Unauthorized Change of Registrants!

William9 · Jun 14, 2003

My monthly domain security sweep just determined an unauthorized change of registrants on one of my .Infos!

I do not know what it means yet. I have E-mailed the registrar and am waiting for the response. I will let you know when I get it.

Whois indicates that the last update was on June 10, 2003, it most probably happened then. I am sweating.

Lesson: Check whois regularly as part of your security procedures. Anyone find anything as astonishing as me?

mole · Jun 14, 2003

Your transfer authorization code or holding account for this name was compromised.

1. Who was your registrar for this domain?

2. Screenshot the current whois for your domain NOW. Also, go to http://www.domainwhitepages.com and screenshot the detailed trace that this service provides.

William9 · Jun 14, 2003

Thanks so much for your thoughts Mole.

I hesitated to respond to your post until I got a reply from the registrar. But without responding to my E-mail, they just changed the registrant back to me.

Actually, I owe the detection of the situation to you. In a post months and months ago, you recommended various steps to take to secure your domains. They included running "Watch My Domains Pro" from Softnic Technologies and other measures. So thank you.

P.S. I am now transferring every non-drop domain out of that registrar as we speak.

hanogl · Jun 15, 2003

I have almost exactly the same experience. About half a year ago I downloaded WMD for at trial and entered my domains. One of them turned out NOT to have my name. The registrar had messed up. Luckily one email was enough to get it restored.

Since then I run WMD once a week, just to see if anything unexpected has changed to my names.

William9 · Jun 15, 2003

If one detects a situation with the registration record, it is a lot easier if you are as lucky as me and it happened only 5 days ago (it could have been 29 days ago because I check them monthly). Or else it may have been a year and a half ago and the records change files were archived by the registrar.

I forgot all about my E-mail change request, but I think I know what happened to this record. This was one of the domains I acquired from a miscellaneous registrar during LR1. The registrar did not have a control panel. Any change such as a registrant E-mail change has to be E-mailed to them. In response to my request, they changed the registrant!