11 ms·

This Site’s Domain is Stolen

355 points by tbassetto 15y ago

VMG 15y ago
In case the nameservers actually update: http://64.13.251.230/ http://64.13.251.230/
- benatkin 15y ago
  and if it updates add this line to /etc/hosts: 64.13.251.230 css-tricks.com I think I got that right. :)
masenf 15y ago
could it be related to this: "After a series of one-sided hearings, luxury goods maker Chanel has won recent court orders against hundreds of websites trafficking in counterfeit luxury goods. A federal judge in Nevada has agreed that Chanel can seize the domain names in question and transfer them all to US-based registrar GoDaddy. The judge also ordered "all Internet search engines" and "all social media websites"—explicitly naming Facebook, Twitter, Google+, Bing, Yahoo, and Google—to "de-index" the domain names and to remove them from any search results." http://arstechnica.com/tech-policy/news/2011/11/us-judge-orders-hundreds-of-sites-de-indexed-from-google-twitter-bing-facebook.ars http://arstechnica.com/tech-policy/news/2011/11/us-judge-ord...
- nknight 15y ago
  You think Chanel cares about a web design website called CSS-Tricks?
- cube13 15y ago
  Except... the domain was transferred AWAY from GoDaddy.
- billpatrianakos 15y ago
  Absolutely not related. I truly hope you made this comment out of pure and sincere ignorance. This isn't a story about rights being trampled on no matter how hard anyone may try to frame it that way. This is just another case of someone getting their email broken into and the byproducts of that break in which in this case was a stolen domain.
ImprovedSilence 15y ago
Judging from the comments on his website, it sounds like everybody and their grandma hates GoDaddy. I've recently been looking into getting a domain name and starting a website, can anyone point me towards a more reputable site to acquire a domain and host a site? (Yeah, I know, I read HN daily, and I'm still clueless when it comes to actually putting up a website)
- tdoggette 15y ago
  NameCheap is good.
  - nicwest 15y ago
    second that, been using them for the better part of decade, never any problems.
    - sunchild 15y ago
      Me too. No issues after many years of namecheap.
      - hornbaker 15y ago
        Another vote for NameCheap. Have had ~50 domains with them for nearly 5 years now, never a problem.
        dctoedt 15y ago
        +1 for NameCheap. (Not to beat a dead horse, but back when we could see the karma numbers for comments, it was possible to visibly "second" an endorsement comment by upvoting it, instead of posting separate +1 comments like this one ...)
        mikeleeorg 15y ago
        Another vote for NameCheap. And to make this comment more useful... I especially love how easy it is to transfer domain names between NameCheap users. I had purchased a domain name once with my personal account. Then I created a company and wanted the domain to be officially owned by that entity and not me. So I created another NameCheap account for that company, then transferred it over very easily. Of course, it's possible other registrars offer such a frictionless transfer process between account holders too. I've only used NameCheap for this and can say I was pleased with the results.
pud 15y ago
This makes me worry about my own domains. I have about 180 domains with GoDaddy (all registered for various projects -- I'm not a squatter). I wish there were a tool that would verify that they're all still registered under my account at GoDaddy. Especially since the "new owners" seem to keep DNS records the same.
- loopdoend 15y ago
  I transferred all my domains to moniker.com and have an account rep that calls me if any odd activity occurs. I doubt this would happen with them. They allow you to lock down your domains so that it requires offline authentication to move them. Been with Moniker for 4+ years.
  - trafficlight 15y ago
    Another vote for Moniker. I transferred everything from GoDaddy to Moniker a couple years ago after GoDaddy pulled some other asinine stunt.
  - rokhayakebe 15y ago
    How long did the process take, and did this create any issues with live sites?
  - citricsquid 15y ago
    Problem with moniker is poor security, they have no protection against bruteforcing. You can endlessly try to login to an account, which isn't necessarily a problem for people with a secure password but it does open up my own concerns about poor security elsewhere...
- larrys 15y ago
  "all registered for various projects -- I'm not a squatter" One of the reasons domain prices are low is that people register domains they are not using. Just like they buy books they don't read. Or buy jewelry they don't wear. (And yes bring on all the replies about the differences that you want but keep in mind the time you picked up the last item on the shelf at the drug store that maybe someone else had a greater need for down the road. Or took the last seat on an airplane.) No problem with buying domains and letting them sit there until you decide what to do. No problem buying domains that you think you could sell either, in general. As much as this might piss people off who feel the domain should just be there ready when they want it. Squatting would be registering a domain that specifically (edit: and reasonably) belongs to someone else. Say you hear the local pizzeria opening is called "xyz pizza" and you register "xyzpizza.com". Despite what the media and all the typical articles say about this. By the way when you say "all registered for various purposes" there is no qualification about what the purpose is so essentially some people would define you as a squatter depending upon the way they see this issue.
someone13 15y ago
I would warn everyone that reads this to be very careful. When a domain is stolen, it's usually not used for "legit" purposes. Be very careful when visiting this site - use a patched browser, Java + Flash + Acrobat, etc., in case the new "owners" decide to stick an exploit kit here.
- vegardx 15y ago
  Why would they need access to the domain to do that?
  - ek 15y ago
