Recently, I read an article on Tech Crunch about a Domain name hijacking that made me think about some of the problems my clients had experienced in the past with similar issues. Diigo a social booking marking site with over 5 million registered users was offline for over 2 days last week because someone had hacked their domain account and transferred the domain away from the site. They were blackmailed by the thief and after paying the ransom money were given back access to their domain.
If anyone has access to your domain name registras account, then they can transfer your domain name (ownership and DNS) away from you. So it’s necessary that you make sure your password is updated regularly and you limit access to the account to only trusted parties.
I often see that many of my real estate agent clients have too much trust in their web development companies along with email management companies. A reasonable estimate would be that around 40% of my new clients do not know that their domain name is controlled in a reseller account belonging to their web development company. Although the agency is the owner of the domain name, the web development company has full control over the domain, meaning they could hijack the domain like in the Diigo case.
This type of arrangement can make for a messy change over when the agency is moving from their existing web developer to the new web developer. Often the old web developer is upset with their client changing providers, so they make it hard for the client to access the domain. In some cases, I’ve seen these providers change the DNS for the domain to their own default page.
There is no reason to keep your domain name in a reseller account with your web developer or email provider. Any company that sells domain names eg Netregistry, Melbourne IT, Crazy Domains, Cheap Domains and thousands more can host your domain names. All you need to do is setup an account with them and then request they transfer your domains from your web providers reseller account into your own account. By doing this allows your to protect your Intellectual Property and guarantee your DNS can be unlawfully adjusted.
1 Comment
Christopher Hofman
Hi Ryan,
great article. We will unfortunately see many more cases like diigo.com in the future. Businesses will let domains expire, which they earlier used to register important domains, and not make sure to update the WHOIS details. And as you point out many domains are still registered in the name of the original web agency, which can close down or not agree to help out.
My suggestion in the short term is to check the WHOIS of each domain registered to make sure that you are the formal owner and in control of the contact emails. In the long term you should have a domain strategy, where a non personal email is used for registrations such as [email protected], so it will not be dependent on a former employee’s email.
At European Domain Centre we have now taken the step to analyze our customers’ WHOIS data and offer to update their WHOIS data for free where necessary, so they will not get into this situation.