[RESOLVED] - Domain Name Stolen...A Horrible Story and a Warning...

[Dustie]

Hi All. I've not been in here for a number of years, but a week ago I had my domain of 20 years (dustie.com) stolen and I have to tell the story. it looks like I'm out of luck here, and out a lot of money, but maybe my story can help prevent this happening to someone else. This happened at Godaddy, though I don't blame them, and i still have all of my domains with them, as well as my websites. I blame the no good slimy thief who stole my domain name!

Here's the story... First off, my name is Dustie, and I've owned Dustie.com since 1998.
Sometime in 2017 (I think) I decided to go ahead and list dustie.com as a premium domain for a high price. It being my name, I wasn't real keen on selling it, but, as they say, everything is for sale for the right price. I'd had someone offer me 5,000.00 for it, but after taxes (it would have put me in a higher tax bracket for the year) and commisison, it wasn't worth it wasn't worth it to sell it for that amount. However, I figured that if someone were willing to pay that for it, maybe someone would pay even more. So I listed it as a premium domain for 20,000.00. I seriously didn't think it would sell but it woudn't hurt to list it (or so I thought).

All was well, until a bit over a week ago. I had been out that evening and didn't get home till nearly 10:00 PM. It was 11:00 before I was able to get onto the computer. That's when I saw the 5 emails from Godaddy.... I'm sure you can imaging my reaction when I saw that, within 20 minutes, my domain name, dustie.com, which I have owned since 1998, sold and transferred for a mere 450.00? I was sick...simply sick. How could this happen! First off, I've never had a domain name sell and transfer inside of 21 minutes and then be paid for it a little over a day and a half later. That's unheard of!

Immediately after reading those 5 emails and realizing my domain name had sold for less then 5% of what I'd had it listed for on Premium Domains, I was online with Godaddy help. Though they were sympathetic, no one there could help. They said I'd have to wait till morning and call auctions help. Needless to say, I didn't sleep well and was on the phone as soon as they opened their office. Though I was on the phone for a good 30 or so minutes with them (a good part of that time on hold), I was ultimately told there was nothing they could do for me. My domain was bought, paid for, and transferred and that was that! (Oh, and this even though they found the price had been tampered with twice that same night, long before I got online). They said this had to be me because no one else had access to that account! That was proof to me that someone was in there messing with my account and screwed me over big time, but not to them.

So I've been sick all week...trying to forget that someone illegally reached into my pocket and stole a lot of money , as well as my NAME! Needless to say, even a week later, I'm just sick about the whole thing.

Today, on a lark I looked up dustie.com on godaddy and was sick all over again when I saw that it is now listed as a premium domain for 12,000.00 (by the person who stole it from me?). That's just wrong, in so many ways! How do I get over this? I want to know how this could have happened!!??

I am posting in here as a warning to you all, as well as wanting to go on record that this did happen, regardless that the guy at [email protected] said that dustie.com had always been listed at 450.00 and it was a legitimate sale! I know how to use GoDaddy. I'm a long time user and have over 50 domain names with GoDaddy, more the half listed as premium domains! Ever since Dustie.com was originally listed as a premium domain at 20,000.00 that was the price that showed up whenever I went to maintain my premium listings. It always stuck out like a sore thumb, because most my other domain names are listed below 1000.00. There is simply no way Dustie.com was ever listed for as little as 450.00. Even go daddy suggested a price of nearly $5,000 as a premium listing starting point for dustie.com.

Without a doubt, my godaddy account was hacked and my domain name of 20 years stolen from me and relisted for 27 times what they paid for it! That burns me to the core!!!

I'm sure that, since this happened to me it will surely happen again. If any of you hear about such a thing, could you please have them get in touch with me? If I can find others that this has happened to, maybe we can do something as a group?

In the meantime, if you have a valuable domain name on Godaddy Premium domains, then you might want to take screen shots of the listed prices. Also, I was told that if I had the original email when it was listed that would be proof that it was listed at 20,000.00. Alas, I did not have it...I had, not long ago, deleted emails that were more then a year and a half old. If you don't have emails for your most valuable domain names, then remove them from listing, then relist them to get a new email and save those emails just in case!!

And Thanks for listening to my very long rant!

Dustie
(was [email protected] for over 20 years...now I am [email protected] and my site is dustie.art ... cool name, but it's certainly not worth what I lost in dustie.com!)

 

[Bob Hawkes]

The sensationalistic tone of this (and too many other) thread titles has always bothered me. Now that the domain is back to @Dustie, and various inquiries have found no evidence it was stolen, I wonder if it would not be appropriate for her to ask mods to change title?

 

[carob]

Anyway, GD must have a log of user activity with IP addresses. Do we have to subpoena for that information ?