    Because they would mirror the site and then add bad stuff, so it looks legit, and then change the DNS record to point to the mirror.
    - vegardx 15y ago
      I cannot really recall that ever happening for, like, the last 10 years. I could see the case if they wanted to intercept mail or something, but then the administrator would notice quite fast what was going on (ie. not receive any mails...).
      - pavel_lishin 15y ago
        Unless they were making copies and forwarding the e-mails on.
      - ajross 15y ago
        Why would a mail interception not simply relay the mail back to the originally intended server (which, for obvious reasons, is happy to accept mail for the targetted domain)? The point is very valid: someone who controls a domain can trivially MitM any communication with that domain over unencrypted HTTP. And given events of the past year, I wouldn't put it past them to be able to get a cert issued for the fraudulent domain too...
      - 15y ago
16s 15y ago
Seems there is no idea how it happened yet. Perhaps a weak password... so weak that it was easily guessed? That would be my first bet.
brokentone 15y ago
I'm curious to know if the domain was in REGISTRAR-LOCK at the time. According to GoDaddy's policies, they relock after 30 days, so it's likely it was locked. http://help.godaddy.com/article/410 http://help.godaddy.com/article/410 (obviously an outside domain transfer is not the only option for takeover)
SahidK 15y ago
This is scary, I have all my domains with godaddy!
bittermang 15y ago
Problem goes beyond just css-tricks.com. I've been following David Walsh for a while, and apparently his domain has been nabbed as well, along with DesignShack.net, SohTonaka.com, and InstantShift.com https://twitter.com/#!/davidwalshblog/status/142645321791586304 https://twitter.com/#!/davidwalshblog/status/142645321791586...
- SystemOut 15y ago
  I thought something weird was going on since the sohtonaka.com domain is available when I checked at namecheap.com. Then I noticed that both the tweet and the above message misspell sohtonaka.com - it should be sohtanaka.com.
- ecaron 15y ago
  It also happened to mckmama.com (a crazy popular blog my wife follows who couldn't believe that domain hacking was even possible anymore.) The more interesting aspect was that since mobile nameservers are slow to update, the site worked on her phone still. That lead to the lovely "Where does DNS come from" conversation we all have with our loved ones eventually:)
ereckers 15y ago
I remember reading about this happening to a few other design blogger websites over the last few weeks. I'm still trying to wade through the "I hate Godaddy" posts to find if anyone has any idea why this might be happening. I'm guessing weak passwords.
- billpatrianakos 15y ago
  I waded through most of it and it seems as though the domain owner's email was broken into which then allowed the thief to begin the transfer process. So from what I'm reading here it actually wasn't GoDaddy's fault but just another Gmail account broken into. I hate GoDaddy more than probably anyone here but it looks like their upselling and bad design didn't cause this one. Rats! I really wanted another excuse to talk shit about GoDaddy.
EGreg 15y ago
Would locking your domain name at GoDaddy help? http://help.godaddy.com/article/410 http://help.godaddy.com/article/410 I am just wondering for my personal info, I have lots of domains hosted with them
bborud 15y ago
I moved my domains away from GoDaddy primarily because I grew tired about all the desperate upsell spam they sent me ALL THE TIME. Secondarily I moved because they are so big that if anything happens to my domains the chance I get to speak to a reasonable person are practically zero. Find a smaller registrar, make sure you can get proper support from them, then move your domains there. (Recovering a domain you have lost is orders of magnitude more expensive than taking steps to reduce the chance of it happening in the first place)
farico 15y ago
Godaddy stole phpiseasy.com from me too. Not sure who to trust anymore
libraryatnight 15y ago
The only way the domain would be able to be moved from Go Daddy would be if the person stealing the name had access to the account, that's the only way to request the transfer authorization / epp code. Their support requires either a pin or last 6 of a CC used on the account to validate callers, if you can provide that they'll update the email on file and help reset the password, but he said his account email is unchanged. So the person taking the name would either have to know the account password, or have access to the email address on file where the reset requests are sent. Given that this would have to happen from inside the customer account, I can understand why Go Daddy would want to confirm that this was indeed a nefarious act and not something like a domain being sold, transferred, then reported stolen to keep the cash and get the domain back. Or any number of other scenarios one might think of - shady domain stuff happens a lot. I can only imagine the hoops required to jump through for a registrar to get a domain back from another registrar under these circumstances.
- arn 15y ago
  "The only way the domain would be able to be moved" Not sure that's the only way. That's like saying the only way you could get credit card information from Sony's playstation servers was if you worked in Sony's billing department. Not saying this is necessarily a hack, as it most likely is insecure practices on the part of the user, be it passwords or phishing. But seeing a cluster of them raises some concerns that it could be some otherwise unknown method.
  - libraryatnight 15y ago
    Thanks, I agree, 'the only way' is probably too absolute a phrasing. I do wonder if the reason we see clusters is because they are the largest, and arguably the most publicized, registrar in the U.S., and in terms of market share, the world.
    - SomeCallMeTim 15y ago
      He said on the page that it apparently involved a Gmail hack of some kind, so even if it's not "the only way", it sounds like it was how it was stolen in this case.
drivebyacct2 15y ago
