Unauthorized re-direction of a domain...

[wisconsin]

Has it happened to you?

I know some members experienced similar problems in the past. I did too and every time I complained to enom, they would tell me they couldn't help and that I should not make nay changes before I contact them so they can look at the link where the domain is beig re-directed to:

Well I just found the following links on some of my domains and here is one of them:

http://landing.domainsponsor.com/?a_id=1637&domainname=bluevote.com

?a_id=1637&domainname

Please note that I had same domain re-directing to my website just recently and all of a sudden it is re-directing to some else's.

I have contacted enom without making any changes and I am waiting for a reply.

Any thoughts?

Thanks,

 

[sunken]

DomainSponsor is a PPC parking engine, like Sedo or DomainHop. I don't deal much with enom, but I've never had this happen on parked names. It sounds like someone hacked in (or someone that knew your password) and changed them. The a_id= is the portfolio of the person who's account the domain is paying for parking. While it may require a court order to get the identity of the person, you may wish to contact DomainSponsor and see what they will say about it...

 

[IAmAllanShore]

Just for reference:

http://www.namepros.com/showthread.php?t=93464

-Allan

 

[wisconsin]

Update! After back and forth emails, the following is enom final reply: What do you thinK?



--- Agent Reply: Amin Taheri - 6/14/2005 6:51 AM ---

Hello,

I have taken this case at jason's request - We have searched our interface history log - its a log that keeps a reference of everything that people do that changes a domain name. We looked through it, and found nothing in the last year for this domain name. If some one did change it recently we have no way to tell who why when or how.

Amin
Technical Support
www.enom.com/help
ICANN Accredited Registrar


--- Your Reply - 6/14/2005 9:18 AM ---

Amin,
You're saying that you have an interface history log that keeps referrences and tracks any changes made...but at the end of your email, you're saying the opposite, which is " if someone did change it recently we have no way to tell who why when and how"

I am sorry if I understood it differently but it contradict the first statement!

......................................................................................
...................................................................

The matter is simply to discover who's domain sponsor ID is it?

As a Rregistrar, you are obligated to investigate any fraud and I am complaining about one but you are not doing anything about it.

Amin, if you can't help me, I repectfully ask that you put me in contact or forward my communication as soon as possible to your supervisor or manager.

I await your prompt reply

respectfully,


--- Agent Reply: Amin Taheri - 6/14/2005 9:29 AM ---


Hello,

I understand its frustrating. Believe me, if we had any information in our system in any way that could be usefull I would have provided it. The only way we can find out who the id belongs to is to ask domain sponsor themselves. They wont tell us - we wouldnt tell them if the situation was reversed either - its a matter of account security, so I dont blame them. The fact that we have no interface history for this domain name means one of two things. A) the domain was never changed, or B) it was changed so long ago that we no longer have the log info.

Either way we dont have any other info on this at all. I applogize and know I am in no way being helpful, but unfortunately we have done everything we can and havent been able to provide you with anything usefull. Sorry, there is nothing left we can do.

Amin
Technical Support
www.enom.com/help
ICANN Accredited Registrar

 

[Shucks]

I don't know if this will help but . . .

I used google with the following search argument: domainsponsor "a_id=1637"
and found an old reference to domain istra.us which must have been parked at domainsponsor with a_id=1637 as late as Nov 2004. (NOTE: "a_id" is the domain sponsor account ID)

I used samspade.org to get whois info on istra.us:
istra.us = [ 63.251.163.122 ]
Domain Name: ISTRA.US
Domain ID: D4380598-US
Sponsoring Registrar: ENOM INC.
Domain Status: ok
Registrant ID: BB7E1974DEF774CF
Registrant Name: Pavel Korenkov
Registrant Address1: 9 Gvardeiskoi devizii 36-116
Registrant City: Istra
Registrant Postal Code: 143500
Registrant Country: Russian Federation
Registrant Country Code: RU
Registrant Email: [email protected]

Registrant Application Purpose: P3
Registrant Nexus Category: C12
Administrative Contact ID: 507250739343CE6A
Administrative Contact Name: Dmitriy Davydenko
Administrative Contact Organization: GoldHost.ru
Administrative Contact Address1: m-on 6-4-39
Administrative Contact City: Karaganda
Administrative Contact Postal Code: 470032
Administrative Contact Country: Kazakhstan
Administrative Contact Country Code: KZ
Administrative Contact Email: [email protected]
Billing Contact ID: 507250739343CE6A
Billing Contact Name: Dmitriy Davydenko
Billing Contact Organization: GoldHost.ru
Billing Contact Address1: m-on 6-4-39
Billing Contact City: Karaganda
Billing Contact Postal Code: 470032
Billing Contact Country: Kazakhstan
Billing Contact Country Code: KZ
Billing Contact Email: [email protected]
Technical Contact ID: 507250739343CE6A
Technical Contact Name: Dmitriy Davydenko
Technical Contact Organization: GoldHost.ru
Technical Contact Address1: m-on 6-4-39
Technical Contact City: Karaganda
Technical Contact Postal Code: 470032
Technical Contact Country: Kazakhstan
Technical Contact Country Code: KZ
Technical Contact Email: [email protected]
Name Server: DNS1.NAME-SERVICES.COM
Name Server: DNS2.NAME-SERVICES.COM
Name Server: DNS3.NAME-SERVICES.COM
Name Server: DNS4.NAME-SERVICES.COM
Created by Registrar: ENOM INC.
Last Updated by Registrar: ENOM INC.
Domain Registration Date: Thu Jun 19 06: 14: 36 GMT00: 00 2003
Domain Expiration Date: Sat Jun 18 23: 59: 59 GMT00: 00 2005
Domain Last Updated Date: Sat Jun 19 09: 39: 11 GMT00: 00 2004
>>>> Whois database was last updated on: Tue Jun 14 19: 06: 06 GMT 2005 <<<<

If I were you, I'd contact DOMAINSPONSOR.COM and let them know that YOUR domain was redirected to their parking, WITHOUT YOUR CONSENT and with the resulting revenues being directed to one of their accountholders (account ID ds1637).

 

[wisconsin]

Thanks, Shucks! I will contact domain sponsor and see what they have to say!