It appears you have not yet registered with our community. To register please click here...

DNforum.com - Domain Sales, Domain Forum, Domain Appraisals
 
Register Now!
Register Now for FREE!
Our records show you have not yet registered to our forums. To sign up for your FREE account INSTANTLY fill out the form below!

Username: Password: Confirm Password: E-Mail: Confirm E-Mail:  
Birthday:       I agree to forum rules 

Go Back   DNForum - Domain Sales, Domain Forum, Domain Appraisals, Domain Registrars > Domain News, Beginners Guides and Legal Stuff! > Legal Issues
Reply
 
LinkBack Thread Tools Display Modes
Old 02-27-2007, 09:51 AM   #1 (permalink)
DNF Addict
 
VirtualT's Avatar
 
Name: Kris
Last Online: 09-22-2008 04:56 AM
iTrader: (73)
Join Date: Aug 2006
Posts: 2,089
DNF$: 32
Location: Perth
Country:


Looks like one of my domains has been stolen

removed

Last edited by VirtualT; 03-04-2007 at 07:50 PM.
VirtualT is offline   Reply With Quote
Sponsored Links
Old 02-27-2007, 10:35 AM   #2 (permalink)
 
TheLegendaryJP's Avatar
 
Last Online: 10-10-2008 06:54 PM
iTrader: (23)
Join Date: Jul 2005
Posts: 1,891
DNF$: 3,248
Location: Canada
Country:




Re: Looks like one of my domains has been stolen

Details.
__________________
TheLegendaryJP is offline   Reply With Quote
Old 02-27-2007, 11:28 AM   #3 (permalink)
Acro.net Αdministrator
 
Acro's Avatar
 
Last Online: Today 05:56 PM
iTrader: (365)
Join Date: Feb 2004
Posts: 19,112
DNF$: 15,828
Location: Domainistan
Country:



Re: Looks like one of my domains has been stolen

RTL is a big German "variety" tv channel. Maybe that's why it was targeted.
__________________

Acroplex.com Professional Web & Graphics development
Acro is offline   Reply With Quote
Old 02-27-2007, 11:31 AM   #4 (permalink)
Vote for Obama 2008
 
Focus's Avatar
 
Name: Chris
Last Online: Today 09:21 PM
iTrader: (94)
Join Date: May 2005
Posts: 7,540
DNF$: 17,777
Location: Dirty South
Country:



Re: Looks like one of my domains has been stolen

public hanging?
__________________
READ PLEASE!
*Buying Typos & Generics of Credit Card/Banking/Credit Report/Insurance
Loans/Cars/Auto with traffic. *~*FinancialBailout com*~*For Sale LOOK!
Focus is online now   Reply With Quote
Old 02-27-2007, 11:37 AM   #5 (permalink)
Platinum Lifetime Member
 
ColdGin's Avatar
 
Name: Daniel
Last Online: 09-26-2008 07:15 AM
iTrader: (23)
Join Date: May 2006
Posts: 1,651
DNF$: 2,568
Location: NoWayOut
Country:


Re: Looks like one of my domains has been stolen

Could someone explain how this could happen? Wich was the registrar?
__________________
Israel Tours
"It´s better to keep your mouth closed and let people think you are a fool than open it and remove all doubt" Mark Twain
ColdGin is offline   Reply With Quote
Old 02-27-2007, 06:17 PM   #6 (permalink)
DNF Addict
 
VirtualT's Avatar
 
Name: Kris
Last Online: 09-22-2008 04:56 AM
iTrader: (73)
Join Date: Aug 2006
Posts: 2,089
DNF$: 32
Location: Perth
Country:


Re: Looks like one of my domains has been stolen

Well basically, this character Morad contacted me on Afternic and enquired about purchase of the the domain R.TL late last year.

At that time the nic.tl registry (who administer the ccTLD) was down for maintenance and after a bit of "to and fro", I advised Morad that there was nothing I could do until the registry became operational again, but I would try to email them and see if I could do a change of registrant in the mean time.

Well It looks as if Morad and his karmaniagroup couldn't wait, and have forged approval for the domain transfer to the registry by social engineering (I presume), as the whois no longer shows my details.

Because the registry logins are not fully functioning yet, I still have control over the DNS oi the domain.

I sent Morad an email last night asking him what was going on, this was his reply:

Kris,

i just asked from our IT manager, and he advised that we purchased r.tl
from you on Nov 24th 2006! and the nic.tl administration received your
letter of agreement! If there is anything wrong, please let me know
because i personally not sure what happened to that.


