11 ms·
My .in domain has been transferred to another registrant without notification
- sandGorgon 7y agoThis is a malware takedown. And must definitely have happened at international law enforcement level. NIXI is regulated by Indian law and is the cctld registrar of .in . The domain records show a registry lock and the new owner being "The Verden Public Prosecutor's Office". This is not common in India.
- whalesalad 7y agoI just bought a .in domain for a side project and was a little worried about this sort of thing being possible based on my experiences with registration.
- nnain 7y agoThere's an update on susam.in. He got the domainname back.
- yowlingcat 7y agoFascinating. The NameCheap CEO is in the replies, and seems to be saying that the registration was pulled at the registry level for some "perceived violation or legal request" -- I'm kind of curious regarding what protocol is for these kinds of situations, and how much they vary from TLD to TLD. I think about the once-popular .ly TLD becoming less popular after instability hit Libya, but I'm curious about what the other case history is here.
- dylz 7y agoThis was pulled at the registry level: Registrar: NIXI Special Projects Registrar IANA ID: 700066
- tzs 7y agoFor the curious, NIXI is the "National Internet Exchange of India", a government non-profit in India. INRegistry, the organization responsible for the .in TLD, was created by NIXI and operates under them.
- belorn 7y agoI work at a registrar and as far I know there are no protocols. We are an intermediary between the registry and registrant (in those TLDs which have a registry/registrar/registrant model), but the business relations involved are a bit more complex. The registrar's job is mostly set to only handle the technical and billing aspect, while the legal relationship is between the registry and registrant. Who owns a domain and which registrar handled the billing and technical aspects is a legal decision which is outside the control of the registrar. The variation between TLD and TLD is massive. Practically all ccTLDs have their own home made rules and more often than not their own technical solutions to match. A big reason why the more exotic ccTLD's can cost a lot of money is the hoops that registrars need to jump through, both legal and technical, and the "workarounds" for both.
- walrus01 7y agoThere are even ccTLDs like .af (afghanistan) where the root zonefile is edited by hand for every new domain, in this case by some persons at the "ministry of communications" in kabul.
- balls187 7y agoThere are other threads that mention this, but his domain was transferred over to Law Enforcement.
- CaliforniaKarl 7y agoImportant to note here that the Registrar (Namecheap) is working the issue[1], and that the domain was pulled from them outside of their control[2]. [1]: https://twitter.com/namecheap/status/1200682593500483584?s=21 https://twitter.com/namecheap/status/1200682593500483584?s=2... [2]: https://twitter.com/namecheapceo/status/1200714718610153472?s=21 https://twitter.com/namecheapceo/status/1200714718610153472?... (This is from Namecheap’s CEO)
- block_dagger 7y agoI’ve run a .in site through Namecheap for 6 years. Glad they are responding to the issue.
- propter_hoc 7y agoYeah, unfortunately, domain squatters have poisoned the well for .com domains. There are many, many domains which should be available for use, but are being squatted indefinitely for speculative purposes. This has caused pretty much every new company to migrate to TLDs like .co, .ly, .me, .ai, .in, and .io. Since these are almost all ccTLDs run by countries, governance is not great. .io has been particularly bad; * https://news.ycombinator.com/item?id=15293578 https://news.ycombinator.com/item?id=15293578 * https://www.theregister.co.uk/2019/05/27/io_domains_uk_un/ https://www.theregister.co.uk/2019/05/27/io_domains_uk_un/
- deleted 7y ago[deleted]
- endorphone 7y agoPeople who lawfully own a domain -- even if in a speculative fashion -- are not domain squatters. If you had a hot new product called CyberTrk and someone ran and registered cybertrk.com, that is arguably squatting and can be legally enforced as such. If you have what you think is a great new online notepad and notes.com is sitting registered but dormant, the inelegant but reasonable way to respond to your situation is "tough shit". Keep looking. 99% of the time that people rant about "squatting" they're talking about the latter case. Yet they are not entitled to a domain because of some imagined better use for it. Sorry for the rant, but misclaims about "Squatting" lead to an iffy area where people have a profound misunderstanding about property rights. I have zero "parked" domains, but contemplating the issue long ago made me less outraged when I lazily searched for the most blatantly obvious domains.
