Stolen Domain
On August 2nd, 2023, while on vacation, I received an email from godaddy.com informing me:
“We successfully completed your domain transfer. ”
The problem is I never initiated the transfer. The domain CREfinancing.com was for an online commercial real estate site I had been building on and off.
Upon calling GoDaddy I was told to contact Google LLC. the new registrar. When I contacted Google they asked me to provide evidence of my ownership of the domain (CREfinancing.com) which I promptly did. Attached is the notice of transfer from GoDaddy along with my most recent renewal receipt.
Google did give me the following link to see how my domain was now registered. From this I was able to see the “thief” was hiding behind the registrant name Contact Privacy Inc. based out of Toronto, Canada.
Initially, Google was helpful. They gave me a support ticket and even a follow-up email a few days later letting me know they were still working on a resolution. However, after a couple more days I receive the following email from Google:
We regret to inform you that our attempts to verify ownership using the domain’s registrant contact information were not successful. It is necessary to confirm ownership of the domain to proceed with the WHOIS update or domain transfer. We do this in order to protect the domains under the account and make sure that access is only granted when we can verify that the person who is contacting us is indeed the owner of the domain.
If you want to obtain the domain name legally, please file a UDRP request since whoever is listed as the registrant contact is considered to be the domain's legal owner.
After wading through the information at the above link it appears the cost to file a UDRP request is $1,000 - $2,000 dollars and the process can be lengthy. This is a complete joke!
Therefore my next steps are:
1) I plan to reach out to the registrar Contact Privacy Inc. as per their terms of service I found the following:
Right to Suspend and Disable. We shall have the right, at our sole discretion and without liability to you or any of your Contacts, suspend or cancel your domain name and to reveal Registrant and Contact Whois Information in certain circumstances, including but not limited to the following: (i) when required by law; (ii) in the good faith belief that disclosure is necessary to further determination of an alleged breach of a law; (iii) to comply with a legal process served upon Tucows; (iv) to resolve any and all third party claims including but not limited to ICANN's or a Registry's dispute resolution policy; (v) to avoid financial loss or legal liability (v) to avoid financial loss or legal liability; (vi) if we believe that you or one of your Contacts is using the Whois Privacy Service to conceal involvement with illegal, illicit, objectionable or harmful activities; or (vii) to transmit SPAM, viruses, worms or other harmful computer programs.
Abuse.. To report abuse of a domain name using the Contact Privacy Inc. service, or to report infringements of rights of trademarks or other rights of third parties, please contact abuse@contactprivacy.com.
2) Continue to publish my findings on this blog and at Twitter (X) @IncomeandEcon
In the meantime, if anybody has advice for me, please reach out to me here but with Twitter (X) being the preferred method of contact.
Update as of 8/17/23:
Contact Privacy’s abuse@contactprivacy.com email address is a waste time as I received an automated response back that was of no help. I realized when I saw they were a Toronto, Canada-based company with no website that it was a long shot. The thief likely is both hiding behind this outsit with no front door and using Canadian law to complicate matters given the crime occurred from a United States domiciled company. Here is Contact Privacy’s company website, shady!
I did have another conversation with GoDaddy where I pointed out that not only did I not get any email notice that my domain was transferred as required, I was able to prove that I didn’t initiate the transfer. Below is my login information at GoDaddy for the time in question (the domain transferred on 8/2/23. I had logged into my Godaddy account since 7/7/23 which is more than 3 weeks prior.
GoDaddy did give me one shred of hope, though, by directing me to the following link to fill out a “Dispute on Transfer Away Form.” I plan to continue to document this article of the entire process. Lastly, thanks to the people who contacted me on Twitter (x) today to offer assistance, such as DNAccess, who was the first to reach out - much appreciated.
Have you gotten the domain name back?
— DNAccess (@dnaccess) August 17, 2023
We've literally recovered hundreds of domains stolen from GD and would be happy to help. We also have contacts at Google Domains, as well.
Do you know how the domain name was stolen from your GoDaddy account?