Thank you
Morad

This person is a thief and a liar, there was never any purchase agreement, no money changed hands and I did not approve a transfer.

All I can say is beware investing decent sums of money into ccTLD's whose registrars security may be less than acceptable.
VirtualT is offline   Reply With Quote
Old 02-28-2007, 02:42 PM   #7 (permalink)
Platinum Lifetime Member
 
Name: Brett
Last Online: 09-19-2008 01:12 PM
iTrader: (1)
Join Date: Jul 2006
Posts: 136
DNF$: 370
Location: Brooklyn, New York
Country:


Re: Looks like one of my domains has been stolen

There are some fairly sophisticated hackers out there. It is also very easy to edit an email that you sent to make it look like you approved the transfer. If the registry has weak security protocols, something like that could work. The best way to get your name back is to contact the registry immediately and demand that they restore the account to your name. Ask them to lock the account pending resolution of the dispute.

Good luck.
__________________
Brett E. Lewis, Esq.
brett@lewishand.com
Brett Lewis is offline   Reply With Quote
Old 02-28-2007, 02:46 PM   #8 (permalink)
Acro.net Αdministrator
 
Acro's Avatar
 
Last Online: Today 05:56 PM
iTrader: (365)
Join Date: Feb 2004
Posts: 19,112
DNF$: 15,828
Location: Domainistan
Country:



Re: Looks like one of my domains has been stolen

Quote:
Originally Posted by Brett Lewis View Post
There are some fairly sophisticated hackers out there. It is also very easy to edit an email that you sent to make it look like you approved the transfer. If the registry has weak security protocols, something like that could work. The best way to get your name back is to contact the registry immediately and demand that they restore the account to your name. Ask them to lock the account pending resolution of the dispute.

Good luck.
That was the case in the days of NetSol and their autoresponder mechanism.
__________________

Acroplex.com Professional Web & Graphics development
Acro is offline   Reply With Quote
Old 02-28-2007, 04:19 PM   #9 (permalink)
 
Raider's Avatar
 
Name: RG
Last Online: Today 09:17 PM
iTrader: (12)
Join Date: Aug 2006
Posts: 3,892
DNF$: 3,252
Location: Private
Country:


Re: Looks like one of my domains has been stolen

Quote:
Originally Posted by Brett Lewis View Post
The best way to get your name back is to contact the registry immediately and demand that they restore the account to your name. Ask them to lock the account pending resolution of the dispute.

Good luck.
I agree with Brett, your #1 priority right now is to have the domain frozen, what Registrar is the domain currently at?
__________________
Is this our next President?
Raider is online now   Reply With Quote
Old 02-28-2007, 06:53 PM   #10 (permalink)
DNF Addict
 
VirtualT's Avatar
 
Name: Kris
Last Online: 09-22-2008 04:56 AM
iTrader: (73)
Join Date: Aug 2006
Posts: 2,089
DNF$: 32
Location: Perth
Country:


Re: Looks like one of my domains has been stolen

Thanks guys

Im currently working with the technical staff at CoCCA to recover the domain.
I have to say that when it came to the crunch, CoCCA technical staff have been very helpful and professional at this stage.

I am expecting a resolution soon and will give credit where it is due.
VirtualT is offline   Reply With Quote
Old 02-28-2007, 07:37 PM   #11 (permalink)
 
Raider's Avatar
 
Name: RG
Last Online: Today 09:17 PM
iTrader: (12)
Join Date: Aug 2006
Posts: 3,892
DNF$: 3,252
Location: Private
Country:


Re: Looks like one of my domains has been stolen

Quote:
Originally Posted by VirtualT View Post
Well basically, this character Morad contacted me on Afternic and enquired about purchase of the the domain R.TL late last year.

At that time the nic.tl registry (who administer the ccTLD) was down for maintenance and after a bit of "to and fro", I advised Morad that there was nothing I could do until the registry became operational again, but I would try to email them and see if I could do a change of registrant in the mean time.

Well It looks as if Morad and his karmaniagroup couldn't wait, and have forged approval for the domain transfer to the registry by social engineering (I presume), as the whois no longer shows my details.

