Archive for the ‘Domain Security’ Category

Friday, November 16th, 2007

Warning to all Enom domainers

If you have an Enom retailer account or sub-account then you need to be aware that you run a risk of losing your expiring domains.

Most domainers set their domains on auto renew, in order to not risk forgetting the domain expiration date and losing that domain. If your payment method is via credit card you might run into problems with your auto renewal at Enom.

Enom is not allowed to store the credit card CVV ( last three digits on the back of your credit card ) so on random occassions when Enom attempts auto renewal of your domain, the credit card provider ( your bank ) rejects the attempt. Your auto renewal fails, and you lose your domain. The only plausible way to avoid this is to login into Enom every month and enter the CVV… which means you might as well track your expiration date and renew manually.

So, make sure you double check your expirations if you have domains at Enom.

You can get further information here.

Saturday, October 27th, 2007

ICANN to investigate domain name search theft

Have you ever searched for a domain name, found that it was available at the time of the search, only to find it has been registered by someone else when you come back to register it a few minutes later?

Well, apparently enough people have complained about this occurance to indicate that it might not be simply a coincidence every time.

The Security and Stability Advisory Committee (SSAC) of ICANN has launched a probe into what they call domain front-running. The term front-running was coined in the wild west, when land speculators purchased soon to be valuable land based on insider information.

"When the domain name of interest for which an availability check is made is registered shortly after such a check, the individuals making the availability check may reasonably assume that the organization operating the web site or service they used to determine the availability of the name pre-emptively registered the name," said the report by the SSAC.

People have been using whois services and domain registrars to check domain name availability, and presumed occurances of front-running can only tarnish the reputation of the said service in the eyes of the customer.

"Registrants have filed complaints with ICANN, registrars, and with intellectual property attorneys that suggest domain name front running incidents may have occurred," it said. "SSAC does not yet have any hard data to draw conclusions regarding the frequency (if any) of the occurrence of domain name front running."

Even though some of the above mentioned occurances might be down to coincidence, it is very hard to believe that all such domain name searches and subsequent registrations by a third party are merely coincidental.

In any case, I think it is very good that ICANN has taken note and that they will at least raise awareness of the customers concerns.

Tuesday, October 9th, 2007

DomainTools launches RegistrantSearch

DomainTools launched RegistrantSearch this month, a tool enabling anyone to search for domains by registrant names. You simply access their site RegistrantSeach.com, type in the person’s details and hit the sarch button.

According to their press release, the tool has been in beta mode for the past 8 years. They were taking email requests from lawyers and legal representatives and doing brute force searches of their 80 million whois records to pull out data.

After all those years of taking email requests, they finally decided to put together a robust tool for everyday use by every day users. It is pretty damn cool, you go to RegistrantSearch.com, type your neighbours name in and you get a display of all the weird domains they own. Not to mention that you can pull up all the domain names your competitor owns, mark them down and wait for them to expire. Hm, the legal connotations are unlimited.

This is just another excellent tool by the ever growing DomainTools website. One  downside is that currently report requesting is not free, a report displaying all the domains I own would cost $88 US.

Thinking it through, a tool of this form probably should not be free to prevent these exact scenarios I mentioned above. If it were a free tool, the amount of spam, abuse and plain old annoyances to various domain owners would increase tenfold.

Still, I think I’ll hold of getting a report on what domains I own. A list of my competitors however… we will see.

Sunday, October 7th, 2007

Domain Name Scams - Be Warned

I blogged recently about a domain name appraisal scam that seems common these days here. That is not the only scam I have been subjected to over the years.

With the amount of domains I own, I am bound to get a lot of the jerks trying to swindle me out of my online possessions. One common scam that seems to follow me like a flu, is a warning approach where the people in question send me an email warning me about losing my alternative domain name.

Say I own something.com and something.net was available. These scammers ( who happen to be a startup registrar or reseller ), send me an email with a "neighbourly" warning that "some person" has approached them with the intent of registering my beloved something.net. They tell me nicely how they really can’t wait long, and they tell me that they care about me and wanted to offer it to me first. However, since they are a business after all, they need a quick reply on whether I want to get this name, and if I don’t  they will proceed to sell it to the "other person".

How "nice" of them to care about me so deeply. What’s more, they are nice enough to provide me with the link to their page, which I can use to purchase something.net.

I reply "nicely" that I do not wish to purchase that domain name, and if they wish to do so, they can proceed to sell something.net to the "other person".

Even if I wanted to purchase the domain name I would definitelly not go through them. In any case, you get my drift, many people fall for this scam, their first instinct is to buy the domain name in order to protect their brand.

