Looks like one of my domains has been stolen

[VirtualT]

removed

[TheLegendaryJP]

Details.

[Acro]

RTL is a big German "variety" tv channel. Maybe that's why it was targeted.

[Focus]

public hanging?

[ColdGin]

Could someone explain how this could happen? Wich was the registrar?

[VirtualT]

Well basically, this character Morad contacted me on Afternic and enquired about purchase of the the domain R.TL late last year.

At that time the nic.tl registry (who administer the ccTLD) was down for maintenance and after a bit of "to and fro", I advised Morad that there was nothing I could do until the registry became operational again, but I would try to email them and see if I could do a change of registrant in the mean time.

Well It looks as if Morad and his karmaniagroup couldn't wait, and have forged approval for the domain transfer to the registry by social engineering (I presume), as the whois no longer shows my details.

Because the registry logins are not fully functioning yet, I still have control over the DNS oi the domain.

I sent Morad an email last night asking him what was going on, this was his reply:

Kris,

i just asked from our IT manager, and he advised that we purchased r.tl
from you on Nov 24th 2006! and the nic.tl administration received your
letter of agreement! If there is anything wrong, please let me know
because i personally not sure what happened to that.


Thank you
Morad

This person is a thief and a liar, there was never any purchase agreement, no money changed hands and I did not approve a transfer.

All I can say is beware investing decent sums of money into ccTLD's whose registrars security may be less than acceptable.

[Brett Lewis]

There are some fairly sophisticated hackers out there. It is also very easy to edit an email that you sent to make it look like you approved the transfer. If the registry has weak security protocols, something like that could work. The best way to get your name back is to contact the registry immediately and demand that they restore the account to your name. Ask them to lock the account pending resolution of the dispute.

Good luck.

[Acro]

Originally Posted by Brett Lewis

There are some fairly sophisticated hackers out there. It is also very easy to edit an email that you sent to make it look like you approved the transfer. If the registry has weak security protocols, something like that could work. The best way to get your name back is to contact the registry immediately and demand that they restore the account to your name. Ask them to lock the account pending resolution of the dispute.

Good luck.

That was the case in the days of NetSol and their autoresponder mechanism.

[Raider]

Originally Posted by Brett Lewis

The best way to get your name back is to contact the registry immediately and demand that they restore the account to your name. Ask them to lock the account pending resolution of the dispute.

Good luck.

I agree with Brett, your #1 priority right now is to have the domain frozen, what Registrar is the domain currently at?

[VirtualT]

Thanks guys

Im currently working with the technical staff at CoCCA to recover the domain.
I have to say that when it came to the crunch, CoCCA technical staff have been very helpful and professional at this stage.

I am expecting a resolution soon and will give credit where it is due.

[Raider]

Originally Posted by VirtualT

Well basically, this character Morad contacted me on Afternic and enquired about purchase of the the domain R.TL late last year.

At that time the nic.tl registry (who administer the ccTLD) was down for maintenance and after a bit of "to and fro", I advised Morad that there was nothing I could do until the registry became operational again, but I would try to email them and see if I could do a change of registrant in the mean time.

Well It looks as if Morad and his karmaniagroup couldn't wait, and have forged approval for the domain transfer to the registry by social engineering (I presume), as the whois no longer shows my details.

Because the registry logins are not fully functioning yet, I still have control over the DNS oi the domain.

I dont quite understand why you would consider changing the Registrant if no money exchanged hands?, and how they were able to process a transfer and change the Registrant or did they? did the domain actually get transferred to another Registrar, it doesnt sound like it. And it appears they dont have complete access to the domain, I'm very interested to know what happened in this case...please provide more details.

[VirtualT]

Originally Posted by RaiderGirl

I dont quite understand why you would consider changing the Registrant if no money exchanged hands?

No, the negotiations with him got to the stage of me saying I would email the registry to see if the domain was able to be transferred as the registry was undergoing maintenance for EPP compliance.

Originally Posted by RaiderGirl

, and how they were able to process a transfer and change the Registrant or did they? did the domain actually get transferred to another Registrar, it doesnt sound like it.

No, the domain was just changed to him as as the registrant, how this actually happened is still not clear, although I suspect by forging documents and a bit of social engineering. You have to remember while the registry was down, all management of .TL domains was handled through email to the registry...

