.com]

hioy.com Domain Hosting History
Old Hoster New Hoster Month / Year Zone Date Transaction
NAME-SERVICES.COM UNDEVELOPED.COM February 2018 2018-03-01 Transfer
INTERNETTRAFFIC.COM NAME-SERVICES.COM January 2018 2018-02-01 Transfer
FABULOUS.COM INTERNETTRAFFIC.COM May 2013 2013-06-01 Transfer
SEDOPARKING.COM FABULOUS.COM December 2009 2010-01-01 Transfer
FABULOUS.COM SEDOPARKING.COM November 2009 2009-12-01 Transfer
SEDOPARKING.COM FABULOUS.COM January 2008 2008-02-01 Transfer
FABULOUS.COM SEDOPARKING.COM March 2007 2007-04-01 Transfer
N/A FABULOUS.COM October 2006 2006-11-01 New
SECURESERVER.NET N/A September 2006 2006-10-01 Deleted
SMARTNAME.COM SECURESERVER.NET July 2006 2006-08-01 Transfer
POWERHOSTING.COM SMARTNAME.COM May 2006 2006-06-01 Transfer
N/A POWERHOSTING.COM July 2005 2005-08-01 New
DOMAINSAREFREE.COM N/A January-March 2001 2001-04-04 Deleted
DOMAINSAREFREE.COM N/A December 2000 Epoch

 

[Bob Hawkes]

DTs show that person Taha as the registrant with an address in Egypt. It shows last change was May 27 of this year. It is currently listed for sale as make offer on Undeveloped and at Sedo at $3850 price. I hope it gets sorted out.
Bob

 

[Goku]

Possible domain hijacking? Did Namecheap gave a reply?