Login info --- legally yours?

[pam]

A friend (and yes, it's really a friend and not me!) had 5 domains with one registrar. The domains were registered by a reseller, his webhost. The login/password information was never given to him.

A page ripper bot got into this site and took $5,000 worth of bandwidth in a short time. He can't pay it, so he's negotiating with his web host. They've shut off his 5 sites.

I gave him information to get a new host and how to change DNS, contact information, etc.

Problem is he has no access to the account and the web host won't give it to him. I told him to call the registrar and simply ask them to send the information to the email address on his account, which is his.

Legally, does he have the right to demand the host release the information? He paid them to do a service, i.e. register his domains for him, but the information was never given to him (or so he claims).

Or, legally, can he demand the registrar release the information to him, even though he's not the reseller??

[jberryhill]

"no access to the account"

The account. You know, there are at least three potentially distinct things you might be by "the account" - his email account, his webhosting account, or the registrar account.

So let's start with three simple questions:

1. (yes or no) Is the administrative contact email address in the domain name registration record (the whois data) accessible to your friend? I.e. is your friend able to send and receive email via this address?

2. (name of registrar) Who is the registrar with whom the domain name is registered? Don't provide the name of the reseller, affiliate, etc. Go to vgrs.com (the registry), and provide the identity of the registrar listed there as the sponsoring registrar.

3. Is your friend the registrant of the domain name - i.e. is your friend the part listed as the registrant (not the admin contact or any other contact) in the whois record?

"Legally" you can demand anyone to do just about anything. Whether or not they are required to comply with the demand can be an interesting question.

However, the solution here may be a lot simpler than arguing with people.

[pam]

Thanks, John --

He is locked out of his domains but that's not the issue. He can't get into registrar to change DNS.

He's listed (fortunately) as the domain owner and the email address is 1000% correct.

He's afraid the web host will go in and lock him out somehow, drop the domains, etc out of spite.

He may have found a way around this, that is going to a new registrar and simply requesting a transfer of domains to the new registrar. However, the technical contact on one domain is his old host and he's afraid they'll block it.

I've impressed upon him to not use a 'reseller' and register things himself, keep a file with passwords and don't let others do your work for you

[cshel]

I'm pretty sure you can get around your technical contact blocking the transfer request by faxing in some form, and a letter on company letterhead (or a photocopy of your DL if the registrant is an individual)... I'm sure it varies by registrar, so your friend will want to check.

Good luck,
Carolyn

[jberryhill]

Cshel, you are correct. The procedure varies by registrar. But apparently, the registrar is not going to be identified in this thread, so of the potentially 150-odd different policies out there, it is not worth guessing, or describing all of the various things that might or might not be worth doing on the off chance that it may be relevant to the unidentified registrar.

Of course, if we knew the registrar, we would know whether the tech contact or reseller could block the transfer. Then again, if it is one of the registrars I work with on a regular basis, a phone call to the right people should take care of it rather simply.

I think we have answers to questions one and three, but not two.

"I've impressed upon him to not use a 'reseller' and register things himself"

Well, that all depends on the registrar, in which case the word 'reseller' can mean a couple of different things.

The "right" thing to do can really depend on which registrar we are (or aren't) talking about here. If it is a Tucows/OpenSRS domain name, then there has to be a reseller, since they do not provide direct domain name registration services.

[pam]

Sorry, I didn't see you ask which registrar, but it's Tucows/OpenSRS

I never knew they had such a reseller program

The problem is this guy was very green (well, still is) and didn't think to check the whois information, didn't bother to ask for the login details for himself, etc.

He could not find information but I gave him the Tucows phone number. He called and was told they would not provide the information. I told him to simply ask them to email it to the registrant on file; they refused.

They will only provide it to the reseller.

Imagine if a reseller went out of business .... sucks to be them

[GeorgeK]

Pam: you can try initiating a transfer from one reseller to another reseller, within OpenSRS (i.e. to a reseller you trust). You might need to talk to OpenSRS' compliance department, but they should allow you to do it, despite the reseller's lock.

[cshel]

This is the OpenSRS policy guilde to Domain Locking...

http://resellers.tucows.com/opensrs/...ckingguide.pdf

It specifically says that Tucows will unlock any domain found to be locked against the registrants wishes. There should also be information within about disputing a lock.

Carolyn

[jberryhill]

"I never knew they had such a reseller program"

If you go to opensrs.net, and click on "end user", it's pretty clearly explained there. The fact that you can't register a domain name at Tucows or OpenSRS should be a pretty big clue.

It is the only way they work. They do manage one reseller - domaindirect.com. Your friend should be able to simply use their domain transfer wizard to move the domain name to the domaindirect reseller.

I would also recommend using www.thenic.com for a high level of personal service.

[pam]

Yes, John, if I were familiar with Tucows as a registrar I'd have known they have a reseller program and seen the "big clue."

However, I'd never been to that site before and don't use them as a registrar so was totally unfamiliar with them.

It makes no sense to me to have a 'reseller' program, but I suppose there are rip-offs in every facet of this industry, and of course, many outside this industry.

[GeorgeK]

Pam: Tucows having a reseller model isn't a scam or ripoff. It's a legitimate business model (which made them go from nothing, to the #2 registrar overall, behind only Network Solutions). Folks like eNom have emulated OpenSRS in that regard too. By concentrating on the back-end, and allowing their partners to concentrate on marketing and customer support, there's a win-win situation that allows folks to add value in areas of their expertise.

I have an account at OpenSRS too (mostly for my own domains, but also for a few private clients), and am happy. Your own bad experience can be overcome by following the appropriate channels, as Carolyn and John have pointed out.

[pam]

Uhm, I haven't had any bad experiences at all. This was honestly not about me and about a friend. I'd never go through a reseller; it's not rocket science to register a domain name and it's crazy to give someone else such control.

To me, it's a rip-off; to pay someone else to register a domain name is just .. nonsense.

My 60+ domains are either with Network Solutions or GoDaddy.

"Go Daddy ranked #1 among all registrars in net new domain name registrations for the year 2002.
Source: Name Intelligence, Inc. DBA Whois Source.

Thanks to all of our customers, Go Daddy Software has climbed the ranks of the largest registrars from #47 in 2001 to #4 in 2003!
Source: www.registrarstats.com and State of the Domain Report, published by SnapNames.com"

[cshel]

Whether you register it through a reseller or through GoDaddy or NetSol, you're still not "registering it yourself" because you don't have the access to initiate a registration without going through a licensed registrar.... do you see what I'm saying?

Granted, I think it IS better when the registrar you're using has a little form doodad and you can personally fill in the appropriate info yourself to make sure you have access to the account, but there are tons of people who just hand off the reg process to their IT consultant.

I think the crux of the problem is that your friend dealt with some shady characters, not that the OpenSRS system of resellers is a bad or good system.

Carolyn

[pam]

Oh, I agree they're shady and if I wouldn't open myself up to litigation, I'd name the SOBs who did this to him (he did so on a public forum but it's his ass, not mine!).

Shutting down his sites for not paying the $5k for bandwidth I understand but not giving him access to his own domains AND using his real name (he's a porn star/escort), address and home phone number on a public whois is reprensible. They used his business information on one level then left him wide open in other areas.