Originally Posted by RaiderGirl

And it appears they dont have complete access to the domain, I'm very interested to know what happened in this case...please provide more details.

please go to http://r.tl for a maybe better explanation

The latest threatening email from our Iranian scammer Morad or his US based croney at Global Marine, they run shipping lines between Iran and America didn't you know.
I don't think they liked the page that I put up identifying their latest business practices.

Dear Mr.Urwin,

This is our final notice to you to shot the published webpage down,
otherwise we will take the legal actions against you if you don't
remove the information you have written on r.tl in 24 hours. That page
snapshots are ready to be submitted to the legal courts as the
evidences of the sue case, since you damaged the international
reputation of Karmania Group of Companies, and the president of the
umbrella company, Dr.Fouladi by writing the shameful destructive
information. As our records show, you have been agreed to sell us R.TL
and you and Dr.Fouladi on behalf of Karmania Group Inc, have finalized
the offer or 600$ on Nov 12-13 2006 and you have paid by Nov 20. Since
you have transferred all rights of R.TL to Karmania Group Inc on Nov 20
2006, your action completely means a fraud if you don't remove the
content of the page and give the domain name back to us in 24 hours.

If you are not fully satisfied with the transaction we have had for R.TL,
you could send me your request and we will negotiate it in priority.


Regards,
Nick Jason
Director
Karmania Group Inc,
404 - 999 Canada Place
World Trade Centre
Vancouver, BC V6C 3E2
Canada

T: 1.604 641 1249
F: 1.866 654 0571

I didn't take it down but the domain is now suspended.
He is sticking to the story that a sales agreement took place and I was paid for the domain, I quote from his response to the registrar:

"The seller agreed to sell the domain name for 600US$. He has confirmed
that he has received the money on Nov 13th(been sent 5 bills of 100$ and 5
bills of 20$ cash by express mail to the seller)."

LOL, so he sent me cash through the mail from Iran or Canada to Australia, come on now, the fact that he didn't know the address might have been a sticking point if a staff member at CoCCA hadn't sent to him in a forwarded email, in fact she sent him my name, address and phone number that I had supplied to them. Great.

The scary thing is that CoCCa seem to be lapping this stuff up. Mind you, Morad is doing an exceptional job at his scam, even throwing in

"We also have registered an international company under this name located
in West Vancouver, BC Canada to do business internationally and in East
Timor. The Canadian trademark also has been filled for R.TL and its logo."

It now seems as though the domain has been transferred to the scammer on the strength of an email that was sent to Diverge (who I bought the domain off) asking if he had recently sold the domain.

This just gets better!, maybe he has rights to the domain because he sounds more important than me?

At this stage I am still hoping that the registrar will examine all the evidence properly, his story has holes all through it.

more to come

[Acro]

Take it to the FBI, Iran is in hot waters currently.

[Raider]

Originally Posted by VirtualT

No, the negotiations with him got to the stage of me saying I would email the registry to see if the domain was able to be transferred as the registry was undergoing maintenance for EPP compliance.



No, the domain was just changed to him as as the registrant, how this actually happened is still not clear, although I suspect by forging documents and a bit of social engineering. You have to remember while the registry was down, all management of .TL domains was handled through email to the registry...



please go to http://r.tl for a maybe better explanation

The latest threatening email from our Iranian scammer Morad or his US based croney at Global Marine, they run shipping lines between Iran and America didn't you know.
I don't think they liked the page that I put up identifying their latest business practices.

Dear Mr.Urwin,

This is our final notice to you to shot the published webpage down,
otherwise we will take the legal actions against you if you don't
remove the information you have written on r.tl in 24 hours. That page
snapshots are ready to be submitted to the legal courts as the
evidences of the sue case, since you damaged the international
reputation of Karmania Group of Companies, and the president of the
umbrella company, Dr.Fouladi by writing the shameful destructive
information. As our records show, you have been agreed to sell us R.TL
and you and Dr.Fouladi on behalf of Karmania Group Inc, have finalized
the offer or 600$ on Nov 12-13 2006 and you have paid by Nov 20. Since
you have transferred all rights of R.TL to Karmania Group Inc on Nov 20
2006, your action completely means a fraud if you don't remove the
content of the page and give the domain name back to us in 24 hours.