Another popular scam involves a registry which you have never been involved with sending you a warning email telling you that your domain name is about to expire and that if you don’t wish to lose the domain name you should renew it immediatelly. The letter is made out to be a renewal notice, but in actual fact it’s a domain transfer form, and the steps you need to take are actually for a domain transfer.

Again, I didn’t fall for this, but I can understand how some people that are not as technically aware of their domain name facts can easily fall for something like this and never even realise they were scammed into it.

To conclude this rant, be very careful with all email your receive concerning your domain names. Your domains are your real estate, guard them carefully. You should only consider emails that you get from your registrar and even then, your registrar is never going to initiate a weird action concerning your domain name. If you do not understand something, contact your registrar directly and ask. They will welcome your enquiry and help you swiftly. If you are approached by a scammer, note down their details. Write down the email address they use, and if they provided you with a link, use a whois service to find their details and use this to report them to the proper authorities.

If you don’t know who to contact, contact your registrar, they will happily take it further from there.

Friday, October 5th, 2007

Beware of whois monitoring - use Domain All in one

There are many tools and programs that domainers use in their day to day domain name hunting.  One big mistake many make is using online website whois tools. I don’t want to name names, but many whois sites monitor whois queries, and snatch good domain names.

It has happened to me many times. I find a perfect domain name, go to a whois site, type in the domain name and see that it’s available. I go away for cofee, come back in about an hour or so after having decided to purchase the domain name only to find that it has been picked up by someone.

They usually do some domain name tasting with it, they see whether it is getting hits, if not they drop it, however if it is a good domain name, there is no way they will drop it once they have snatched it.

In any case, in order to avoid getting your domain names snatched from under your noses while doing whois queries on various sites, download the Domain All In One tool from DomainState.com. It is located in their tools section and is a brilliant little resource. Not only does it let you do live whois checks on various extensions, but it also does some backlink checking, PR, and overture. And most importantly, a lot of us domainers have used it without ever experiencing a name being snatched from under our noses. I have checked over a 1000 domain names and come back tomorrow to find the domain names still available.

Domain All In One is definitelly worth downloading, and it’s only a 388kb application :).

Wednesday, October 3rd, 2007

Appraisal scams

I’ve had quite a few offers for my domain names over time. There is one kind of offer that I have received numerous times which I would like to warn my readers about. It is a domain name appraisal scam covered up as a domain name enquiry.

Basically, a domain name appraisal company acts as a party interested in the purchase of your domain name. They put together an approach letter like the following email that I received for a domain name of mine:

Hello,
We are interested in xxxx.xxxx
It was listed in auction (your address was found via WHO IS).
Please submit your price for consideration.
Our company is involved in software development/support business. Now domain invetsing/reselling is just an additional direction of our investment strategy.
Looking forward to do business with you.
Regards,

After I received this letter, I replied with something like this "Thanx for the offer. I am planning to develop the domain name in question into a profitable website. However, I value the domain name at $2500, and I will sell it if an offer of that amount is made".

The next email they sent went right for the juggular:

Hello,
$2500?
Ok.
However, before we buy the domain, we have to make sure that it is worth the amount that you claim.
It is nothing personal, we just want to be sure our investment is valuable. We have seen this post <link> at a forum we frequent which shows a link to a reputable appraiser which you can use to appraise the domain.
Please follow that link to get the name appraised and once you appraise it, send us the appraisal certificate.
Once the appraisal is made, we will talk about making a deal.
Do you use escrow? We prefer it.
Regards,

Nice touch, they did not actually include the appraisal link in the email, but rather pointed me to a forum where they had previously posted their appraisal link. Also, notice the mention of escrow… of course they are concerned about the security of the transaction, there is nothing else on their mind :). This domain name appraisal scam is very well planned and very well executed. They want to come across as geniune, and I bet a lot of people have falled for it. After all, a great offer for some of your domain names does not come along that often.

I replied that I value the domain name at $2500 and that I do not need a domain name appraisal company to appraise the domain name for me. They hounded me with another 3 or 4 emails begging me to do an appraisal before they gave up.

The moral of the story? Be careful about approaches for your domain name. Think about this - if you are interested in a domain name and you decide to write to the domain name owner to inquire about purchasing that domain name, are you really going to ask that domain name owner to pay for appraisal for their own domain name? I would think you will do your homework, find out how much that domain name is worth, after all, you are purchasing it because in your eyes that domain name is valuable, and only then will you make an offer. People who ask you to pay for appraisal for a domain name you own are one thing and one thing only - DOMAIN NAMEAPPRAISAL SCAMMERS - so be aware.