- pjc50 7y agoInternet domains are not property, and to the extent they are, they are all the property of ICANN. The delegation system is somewhere between leasing and feudalism. You can tell it's not property because the one thing that's guaranteed to result in losing a domain is failing to pay the fees. The idea that first registration entitles someone to (a) waste a finite resource forever and (b) sell it at arbitrary prices later was fought out in the early 00s, and the real WIPO trademark system won. A number of people who had squatted the names of famous companies in hope of extorting a payout were disappointed.
- leetsec 7y agoThe OP here is also the author of MathB.in, a popular math pastebin. He has decided to shut down MathB.in now as a result of this incident. Quoting from http://mathb.in/6 http://mathb.in/6 below: > I have considered shutting down this website several times in the past. But when another of my domain, susam.in, where I used to host my personal blog (archive) was seized and transferred to a law enforcement organization without any notification or authorization, it was the last straw. I do not wish to spend my weekends worrying about spam and unlawful content. I do not wish to maintain constant vigilance on my online servers to maintain ownership. It consumes time, more time than I can afford. This is sad for WWW. We need more independently run websites, not less. The web of early 2000 is rapidly disappearing.
- deleted 7y ago[deleted]
- jorvi 7y ago> This is sad for WWW. We need more independently run websites, not less. The web of early 2000 is rapidly disappearing. Its still there, but there is a lot less of it. Recently I've decided to go back to ownership of my music and rebuild my old (~20 000 track) collection. Some of the stuff is rather obscure so I end up on niche blogs with pixelated-animated favicons, no weird whitespace and sometimes almost bare HTML. Definitely makes for nostalgic feelings..
- tomrod 7y agoCan we build another one?
- frou_dh 7y agoIf someone steals your domain registration, they can then change the MX records and start receiving your email. In some scenarios, I think that could be a more serious consequence than the website being down or replaced. Same reason that deliberately letting domain registration lapse for a domain that was used widely for email is a scary prospect.
- zenexer 7y agoAdditional information and discussion: https://gist.github.com/susam/3cb42e571c4ab12987b286791bdfe9d2 https://gist.github.com/susam/3cb42e571c4ab12987b286791bdfe9... Commenters have speculated that the domain was seized by law enforcement due to participation in a malware campaign. The domain in question may have been used by malware that was phoning home, perhaps because the Linode server hosting it was compromised. This stems from the fact that the domain's new nameservers are Shadowserver's sinkholes: Name Server: sc-c.sinkhole.shadowserver.org Name Server: sc-d.sinkhole.shadowserver.org Name Server: sc-a.sinkhole.shadowserver.org Name Server: sc-b.sinkhole.shadowserver.org Edit: When querying the domain in RiskIQ, one of the Linode IP addresses formerly associated is tagged with `emerging_threats` and `kaspersky`. Other domains/subdomains associated with the same IP address have similar tags. One such domain is MathB.in, which is a public pastebin. It's conceivable that malware was phoning home by creating pastes on that site. Susam, I don't have much experience recovering domains in this state, but it's conceivable that Namecheap will be able to put you in contact with someone who can help resolve the matter. However, if there's something like a sealed court order involved, you may find that you're stonewalled at first. I don't know if there's any available recourse for this, especially since this appears to be an international effort.
- axaxs 7y agoabsolutely. I recognize those nameservers from my work in a registry, and usually came as a request from a federal agency.
- hsivonen 7y agoAt least as of a couple of years ago, Shadowserver could accuse you of botnet participation on such flimsy evidence that it was way too easy to frame someone else as being a botnet participant. I don't want to give ideas how, but it happened to me. Since then, I've configured my firewalls to block traffic to Shadowserver IPv4 space. I'm more worried about getting framed again than actually getting a botnet infection and not getting notified.
- foob4r 7y agoSeems like the most likely case is that law enforcement clawed the domain for suspicious activity. Which brings up the question, is this problem limited to ccTLDs or TLDs like com, net as well?
- CydeWeys 7y agoYou have much more protections on gTLDs than on ccTLDs (where you have none). I've always wondered why so many people are using .io domains (and now .ai domains).