First line: "... GoDaddy". Laughed and closed the page. Even if it's not their fault for the original transfer, the headache of support is on you. edit: Sorry you don't like to hear it? You get what you pay for, and you get what deserve for not shopping around and just going with the brand name that stuck because their CEO shot an elephant.
- ceejayoz 15y ago
  Once it's transferred away, GoDaddy has no power over it. Even the best support team can't do anything more than "give it back, please, new registrar".
  - larrys 15y ago
    I upvoted you but that's not true. The best support team can get on the phone with the other registrar and do something. They don't have to but they can. But sure they can just as easily go for the low hanging fruit. As a registrar we have access to exclusive contacts at other registrars as well as in many cases personal relationships. If we want to help you there is plenty we can do. Yes in the end it's up to the other registrar. But there are professional courtesies as well and other ways of getting things done.
    - ceejayoz 15y ago
      In no way have you disagreed with me. You just reworded my "Even the best support team can't do anything more than 'give it back, please, new registrar'" statement.
      - ceol 15y ago
        larrys' point is that there's a difference between begging the other registrar and using professional connections to ask for favors. Your original comment implied GoDaddy could do nothing the previous owner of the domain could do when that's not the case.
sloak 15y ago
I mostly use Google Apps with enom, since it gives me the domain + email & all other google apps goodies "for free". That said, I want to move a few domains away from GoDaddy but I am a bit confused how to do it the right way. Anyone have a good order-of-events list? I'd hate to lose the domains over a technicality when transferring. [edit: misspellings]
whileonebegin 15y ago
There are a lot of posts blaming GoDaddy. Did anyone read the post by David Airey, linked in the article? The reason for his lost domain was that his Gmail account was hacked. The attacker performed a "legit" domain transfer through his registrar. It wasn't the registrar's fault, in this case. The only blame you could place was that perhaps the registrar didn't have enough security check points. GoDaddy is certainly annoying with their obnoxious web site and sometimes, their tactics, but this could be another email-hijack attack.
- paul9290 15y ago
  Yeah i am thinking this too. I mean a day or two ago Gmail was showing and promoting users to enable 2 step verification because thousands and thousands of gmail accounts are stolen everyday (something to that extent). Big fish are big targets and gmail like godaddy and bank of america may no longer be safe and or wise to maintain your business with!?! I have had issues with all 3 mentioned.
- paul9290 15y ago
  Yeah i am thinking this too. I mean a day or two ago Gmail was showing and promoting users to enable 2 step verification because thousands and thousands of gmail accounts are stolen everyday (something to that extent). Big fish are big targets and gmail like godaddy and bank of america may no longer be safe and or wise to maintain your businesses with!?! I have had issues with all 3 mentioned.
- calvin 15y ago
  One more great reason to set up two-step verification for your Gmail and Google Apps accounts. http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu...
  - brador 15y ago
    I've yet to do this. Reason being I wonder what will happen if I lose my phone... Is there a way to set up two-step without a phone?
dkersten 15y ago
They don't seem to have an active Twitter account. Just sending an email through the contact form for now. Wait, what? Since when is twitter a replacement for email?
- mikeash 15y ago
  Twitter often works better. The semi-realtime nature of the system means responses often come faster, worthless autoresponse systems haven't found their way onto Twitter yet, and the public-ish nature of Twitter means the other side is somewhat under a spotlight and this often improves their behavior. Obviously, it depends on the situation and the company, but Twitter can be a great way to approach some places. For example, if I was having problems with Comcast's phone support, I'd rather tweet @ComcastCares than figure out how to e-mail them.
- ceejayoz 15y ago
  Since major corporations started having turnaround times of minutes when contacted in the public manner that is Twitter rather than days, weeks, or never.
- billpatrianakos 15y ago
  I second what mikeash said about Twitter and I'd add that because of the nature of Twitter you'll be posting a support inquiry publicly (I doubt many DM's get sent) which makes the company want to resolve the issue and in the process make themselves look good. It's like publicly saying "hey, we're a company that takes support seriously, just look at us being helpful". There was a great post on HN a few months back about a guy who got a steak delivered to him when he arrived home from the airport from his favorite restaurant because he tweeted something about really wanting one of their steaks before his flight departed and he mentioned them. The company had followed him on Twitter, knew he was a loyal customer and went the extra mile to personally deliver the steak when his flight landed. I always think of this story when I think about customer service for my own company. The point is that Twitter's public nature can make or break you as a business and smart businesses know how to leverage that power for positive PR.
larrys 15y ago
