warning Theft of Perl.com, a 1994 domain

[Acroplex]

Perl.com, a 1994 domain name, has been reported as stolen and listed for sale on Afternic and possibly other marketplaces.

The thief's profile on Afternic, now deleted, indicates they are in the possession of other stolen domains:

• Piracy.com
• Chip.com
• Patterns.com
• Neurologist.com
• FinPlan.com (new)

Fair warning, in case you are contacted to buy/broker these domains.

 

[Acroplex]

Adding FinPlan.com to the list of stolen domains by the same criminal.

 

[Samer]

Pathetic this still happens.

Thief needs to be exposed and prosecuted to full extent.

 

[robbie777]

How do they actually manage to steal such domains? Is it a lack of registrar security? Or some kind of email scam to obtain passwords to registrar accounts??

 

[Acroplex]

This one appears to be via social engineering of registrar support and document forgery. Domain registrars should not ask for "paper" ids.

 

[robbie777]

Scary stuff .. I have a website with the word perl, hence why this thread caught my eye lol can the original owners of that domain not freeze it via icann? What can be done if a domain has been stolen in such a manner?

 

[Gube]

Scary stuff .. I have a website with the word perl, hence why this thread caught my eye lol can the original owners of that domain not freeze it via icann? What can be done if a domain has been stolen in such a manner?

They could try, but it seems icann replies for that sort of things are relatively slow..
Another solution is through the registrar, they typically have access to a dispute resolution system. But you should probably get help from a lawyer if your domain was stolen (and it was worth it), just to be sure at least.

 

[Reallybigidea.com]

amazing portfolio...

According nameservers Afternic knows who is an owner.
Key-systems have ip address logs

Domain:
chip.com

Registrar:
Key-Systems GmbH

Registered On:
1994-08-16

Expires On:
2026-08-15

Updated On:
2021-01-27

Status:
clientDeleteProhibited
clientTransferProhibited
clientUpdateProhibited

Name Servers:
ns1.afternic.com
ns2.afternic.com

 

[lambo.com]

I nearly acquired finplan, too bad they backed out

 

[Mytz.com]

• Chip.com

 

[Acroplex]

I was informed that the current holder is in Moldova.

Adding another stolen domain to the list: AcneTreatment.com.

 

[Acroplex]

Can't update the first post, so more info on the current list of reportedly stolen domains here.

 

[lambo.com]

I wonder if they were stolen at gun point or could be, I suppose, negligence and poor opsec that facilitated their transfer to the new bearer. Any ideas?

 

[EmpireNames.com]

Can't update the first post, so more info on the current list of reportedly stolen domains here.

Mamas.com was also in his list which i was near to buy but i stopped after i investigated further first he set bin of 20000 euros then he changed to minimum offer 25000 euros..
now a days pvt purchases are way risky so i would suggest to investigate deeply before making any purchase
Thanks
Riz M

 

[SamQuino]

How did these domain thefts steal domains from the rightful owners?

just wondering how did they do it.

 

[lambo.com]

How did these domain thefts steal domains from the rightful owners?

just wondering how did they do it.

It takes negligence on the part of the registrant.

There are plenty of steps and options to secure a domain asset properly in addition to processes that delay or prevent an unauthorized transfer of a domain.

Ultimately, a domain name owner is responsible for more than just paying the fees annually. We all need to have proper opsec for our leased assets/ burdens and our digital houses in order.

 

[AEProgram]

It takes negligence on the part of the registrant.

There are plenty of steps and options to secure a domain asset properly in addition to processes that delay or prevent an unauthorized transfer of a domain.

Ultimately, a domain name owner is responsible for more than just paying the fees annually. We all need to have proper opsec for our leased assets/ burdens and our digital houses in order.

is 2FA enough would you say?

 

[lambo.com]

is 2FA enough would you say?

Yes, 2FA is a key step to take along with email address and strong password

 

[Acroplex]

Update: Some of the stolen domains have been returned to their rightful owners that acted fast to dispute the transfers.

 

[Samer]

DNProtect.com by epik aims to solve this.

Sad it still happens.

Thank you, @Acroplex.

 

[Business Brands]

Thats a tiny thief. We all know who the REAL THIEVES are!

 

[branding]

Perl.com theft blamed on social engineering attack: Registrar 'convinced' to alter DNS records by miscreants.

https://www.theregister.com/2021/03/02/perl_domain_theft/

 

[Acroplex]

Chronicles of the theft: The Perl.com editor Brian D. Foy kept an active log during the incident.

He released the timeline and overall experience in a testimonial worth reading. More info.

 

[DomainRecap]

is 2FA enough would you say?

2FA means absolutely nothing when the social engineering attack takes place through the registrar.

By going straight to the source, the domain thief totally bypasses all the security protocols you have created, and all that's needed is the scammer to convince the registrar CSR that he is you, and that "you" have lost your password/phone/ID/whatever and are in dire need of help.

 

[AEProgram]

2FA means absolutely nothing when the social engineering attack takes place through the registrar.

By going straight to the source, the domain thief totally bypasses all the security protocols you have created, and all that's needed is the scammer to convince the registrar CSR that he is you, and that "you" have lost your password/phone/ID/whatever and are in dire need of help.

A CSR rep has such power to just move around domains?