CNOBIN: automatic transfer if not authorized?

[Mr. DeletedMr. Deleted is verified member.]

Transfer of ****.com


Dear Customer,


Bizcn.com, Inc received notification on 2005-10-07 13:08:12.0 that you have requested a transfer to another domain name registrar.Please visit the secure web page http://www.cnobin.com within three (3) days,click "Confirm" button if you want to proceed with the transfer or click "Cancel" button if you want to cancel the transfer.

If we do not hear from you by 2005-10-10, the transfer will proceed.



Best regards,

CNOBIN
Email:[email protected]

The way I understand this is that if I do NOT CANCEL the transfer, then it will go through... So if a hacker knew that a domain owner was away for 3 days and had his name unlocked and at a cnobin reseller, then they could just do a transfer and it would go through? Man I don't want to deal with a site like that.

Also they sent this to an email that was no longer an admin contact email address.This is a domain that I'm selling and the new owner had his email as the admin contact but now they sent me this email and I don't understand why anyone would deal with them.

 

[stuff]

The way I understand this is that if I do NOT CANCEL the transfer, then it will go through... So if a hacker knew that a domain owner was away for 3 days and had his name unlocked and at a cnobin reseller, then they could just do a transfer and it would go through? Man I don't want to deal with a site like that.

Also they sent this to an email that was no longer an admin contact email address.This is a domain that I'm selling and the new owner had his email as the admin contact but now they sent me this email and I don't understand why anyone would deal with them.

not if You have reg lock

 

[Jeffreyw]

It is an ICANN policy.

Lock it now fast!

 

[Dave Zan]

I've never used cnobin yet. But if they're following a "trend" among registrars,
they may be utilizing user level accounts.

One registrar set their domain accounts to have a main user. The main user
can add other contacts with lesser permissions.

I'm just guessing that's what happened in this case, of course. Ask cnobin to
be sure.

Anyway, as Jeffreyw said it's now ICANN policy that losing registrars no longer
need confirmation for registrar transfers. Go to panix.com and read what had
happened to it, although I wrote about it in my blog as well.

 

[Mr. DeletedMr. Deleted is verified member.]

i have read about panix.com before so I know a little about that, but to auto approve a transfer is wierd. I use locks on most of domains but if I did not by mistake, I would not want to have someone transfer it out like that.

 

[DomainEmpire.com]

Cnobin lock all domains automatically, check to be sure that it's currently locked ... at 99% it is

 

[madcamel]

The gaining registrar should get your approval, not the losing registrar

 

[pelican]

although you do not need to validate anything for losing registrar, you must approve/validate for the gaining registrar. Therefore, if you do not click anything to approve the transfer at the gaining registrar, transfer will not complete