As a registrar I would like to point out that this is a good reason to not have privacy protection on your domain. It raises the chance of losing your domain greatly. (Even though you can argue that having your email displayed exposes an attack vector). Public info makes it much easier to recover a domain. And proper security on the email is required as always obviously. I've helped several people recover domains by going to contacts I have at ICANN. Not having public info doesn't give me what I need to make a case. It's a non-starter many times. And it just confuses the issue for you as well when you are trying to correct things. Registrars (we don't offer privacy by the way) want privacy because it is a) something they can offer and charge for and b) allows them to lock the customer in and create a barrier to exit. c) Many of them do this by changing ownership to them for the domain and giving you a contract that you are the beneficial owner. Not good for you. You want and need to be owner according to whois. (Read this again.) If you want a private domain use a po box or a work address etc or your uncles's address. If you are a business you absolutely have no reason to have privacy (and many many businesses do because they have been sold some bullshit on this with respect to spam).
- JoshTriplett 15y ago
  A very good point. Personally, I use Gandi.net as my registrar, and I use their privacy protection; however, they very specifically keep my name listed as the owner, and just provide a forwarding email address and a dummy postal address and phone. Gandi mentions this ownership issue as the reason, and points out the implications of other registrars which list their own name instead.
  - larrys 15y ago
    That's certainly better. And you have a somewhat unique name. But imagine your name was "John Brown". Having address data (any address data) is additional protection. And it creates an additional public paper trail. And even your name is coming up with approx. 42 potential matches (according to http://www.usa-people-search.com http://www.usa-people-search.com) Why not just use the address data you use for apters.com ?
- mikeash 15y ago
orenmazor 15y ago
heh, this happened to us a month or so ago. we even got a ransom note! (TLDR: godaddy eventually came through for us)
- pavel_lishin 15y ago
  That ... sounds ominous and fascinating. Would you mind writing about your experience?
  - orenmazor 15y ago
    That was basically it, for the most part. I wasn't the one handling it, but essentially the guy was trying to get some of our server configs for some reason (I work on Postmark). We filed an FBI report and went back and forth with GoDaddy until they got our domain back a week later. So not really as exciting as Hackers, but sort of.
brokentone 15y ago
With the number of domains that are being discussed here as recently stolen (seemingly all from GoDaddy), I think we need some answers. How did this happen? GoDaddy account hacked? GoDaddy account social engineered? GoDaddy internal systems compromised? GoDaddy - person on the inside? New flaw/hack in the ICANN registration methods?
larrys 15y ago
Here's another tip when dealing with registrars that really relates to dealing with any business or person when in this situation. People have much discretionary power to help you depending on how you treat them. While there are many people who get their way by instilling fear my personal belief is that you get more by being nice to people and making them want to help you (and this has always worked for me). So when you have a problem with your registrar or hosting company or a meal at a local restaurant don't go off on a rant and tell them a) It's their fault b) They suck c) you will never use them again d) You will tell everyone a&b&c (Did I forget anything?) This will only make them defensive and will alienate them and get them to form a wall. I'm not saying to not point out some truths about what happened. But do it in a way that makes them think you will be a happy customer if they manage to help you. Edit: And you still love them.
- freejack 15y ago
  Yes, you are right - unless they are a service-oriented company, in which case, they will jump through hoops to make it right for you, no matter how surly you are when you present your issue.
dredmorbius 15y ago
If a business is unwilling to release information to you per a standard request, look into filing a lawsuit and submitting a subpoena. Even discussing that option with them may get them to disclose. Lawyering up sucks for businesses as much as it does for you. IANAL / IDEPLOTI, you may want to chat with one or several or even just find folks who've disputed stuff themselves. Additionally: register complaints with any and all consumer protections services: BBB, chamber of commerce, your state's attorney general's office, etc. And post to HN (OK, check that punchlist item).
TheENFORCER 15y ago
Here's what we know: Their GMail accounts are the common thread here: even Kirupa posts his addy with @gmail.com. And we know that hackers have been all over Gmail. So obviously they got into their account. Their account probably had links to the registration... or they tried the same password, who knows. But now they have them. I think the important thing is that the new 'Registrants' return them to Godaddy.com right now. They are trying to say that these people have to prove fraud? That's ridiculous. With easy to provide proof, get them returned. Also don't use GMail for important stuff... maybe your own mail server? One that you harden yourself? JK!
cheald 15y ago
Why is all the blame being put on GoDaddy here? The problem is that his email account was compromised. Once that happens, it's game over. Everything online linked to that account is likely up for grabs at that point. Use two-factor auth on your Google accounts, people.
- hetman 15y ago
  How does this look specifically with Google?
  - cheald 15y ago
    Two factor auth? You just go into your account settings, elect to turn it on, it'll have you install the Google Auth app on your phone and scan a QR code, which configures the app. Then, when you try to log into your account next, it'll ask for the code generated by the app. The authenticator itself is just HMAC-OTP with the seed as the current time quantitized to 30-second intervals. Very straightforward.
    - jberryman 15y ago
      Also to use google services that don't support it (or can't, e.g. Smtp with gmail), you can have google generate a new "throwaway" password which it will display for you one time. It was pretty straightforward and actual kind of fun to make the switch.