Not if you are an EU citizen or resident, - you just make a free request, called a Subject Access Request, for all info that GD hold about you. That should also include transcripts of telephone calls. Instructions here:

https://uk.godaddy.com/help/gdpr-privacy-features-for-eu-residents-27883#Portability

 

[carob]

Tho I know I have beaten this drum hard - I do feel that you, Maxtra, and all for that matter would benefit from the hard data identified by GD's research. There is no Proprietary or "Trade Secrets" being requested here - just simply an event timeline and event request (who or which venue requested the pricing change events) to be provided to all. Yes, the NamePros community is not a party to the transaction, but the pricing change request events data would help table the topic and would demystify the situation for all.

Additionally - by providing this data this would help table the credibility hit that Maxtra faced - let's be honest about this - initially in this thread many shouted "OGRE- grab your pitch fork!" and chased after Maxtra as a villain - who then was shamed into returning the domain.

Without the data - he is left with mud on his face (even tho he returned the domain - there's still a stain).

IMO - you owe it to Maxtra to seek and provide below information - and then share with Maxtra the hard facts that GD identified. (and with us if both you and Maxtra are receptive to)

A mistake made (understandable) or a hack (unknown) ----> but GD should know if the IP used for the $30,000 and $450 price change request were actually your IP when your GD Panel was accessed -or- whether is was a different IP address.

This fact alone would help to clear the fog a bit..

Joe should have no issue providing you that one simple fact.

-Cougar

ps: Let me be clear - I think Dustie had a valid issue and you have initiated a thread that drew a lot of discussion - as well as - a lot of great recommendations - I also think you have done an OUTSTANDING job of continuing to respond to questions being asked on this thread even after you have received your domain back - there are some that would have said "thanks" and then disappeared all jolly and happy - but you have continued to respond post-return and I thank you for that.

You are absolutely right - if we do not know what happened it can just happen again, to anyone, many times.

The assumptions here have been hack of an individual GD account, or an individual email account, or user error, or system glitch, or abuse of Afternic loopholes. But it is also possible the problem is at a higher level of privilege - a compromised GD admin account or database, or some is able to create rogue admin accounts at GD. So even from their own internal point of view, GD owe it to themselves and customer security and confidence in them to identify the problem. Who knows what prices have been changed or will be changed?

@Dustie, Cougar kindly provided a list of key questions you can put to Godaddy. After the help and support you have received here, do you think you could help us all by politely asking Joe Styler to answer those questions? You don't need to fully understand the answers, just share them with the community.

 

[SuperBrander]

Glad to see that things worked out as they should have. I don't really understand this theory about someone hacking Dustie's account though. The domain wasn't stolen. It was sold for $450 and Dustie got the money for that sale. What incentive does a person have to break into someone else's account and change a marketplace price? Dustie said that she was tweaking prices. Godaddy say they found nothing suspicious. The most logical conclusion is that Dustie simply changed the price by mistake.

 

[tonyk2000]

But it is also possible the problem is at a higher level of privilege - a compromised GD admin account or database, or some is able to create rogue admin accounts at GD.

If it is the case, then the radio silence would not be too surprising Unless until the issue is 100% fixed...

 

[carob]

What incentive does a person have to break into someone else's account and change a marketplace price?

If you changed price from 50k to $20 on one domain and your accomplice then bought the domain on Fast Transfer it would be a steal. But more interesting and advantageous would be to hack GD at admin level, change a whole lot of prices over time, including unimportant ones, and cover your tracks, then slowly have accomplices buy the selected subset of the top price changed domains under the radar, and if any were detected hope it seemed a system glitch.

 

[tonyk2000]

The most logical conclusion is that Dustie simply changed the price by mistake.

Dustie was told by GD that the price was changed first from 20K to 30K and then immediately to $450. Which sequence is strange by itself. Why the price change happened two times... Looking at the sequence "20K-30K-450" separately and outside this thread or domain pricing, one may guess that there is a mistake and it should be "20K-30K-45K" (missed "00"), but it is unlikely that somebody (including Dustie herself) might wish to set 45K price on this domain for any purpose. All this is a big puzzle.

 

[SuperBrander]

@carob @tonyk2000 Thanks for your posts. Theoretically, I agree that someone could try something like that if they have access and are more sophisticated than usual. However, I think a hacker would try to be fast about whatever they're doing rather than turn it into a long term project because when you lower prices- other people will see the domains too and buy them.

