legal Hijackin attempt by Gary Blake requesting transfer authorization for a domain of mine

[Makis77]

Just today I received a "Transfer Authorization for *********.com" email.
Based on email source(vexxhost [Under Registrar: Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com]) request of transfer was initiated by Gary Blake without any prior related agreement with me.

This was the second attempt for hijacking my domain in 4 months time so beware.

 

[silentg]

How is he initiating the transfer without the authorization code?

 

[Cartoonz]

How is he initiating the transfer without the authorization code?

Excellent question.

 

[Makis77]

I never thought about that...
Maybe his registrar doesnt need auth code?

 

[Makis77]

This is the email I ve got:

Dear Customer,

vexxhost [Under Registrar: Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com] has received a request from Gary Blake on Saturday, Jun 16, 2012 for Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com to become the new registrar of record, for *********.com.

You have received this message because you are listed as the Registered Name Holder or Administrative contact for this domain name in the WHOIS database.

Please read the following important information about transferring your domain name:

You must agree to enter into a new Registration Agreement with us. Click Here to review the full terms and conditions of the Agreement
Once you have entered into the Agreement, the transfer will take place within five (5) calendar days unless the current registrar of record denies the request.
Once a transfer takes place, you will not be able to transfer to another registrar for 60 days, apart from a transfer back to the original registrar, in cases where both registrars so agree or where a decision in the dispute resolution process so directs.

If you WISH TO PROCEED with the transfer of zencoding.com, you must respond to this message by clicking the below link:

Approve Transfer Link:

http://domains.vexxhost.com/linkhan...tfor=DomTrfRegToUs&rvid=4457&orderid=44551154

(Note: If the above link appears to be broken, copy and paste it in your Browser's Address Bar)

Important - If you do not respond by Thursday, Jun 21, 2012, *********.com will not be transferred to us

If you DO NOT WANT the transfer of zencoding.com to proceed, then don't respond to this message or click on the below link to cancel the transfer request.

Cancel Transfer Link:

http://domains.vexxhost.com/linkhan...tfor=DomTrfRegToUs&rvid=4457&orderid=44551154

 

[Raider]

Doesn't sound like a hijacking attempt to me, He has no Auth code that I can see, your email address hasn't been compromised and neither has your registrar account....

How do you know he didn't misspell the domain in the transfer request? Maybe it's another name he's trying to transfer... Or maybe he's just a idiot, I had the same situation with someone trying transfer a 8 year old domain I had at Enom, he attempted to transfer it to Godaddy, 8 transfer requests in total and Godaddy refused to do anything about it when I reported it.... It wasn't until the guy contacted me and told me he was able to Register the domain and that it was his, Took me a while to convince he was mistaken.

 

[katherine]

How is he initiating the transfer without the authorization code?

Some registrars do not require the information to start the transfer, they first get consent from the current holder.
But even if he were to agree by accident, the transfer would not proceed since .com requires an auth code.

 

[Theo]

The transfer process won't complete but why is it initiated in the first place, that's a good question.

 

[Makis77]

This is a hijack attempt, if it was successful then topic should have a title "I ve been hijacked".
Same guy started transfer in beginning of April, so its not the first time.

I opened a ticket with vexxhost and waiting for their reply.

 

[Raider]

Some registrars do not require the information to start the transfer, they first get consent from the current holder.
But even if he were to agree by accident, the transfer would not proceed since .com requires an auth code.

Exactly, Just like Godaddy does when I went through this exact same scenario.

This was clearly not a hijacking attempt, and to say that is was, the hijacker would have to be very stupid.

This is a hijack attempt, if it was successful then topic should have a title "I ve been hijacked".
Same guy started transfer in beginning of April, so its not the first time.

I opened a ticket with vexxhost and waiting for their reply.

So because he's done it before that makes it a hijacking?... Don't you thin your being over dramatic?

And you can expect a letter from Vexxhost explaining just what Katherine posted.


Vexxhost

 

[Theo]

Since it occurred more than once, it can't be random or an accident. Were you able to find out who this 'Gary Blake' is?

 

[Raider]

Since it occurred more than once, it can't be random or an accident. Were you able to find out who this 'Gary Blake' is?

Like I noted earlier, 8 transfer requests from the same person who admitted to doing it, It was no accident but rather a case of inexperience and ignorance.

 

[bwhhisc]

Maybe just a 'spam' e-mail to try and get you to click on one of their "poisonous" links.

 

[Cartoonz]

Some registrars do not require the information to start the transfer, they first get consent from the current holder.
But even if he were to agree by accident, the transfer would not proceed since .com requires an auth code.

I'd like to see a list of Registrars that fit the profile you've described... they are in direct violation of ICANN's mandate for this procedure - this was exactly the reason EPP codes were implemented with .com/.net in the first place.

 

[FreddyS]

We get from time to time those emails as well, nothing what I am worrying about to much at the moment.
But Cartoonz is right, those registrars are in violation of Icann´s rules.

 

[Raider]

I'd like to see a list of Registrars that fit the profile you've described...

I can confirm at least one, GODADDY.COM

This happened on 04/06/2011 and I just found the emails to prove it.

 

[Makis77]

I got a reply from vexxhost stating that it could be a fradu, they asked me to reply back the domain in question so I did and now waiting for their reply.
If you google for "Gary Blake " you ll get some domains under that name, nothing fancy though.

 

[Theo]

Any news about this, Maki?

 

[Makis77]

Yes, I got 2 more email from vexxhost first one saying that "We are closing this and discussing this with the customer on why this happened." and when I asked them what was this all about I got this reply:
"It seems that there has been an issue and we will stop this from happening again.

Thank you for the notification.".

Go figure...