Godaddy domain names being stolen!

**Rockefeller** · 10-06-2009, 10:56 AM

A scammer is on a stealing spree as of right now, as far as I know, he is only stealing GoDaddy domain names. Godaddy isn't really doing anything about it. The scammer will either hack into your Godaddy account, steal it, and then sells it as fast as possible. BEWARE: The scammer is also contacting people with Godaddy domain names, setting up escrow transactions at Escrow.com, EscrowDNS, Moniker, etc, and then emails the seller making it appear that it is from the escrow service and tells the seller to push the domain name into their account at Godaddy. Make sure that you CALL any escrow service that you are using before pushing the domain name. Also remember that an escrow service WILL NEVER ask you to transfer the domain name UNTIL THE PAYMENT is secured. If you are a victim of this scammer, I recommend that you contact Godaddy ASAP.

Here are some of the scammers email addresses:

meebooo1@yahoo.com
i.domain405@gmail.com
i.domain405@yahoo.com
i.domain405@*.com
mrmaster123@gawab.com
domainguy25@rocketmail.com
domainguy25@*.com

And several others

**Gerry** · 10-06-2009, 11:07 AM

have not seen anything like the above emails but thanks for the tip off

**Rockefeller** · 10-06-2009, 11:16 AM

Also:

A scammer is on a stealing spree as of right now, as far as I know, he is only stealing GoDaddy domain names. Godaddy isn't really doing anything about it. The scammer will either hack into your Godaddy account, steal it, and then sells it as fast as possible. BEWARE: The scammer is also contacting people with Godaddy domain names, setting up escrow transactions at Escrow.com, EscrowDNS, Moniker, etc, and then emails the seller making it appear that it is from the escrow service and tells the seller to push the domain name into their account at Godaddy. Make sure that you CALL any escrow service that you are using before pushing the domain name. Also remember that an escrow service WILL NEVER ask you to transfer the domain name UNTIL THE PAYMENT is secured. If you are a victim of this scammer, I recommend that you contact Godaddy ASAP.

Here are some of the scammers email addresses:

eileenturn.22@gmail.com
rknippel66@yahoo.com

Normally this guy will create an escrow transaction and immediately email seller asking to push the domain name, just stay sharp and don't fall for this guy!

**stevo** · 10-06-2009, 11:28 AM

Thanks for the heads up. I'll definitely scrutinize any suspicious emails.

**stewie** · 10-06-2009, 11:52 AM

thx for headsup

**Rockefeller** · 10-06-2009, 11:53 AM

No problem, if you've had your domain names stolen, please post the email addresses that the scammer used here to get them cached in Google.

**hina** · 10-06-2009, 02:32 PM

The scammer will either hack into your GoDaddy account, steal it, and then sells it as fast as possible.

Is this some security hole / exploit at GoDaddy? Our accounts can get hacked without us doing anything?

**dejanlesi** · 10-06-2009, 05:00 PM

I have one more email address to add to your list as we just got one domain stolen through the same tactic described above.

i.domain405@yahoo.com

**Onward** · 10-06-2009, 05:51 PM

http://forums.digitalpoint.com/showthread.php?t=1198097

This is the same guy....so add these e-mails:

ldarushl@yahoo.com
legia_cwks@yahoo.com

He is associated with the domain: Foolex.com - It looks like he owns this one

**Rockefeller** · 10-06-2009, 06:18 PM

Originally Posted by dejanlesi

I have one more email address to add to your list as we just got one domain stolen through the same tactic described above.

i.domain405@yahoo.com

That one is already listed above, which name did he steal from you?

Also want to add that I know of these domain names being stolen within past few days:

4n.net
iwy.com
zaq.com
vpr.com

**bdjuf** · 10-06-2009, 06:28 PM

i.domain405@gmail.com

he currently has my VPR.com

Gave GoDaddy a call and left an email as soon as I found out about this...

**Rockefeller** · 10-06-2009, 06:29 PM

try emailing undo@godaddy.com asap if you have a domain name stolen

This guy also uses Yahoo and MSN messenger using the screen name:

GMDomain1

GMdomain1@yahoo.com

**bdjuf** · 10-06-2009, 08:42 PM

Dear Robert **********,

Thank you for your email.

Unfortunately, you initiated the change of account for the domain name. For that reason, we will be unable to reverse the change that was made.

Upon creating your account, you agreed to the Universal Terms of Service for GoDaddy. The Terms specified that you are entirely responsible for the activities that take place in your account.

The Terms can be found at: https://www.godaddy.com/gdshop/agreements.asp?ci=8924

Any disputes over the ownership of the domain name will need to be sent through an ICANN-approved arbitration provider (http://www.icann.org/dndr/udrp/approved-providers.htm) or the court system.

It is never necessary to name GoDaddy.com, Inc. in a dispute. We will abide by any decision from an ICANN-approved arbitration forum or a court of competent jurisdiction.

Please be assured that if we receive notice of a pending legal dispute we will lock the name so it cannot be transferred or otherwise modified. Likewise, when we receive a decision we will update the name accordingly. If you file a dispute concerning the domain name, please forward a filed copy to domaindisputes@godaddy.com.

Best Regards,

Undo Department

**Rockefeller** · 10-06-2009, 08:49 PM

So who owns the domain name Robert, you or dejanlesi?

**bdjuf** · 10-06-2009, 08:49 PM

I own it, Dejan was brokering it for me to the buyer

**Gerry** · 10-06-2009, 09:13 PM

Do you know if any of this has anything to do with the 100,000 yahoo email accounts (?) accounts hacked (saw this on the news this evening)? Also, google gmail accounts have also been hacked although google has not revealed how many.

The reason I mention this is nearly all of these hacked email accounts are being used for phishing schemes on one form or another.

The question would be how someone has been able to access GoDaddy's database of accounts to access and match up domains with email addresses.

This really appears a very well planned and coordinated event and not someone who "just got lucky".

**ydnaemsti** · 10-06-2009, 10:01 PM

Guy is from Chicago IL.

His real name could be: luke zycki

You guys should check the IPs he sent those emails from and try to match IP addresses on DNForum in order to get his screen name here.

And this could be the address:
221 POPPY LN, BENSENVILLE, IL 60106

**Mazkel** · 10-06-2009, 10:20 PM

Thanks for the heads up.

**Mike Cruz** · 10-07-2009, 12:06 AM

Originally Posted by ydnaemsti

Guy is from Chicago IL.

His real name could be: luke zycki

You guys should check the IPs he sent those emails from and try to match IP addresses on DNForum in order to get his screen name here.

And this could be the address:
221 POPPY LN, BENSENVILLE, IL 60106

OMG! Obviously this was OBAMA! Lol....

This is some crazy shit, times like this makes me feel better about not having any HIGH END LLL's and such... or gmail / yahoo addy's...

Sigh, good luck to everyone who lost a domain and I feel for you all, this has got to suck...