Published on October 24, 2022
You may have heard about cybercrimes such as phishing, spoofing, identity theft etc. but have you heard about domain theft? Yes DOMAIN theft. You might be thinking why would someone steal a domain, but people do! You must be thinking how is it done? Hackers hack your email, then steal your domain and then change the ownership of the website by altering all the login credentials. This way when the registrar sends you a confirmation email that the owner of your domain has changed, you never receive it! By the way, a registrar is the domain provider who keeps an entry of your domain registration and stores all your website data and files. So, when your domain is hijacked, it means that the access to view/edit your website if gone, forever. According to an FBI spokesman, 26 reports of domain reports were received by FBI in the US. Domain theft is as old as the internet itself but so far there is no law to protect people who suffer from this worst nightmare.
Unfortunately, small businesses become the major part of domain theft because the hackers know that these businesses do not have much resources to protect their domain nor they have so much information about the recovery process.
The only way that has been proved fruitful in recovering the stolen domain so far, is buying your stolen domain from the hacker. Yes, you heard me right! You buy your own, legally-registered-and-then-stolen domain from someone. One such example is of Jordan Reid, a lifestyle blogger, whose website RamshackleGlam.com was hijacked. After being stolen, her blog name was sold on Flippa.com for a huge amount. Flippa.com is a marketplace to buy and sell websites and the hacker kept all Reid’s data, files and everything on the blog on bid. After spending a good amount of time on phone with registrar of the blog and the new registrar that the hacker had transferred the blog to, Reid decided to take the matter in her own hands. She negotiated with the hacker and they agreed on a deal which was around $30,000 which she was supposed to pay via third party, Escrow.com.
Luckily, Reid got her stolen website back in three days and at the same time she stopped the payment process. This means that the hacker never got the money! Serves him right, right? After getting her website back, she lodge a complaint in FBI and surprisingly, FBI took action, right away. However Reid still cannot believe whatever happened and how she got the website back. She said in an interview,
“I think it’s pretty extraordinary that the only recourse I had was to interact with a criminal and pay him off. That was the only thing I could do.”
People round the globe never bother about getting their domain secure or having an insurance policy on it (does that even exist?) until they suffer with their domain getting stolen. The owner of MLA.com, Michael Lee suffered from the same catastrophe sometime in 2015, when he was about to sell his website as a part of his retirement plan. Just before the time he planned he would sell this online setup, he revealed that his domain is stolen.
The unfortunate Lee filed a lawsuit against a Russian guy who was found to be the new owner of MLA.com. This theft caused severe business and personal losses to Lee. Just because his customers were not able to reach him on his previous email, they hired someone else for their tasks. He lost his potential clients and his sales, which were around $200,000 at that time. He had to lay off his valued employees and bring major changes to his lifestyle.
In an interview Lee said,
“A lot of customers have said, ‘I tried to email you and it kept bouncing back, so I gave the job to someone else. I’ve lost a ton of business. I’ve also lost a three-letter domain that I was counting on for my retirement.”
Your domain getting hacked is as scary as your Limousine or Ferrari getting stolen. Or may be worse! Because it is your domain where your whole online business or setup lies. Domain is like a shelter, a foundation to your online business, your website. If your domain is gone, where will your business stand?
The worst part is that your domain registrar cannot do much about it. They have no policies, no procedure to get a stolen domain back. For example, GoDaddy.com has Undo and Change teams, which are meant to provide assistance to people with similar situations as Lee’s. However, in many cases they say that they do not have much resources to work further on the claims made by victims and are unable to provide further assistance. Even worse, if the domain is shifted to another registrar after getting stolen, you can do ABSOLUTELY nothing about it. You cannot even file a lawsuit if your country/state doesn’t recognize your domain as property. Lee faced the same situation; when he reported to GoDaddy.com that his domain is stolen, he discovered that the domain is now shifted to another registrar known as Internet.bs. When the case was referred to Internet.bs, it refused to transfer the domain back to Godaddy.com. However, he was successful in filing the lawsuit. But then again, that wasn’t of any use either. Till now Lee hasn’t got his domain back and his case is still pending.
Lee had to start from scratch, at the age when he was about to retire. He managed to have a company of four employees and 20 clients. It took him a long time to retain his business to where it was before the domain getting hijacked. In a post on HuffingtonPost.com, Lee says,
“You have to start over after having spent years building something up. It just kind of wipes you out.”
This is not just one victim. There are hundreds of them. Some take action and file lawsuits while there are some who do not even know what to do, where to go and whom to talk. As stated on HuffingtonPost.com, in US only some states including California and Nebraska recognize domain name as physical property and permit the victim to file lawsuit for its recovery.On the other hand, few victims find a shorter way and negotiate with the hacker to get their domain back. Just as Jordan Reid did.
Now the question is why do people hijack domains and website?
Money make look the obvious answer but this is not just it! There are various things what hackers do with a stolen domain. One reason is they sell it on websites where websites are usually sold and bought, just like what happened in Reid’ case and if you have not installed SSL certificate you can lose your all confidential data. Another reason is they demand money from the owner in return of the domain. Did someone say domain ransom? At least you get your domain back. But worst is the case when the hacker sells your domain name to someone else or misuses it for phishing or other malicious activity. This can cause terrible outcomes, as your clients might end giving their sensitive credentials on the website, thinking it as yours!
In the next article we will discuss how domain theft can be prevented and recovered.