355 points by tbassetto 15y ago

VMG 15y ago

In case the nameservers actually update: http://64.13.251.230/ http://64.13.251.230/

benatkin 15y ago
and if it updates add this line to /etc/hosts: 64.13.251.230 css-tricks.com I think I got that right. :)

masenf 15y ago

could it be related to this: "After a series of one-sided hearings, luxury goods maker Chanel has won recent court orders against hundreds of websites trafficking in counterfeit luxury goods. A federal judge in Nevada has agreed that Chanel can seize the domain names in question and transfer them all to US-based registrar GoDaddy. The judge also ordered "all Internet search engines" and "all social media websites"—explicitly naming Facebook, Twitter, Google+, Bing, Yahoo, and Google—to "de-index" the domain names and to remove them from any search results." http://arstechnica.com/tech-policy/news/2011/11/us-judge-orders-hundreds-of-sites-de-indexed-from-google-twitter-bing-facebook.ars http://arstechnica.com/tech-policy/news/2011/11/us-judge-ord...

nknight 15y ago
You think Chanel cares about a web design website called CSS-Tricks?
cube13 15y ago
Except... the domain was transferred AWAY from GoDaddy.
billpatrianakos 15y ago
Absolutely not related. I truly hope you made this comment out of pure and sincere ignorance. This isn't a story about rights being trampled on no matter how hard anyone may try to frame it that way. This is just another case of someone getting their email broken into and the byproducts of that break in which in this case was a stolen domain.

ImprovedSilence 15y ago

Judging from the comments on his website, it sounds like everybody and their grandma hates GoDaddy. I've recently been looking into getting a domain name and starting a website, can anyone point me towards a more reputable site to acquire a domain and host a site? (Yeah, I know, I read HN daily, and I'm still clueless when it comes to actually putting up a website)

tdoggette 15y ago
NameCheap is good.
- nicwest 15y ago
  second that, been using them for the better part of decade, never any problems.
  - sunchild 15y ago
    Me too. No issues after many years of namecheap.
    - hornbaker 15y ago
      Another vote for NameCheap. Have had ~50 domains with them for nearly 5 years now, never a problem.
      - dctoedt 15y ago
        +1 for NameCheap. (Not to beat a dead horse, but back when we could see the karma numbers for comments, it was possible to visibly "second" an endorsement comment by upvoting it, instead of posting separate +1 comments like this one ...)
        mikeleeorg 15y ago
        Another vote for NameCheap. And to make this comment more useful... I especially love how easy it is to transfer domain names between NameCheap users. I had purchased a domain name once with my personal account. Then I created a company and wanted the domain to be officially owned by that entity and not me. So I created another NameCheap account for that company, then transferred it over very easily. Of course, it's possible other registrars offer such a frictionless transfer process between account holders too. I've only used NameCheap for this and can say I was pleased with the results.

pud 15y ago

This makes me worry about my own domains. I have about 180 domains with GoDaddy (all registered for various projects -- I'm not a squatter). I wish there were a tool that would verify that they're all still registered under my account at GoDaddy. Especially since the "new owners" seem to keep DNS records the same.

loopdoend 15y ago
I transferred all my domains to moniker.com and have an account rep that calls me if any odd activity occurs. I doubt this would happen with them. They allow you to lock down your domains so that it requires offline authentication to move them. Been with Moniker for 4+ years.
- trafficlight 15y ago
  Another vote for Moniker. I transferred everything from GoDaddy to Moniker a couple years ago after GoDaddy pulled some other asinine stunt.
- rokhayakebe 15y ago
  How long did the process take, and did this create any issues with live sites?
- citricsquid 15y ago
  Problem with moniker is poor security, they have no protection against bruteforcing. You can endlessly try to login to an account, which isn't necessarily a problem for people with a secure password but it does open up my own concerns about poor security elsewhere...
larrys 15y ago
"all registered for various projects -- I'm not a squatter" One of the reasons domain prices are low is that people register domains they are not using. Just like they buy books they don't read. Or buy jewelry they don't wear. (And yes bring on all the replies about the differences that you want but keep in mind the time you picked up the last item on the shelf at the drug store that maybe someone else had a greater need for down the road. Or took the last seat on an airplane.) No problem with buying domains and letting them sit there until you decide what to do. No problem buying domains that you think you could sell either, in general. As much as this might piss people off who feel the domain should just be there ready when they want it. Squatting would be registering a domain that specifically (edit: and reasonably) belongs to someone else. Say you hear the local pizzeria opening is called "xyz pizza" and you register "xyzpizza.com". Despite what the media and all the typical articles say about this. By the way when you say "all registered for various purposes" there is no qualification about what the purpose is so essentially some people would define you as a squatter depending upon the way they see this issue.

someone13 15y ago

I would warn everyone that reads this to be very careful. When a domain is stolen, it's usually not used for "legit" purposes. Be very careful when visiting this site - use a patched browser, Java + Flash + Acrobat, etc., in case the new "owners" decide to stick an exploit kit here.

