{"id":48,"date":"2008-07-11T15:32:06","date_gmt":"2008-07-11T20:32:06","guid":{"rendered":"http:\/\/acro.net\/blog\/2008\/07\/11\/stolen-domains\/"},"modified":"2008-07-11T16:28:46","modified_gmt":"2008-07-11T21:28:46","slug":"stolen-domains","status":"publish","type":"post","link":"https:\/\/acro.net\/blog\/stolen-domains\/","title":{"rendered":"Buying domains with other people’s money"},"content":{"rendered":"

From behind the iron curtain of a middle Eastern nation known for its anti-American sentiment, a self-proclaimed hacker seems to be the perpetrator of a series of recent, high profile purchases of domains – using stolen credit cards.<\/p>\n

Using proxy servers located in Iraq, he took control of a Network Solutions<\/strong><\/a> user account and its main domain, Get-Hosted.com. Then, using either a credit card associated with the account or other stolen credit cards, he made purchases of domains offered for sale via the Network Solutions marketplace. These domains are brokered by two major players in the domain after-market field, BuyDomains<\/strong><\/a> and Fabulous<\/strong><\/a>.<\/p>\n

Apparently, he tried the fraud scheme first at Fabulous, as their domains are typically priced lower. After testing the waters of his process by making several small purchases, he turned his attention to the higher-priced domains offered by BuyDomains. A week or so later, his appetite was large enough that one of these purchases made it on DNJournal<\/strong><\/a>: DomainTools.net was sold for $4,088.<\/p>\n

Fabulous reacted quickly, reversing between 5 and 6 purchases of about $350 each and regaining control of the domains within days of the incident. The perpetrator, having gained experience from this test run, then decided to alter his process; the roughly 6 large purchases he made from BuyDomains were immediately transfered out to the compromised Network Solutions account and WHOIS protection was added.<\/p>\n

Having used stolen credit cards – in other words, other people’s money – it was time now for the hacker to capitalize on the value of the assets; an estimated $25,000 worth of domains. Not too shy about declaring his location (Iraq), he created two accounts at DNForum<\/strong><\/a> and offered the domains for a quick sale, at extremely low prices. These aged or otherwise generic names were being offered for $200 to $500 each, with a couple of others seeking offers.<\/p>\n

The DNForum sales thread<\/strong><\/a> about one of these domains, xdev.com, had a short lifespan; the domain was still listed for sale at Afternic<\/strong><\/a> by BuyDomains with a hefty $9,700 price tag on it. And yet, the seller was eager to take any amount of money, ranging from $1,500 up to a BIN price of $5,000. After all, he never paid a penny out of pocket for these domains. The DNForum community was quick to determine that the sale was extremely suspicious and to alert the moderators about the ongoing scam.<\/p>\n

Other domains offered for sale included Getting.net, DomainTools.net, DoTrust.com and OrbitPay.com – all of them were being offered at unreasonably low prices. Thankfully, DomainTools.com<\/strong><\/a> maintains historical data on domain ownership; it was easy to see that all these domains followed the same pattern: they were sold recently by BuyDomains and were instantly transferred to Network Solutions, to an account with WHOIS shield.<\/p>\n

It’s probably the first time that several major players in the domain market were involved as the direct victims of a scam:<\/p>\n