Either way- in this case, it really doesn't seem like anything sinister happened. Sometimes when people play around with prices, they change them multiple times. They can price the wrong domain or miss a digit. I've heard quite a few stories about domainers making mistakes in pricing or editing prices in bulk and then selling at a price they were surprised at. Shane from DSAD mentioned such a sale recently, for example, for a much lower price than he intended to sell for. Since Dustie said she was playing around with the prices lately it just seems reasonable that's what happened. That's my take on it anyway.

 

[tonyk2000]

I've heard quite a few stories about domainers making mistakes in pricing or editing prices in bulk

Yes, happened to me once. Was an expired auction bidding. Fortunately, I was overbid

 

[namelancer]

Looking at the sequence "20K-30K-450" separately and outside this thread or domain pricing, one may guess that there is a mistake and it should be "20K-30K-45K" (missed "00"), but it is unlikely that somebody (including Dustie herself) might wish to set 45K price on this domain for any purpose. All this is a big puzzle.

My guess: could Dustie be a sleep-walker unbeknown to herself ? : )

 

[namelancer]

Theoretically, I agree that someone could try something like that if they have access and are more sophisticated than usual. However, I think a hacker would try to be fast about whatever they're doing rather than turn it into a long term project because when you lower prices- other people will see the domains too and buy them.

Exactly. It's been reported by Dustie, by retrieving the data supplied by the Godaddy tech assistance, that the domain had been listed at a 450 usd price for a substantial amount of time prior to its purchase.

 

[namelancer]

By providing the time-frame and pinpointing out the exact timing of when a pricing changed on the domain from a high to a much lower amount, this in all probability, rules out interference of a hacker the timing of whose actions would simply have had to coincide wih Dustie's own volitions with respect to modifying the prices:

Cougar, I am satisfied that GD did all they could. They dated the change from 20,000.00 to 450.00 around the same time I actually did make some price changes to some of my domain names, and they found no unwanted or untoward "trespass" nor could they find any glitches or errors.

Therefore, I'm inclined to agree with the view expressed here:

Since Dustie said she was playing around with the prices lately it just seems reasonable that's what happened. That's my take on it anyway.

 

[namelancer]

Anyway, GD must have a log of user activity with IP addresses. Do we have to subpoena for that information ?

On the latter, a power-of-attorney would do...

On the first issue, modern hacking reaching advanced stages, it's possible for someone to operate from within a hijacked IP number, committing attacks and offences from a computer taken over by a third-party.

 

[Dustie]

@Dustie, Cougar kindly provided a list of key questions you can put to Godaddy. After the help and support you have received here, do you think you could help us all by politely asking Joe Styler to answer those questions? You don't need to fully understand the answers, just share them with the community.

Guys, Joe Styler has been keeping a close eye on this thread. If he wants to answer the questions you are putting to him, I'm sure he will do so. I'm satisfied with the effort he's put into getting to the bottom of this. I just wish I was a fly on the wall when the domain name change happened sometime in February so I could absolutely know what happened. But, alas, neither I nor Joe know the whole answer I'm afraid. Though it doesn't make sense to me that I could have started all this, it could have been so... I am only human after all, and blond, and old...

 

[Keith]

Guys, Joe Styler has been keeping a close eye on this thread. If he wants to answer the questions you are putting to him, I'm sure he will do so. I'm satisfied with the effort he's put into getting to the bottom of this. I just wish I was a fly on the wall when the domain name change happened sometime in February so I could absolutely know what happened. But, alas, neither I nor Joe know the whole answer I'm afraid. Though it doesn't make sense to me that I could have started all this, it could have been so... I am only human after all, and blond, and old...

Have you got it back yet? If not, there’s more to the story than I initially thought.

 

[Dustie]

Have you got it back yet? If not, there’s more to the story than I initially thought.

Keith, yes, thanks to Maxtra (A ROCK STAR IN MY BOOK) dustie.com is safe and sound back home where she belongs. Maxtra refunded MapleDots (ALSO A ROCK STAR IN MY BOOK) his money, Joe Styler made sure MAXTRA (Rock Star) was paid what he originally paid plus gave him a credit for his noble gesture of pushing the name back to me, and I paid GD back the 360.00 that had come to me after commission. So the clock was turned back! This has been a fantastic journey...so totally unexpected and renews my faith in the basic goodness of people!

 

[Name Trader]

Keith, yes, thanks to Maxtra (A ROCK STAR IN MY BOOK) dustie.com is safe and sound back home where she belongs. Maxtra refunded MapleDots (ALSO A ROCK STAR IN MY BOOK) his money, Joe Styler made sure MAXTRA (Rock Star) was paid what he originally paid plus gave him a credit for his noble gesture of pushing the name back to me, and I paid GD back the 360.00 that had come to me after commission. So the clock was turned back! This has been a fantastic journey...so totally unexpected and renews my faith in the basic goodness of people!

