RE: [gnso-irtp-b-jun09] more on identity theft case
Thanks for sharing this Paul. Just a small clarification - the name prince. com isn't locked at the registry level but rather at the registrar level. Barbara Steele Compliance Officer / Director of Policy Naming Services bsteele@xxxxxxxxxxxx Direct 703 948 3343 Fax 703 421 4873 VeriSign, Inc. 21345 Ridgetop Circle, 4th Floor Dulles, VA 20166 www.VeriSign.com | 25yearsof.com -----Original Message----- From: owner-gnso-irtp-b-jun09@xxxxxxxxx [mailto:owner-gnso-irtp-b-jun09@xxxxxxxxx] On Behalf Of Diaz, Paul Sent: Wednesday, October 06, 2010 3:31 PM To: <Gnso-irtp-b-jun09@xxxxxxxxx> List Subject: [gnso-irtp-b-jun09] more on identity theft case Some more data to think about Another Domain Theft: UDRP On Prince.com Filed With Owner Alleging The Domain Was Stolen (TheDomains.com, 100510) http://www.thedomains.com/2010/10/05/another-domain-theft-udrp-on-prince-com -filed-with-owner-alleging-the-domain-was-stolen/ The former owner of the domain name Prince.com, Andrew Prince has filed a UDRP on the domain, claiming the domain which was sold by Mediaoptions.com for $235,000 in August was stolen. The domain is currently at Moniker.com showing the buyers whois info but is locked by the registry so the respondent of the UDRP (as it is referred to below) is Moniker.com This follows on the story of Chris Hartnett who was the victim of identity theft we wrote about yesterday. Matter of fact in his telling of his story Dr. Hartnett mentioned that he was contacted in reference to this exact domain Prince.com: “A few weeks ago John Mauriello from SnapNames/Moniker called me to see why I hadn’t paid an invoice for $35,000. “For what I asked?” “He said because I had sold the domain, Prince.com privately but I signed a 90 day exclusive with Moniker and the domain was in the August Showcase auction.” “I told him I never owned that domain name.” “This person put the domain up for auction using my name” The story regarding Prince.com, as far as I have been able to piece it together from the information I already have from Dr. Hartnett, and the claims of Andrew Prince from his UDRP is that around the beginning of April 2010 the domain name was stolen. The domain was submitted to the SnapNames.com monthly showcase auction for August. As part of submitting the domain to the SnapNames.com auction the domain was transferred into Moniker.com and as part of that process Moniker got a 90 day exclusive contract to sell the domain. The reserve in the SnapNames.com auction was in excess of $350K. The domain did not sell. Shortly thereafter MediaOptions.com was retained to sell the domain and completed a sale sometime after the showcase auction ended but still in August for $235,000. The original owner of the domain Andrew Prince is claming that the domain was stolen and sold without his permission and he did not not get any of the purchase price. The buyer who paid $235,000 is now showing as the owner of the domain on the whois, but the domain is locked at the registry and not in the buyers control. >From the Complaint this is what Andrew Prince had to say about this domain: “On April 4, 2010 the Registrar had changed.” “That transfer at the beginning of April this year was undertaken without my knowledge or consent.” “I have at no time had any contact with the Respondent or anyone acting for them. ” “The only information that I have on the transfer is what I have been told by Claranet Limited the hosting company and the Technical contact for the Domain Name while it was in my name. In a telephone conversation on September 28, 2010 with Ian Davis, a team leader at Claranet I was informed that they received an email on March 24, 2010 from “Andrew Prince” using the account NOC1@xxxxxxxxxxxxxxx purporting to come from me and requesting the transfer. The following day the sender of that email provided Claranet with the first and last letters of my password and that on March 30, 2010 they transferred the Domain Name.” “I confirm that I have never contacted Claranet with a view to arranging transfer of the Domain Name, nor have I instructed anyone to contact them on my behalf. The Domain Name has been stolen from me.” “I do not begin to understand what has happened. I have never sought to sell the Domain Name to anyone. From the sums of money mentioned, it is apparent that the Domain Name has a very high value. It is inconceivable that anyone would be paying that sum of money for an asset without checking very carefully the chain of title to that asset. In the UK if one purchases, a car which has been stolen one does not obtain title to the car. The responsibility is on the purchaser and any intervening dealers to conduct proper checks. With an asset said to be worth over half a million dollars it would be crass not to conduct in depth investigations. Failure to do so is strongly indicative, I suggest, that those involved in the theft and subsequent dealings in the Domain Name were aware either that the Domain Name had been stolen or was likely to have been stolen.” The purpose of this Complaint is simply to recover my stolen property. I reported the theft to the Police on September 27, 2010. “The Domain Name is confusingly similar to my registered UK trade mark no. 2123377, PRINCE (word and device) dated February 11, 1997 in classes 41 and 42. Details of my trade mark registration taken from the database of the United Kingdom Intellectual Property office are at Annex 6. The mark comprises the word ‘PRINCE” and the device of a frog, the former being the more prominent. The mark is