vegardx 15y ago
Why would they need access to the domain to do that?
- ek 15y ago
  Because they would mirror the site and then add bad stuff, so it looks legit, and then change the DNS record to point to the mirror.
  - vegardx 15y ago
    I cannot really recall that ever happening for, like, the last 10 years. I could see the case if they wanted to intercept mail or something, but then the administrator would notice quite fast what was going on (ie. not receive any mails...).
    - pavel_lishin 15y ago
      Unless they were making copies and forwarding the e-mails on.
    - ajross 15y ago
      Why would a mail interception not simply relay the mail back to the originally intended server (which, for obvious reasons, is happy to accept mail for the targetted domain)? The point is very valid: someone who controls a domain can trivially MitM any communication with that domain over unencrypted HTTP. And given events of the past year, I wouldn't put it past them to be able to get a cert issued for the fraudulent domain too...
    - 15y ago

16s 15y ago

Seems there is no idea how it happened yet. Perhaps a weak password... so weak that it was easily guessed? That would be my first bet.

brokentone 15y ago

I'm curious to know if the domain was in REGISTRAR-LOCK at the time. According to GoDaddy's policies, they relock after 30 days, so it's likely it was locked. http://help.godaddy.com/article/410 http://help.godaddy.com/article/410 (obviously an outside domain transfer is not the only option for takeover)

SahidK 15y ago

This is scary, I have all my domains with godaddy!

bittermang 15y ago

Problem goes beyond just css-tricks.com. I've been following David Walsh for a while, and apparently his domain has been nabbed as well, along with DesignShack.net, SohTonaka.com, and InstantShift.com https://twitter.com/#!/davidwalshblog/status/142645321791586304 https://twitter.com/#!/davidwalshblog/status/142645321791586...

SystemOut 15y ago
I thought something weird was going on since the sohtonaka.com domain is available when I checked at namecheap.com. Then I noticed that both the tweet and the above message misspell sohtonaka.com - it should be sohtanaka.com.
ecaron 15y ago
It also happened to mckmama.com (a crazy popular blog my wife follows who couldn't believe that domain hacking was even possible anymore.) The more interesting aspect was that since mobile nameservers are slow to update, the site worked on her phone still. That lead to the lovely "Where does DNS come from" conversation we all have with our loved ones eventually:)

ereckers 15y ago

I remember reading about this happening to a few other design blogger websites over the last few weeks. I'm still trying to wade through the "I hate Godaddy" posts to find if anyone has any idea why this might be happening. I'm guessing weak passwords.

billpatrianakos 15y ago
I waded through most of it and it seems as though the domain owner's email was broken into which then allowed the thief to begin the transfer process. So from what I'm reading here it actually wasn't GoDaddy's fault but just another Gmail account broken into. I hate GoDaddy more than probably anyone here but it looks like their upselling and bad design didn't cause this one. Rats! I really wanted another excuse to talk shit about GoDaddy.

EGreg 15y ago

Would locking your domain name at GoDaddy help? http://help.godaddy.com/article/410 http://help.godaddy.com/article/410 I am just wondering for my personal info, I have lots of domains hosted with them

bborud 15y ago

I moved my domains away from GoDaddy primarily because I grew tired about all the desperate upsell spam they sent me ALL THE TIME. Secondarily I moved because they are so big that if anything happens to my domains the chance I get to speak to a reasonable person are practically zero. Find a smaller registrar, make sure you can get proper support from them, then move your domains there. (Recovering a domain you have lost is orders of magnitude more expensive than taking steps to reduce the chance of it happening in the first place)

farico 15y ago

Godaddy stole phpiseasy.com from me too. Not sure who to trust anymore

libraryatnight 15y ago

The only way the domain would be able to be moved from Go Daddy would be if the person stealing the name had access to the account, that's the only way to request the transfer authorization / epp code. Their support requires either a pin or last 6 of a CC used on the account to validate callers, if you can provide that they'll update the email on file and help reset the password, but he said his account email is unchanged. So the person taking the name would either have to know the account password, or have access to the email address on file where the reset requests are sent. Given that this would have to happen from inside the customer account, I can understand why Go Daddy would want to confirm that this was indeed a nefarious act and not something like a domain being sold, transferred, then reported stolen to keep the cash and get the domain back. Or any number of other scenarios one might think of - shady domain stuff happens a lot. I can only imagine the hoops required to jump through for a registrar to get a domain back from another registrar under these circumstances.

arn 15y ago
"The only way the domain would be able to be moved" Not sure that's the only way. That's like saying the only way you could get credit card information from Sony's playstation servers was if you worked in Sony's billing department. Not saying this is necessarily a hack, as it most likely is insecure practices on the part of the user, be it passwords or phishing. But seeing a cluster of them raises some concerns that it could be some otherwise unknown method.
- libraryatnight 15y ago
  Thanks, I agree, 'the only way' is probably too absolute a phrasing. I do wonder if the reason we see clusters is because they are the largest, and arguably the most publicized, registrar in the U.S., and in terms of market share, the world.
  - SomeCallMeTim 15y ago
    He said on the page that it apparently involved a Gmail hack of some kind, so even if it's not "the only way", it sounds like it was how it was stolen in this case.

