Domain Name Wire | Domain Name News

Domain Name Industry News

Featured Domains

Stolen “Go” domains end up in court battle

by — Policy & Law 4 Comments

Many of the domain names were subsequently sold.

Image of cyber thief

15 domain names beginning with “go” have allegedly been stolen and many of them have been resold — creating a complicated issue now in the courts.

Scott Petretta registered the domain names about two decades ago as part of his business Multi-Force Corporation. The names include popular keywords preceded by “Go”, such as GoCars.com, GoParts.com, and GoSales.com. Petretta apparently discovered they were stolen sometime late last year or early this year.

Unfortunately, some of them had been sold to third-parties already. Domain investors purchased some of the domains, but at least one was purchased by an end user.

Petretta filed an in rem lawsuit to get the domains back, but there’s a wrinkle. Before he filed his suit, the end user that bought GoParts.com sued Petretta (pdf) alleging cybersquatting with the domain.

Go-Parts, which was incorporated in 2013, has long coveted the GoParts.com domain name. Its lawyers sent a cease and desist letter to Petretta in 2015. That letter argued that “… By law, a domain name owner is not entitled to profit in any amount from the sale of a domain name…” (emphasis in original) and threatened that Petretta was liable to pay at least $175,000.

Go-Parts does not appear to have acted on its threats, perhaps because it knew its trademark rights postdated Petretta’s registration of the domain name.

But the company then thought it bought the domain name in October 2019. It popped up for sale at GoDaddy for $4,900 and the company paid for the domain. This probably seemed like an incredible stroke of luck for the company given that it says Petretta previously asked for $100,00 for the domain.

In February, GoDaddy notified Go-Parts that it was canceling the transaction because Petretta’s attorney, David Weslow of Wiley Rein, notified it that they were filing a lawsuit to recover the domain names.

On August 11, Go-Parts’ (new) attorneys filed a lawsuit (pdf) against Petretta. The lawsuit appears to be dead on arrival because it admits that Petretta owned the domain name before it was in business. Its lawsuit makes arguments including that Petretta bought the domain “with the sole or primary intent to sell or license it later to a third party who was or would be using it for an actual business.”

There’s another odd wrinkle to this mess. I checked the Whois record for GoParts.com this morning and it shows that the owner is in California, where Go-Parts is located. Petretta is in New Jersey. (GoDaddy’s obscured whois records do not show the registrant name.) And GoParts.com still forwards to Go-Parts’ website at Go-Parts.com. So if GoDaddy canceled the transaction, who did it return the domain name to?

The situation is unfortunate for everyone involved, save for the thief. Assuming the allegations of theft are true, then the other parties bought hot domains.

Purported Calculator.com thief might still be active

by — Domain Sales 4 Comments

A person using the same name as the alleged thief of Calculator.com is still trying to sell domains.

Picture of shaded man in hoodie with the words "stolen domains"

A purported domain thief going by the name Ruth Yakobzon appears to still be active.

The person, whose name may or may not be real, tried to sell Calculator.com on Sedo in 2018. An auction for the domain concluded at $250,000. But a couple of domain investors saw warning signs that the domain might have been stolen and the buyer backed out of the deal after the previous owner of the domain confirmed the concerns to the buyer.

(Calculator.com sold a couple of months ago and the original owner says the domain was stolen. The buyer is arguing in court that it did not buy a stolen domain.)

Domain Name Wire has learned that someone going by the name Ruth Yakobzon recently tried to sell another name through Sedo. The buyer backed out after seeing warning signs that the domain might be stolen, and after viewing the name on the sales contract. The purported address for the seller in both cases is Billerica, Massachusetts.

I reached out to Sedo to understand why the seller was still active on its platform. Regarding the 2018 sale of Calculator.com, the company stated:

There were “internet rumors” that the domain could be stolen. Upon hearing these, we investigated them further on our end but could not find any evidence to support the validity of these statements. So we asked that the person communicating about this theft to ask the real domain owner to contact us which never happened. But even though we never received an official complaint in regards to this, it was cancelled on the request from the buyer because he did not want to proceed.

In other words, because the “real” owner of the domain never contacted Sedo, the company wasn’t able to conclude that the domain was stolen.

The seller’s account at Sedo has now been suspended after the second case, in which the real owner of the domain made an official complaint with Sedo.

Sedo also stated:

In both cases the seller had full access to the domains and was actively communicating with us without any delay and provided any additional documentation we requested.

Without verification that the domain was not stolen, the only thing we could verify is that the seller passed all our additional checks which is only possible when you have full access to the domain.

In both cases we left the decision with the buyers and both decided to cancel the transaction.

In general as part of our procedures on domain ownership, we complete ownership verifications as a precaution.

In addition, here is a link to more detailed information on the process we have in place to report potential stolen domains:

https://sedo.com/us/about-us/policies/stolen-domain-policy/

We had also participated in this post on Domain Name Investing last year. It has some really good information in a statement we provided:

https://domaininvesting.com/sedo-comments-on-domain-theft-verification-policy/

Stolen domains and ownership verification of domains being sold on our marketplace is something we take very seriously as a trusted third party service provider in the domain industry. We know it is a crucial part of the confidence our customers have in using us to buy and sell domains.

Stolen domains are a big issue in the domain name industry. GDPR and other privacy laws are making it harder to track the provenance of domain name ownership in Whois. At the same time, a lack of Whois information could make it harder for thieves to steal domains because they won’t know the contact details for the registrar accounts they want to target.