If you are not fully satisfied with the transaction we have had for R.TL,
you could send me your request and we will negotiate it in priority.


Regards,
Nick Jason
Director
Karmania Group Inc,
404 - 999 Canada Place
World Trade Centre
Vancouver, BC V6C 3E2
Canada

T: 1.604 641 1249
F: 1.866 654 0571

I didn't take it down but the domain is now suspended.
He is sticking to the story that a sales agreement took place and I was paid for the domain, I quote from his response to the registrar:

"The seller agreed to sell the domain name for 600US$. He has confirmed
that he has received the money on Nov 13th(been sent 5 bills of 100$ and 5
bills of 20$ cash by express mail to the seller)."

LOL, so he sent me cash through the mail from Iran or Canada to Australia, come on now, the fact that he didn't know the address might have been a sticking point if a staff member at CoCCA hadn't sent to him in a forwarded email, in fact she sent him my name, address and phone number that I had supplied to them. Great.

The scary thing is that CoCCa seem to be lapping this stuff up. Mind you, Morad is doing an exceptional job at his scam, even throwing in

"We also have registered an international company under this name located
in West Vancouver, BC Canada to do business internationally and in East
Timor. The Canadian trademark also has been filled for R.TL and its logo."

It now seems as though the domain has been transferred to the scammer on the strength of an email that was sent to Diverge (who I bought the domain off) asking if he had recently sold the domain.

This just gets better!, maybe he has rights to the domain because he sounds more important than me?

At this stage I am still hoping that the registrar will examine all the evidence properly, his story has holes all through it.

more to come

Incredible.....Are you communicating with the Registrar by phone? If he cant show proof of payment or a signed agreement by you, he's dead in the water, at least in the USA, did you receive anything by registered mail from this guy, such as a envelope with blank paper?....Does he have your signature on anything?

Dealing with a another country is so unpredictable...I really hope you get your name back!

[Devil Dog]

Preposterous. I can't believe someone sat there and actually believed that this individual sent you cash through the mail.

What's funny also is, if they owned it, why do you still have the abilities to change the content?

[VirtualT]

Originally Posted by RaiderGirl

Incredible.....Are you communicating with the Registrar by phone? If he cant show proof of payment or a signed agreement by you, he's dead in the water, at least in the USA, did you receive anything by registered mail from this guy, such as a envelope with blank paper?....Does he have your signature on anything?

Negative on all counts but I have talked to the registrar by phone, notice that he claims payment by "express post" not registered post, big difference, and is claiming an express post receipt as proof of payment, yes,,, laughable

Originally Posted by Devil Dog

Preposterous. I can't believe someone sat there and actually believed that this individual sent you cash through the mail.

What's funny also is, if they owned it, why do you still have the abilities to change the content?

The dns has been suspended now, but as the domain was locked and DNS remained the same, pointing my 3rd party dns provider.

It appears that even though the domain was in my account, and I had full control over it, the original registrant of the domain, Diverge, was still the actual owner of the domain.

A signed and faxed document needs to be procured from the original registrant to change the owner of the domain to me.

Even though my email address was listed in the administrative contacts, I myself never received the email from the registrar to authorise the transfer to Morad, Diverge received the email, which basically just asked him if he had sold the domain recently, to which he replied he had.

On the strength of this, it seems the domain was not only pushed to Morad, but Morad has become the actual registered owner, even without the fax been sent.

This is starting to sound very much like Registrar mismanagement to me.

more to come....

[Brett Lewis]

Keep documenting your claim and force him to prove his. There is one very sophisticated Iranian hacker out there who fits the M.O. of your guy. He socially engineers, and he hacks, and forges I.D. Not good if he is your guy. Emphasize that you never sold the domain and force the other guy to prove it. Don't be surprised if he produces forged documents of sale, etc.

[Raider]

Yes document everything, but also stay in contact with the Registrar by phone, build a relationship of trust with the person who is helping you, it will make things flow that much easier.

[Dave Zan]

Originally Posted by Brett Lewis

Don't be surprised if he produces forged documents of sale, etc.

And don't be surprised if the Registry tells you to duke it out in court as well.