held in the joint names of my wife and myself. At Annex 7 is a communication from my wife confirming that she supports this complaint and agrees that, if the Complaint is successful, the Domain Name should be transferred into my name, as before.” “Self-evidently, the Respondent has no rights or legitimate interests to the Domain Name. The Respondent stole it. It is currently in use merely to resolve to the Google UK homepage.” “I respectfully request the Panel to interrogate the Respondent and the underlying registrant and anyone else involved as to (a) precisely how and when and by whom the relevant transfers were effected and (b) what title checks were conducted to verify the title to this asset valued by the Respondent at over half a million dollars. ” “Self-evidently, again, the Domain Name has been acquired by the Respondent in bad faith and while I can have no idea what plans the Respondent has for the Domain Name it is fair to assume that the planned use is abusive. No use of a stolen name can be anything other than abusive. Currently, if one enters the URL www.prince.com into the browser it resolves to the Google UK homepage. I assume, but do not know that the Respondent is rewarded in some way by Google.” “Indeed I contend that any use of a stolen domain name must constitute an abusive use.” A few observations: First of all I’m not sure if a UDRP is a proper venue for such a claim, that is the return of a stolen domain name that seems to have been bought by an innocent third party. Maybe one of the lawyers that frequently comment on this blog can address that issue. Second there is a LOT of time from the beginning of April when Mr. Prince says the domain was stolen until late September when this complaint was filed. Moniker.com/SnapNames.com typically publicizes its showcase auctions pretty heavily and Prince.com was one of the stars of the auction. One would hope if they owned as Mr. Prince says a domain worth over a half of million dollars, you would catch some news of the auction of the domain. Thirdly based on the brief connection with Mr. Hartnett as decribed above, I would have to assume the same person that hacked into Hartnett computer, and took his identity and domains, is the same person involved here. Therefore this would be a second victim of the same thief. -----Original Message----- From: owner-gnso-irtp-b-jun09@xxxxxxxxx [mailto:owner-gnso-irtp-b-jun09@xxxxxxxxx] On Behalf Of Diaz, Paul Sent: Monday, October 04, 2010 4:29 PM To: <Gnso-irtp-b-jun09@xxxxxxxxx> List Subject: [gnso-irtp-b-jun09] Identity theft case FYI ALERT: Identity Theft Hits NameJet (TheDomains.com, 100410) http://www.thedomains.com/2010/10/04/alert-identity-theft-hits-namejet-dr-ch ris-hartnett-it-can-happen-to-you/ This is some pretty scary stuff. REALLY SCARY stuff and its happening to domainers Identity theft, impersonation, and if one victim is correct, there is a thief among us, someone with a lot of knowledge about the domain industry, how the business works, who the players are. Dr. Chris Hartnett is here to warn you. Dr. Chris Hartnett, is no ordinary domainer. Dr. Chris is a member of the Domain Hall Of Fame, and was the subject of A Cover Story by Ron Jackson’s DnJournal.com back in June 2008. This week he was the victim of identity theft at NameJet.com. Here the REALLY scary part: Dr. Chris says It hasn’t been the first time. He thinks he was targeted because he is in the domain business. and he is warning it could happen to you. Let's review what we know. On the morning of September 30th I got three separate emails from three separate people that watch the NameJet.com auctions all letting me know that several domains had been put back into auction due to a non payment with the bidder ID: bidder9999, which these domainers associated with Dr. Chris. The domains effected included Solars.com which “sold” for $6,100 on September 21, TradeWire.com which “sold” for $4,600 and W3W.com which sold for $3,200 on September 23rd. These weren’t the only domains “won” by that bidder ID, but these totaled almost $15K in bids alone. The emails I received from the concerned domainers all suggested the same thing. Dr. Chris “used to have money” what happened to him that he can’t pay for his auctions. In the business world about all you have is your reputation so I immediately wrote to Dr. Chris and the GM of NameJet. Here’s the bottom line Someone set up an account at NameJet.com in Chris Hartnett’s name, furnishing NameJet.com with a North Carolina’s drivers license, with Dr. Chris’s home address but with a different picture. This person then put in stolen credit card numbers into Namejet.com system to pay for his purchases. Some of the purchases went through, and the domains we transferred to the fake Dr. Chris Harnett account so that the whois of these domains now reflect the owner to be “Hartnett, Chris”. Other domains won by auction under this bidder id were not paid for, some where over the credit card limit of $5K set by NameJet.com, like Solars.com. Namejet.com has had a policy since its inception that any auction ending in $5K or more had to be paid by wire transfer. Other NameJet.com bidders were pushed up by the bids placed by fake Chris bidding account in some cases by increasing their bids by thousands of dollars. At this point Namejet.com recognizes that the fake Chris account is just that, a fake account set up with fake Id and stolen credit cards. NameJet.com will be commenting on this story later sometime today and I will let them figure out how they are going to handle the effected bidders. Back