I repeat what I think I said earlier in this thread. You were extremely lucky that the buyer was a NP's member who was prepared to feel sorry for you. The chances were slim of that happening (but not impossible, it seems). Otherwise, this story would have ended entirely differently. Since GD found nothing wrong with the sale. Your dispute with GD was toast.

And @maxtra is rightly a god

 

[Dustie]

I repeat what I think I said earlier in this thread. You were extremely lucky that the buyer was a NP's member who was prepared to feel sorry for you. The chances were slim of that happening (but not impossible, it seems). Otherwise, this story would have ended entirely differently. Since GD found wrong with the sale. Your dispute with GD was toast.

It would have been as I expected it to be when I first posted in here. With me knowing there was no hope, my name gone and all I had left was to warn others so that, hopefully it didn't happen to them. I'd been told by auctions tech that my name had always been listed at 450.00 and there was no record of it ever having been listed at 20,000.00 and so there was nothing I could do about it. I definitely knew better so I had no choice but to believe I was hacked and my domain stolen. Thus the long warning post!

And I totally agree! My posting in here and having so many people trying to help, and ultimately Maxtra and Mapledot being so generous saying that, regardless of the GD research and outcome, they would reverse the purchase to see to it I get my name back was one heck of a bit of luck on my part! Wow...very lucky indeed that I posted my plight here in NP, without a doubt!!!

 

[alcy]

Guys, Joe Styler has been keeping a close eye on this thread. If he wants to answer the questions you are putting to him, I'm sure he will do so. I'm satisfied with the effort he's put into getting to the bottom of this. I just wish I was a fly on the wall when the domain name change happened sometime in February so I could absolutely know what happened. But, alas, neither I nor Joe know the whole answer I'm afraid. Though it doesn't make sense to me that I could have started all this, it could have been so... I am only human after all, and blond, and old...

Joe cannot share publically about private accounts and investigations. he made that very clear on namepros many times.

he can just pm or email you the account holder. and then its entirely up to you what or if you want to share with others.

 

[Dustie]

Then if he wants me to share, he will send me an email with the answers to the questions and let me know it's ok to post them. He really is reading this thread.

 

[Dustie]

The sensationalistic tone of this (and too many other) thread titles has always bothered me. Now that the domain is back to @Dustie, and various inquiries have found no evidence it was stolen, I wonder if it would not be appropriate for her to ask mods to change title?

I asked...they said they can't change the title now..that the most they can do is add RESOLVED, so that's what they did. And it's indeed resolved thanks to all of you and to my new ROCK STARTS Maxtra and Mapledot, of course!

 

[equity78]

Keith, yes, thanks to Maxtra (A ROCK STAR IN MY BOOK) dustie.com is safe and sound back home where she belongs. Maxtra refunded MapleDots (ALSO A ROCK STAR IN MY BOOK) his money, Joe Styler made sure MAXTRA (Rock Star) was paid what he originally paid plus gave him a credit for his noble gesture of pushing the name back to me, and I paid GD back the 360.00 that had come to me after commission. So the clock was turned back! This has been a fantastic journey...so totally unexpected and renews my faith in the basic goodness of people!

Congrats

 

[Soofi]

Keith, yes, thanks to Maxtra (A ROCK STAR IN MY BOOK) dustie.com is safe and sound back home where she belongs. Maxtra refunded MapleDots (ALSO A ROCK STAR IN MY BOOK) his money, Joe Styler made sure MAXTRA (Rock Star) was paid what he originally paid plus gave him a credit for his noble gesture of pushing the name back to me, and I paid GD back the 360.00 that had come to me after commission. So the clock was turned back! This has been a fantastic journey...so totally unexpected and renews my faith in the basic goodness of people!

@Joe Styler is a ROCKSTAR as well IMO Always helping us with our assets over and again. Way to go!!

Dustie, glad you got Dustie.com back and are smiling

 

[Dustie]

@Joe Styler is a ROCKSTAR as well IMO Always helping us with our assets over and again. Way to go!!

Dustie, glad you got Dustie.com back and are smiling

Ok, I'll give Joe ROCKSTAR Status, even though I know he thinks I actually changed my 20,000.00 domain to 450.00 by accident (after changing it to 30,000?). He did try to help as well as he could...so KUDOS TO ROCKSTAR JOE too!

 

[Dave]

I wonder if you're all overthinking this. Is it not just possible that Dustie was making bulk updates and mistakenly changed the price to 450?

It was incredibly nice for @maxtra to return the domain to @Dustie and for @MapleDots for his incredible offer.

@stub rightly pointed out that Dustie has been fortunate here, and this could've easily ended up with a non NP member or buyer who wouldn't give it back.

Congrats on getting your name back.