SECURITY BREACH at Enom/BulkRegister. Check your domains!

[BELLC1]

If you have domains at Enom, please verify they are actually in your account. This doesn't mean just listed; rather, make sure they are actually there by asking for your authorization code or by your ability to change Registrar Lock status. These domains may still be listed in your account even though you no longer have access to them! (And this *may* be only with former BulkRegister accounts.)

====================
First incident - January 2008 - Enom #080127-000125 - Went to renew name only to find it was in someone else's account. Enom claims I pushed it. I never had. Changed very unique password for future safety. Enom still has ticket open as "Waiting on Internal" Domain still in someone else's account.
All future inquiries and requests for account audits have gone unanswered. Yes, it has been 6 months.

Second Incident - Today - Enom #080608-000080 - While doing renewals this morning, I went to move another 16 domains to another registrar due to First Incident above. Come to find out, another one of these 16 was moved to another registrar back in March, again without my knowledge or approval or notice of transfer. And yet, it is still listed in my account. I would never have known it was missing had I not requested Tech Support after trying unsuccessfully to "Unlock Registrar Lock" and "Request Auth Code"

Enom's reply - "I reviewed this domain and found it is not with Enom. The record you see of the domain in your account is an old recorded. The Whois shows the domain was moved to rallydomains.com on or around 06-mar-2008

Second reply from "Laurie" a few minutes later - "Your domain was not lost. The only way a domain can be moved to another registrar is by transfer. All transfer need the authorization code and the domain unlocked. There for the transfer would have had to been started from with in your account."

============

I submitted a request to my Moniker rep who already verified today's domain was not in my account. We're now trying to figure out how it got where it is at.

[draggar]

Hmm..

There's a domain I've been watching that's at Enom that went from a developed site to a generic (non optimized) parked page over the last week. I wonder if it is related? WhoIs information hasn't changed (and it was renewed last month)

[steveto]

no...it's someone on the inside. It happened to me for one of my domains. I had forgotten to renew it on time..I was like 2 days late, so well within my rights to renew and the domain was in some other dudes account..I was like WTF? I sent in a ticket..it went for review and enom never gave an explaination. What I think is that someone on the inside monitors domains with little activity and secretly pushes close to expired domains into another account..if no one complains, the get the domain and if someone does, they just give it back.

The reg date was exactly the same and I told enom..if it was a new registration, the reg date would be that of this year NOT 8 years ago.

Anway...hope you get it back into your account.

[katherine]

Other registrars have similar glitches in their systems and will continue to display domains in your account even after they have been transfered away. Worse, they even invite you to renew them

Your domain actually is with moniker:

Domain Name: RALLYDOMAINS.COM
Registrar: MONIKER ONLINE SERVICES, INC.
Whois server: whois.moniker.com
Referral URL: http://www.moniker.com/whois.html
Name Server: NS1.DOMAINSERVICE.COM
Name Server: NS2.DOMAINSERVICE.COM
Name Server: NS3.DOMAINSERVICE.COM
Name Server: NS4.DOMAINSERVICE.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 17-jan-2008
Creation Date: 19-oct-2004
Expiration Date: 19-oct-2008

[BELLC1]

The first domain, which still resolves to my sedo parking account, now has someone else's reg info: Contact: T.B.A Wood Green 196 High Road U.K, N22 8HH GB

The second domain still points to my Parked account, appears to be registered with Moniker's "Rally Domains" but the WHOIS at Rally does not show ownership. I've asked my Moniker rep for help in obtaining the registrant info and proof of purchase.

Yes, I believe it is either an insider or someone with access to Enom's security programs (or apparently lack thereof).

I have 350 more domains to verify with them now. Sadly, after 10 years with them, Enom will be losing thousands per year in renewals because they can no longer be assumed to be secure and there is no one at the top who can defend their reputation through swift resolution.

[Acro]

Do you have proof of a security breach?

It could be any of the following:

1. Bad memory on your part
2. Bad organizational skills
3. Malware
4. You sold/dropped/forgot about the domain

[BELLC1]

I may be over 40, and, nope, but here is an update I just got from Moniker who was looking it up on their end for me:

"...This is very bizarre! I have no clue how it got to Rally. I did a whois look up and I show your info...."

I've never heard of Rally before today and I only move domains to two registrars. So now they are moving it to my Moniker account from their subsidiary, Rally Domains. I also have the original purchase receipt from BulkRegister/Enom via ClubDrop on 6/19/07. There is also no proof of any transactions or moves from either registrar though Enom "claims" that it was transferred out three months ago in March.

I forwarded the link to this forum to their CEO. I would say me and Enom are history as soon as I can move the rest of my domains away.

Does anyone know if Enom has a bulk tool to get all my auth codes? I can't find one listed and the only option appears to be to go through each domain and make a request.

[Focus]

This industry like any other business that involves valuable assets & lots of money is bound to have some shady crooks!

[KING dot NET]

I am with enom for years and have no incident as you mentioned.

Show some proof!

[BELLC1]

Show some proof!

Um, that's kind of the point.

They lost the domains. They say I moved them. They have audit records with IP addresses but won't show them to me nor can they provide me any documentation about the alleged moves. I still have my receipts of purchase. The ticket numbers above are still open, one for six months.

Hmmm....what could the missing variable possibly be??? <scratching head>