- btashton 7y agoI think some is hype, but also there are so many .com domains being squatted on. I'm only willing to pay so much to host my personal site.
- CydeWeys 7y agoThere are hundreds of gTLDs available now, all operating under the same contract with ICANN (i.e. you as the registrant get there same protections).
- marcosdumay 7y ago> You have much more protections on gTLDs than on ccTLDs (where you have none). Hum... No. On ccTLDs you have the protections the issuing country gives you. On gTLDs, you have the protections the US gives you. Some countries won't protect your domains at all, others will protect it even more than the US.
- ur-whale 7y agoOne more reason why DNS must as quickly as possible be migrated to a decentralized blockchain. I'd say DNS is the poster-child example of why - in spite of all the naysayers - blockchain is a desperately needed technology.
- number6 7y agoFirst I was like: what a stupid idea, silly blockchain guys. But than I thought: a decentral ledger is not much different from the original DNS idea.
- bumbacloth 7y agoThey had namecoin for ages now.. but you need a browser extension to visit .bit domains in the browser
- CharlesW 7y agoIt amazes me that anyone with any awareness of how much Bitcoin has been lost or stolen (to name just one issue) can demonstrate this kind of magical thinking.
- ben509 7y agoIt's all been lost by third parties, though. Any idiot can make a pretty webpage advertising BitCoinBank and all the best thieves in the world can try to break in.
- CharlesW 7y ago> It's all been lost by third parties, though. Sadly, no. In addition to the hive of scum and villainy that are Bitcoin exchanges and other ecosystem players, there are a thousand stories of first-party losses. https://www.wired.com/story/wired-lost-bitcoin/ https://www.wired.com/story/wired-lost-bitcoin/
- ben509 7y agoI didn't consider user error because if we apply that objectively we'd have to say that standard fiat currencies don't work because people routinely lose cash to loss, theft, fire, flood, etc. My point with bitcoin is that bitcoin itself works as advertised. But like gold, directly working with bitcoin requires a good deal of specialist knowledge. That's why, as with any medium of exchange, you need an infrastructure to manage funds and enable transactions, and the crypto-monkeys are trying to replicate systems that developed over centuries.
- putlake 7y agoThe same thing happened to my .cm domain with Namecheap a few weeks ago. They were eventually able to recover it. But there was no communication from them for quite a few days.
- susam 7y agoI was able to recover my .in domain too. Here is the full complete story: https://susam.in/blog/sinkholed/ https://susam.in/blog/sinkholed/
- deleted 7y ago[deleted]
- rhizome 7y agoCapitalist interests prefer less competition, the end goal is monopoly. People are trying to raise the prices of .org domains too, so I feel like a hammer is about to fall as far as the practical level of involvement and presence on the internet goes for individuals the world over. Keep an eye on the canary in the coal mine, or even deploy several of them.
- erikpukinskis 7y agoSad, but also promising. Our WWW was only V1 of the people’s internet. There will surely be another, more radical in its decentralization. I love the WWW, but I don’t mind if Capital will take it. They’ve already ruined much of it... the ads, the surveillance, SquareSpace’s cookie cutter stores, ES6, Webpack, etc. Erasing everything that was good about the old days. The old will rise again anew.
- dang 7y agoPlease don't take HN threads on generic ideological tangents. They lead to generic ideological flamewars, which are all the same. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html We detached this subthread from https://news.ycombinator.com/item?id=21671771 https://news.ycombinator.com/item?id=21671771 and marked it off-topic.
- onetimemanytime 7y agoMore or less in a lot of countries with fishy legal system you have zero protections with their .cctlds. Even then the courts might rule that the name is not property or whatever. In a lot of countries you will lose the name if the well connected person there wants. They'll find a justification that doesn't pass any smell test but you're out of luck. Nothing, absolutely nothing can be done. So use them, but be prepared to lose your names. Everything is fine, until it isn't.
- onetimemanytime 7y agomalware is my guess. New registrant is The Verden Public Prosecutor's Office which shows up on: "Over the following years, the Luneberg police and the Verden Public Prosecutor’s Office, in combination with the BSI, FKIE, BFK, and numerous other law enforcement and industry partners, continued investigating the Avalanche network, discovering a massive operation responsible for controlling a large number of compromised computers across the world. https://www.symantec.com/connect/blogs/avalanche-malware-network-hit-law-enforcement-takedown https://www.symantec.com/connect/blogs/avalanche-malware-net...