Because the registry logins are not fully functioning yet, I still have control over the DNS oi the domain.
I dont quite understand why you would consider changing the Registrant if no money exchanged hands?, and how they were able to process a transfer and change the Registrant or did they? did the domain actually get transferred to another Registrar, it doesnt sound like it. And it appears they dont have complete access to the domain, I'm very interested to know what happened in this case...please provide more details.
__________________
Is this our next President?
Raider is online now   Reply With Quote
Old 02-28-2007, 07:52 PM   #12 (permalink)
DNF Addict
 
VirtualT's Avatar
 
Name: Kris
Last Online: 09-22-2008 04:56 AM
iTrader: (73)
Join Date: Aug 2006
Posts: 2,089
DNF$: 32
Location: Perth
Country:


Re: Looks like one of my domains has been stolen

Quote:
Originally Posted by RaiderGirl View Post
I dont quite understand why you would consider changing the Registrant if no money exchanged hands?
No, the negotiations with him got to the stage of me saying I would email the registry to see if the domain was able to be transferred as the registry was undergoing maintenance for EPP compliance.

Quote:
Originally Posted by RaiderGirl View Post
, and how they were able to process a transfer and change the Registrant or did they? did the domain actually get transferred to another Registrar, it doesnt sound like it.
No, the domain was just changed to him as as the registrant, how this actually happened is still not clear, although I suspect by forging documents and a bit of social engineering. You have to remember while the registry was down, all management of .TL domains was handled through email to the registry...

Quote:
Originally Posted by RaiderGirl View Post
And it appears they dont have complete access to the domain, I'm very interested to know what happened in this case...please provide more details.
please go to http://r.tl for a maybe better explanation

The latest threatening email from our Iranian scammer Morad or his US based croney at Global Marine, they run shipping lines between Iran and America didn't you know.
I don't think they liked the page that I put up identifying their latest business practices.

Dear Mr.Urwin,

This is our final notice to you to shot the published webpage down,
otherwise we will take the legal actions against you if you don't
remove the information you have written on r.tl in 24 hours. That page
snapshots are ready to be submitted to the legal courts as the
evidences of the sue case, since you damaged the international
reputation of Karmania Group of Companies, and the president of the
umbrella company, Dr.Fouladi by writing the shameful destructive
information. As our records show, you have been agreed to sell us R.TL
and you and Dr.Fouladi on behalf of Karmania Group Inc, have finalized
the offer or 600$ on Nov 12-13 2006 and you have paid by Nov 20. Since
you have transferred all rights of R.TL to Karmania Group Inc on Nov 20
2006, your action completely means a fraud if you don't remove the
content of the page and give the domain name back to us in 24 hours.

If you are not fully satisfied with the transaction we have had for R.TL,
you could send me your request and we will negotiate it in priority.


Regards,
Nick Jason
Director
Karmania Group Inc,
404 - 999 Canada Place
World Trade Centre
Vancouver, BC V6C 3E2
Canada

T: 1.604 641 1249
F: 1.866 654 0571

I didn't take it down but the domain is now suspended.
He is sticking to the story that a sales agreement took place and I was paid for the domain, I quote from his response to the registrar:

"The seller agreed to sell the domain name for 600US$. He has confirmed
that he has received the money on Nov 13th(been sent 5 bills of 100$ and 5
bills of 20$ cash by express mail to the seller)."

LOL, so he sent me cash through the mail from Iran or Canada to Australia, come on now, the fact that he didn't know the address might have been a sticking point if a staff member at CoCCA hadn't sent to him in a forwarded email, in fact she sent him my name, address and phone number that I had supplied to them. Great.

The scary thing is that CoCCa seem to be lapping this stuff up. Mind you, Morad is doing an exceptional job at his scam, even throwing in

"We also have registered an international company under this name located
in West Vancouver, BC Canada to do business internationally and in East
Timor. The Canadian trademark also has been filled for R.TL and its logo."

It now seems as though the domain has been transferred to the scammer on the strength of an email that was sent to Diverge (who I bought the domain off) asking if he had recently sold the domain.

This just gets better!, maybe he has rights to the domain because he sounds more important than me?

At this stage I am still hoping that the registrar will examine all the evidence properly, his story has holes all through it.

more to come

Last edited by VirtualT; 03-01-2007 at 10:08 AM. Reason: Automerged Doublepost
VirtualT is offline   Reply With Quote
Old 03-01-2007, 01:23 PM   #13 (permalink)
Acro.net Αdministrator
 
Acro's Avatar
 
Last Online: Today 05:56 PM
iTrader: (365)
Join Date: Feb 2004
Posts: 19,112
DNF$: 15,828
Location: Domainistan
Country:



Re: Looks like one of my domains has been stolen

Take it to the FBI, Iran is in hot waters currently.
__________________

Acroplex.com Professional Web & Graphics development
Acro is offline   Reply With Quote
Old 03-01-2007, 02:03 PM   #14 (permalink)
 
Raider's Avatar
 
Name: RG
Last Online: Today 09:17 PM
iTrader: (12)
Join Date: Aug 2006
Posts: 3,892
DNF$: 3,252
Location: Private
Country:


Re: Looks like one of my domains has been stolen

Quote:
Originally Posted by VirtualT View Post
No, the negotiations with him got to the stage of me saying I would email the registry to see if the domain was able to be transferred as the registry was undergoing maintenance for EPP compliance.



