Had I been empowered to set myself as tech contact this would have never happened. We've set her up on a new domain, but the losses are of course huge - there is a vast amount of printed matter involved.
When we do a whois, she is **still** listed as the domain registrant. Only the tech contact is new (The surreptitious registrant that begins with "I"!)
Why would a registrar leave the original registrant data in the record, and how would they steal it without changing that data? Does it leave an opening for her to regain it?
I've gone over this with the client who is hands-off and knows nothing, and a system admin. None of us know of any real means to regain this name, and she's certainly not going to buy it back.
The FFA may be a function of the lapsed status, not indicative of a theft. Registars are now monetizing "expired but not lapsed" domains by redirecting them to parking feed providers.
Check all facts, quickly. Call the registar. Now. You may find that all you need to do is to pay the renewal.
I'd be more concerned about a change of the Admin contact or Registrant contact info than Tech contact. Only the Admin should be able to update the WhoIs record - so "the update" is puzzling.
Call. Fax letters. Send money. You might be able to fix this. When you call get names and move as quickly as possible up the management chain. Fax lawyer letters if need be and, until this is resolved, SEND THE RENEWAL MONEY - IMMEDIATELY. (If it's expired but not lapsed. Lapsed meaning the registration went beyond the point of redemption.)
but the losses are of course huge - there is a vast amount of printed matter involved.
They stole a whole room full of Banker's Boxes?
Or do you mean that you lost the site content? Or something else?
Site content should not have been lost, unless you were hosting with the registrar. One of the reasons I'd advise never to host with your registrar.
If your site is hosted elsewhere, it's still there, only accessible by IP address.
The domain expired on 12/18, then shows it was updated on 12/20. The customer had no awareness of renewing the registration, yet there it is, renewed/valid until 12/08 and in transfer lock. With the FFA in place, we can only **assume** it was bought and registered. I tracked down the registrant and provider - which are the same company - and provided them the contact details.
By "vast amounts of printed matter" I mean their business cards, letterheads, brochures, and even their student materials all bear the old domain name.
Prior to my original post yesterday I asked them to get more information for me, that I can't just let it go. They were perfectly willing to let it go and go with the new domain name, and take their losses. Still waiting to hear back from them.