Got Hijacked

Need help because my domain was hijacked

[vegas]

Thiose who are familiar with ICANN you help is needed. I baught a domain 5 years ago, it has a PR of 9. About a month ago I had some problems with my email and it turnes out my ISP changed the password. I guess ehile it was out someone made a WHOIS change and moved it from NetSol to Go daydaddy. The email was still forwarded to me and I never thought to check it.

Turns out last week my email stopped coming in to my forwarded address and now I find out this all happened.

It is locked at GoDaddy and the owners name hidden. What can I do to get it back?

Thanks,

[davezan]

Yours will be a difficult, if not impossible, case to solve.

Most, if not all registrars, won't help out unless forced to by either a court order
or ordered by a law enforcement agency to cooperate in the investigation of a
case.

In your case, I hate to say this, but you will definitely have to seek legal advice.
But even that may not be helpful if your attorney is not well versed in this field.

Some questions, though:

1. Why did your ISP change your email password?

2. Was your email in question the one listed in your
domain name's WHOIS?

The difficulty lies in being able to prove to all parties concerned that a hijacking
did occur.

Tell you what: email me thru here and I may be able to help, though I can't assure
you it'll result in getting your domain name back, being a tough problem as it is.

[encyclo]

Welcome to WebmasterWorld [webmasterworld.com], vegas.

All I can really say is: you need legal advice from a specialist domain name lawyer. It looks like you've been defrauded, and so you will need to pursue this matter through the legal system.

Bear in mind that it can take years to get a domain name back, and it could well cost you a lot of money. So, good luck.

[killroy]

As as side note, doesn't the new system invite this to happen frequently? How can a property transfer occur BY DEFAULT without any intervention of the owner? I never got that about the new system.

SN

[Jon_King]

At this point, it is not the pointing of the domain you should be concerned about. It is the Administrative Contact and Technical Contact that controls access to your domain. Can you login onto your registrar account using the email address found in the Whois? If so great, you can make any changes you need. If not write the registrar and tell them you want to change the Admin Contact and they should offer to email or fax a form you fill out stating your rights to the domain and they will change it.

[edited by: Jon_King at 2:24 pm (utc) on Oct. 18, 2004]

[vegas]

Well I dont want to mention the domain name for fear the wrath of google but this is a very large site. It is currentl up. The hijackers DNS servers are pointing to me still! Can you beleive it.

The one in question was the password that was changed.

[vegas]

I am no longer the contact. My register is no longer the registrar.

[bakedjake]

Did you let it expire?

[vegas]

No. Not expire. It was hijacked. I trying to find out if there is a time frame that ICANN allows for a swtich from one authority to another to be reversed. Otherwise i'm up crap creek.

[DaveN]

Sue the ISP!

[vegas]

THE ISP? That doesn't make sense.

NetSOL had it. Hijacker moved it last month. Still has the DNS pointing to my host. My email does not forward for the domain.

The registar is nowgodaddy and is protected.

[DaveN]

for a hi-jack to work the email has to be sent releasing the domain....

[davezan]

From your post, I speculate someone gained access to your email, used that to
obtain the user login, then went inside your account, made changes, then ACKed
(ACKnowledged) the transfer.

[edited by: rogerd at 5:43 pm (utc) on Oct. 18, 2004]
[edit reason] no e-mails, please [/edit]

[vegas]

That is what happened.
I'm wondering what recourse I have..

[davezan]

To directly answer your question, your best recourse is to seek legal help
and law enforcement. Doesn't the FBI have a group working on Internet fraud?

[edited by: tedster at 8:22 pm (utc) on Oct. 18, 2004]

[bakedjake]

I'd call your registrar and ask who approved the transfer. They will certainly have record of that.

[devildude8989]

Call NSI and call GoDaddy. GoDaddy is a hard cookie in regards to stolen domains, but NSI isn't.

[bakedjake]

Not true. NetSol is extremly agressive in pursuing stolen domains. Been there, done that.

[davezan]

When investigating an unauthorized transfer, you need to talk to the registrar
the domain name was transferred from. Find out from them what documents
they may require to prove such a thing occurred.

If NetSol tells Go Daddy the transfer was fraudulent, that'll be a start.

Since emailing here isn't an option, can you provide the domain name? I might
be able to get some answers.

Also, was the domain name registered to you directly or to another entity, be
it a person or company?

[Webwork]

This will come down to 'proof': proof that the domain was ever registered to you, personally, as registrant; proof you paid renewals, that it didn't lapse; proof you were the registrant, not just the admin contact; proof that 'you' actually 'owned it', versus you were acting in a trustee capacity of the web id, such as a web designer who handles renewals/registrations as part of an entire 'service package'; proof that 'you are one and the same' as the registrant - not just sharing the same name (i.e., proof of proper address, etc.); proof that you didn't authorize the transfer meaning proof that your email account was somehow hijacked; etc.

Get your paperwork in order: Charge card receipts for domain payment; copies of acknowledgements that you paid to renew this particular domain, which is usually handled by a responsive email.

If you claim you 'owned the domain' starting several years ago, but don't have proof of payment of annual renewal fees, then something doesn't add up.

It's all about the proof.

[vegas]

Thank You.

You can close this thread.

[EliteWeb]

Last I checked Netsol allows transfers away without approving the domain transfer. The only way to stop it is to watch your emails (which you didnt in this case) or lock the domain :D

Now you have to prove that you didn't transfer out the domain. Time to get NetSol on the phone and cry fraud :P

[div01]

Any updates?