Domain Theft-for-Ransom Hits css-tricks.com and Others

An anonymous reader writes "Chris Coyer at css-tricks.com has had his domain transferred from GoDaddy.com to a registrar in Australia where it's being held for ransom. Several other domains have experienced the same theft by what seems to be the same person, and the registrars seem helpless to do anything about it."

Comments

For the curious

[Anonymous Coward]

That phone number looks like a valid aussie mobile number. Who answers?

Domain Name: CSS-TRICKS.COM
            Reseller..............: PlanetDomain Ltd Pty
            Created on............: 4 Jul 2007 16:26:57 EST
            Expires on............: 4 Jul 2019 16:26:57 EST
            Record last updated on: 21 Nov 2011 16:20:33 EST
            Status................: ACTIVE

      Owner:
            oca
              (465144)
                Bakulina 12,
            Kharkiv, gras 61166
            Austria
            Phone: +61.4354353455
            Email:
      Administrative Contact, Billing Contact:
            oca
              (465143)
                Bakulina 12,
            Kharkiv, gras 61166
            Austria
            Phone: +61.4354353455
            Email:
      Technical Contact:
            oca
              (465145)
                Bakulina 12,
            Kharkiv, gras 61166
            Austria
            Phone: +61.4354353455
            Email:

      Domain servers in listed order:

      No name servers present.

Re:Umm....

[John Hasler]

It's certainly a crime, but it is fraud, not theft (just as copyright infringement is not theft). Theft involves deprivation of possession of chattel property.

Re:So out of curiosity,

[John Hasler]

> Who is a reputable registrar these days?

Gandi.

Re:Gmail problem

[cultiv8]

As noted in 2008 on Mashable:

According to a proof of concept by Geek Condition, there is a security flaw in Gmail that allows an attacker to forward GoDaddy account reset information to the offending party unbeknownst by the victim. This is done by creating a filter that forwards GoDaddy’s “change of password” mail to the attacker and deletes it from your inbox.

Re:So out of curiosity,

[tomp]

Gandi rocks, no doubt about it. However, they cannot protect a domain owner from the US government.

I have my domain there because they respect the rights of a domain owner far more than other registrars, but there's nothing they can do if the US government wants a domain in a US-hosted top level domain. When it comes .com, .net, or .org, NSI is all that matters. And unfortunately, they don't care about domain owners.

Re:Umm....

[the eric conspiracy]

Legally fraud is a form of theft, i.e. theft by deception.

Re:ICANN

[Tacvek]

ICANN cannot technically do that, since they don't actually control the content of the TLD. The Domain Registry (Verisign) could technically reverse the transfer, but are bound by ICANN policies that likely prevent them from doing anything. ICANN in conjunction with Verisign could get the transfer reverted, but since that requires two entities working in concert, I would not count on it happening.

Of course the Australian registry could determine that the transfer was fraudulent, and transfer it back to Go Daddy as a registrar (who is bound by contract to return it to the control of Chris Coyer), and provide information about the fraud to the police, but since that is not in their interests, they will never do that either.

Re:So out of curiosity,

[The Blue Meanie]

Nope, you misunderstand. I got them to issue one of the free certs for one of my domains (I use Gandi for all of my registrations), and it works perfectly with all major browsers out of the box.
All you have to do is add Gandi's intermediate certificate (the cert that links their signature on your free cert to the base CA cert that's in everybody's browser), but you do that on your server (web/mail/whatever) and offer it up as part of the SSL negotiation. It works perfectly, and transparently. It is definitely NOT like the hassle of a self-signed certificate, where you DO have to either add the "security exception" to every client's browser, or get them to install your cert into their browser ahead of time.

Re:Umm....

[mysidia]

and secondly, godaddy can't actually do anything about it because they don't own the domain anymore.

There are things they can do about it, the ICANN Inter-Registrar Transfer Policy says so, so does the ICANN Transfer Dispute Resolution Policy,

The Gaining Registrar must retain, and produce pursuant to a request by a Losing Registrar, a written or electronic copy of the FOA. In instances where the Registrar of Record has requested copies of the FOA, the Gaining Registrar must fulfill the Registrar of Records request (including providing the attendant supporting documentation) within five (5) calendar days. Failure to provide this documentation within the time period specified is grounds for reversal by the Registry Operator or the Dispute Resolution Panel in the event that a transfer complaint is filed in accordance with the requirements of this policy.

If either a Registrar of Record or a Gaining Registrar does not believe that a transfer request was handled in accordance with the provisions of this policy, then the Registrar may initiate a dispute resolution procedure as set forth in Section C of this policy.

Registry Operator must undo the transfer within fourteen calendar days unless a court action is filed. The notice required shall be one of the following:

Agreement of the Registrar of Record and the Gaining Registrar sent by email, letter or fax that the transfer was made by mistake or was otherwise not in accordance with the procedures set forth in this policy;