Hijack attempt

[exxe]

GoDaddy sent me a transfer request for a domain registered at NetworkSolutions. The weird thing is that my domain is LOCKED and I don't know why GoDaddys accepted the request...

So I've contacted GoDaddy and they replied quite fast and I've emailed them back and they replied again, but they either don't know the answer or simply cannot understand the problem.

My email:

Hello,

I have not requested any transfer of the domain *****. Please investigate this, it could be a hijack attempt.

Also, the domain is LOCKED and, as far as I know, you check the domain status before accepting a domain transfer request. Why did you accept the request in this case?

Thank you,
Andrei

GoDaddy's reply:

Dear Andrei

Unfortunately requesting a domain name to be transferred is allowed for any domain name and this can cause a problem such as this. Many requests for transfers are made because people think that they can acquire the domain names this way or simply think that this is the correct procedure on how to register domains. This is not the case as people also make mistakes in misspelling domains while requesting a transfer.

If you did not make the request to have this domain name transferred then you can simply ignore this email notification. This is because the domain name will not be transferred unless the party attempting the domain has access to the admin email address. There are codes sent to this particular email address for the domain name that are needed in order to complete the transfer process. Since you have the codes and they do not then your domain name remains safe.

Note: Names for transfer requests are not given out in case of one of the instances above (a mistake of sorts).

We appreciate your understanding on this matter and will gladly answer any further questions you may have.

Sincerely,

My reply:

Thank you for your reply.

Yes, I am aware the domain is safe and cannot be transferred. I've only contacted you to report a possible security issue.

From my experience, whenever I try to transfer a domain to GoDaddy, your system checks if the domain can be transferred and proceeds ONLY in the case the domain is unlocked. In this particular case, it seems your system didn't verify the lock status of my domain name and that seemed weird to me.

And I've just tried to transfer, few seconds ago, that domain to GoDaddy and seen the message below:

"
Transfer Error:
******* is unavailable for transfer.
"

So I really cannot understand how that transfer request bypassed your automatic verification of the domain status.

Kind regards,
Andrei

GoDaddy's reply:

Dear Andrei,

As previously indicated, a transfer request is allowed for any domain name. However, the domain transfer can not be completed unless the domain is unlocked and the proper codes are provided to the new registrant. We apologize for any confusion in this matter.

Please let us know if we can assist you in any other way.

Sincerely,

Can anyone explain me how was that possible? Again, the domain status is LOCKED.

[draggar]

Anyone can request a transfer - I could go to Moniker now and request one of your domains if I wanted to. It is up to you (the owner) to accept or decline the transfer (too bad with some registrars you need to click to accept the transfer and others you need to click to decline it).

Some registrars check if the domain is locked and other's don't. For all GD knows you could have requested the x-fer but forgot to unlock it (they need to consider the lowest common denominator when it comes to their customer base).

Someone put in the reuqest with NetSol to transfer the domain to them from GoDaddy and GoDaddy sent you the notification / approval request. All you need to do is decline the request (according to GD's response - you can just ignore the request to decline it).

If you have repeated requests, I would recommend shooting an email to NetSol about it since the request is coming from them.

[exxe]

Someone put in the reuqest with NetSol to transfer the domain to them from GoDaddy and GoDaddy sent you the notification / approval request. All you need to do is decline the request (according to GD's response - you can just ignore the request to decline it).

Hm, I didn't know this is possible. Thanks for the info.

Whenever I've transferred a domain I've initiated the transfer from the "receiving" Registrar.

[draggar]

First, I read it backwards, I thought the domain was a GD and NetSol requested the transfer - if you keep getting them from GD, then shoot them another email.

But still - anyone can request a domain transfer and GD normally send the request to the domain owner.

[exxe]

Ed, if I try to initiate a transfer on GoDaddy and the domain is LOCKED at another Registrar I receive the message below:

"
Transfer Error:
******* is unavailable for transfer.
"

[draggar]

Really? I didn't before - it let me put in the request and I got the confirmation (and accepted). This was with a domain I forgot to unlock (but the domain didn't transfer until I did unlock it).

[SIKHboy]

Ed, if I try to initiate a transfer on GoDaddy and the domain is LOCKED at another Registrar I receive the message below:

"
Transfer Error:
******* is unavailable for transfer.
"

may be after you reported the incident to godaddy, they might have locked your domain for a while and that is why you are getting this error.



additionaly, anyone can request the domain to be transferred...thats nice if i would have done a transfer for business dot com and then owner would simply accept it LMAO

[exxe]

may be after you reported the incident to GoDaddy, they might have locked your domain for a while and that is why you are getting this error.

I have seen that exact message whenever I've tried to transfer a locked domain. That's why it seemed weird to me when I've received the transfer request.

[exxe]

It seems I was wrong :/ I've tried to transfer few of my locked domains and I would have been able to request a transfer with all of them.

I see the message "Transfer Error: ****.COM is unavailable for transfer" only when I try to transfer that specific domain. Maybe that happens because someone already requested a transfer for it. I have seen that error message in the past too, that's why I was thinking GoDaddy checks the domain lock-status.

[fatter]

I had exact same problem with GD I reported it twice so they could address it and they proceeded to give me 2 lectures on how to lock my names, they could care less about their clients attempting to steal domains I dont do any business with them any more because of this. The same person I beleive who tried to transfer name also tried to buy it for peanuts right after transfer requests where denied.
What would be appropiate is for GoDaddy to track clients who repeatidly attempt to do this and ban them