drivebyacct2 15y ago

First line: "... GoDaddy". Laughed and closed the page. Even if it's not their fault for the original transfer, the headache of support is on you. edit: Sorry you don't like to hear it? You get what you pay for, and you get what deserve for not shopping around and just going with the brand name that stuck because their CEO shot an elephant.

ceejayoz 15y ago
Once it's transferred away, GoDaddy has no power over it. Even the best support team can't do anything more than "give it back, please, new registrar".
- larrys 15y ago
  I upvoted you but that's not true. The best support team can get on the phone with the other registrar and do something. They don't have to but they can. But sure they can just as easily go for the low hanging fruit. As a registrar we have access to exclusive contacts at other registrars as well as in many cases personal relationships. If we want to help you there is plenty we can do. Yes in the end it's up to the other registrar. But there are professional courtesies as well and other ways of getting things done.
  - ceejayoz 15y ago
    In no way have you disagreed with me. You just reworded my "Even the best support team can't do anything more than 'give it back, please, new registrar'" statement.
    - ceol 15y ago
      larrys' point is that there's a difference between begging the other registrar and using professional connections to ask for favors. Your original comment implied GoDaddy could do nothing the previous owner of the domain could do when that's not the case.

sloak 15y ago

I mostly use Google Apps with enom, since it gives me the domain + email & all other google apps goodies "for free". That said, I want to move a few domains away from GoDaddy but I am a bit confused how to do it the right way. Anyone have a good order-of-events list? I'd hate to lose the domains over a technicality when transferring. [edit: misspellings]

whileonebegin 15y ago

There are a lot of posts blaming GoDaddy. Did anyone read the post by David Airey, linked in the article? The reason for his lost domain was that his Gmail account was hacked. The attacker performed a "legit" domain transfer through his registrar. It wasn't the registrar's fault, in this case. The only blame you could place was that perhaps the registrar didn't have enough security check points. GoDaddy is certainly annoying with their obnoxious web site and sometimes, their tactics, but this could be another email-hijack attack.

paul9290 15y ago
Yeah i am thinking this too. I mean a day or two ago Gmail was showing and promoting users to enable 2 step verification because thousands and thousands of gmail accounts are stolen everyday (something to that extent). Big fish are big targets and gmail like godaddy and bank of america may no longer be safe and or wise to maintain your business with!?! I have had issues with all 3 mentioned.
paul9290 15y ago
Yeah i am thinking this too. I mean a day or two ago Gmail was showing and promoting users to enable 2 step verification because thousands and thousands of gmail accounts are stolen everyday (something to that extent). Big fish are big targets and gmail like godaddy and bank of america may no longer be safe and or wise to maintain your businesses with!?! I have had issues with all 3 mentioned.
calvin 15y ago
One more great reason to set up two-step verification for your Gmail and Google Apps accounts. http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html http://googleblog.blogspot.com/2011/02/advanced-sign-in-secu...
- brador 15y ago
  I've yet to do this. Reason being I wonder what will happen if I lose my phone... Is there a way to set up two-step without a phone?

dkersten 15y ago

They don't seem to have an active Twitter account. Just sending an email through the contact form for now. Wait, what? Since when is twitter a replacement for email?

mikeash 15y ago
Twitter often works better. The semi-realtime nature of the system means responses often come faster, worthless autoresponse systems haven't found their way onto Twitter yet, and the public-ish nature of Twitter means the other side is somewhat under a spotlight and this often improves their behavior. Obviously, it depends on the situation and the company, but Twitter can be a great way to approach some places. For example, if I was having problems with Comcast's phone support, I'd rather tweet @ComcastCares than figure out how to e-mail them.
ceejayoz 15y ago
Since major corporations started having turnaround times of minutes when contacted in the public manner that is Twitter rather than days, weeks, or never.
billpatrianakos 15y ago
I second what mikeash said about Twitter and I'd add that because of the nature of Twitter you'll be posting a support inquiry publicly (I doubt many DM's get sent) which makes the company want to resolve the issue and in the process make themselves look good. It's like publicly saying "hey, we're a company that takes support seriously, just look at us being helpful". There was a great post on HN a few months back about a guy who got a steak delivered to him when he arrived home from the airport from his favorite restaurant because he tweeted something about really wanting one of their steaks before his flight departed and he mentioned them. The company had followed him on Twitter, knew he was a loyal customer and went the extra mile to personally deliver the steak when his flight landed. I always think of this story when I think about customer service for my own company. The point is that Twitter's public nature can make or break you as a business and smart businesses know how to leverage that power for positive PR.

larrys 15y ago

As a registrar I would like to point out that this is a good reason to not have privacy protection on your domain. It raises the chance of losing your domain greatly. (Even though you can argue that having your email displayed exposes an attack vector). Public info makes it much easier to recover a domain. And proper security on the email is required as always obviously. I've helped several people recover domains by going to contacts I have at ICANN. Not having public info doesn't give me what I need to make a case. It's a non-starter many times. And it just confuses the issue for you as well when you are trying to correct things. Registrars (we don't offer privacy by the way) want privacy because it is a) something they can offer and charge for and b) allows them to lock the customer in and create a barrier to exit. c) Many of them do this by changing ownership to them for the domain and giving you a contract that you are the beneficial owner. Not good for you. You want and need to be owner according to whois. (Read this again.) If you want a private domain use a po box or a work address etc or your uncles's address. If you are a business you absolutely have no reason to have privacy (and many many businesses do because they have been sold some bullshit on this with respect to spam).