No, the domain was just changed to him as as the registrant, how this actually happened is still not clear, although I suspect by forging documents and a bit of social engineering. You have to remember while the registry was down, all management of .TL domains was handled through email to the registry...



please go to http://r.tl for a maybe better explanation

The latest threatening email from our Iranian scammer Morad or his US based croney at Global Marine, they run shipping lines between Iran and America didn't you know.
I don't think they liked the page that I put up identifying their latest business practices.

Dear Mr.Urwin,

This is our final notice to you to shot the published webpage down,
otherwise we will take the legal actions against you if you don't
remove the information you have written on r.tl in 24 hours. That page
snapshots are ready to be submitted to the legal courts as the
evidences of the sue case, since you damaged the international
reputation of Karmania Group of Companies, and the president of the
umbrella company, Dr.Fouladi by writing the shameful destructive
information. As our records show, you have been agreed to sell us R.TL
and you and Dr.Fouladi on behalf of Karmania Group Inc, have finalized
the offer or 600$ on Nov 12-13 2006 and you have paid by Nov 20. Since
you have transferred all rights of R.TL to Karmania Group Inc on Nov 20
2006, your action completely means a fraud if you don't remove the
content of the page and give the domain name back to us in 24 hours.

If you are not fully satisfied with the transaction we have had for R.TL,
you could send me your request and we will negotiate it in priority.


Regards,
Nick Jason
Director
Karmania Group Inc,
404 - 999 Canada Place
World Trade Centre
Vancouver, BC V6C 3E2
Canada

T: 1.604 641 1249
F: 1.866 654 0571

I didn't take it down but the domain is now suspended.
He is sticking to the story that a sales agreement took place and I was paid for the domain, I quote from his response to the registrar:

"The seller agreed to sell the domain name for 600US$. He has confirmed
that he has received the money on Nov 13th(been sent 5 bills of 100$ and 5
bills of 20$ cash by express mail to the seller)."

LOL, so he sent me cash through the mail from Iran or Canada to Australia, come on now, the fact that he didn't know the address might have been a sticking point if a staff member at CoCCA hadn't sent to him in a forwarded email, in fact she sent him my name, address and phone number that I had supplied to them. Great.

The scary thing is that CoCCa seem to be lapping this stuff up. Mind you, Morad is doing an exceptional job at his scam, even throwing in

"We also have registered an international company under this name located
in West Vancouver, BC Canada to do business internationally and in East
Timor. The Canadian trademark also has been filled for R.TL and its logo."

It now seems as though the domain has been transferred to the scammer on the strength of an email that was sent to Diverge (who I bought the domain off) asking if he had recently sold the domain.

This just gets better!, maybe he has rights to the domain because he sounds more important than me?

At this stage I am still hoping that the registrar will examine all the evidence properly, his story has holes all through it.

more to come

Incredible.....Are you communicating with the Registrar by phone? If he cant show proof of payment or a signed agreement by you, he's dead in the water, at least in the USA, did you receive anything by registered mail from this guy, such as a envelope with blank paper?....Does he have your signature on anything?

Dealing with a another country is so unpredictable...I really hope you get your name back!
__________________
Is this our next President?
Raider is online now   Reply With Quote
Old 03-01-2007, 04:38 PM   #15 (permalink)
 
Devil Dog's Avatar
 
Name: Darren
Last Online: Today 07:45 PM
iTrader: (70)
Join Date: Feb 2006
Posts: 2,738
DNF$: 6,458
Location: Iraq
Country:


Re: Looks like one of my domains has been stolen

Preposterous. I can't believe someone sat there and actually believed that this individual sent you cash through the mail.

What's funny also is, if they owned it, why do you still have the abilities to change the content?
__________________
.::: e-nic.com :::. - semperfidelis.com - stow.org - curfew.net - parlaying.com - shopbooks.com - 775.org - marinecorps.org and more....
Devil Dog is offline   Reply With Quote
Old 03-01-2007, 06:49 PM   #16 (permalink)
DNF Addict
 
VirtualT's Avatar
 
Name: Kris
Last O