 

Judge issues TRO to transfer Calculator.com back to original owner

by — Policy & Law 0 Comments

Order comes just days after case is filed.

Picture of judge's gavel

A judge in Florida has granted a request (pdf) for a Temporary Restraining Order (TRO) involving the domain name Calculator.com.

Last week, the original registrant of the domain name filed a lawsuit alleging that the domain name was stolen. Today, United States District Judge Beth Bloom granted a TRO.

The TRO requests that GoDaddy transfer the domain name back to Network Solutions. Should GoDaddy not immediately comply, the request will be sent to Verisign.

This case could get a bit complicated, though. It appears that the domain name was sold after it was allegedly stolen. It will be interesting to see if the buyer decides to fight the case in court.

Stolen domain lawsuit now officially a clusterf*ck

by — Policy & Law 4 Comments

Another party shows up to continue lawsuit over allegedly stolen domains.

Picture of a kid making a mess with spaghetti

An apt representation of this lawsuit.

What was supposed to be a simple in rem stolen domain name case got a lot messier in April. Now it is a clusterf*ck.

Yoshiki Okada filed a lawsuit late last year to recover domain names he said were stolen from his possession, including eol.com, fde.com, jol.com, nnn.com, olp.com, tang.com, wok.com, wtv.com, and zhang.com.

At first, no one showed up to defend the domain names. Still, the judge was wary of handing the domains over. She questioned how the plaintiffs had trademark rights to a domain like Tang.com.

Okada’s attorneys tried to convince the judge. Meanwhile, a company showed up in April to defend OLP.com, saying it recently acquired the domain name.

At this point, the case reached ‘messy’ status on the DNW-lawsuit-messiness scale.

The scale goes even higher, and this case has officially reached clusterf*ck level.

A third party has shown up at the court claiming that he was financing the lawsuit in an effort to buy the domain NNN.com.

Mark Thompson says (pdf) he agreed with Okada that he would finance the litigation to recover the domains and, if successful, Okada will sell NNN.com to him for $335,000.

But, according to Thompson, Okada hasn’t been very responsive. Okada’s attorneys at ESQwire.com withdrew as counsel. If you read between the lines, it sounds like they weren’t able to get Okada to respond in a timely manner:

A dispute has arisen between counsel and the Plaintiff such that counsel can no longer, consistent with his ethical obligations, continue to represent the Plaintiff. Counsel is prohibited
from disclosing the nature of the dispute as all communications with the client are protected by the attorney-client privilege. A key element of the attorney-client relationship is regular
communication and interactions regarding the matter at hand including discussions of strategy and substance. In particular, counsel can only act upon the direct instructions of the client and, in the absence of such direct instructions, is barred from taking any action. Based on this standard, and without divulging client confidences, counsel represents to the Court that he can no longer continue to represent the Plaintiff in this matter.

Thompson wants to move forward with the case and is trying to intervene based on his interest in NNN.com.

How to keep your domains from being stolen (2019 edition)

by — Domain Registrars 4 Comments

Consider these eight safeguards to keep thieves away from your domain names.

image of hackers breaking into online passwords, credit cards

If you own domain names–particularly good names–you are at risk of having your valuable assets stolen from you.

Thieves will try to compromise your domain registrar account (sometimes by first compromising your email account) and transfer the domains to another registrar. Sometimes they won’t change your nameservers, so you might not realize the domain name is stolen until much later. This makes it harder to recover the domain name.

Here are some tips to protect yourself from domain theft:

  1. Use two-factor authentication at your domain name registrar. Any reputable domain name registrar offers two-factor authentication. A thief then needs access to a secondary device (such as your phone number) if they want to crack into your account.
  2. Use secure email with two-factor authentication. A common way thieves get into your registrar account is by compromising your email. Once they have access to your email they can reset the password at your registrar. I’ve heard some advice that suggests you shouldn’t use free email services for your domain accounts. I disagree; web-based email services can be some of the most secure options. Consider using Gmail with a physical security key as secondary authentication.
  3. Use a different email address for your registrar account than Whois. While many registrars have masked email addresses in Whois, some still show it. Thieves use the email address on a Whois record as a starting point. They try to hack that email account to access the registrar account. One way to stump them is to use a different email address for your registrar account.
  4. Use a password manager. Another way thieves get into your registrar account is by phishing. They use your email address from Whois to ask you to log in to a fake site. They grab your credentials when you do this. Two-factor authentication (see #1) can stump them even if they have your username and password. Using a password manager can stop you from falling for the phishing scam because it won’t allow you to auto-fill your credentials on the wrong site.
  5. Remember that Whois privacy is a double-edged sword. While thieves use public Whois info to try to break into your account, masked Whois records aren’t always better. After all, if your domain is stolen it might not be reflected in the public database. It will be more difficult for you to discover that your domain is stolen.
  6. Use GoDaddy’s domain transfer verification services. This only applies to GoDaddy customers that have Premier Services account managers. The minimum to be considered is 300 domains but there are other qualifications, too. (Here are the qualifications from 2013.) With this added service, your account representative will call you to verify all domain transfers that aren’t Afternic fast transfer sales. It slows down the process but it’s a very good layer of additional security.
  7. Add transfer lock to your domains at your registrar. 
  8. Track your domains. Use a service like DomainTools to track your domains. You’ll get alerts when a domain is unlocked, transferred to another registrar, etc.

Feel free to comment about additional safeguards you take to protect your domain name portfolio.

Domain Name Wire | Domain Name News