JoshTriplett 15y ago
A very good point. Personally, I use Gandi.net as my registrar, and I use their privacy protection; however, they very specifically keep my name listed as the owner, and just provide a forwarding email address and a dummy postal address and phone. Gandi mentions this ownership issue as the reason, and points out the implications of other registrars which list their own name instead.
- larrys 15y ago
  That's certainly better. And you have a somewhat unique name. But imagine your name was "John Brown". Having address data (any address data) is additional protection. And it creates an additional public paper trail. And even your name is coming up with approx. 42 potential matches (according to http://www.usa-people-search.com http://www.usa-people-search.com) Why not just use the address data you use for apters.com ?
mikeash 15y ago

orenmazor 15y ago

heh, this happened to us a month or so ago. we even got a ransom note! (TLDR: godaddy eventually came through for us)

pavel_lishin 15y ago
That ... sounds ominous and fascinating. Would you mind writing about your experience?
- orenmazor 15y ago
  That was basically it, for the most part. I wasn't the one handling it, but essentially the guy was trying to get some of our server configs for some reason (I work on Postmark). We filed an FBI report and went back and forth with GoDaddy until they got our domain back a week later. So not really as exciting as Hackers, but sort of.

brokentone 15y ago

With the number of domains that are being discussed here as recently stolen (seemingly all from GoDaddy), I think we need some answers. How did this happen? GoDaddy account hacked? GoDaddy account social engineered? GoDaddy internal systems compromised? GoDaddy - person on the inside? New flaw/hack in the ICANN registration methods?

larrys 15y ago

Here's another tip when dealing with registrars that really relates to dealing with any business or person when in this situation. People have much discretionary power to help you depending on how you treat them. While there are many people who get their way by instilling fear my personal belief is that you get more by being nice to people and making them want to help you (and this has always worked for me). So when you have a problem with your registrar or hosting company or a meal at a local restaurant don't go off on a rant and tell them a) It's their fault b) They suck c) you will never use them again d) You will tell everyone a&b&c (Did I forget anything?) This will only make them defensive and will alienate them and get them to form a wall. I'm not saying to not point out some truths about what happened. But do it in a way that makes them think you will be a happy customer if they manage to help you. Edit: And you still love them.

freejack 15y ago
Yes, you are right - unless they are a service-oriented company, in which case, they will jump through hoops to make it right for you, no matter how surly you are when you present your issue.

dredmorbius 15y ago

If a business is unwilling to release information to you per a standard request, look into filing a lawsuit and submitting a subpoena. Even discussing that option with them may get them to disclose. Lawyering up sucks for businesses as much as it does for you. IANAL / IDEPLOTI, you may want to chat with one or several or even just find folks who've disputed stuff themselves. Additionally: register complaints with any and all consumer protections services: BBB, chamber of commerce, your state's attorney general's office, etc. And post to HN (OK, check that punchlist item).

TheENFORCER 15y ago

Here's what we know: Their GMail accounts are the common thread here: even Kirupa posts his addy with @gmail.com. And we know that hackers have been all over Gmail. So obviously they got into their account. Their account probably had links to the registration... or they tried the same password, who knows. But now they have them. I think the important thing is that the new 'Registrants' return them to Godaddy.com right now. They are trying to say that these people have to prove fraud? That's ridiculous. With easy to provide proof, get them returned. Also don't use GMail for important stuff... maybe your own mail server? One that you harden yourself? JK!

cheald 15y ago

Why is all the blame being put on GoDaddy here? The problem is that his email account was compromised. Once that happens, it's game over. Everything online linked to that account is likely up for grabs at that point. Use two-factor auth on your Google accounts, people.

hetman 15y ago
How does this look specifically with Google?
- cheald 15y ago
  Two factor auth? You just go into your account settings, elect to turn it on, it'll have you install the Google Auth app on your phone and scan a QR code, which configures the app. Then, when you try to log into your account next, it'll ask for the code generated by the app. The authenticator itself is just HMAC-OTP with the seed as the current time quantitized to 30-second intervals. Very straightforward.
  - jberryman 15y ago
    Also to use google services that don't support it (or can't, e.g. Smtp with gmail), you can have google generate a new "throwaway" password which it will display for you one time. It was pretty straightforward and actual kind of fun to make the switch.