to the REALLY scary part: This is not an isolated instance. This is one of several identity fraud situations Dr. Chris has faced over the last few months, including the loss of a few of his domains (still unretrieved). In Dr. Chris own words, he details what has happened to him: “So far over the last 6 months they have hacked into several registrar accounts where my domains are kept.” “The hacker put a Key Logger on one of my computers that watched every word I typed.” “Then he got into all my email accounts (5) and changed the forward to his hotmail email address and when I was in one of the accounts just as they were changing the email forward address they knew then that I was on to them.” “So within minutes I received an email stating that they “owned me” knew where I lived and they had control of my life. They said if I wanted them to leave me alone I had to transfer these 3 major domain names I own to them within 24 hours.” “I was in Vancouver at the time and the head of security at a major registrar told me I couldn’t get back into my account because I wasn’t Chris Hartnett. He said that he had talked to Chris Hartnett a number of times over the last few weeks and I wasn’t him. He said he had a photo copy of Chris Hartnett’s North Carolina drivers license in hand. I said, “really” how old is Chris Hartnett? He said, “37″. I told him I was 56 at the time and asked him for his email address and I took a picture of my drivers license and my passport and emailed it to him with another picture of me while I was on the phone.” “I told him to Google me and see if I am 37 or 56 and gave him my hotel phone number in Vancouver to call me back through the switch board. He called back and apologized and put a hold on my entire account and 15K domains.” “There were 380 of my best domains scheduled to be transferred out within the next few days. I lost 3 domains in the process, the rest were saved. By the time I figured what was gone, all three were flipped and purchased at auction or sold privately for pennies on the dollar within days.” “The hacker sent me an email calling me “a stupid asshole” for not checking my accounts in over three weeks. He probably had a point but I wouldn’t have put it that way.” “I had a old employee of mine who could hack into anything on earth spend the next three days getting my life back for me. He told me that this crook was very very good and he had also loaded three, not one but three Key Loggers on my computer and he knew every word that I typed, probably for months.” “This crook is obviously a domainer because he is all over our space.” “Last week a got a letter from a guy who wanted a domain name I owned. It turned out I didn’t own it but the domain was using my whois info with a different email address but my home address here at heavenly mountain.” “These guys are slick.” “Let’s say they somehow get a key logger onto one of your computers. (very easy to do.) They quietly watch what you are doing.” They see you log into one of your domain accounts by watching every keystoke you make over a few weeks. ” Now they can hack into your domain account when you aren’t looking. Quietly over a few weeks or months they go into your account and they look at all your domains.” They pick some good ones but not great ones that you wouldn’t instantly miss and steal some of the good ones.” They transfer those names out quietly and they change the email forwarding address on your account long enough so that they get the transfer notice and not you. They then switch the forwarding email back to you as soon as the notice comes from your registrar saying that you have transferred out a name or changed the email address or something like that. Now they have got your name and you may not notice that it is even missing from the account (which is what happened to me).” “They change the whois info on your stolen name to my name and address (Chris Hartnett’s) and open an auction account, put up a valid yet stolen credit card on that new account and they start auctioning off names for a few hours or days. Eventually they sell something and take the money and run.” “This guy probably figures that he can’t get cash or gems or gold on the internet but if he targets a domainer and gets control of his accounts, he can transfer out domains, put them up for quick auction, get the cash out that way.” He also is using my name when he wants to auction off an important domain because he figures it is believable that I would own such a name.” “A few weeks ago John Mauriello from SnapNames/Moniker called me to see why I hadn’t paid an invoice for $35,000. “For what I asked?” “He said because I had sold the domain, Prince.com privately but I signed a 90 day exclusive with Moniker and the domain was in the August Showcase auction.” “I told him I never owned that domain name.” “This person put the domain up for auction using my name” “John apologized for the mistake” “Bottom-line. There is a very very very smart thief amongst us and we should all beware.” Thanks to Dr. Chris for bravely telling his story. As domainers we are particular in danger of identity theft. We have a LOT more at stake than most people, assets that are protected only by log in access to registrars accounts and those other companies in the domain space. So we have someone or a group of people who are pretty brazen. Fake Id’s Stolen credit cards and I have been told by mulitple parties he has no problem getting on the phone to assert that he is the person he is pretending to be. Scary Be careful out there. Attachment:
smime.p7s
|