- Avamander 7y agoIn order to reduce risk I really wouldn't recommend running any service that hosts any user content on the same domain and TLD you host your personal stuff.
- edoceo 7y agoSame domain I get but a new TLD? I like to keep stuff in '.com'
- tzs 7y agoI've sometimes wondered if it would be worth getting something like 4e4eee247a69fab841ec36eabc95eee9.com [1] and only using it for email hosting to host my contact emails and for my other services. The idea is: 1. By having no other services on it that minimizes the chances that it could get hacked and used for nefarious purposes that might get it seized by law enforcement. 2. By using a meaningless name like 4e4eee247a69fab841ec36eabc95eee9 there is no chance someone will come along with a trademark claim or an accusation that I'm squatting on a name that they have a better claim to. [1] dd if=/dev/urandom bs=1 count=16 | xxd -g 16
- deleted 7y ago[deleted]
- gesman 7y agoThat's a problem with all country-specific TLD's. At any moment country 'X' can decide to take over '.xx' and nothing anyone can do.
- instakill 7y agoWhich TLDs are immune to this kind of takedown request?
- RKearney 7y ago.onion
- mirimir 7y agoIf I could magically put this at the top, I would. There are other options, but they require hosting on overlay networks, and running your own name servers. But then people must install suitable gateway routers to reach your sites. Those can be VMs, but it's nontrivial for most people.
- FfejL 7y agoI had this happen to a .com domain I own, also at Namecheap. In my case it was actually a trademark infringement legal action. My domain got listed as hosting a site that sold knock-off sunglasses[1] . The plaintiff in the case got a court order to transfer all the suspected domains to them, a list of about 1,000 domains. I got no notice, my domain just suddenly disappeared. I had my lawyer contact the plaintiff, in which we apologized, told them we had no idea this had happened, and promised to up the security (in reality I just nuked the WP site.) About a week or so later they transferred the domain back. For me this was annoying and cost a few hundred bucks in legal fees, but not that big a deal. Obviously not the case for Susam. [1] My (largely abandoned) self-promotion Wordpress site got hacked, and was used to host an e-commerce site. Weirdly the domain was ${my_real_name}.com, hardly an obvious choice for selling knock off sunglasses.
- anon1m0us 7y agoI actually think wordpress has contributed significantly to the decline of the web. It's not secure. It proliferates so it's easy to hack. It's easy to embed untested plugins in it that are also vectors. It's plagued by all the same problems as microsoft windows.
- a3n 7y ago> I owned this domain for 12 years ... Rented. They rented this domain for 12 years. Not to excuse the appropriation. But no one owns their domain, except possibly govs and mega-corps by virtue of mass.
- mr_toad 7y agoLegally it’s neither. It’s more like paying for a listing in a phone book.
- chatman 7y agoI think he should change his name and get a new domain. It must be hard to have a name like that and trying to live a normal life.
- pragnesh 7y agoI have purchased domain on namecheap based on yc feedback. Looks like i have to rethink.
- dooglius 7y agoI wish we could switch to a system like Tor's onion services where each URL has an embedded key, it would solve so many problems!
- lazylizard 7y agoSo. Namecoin? Onion domains? Opennic? Ipfs? How else can u opt out of icann's influence?
- susam 7y agoThe domain susam.in has been transferred back to me. I've updated the original Gist post with recent updates on why this issue occurred and how it was resolved: https://gist.github.com/susam/3cb42e571c4ab12987b286791bdfe9d2#updates https://gist.github.com/susam/3cb42e571c4ab12987b286791bdfe9... (see the "Updates" section). Summary: The Shadowserver Foundation contacted me by email and informed me that my domain name was sinkholed accidentally as part of an operation they were performing. They have now examined my domain name and found that my domain name should be excluded from their operation. They worked with NIXI to transfer the domain name back to me. Thank you, everyone, for your support as well as for the great quality of discussion on this thread.