Wednesday, January , 07, 2009

Information Highwaymen and Your Domain

You go to work every day at the store you own, and one morning,your key to the door doesn`t work. You look in the window, andthe display items have changed. A stranger is behind thecounter. But when you call the police, they can`t do anythingbecause the company papers now indicate that the store belongsto the stranger.

The above scenario isn`t likely to happen with abricks-and-mortar store. Because of insecurities in the domainregistration system, however, information highwaymen could takeover your online business.

As with identity theft, domain thieves steal your identity --the identity used to register and configure your domain name.After that, your website, your email, your online business, andpossibly your reputation are theirs.

Domain names at risk of theft

While theft is a risk with all domain names, domains most atrisk are more valuable ones. Domains with dot com extensionshave a higher resale value than domains with other extensions,and domains with high traffic or valuable keywords are also morelikely to be targets.

The motive behind domain hijacking is usually monetary, but itmay be personal. If anyone wants to attack you, stealing yourdomain name is one way to do it.

How domain theft happens

When domain hijackers steal your domain, they gain access to thedomain`s Whois records. Theycan modify the domain`s nameservers so that the domain points toa different server. They can also transfer the domain to adifferent registrar.

Either way, site visitors will find themselves at the website ofthe domain hijacker instead of at your site. All domain emailwill go to or through the other server instead of to you. Allyou`ll have left is a website without public access because yourdomain isn`t pointing to it any more.

How can this happen?

Domain hijacking methods

• Domain hijackers send forged faxes to the domain registrar,impersonating the registrants.

• Domain hijackers hack into the accounts of free emailaddresses listed in Whois records and use those addresses toobtain domain account information.

• Domain hijackers send out fraudulent email renewal notices,and registrants unknowingly transfer their domains to thethieves.

Registrar non-action

• The gaining registrar (the registrar that the domain istransferred to) doesn`t obtain approval from the domain nameregistrant or administrative contact as required by ICANN Inter-RegistrarTransfer Policy.

• The losing registrar (that the domain is transferred from)doesn`t notify the registrant of the transfer during thefive-day pending transfer period. During this period, theregistrant can cancel or deny approval of the domain transfer--- if the registrar notifies the registrant of it.

Registrant carelessness

• The registrant forgets to update Whois details or to renewthe account.

• Someone with access to the registrant`s records steals theinformation.

Domain name disputes

If you discover that your domain has been hijacked, contactyour registrar immediately. If your registrar is unable toresolve the situation, the ICANN (Internet Corporation forAssigned Names and Numbers) Transfer Dispute Resolution Policy (TDRP) applies.

By going the above arbitration route, you don`t have to argueyour case in person. On the other hand, all you can get back inthe process is your domain (and not necessarily that). For a lotmore money, you can take your case to court, where you can seekcompensation for damages in addition to the return of yourdomain. This process takes more time, however.

You may be able to proceed both ways – get your domain back viaICANN domain dispute resolution procedures and then go to courtto collect damages. You can also appeal a domain arbitrator`sdecision in court.

How to protect your domain name

Protecting a domain name is similar to protecting abricks-and-mortar store from burglary. With a combination ofprecautions in place, thieves will find it difficult orimpossible to gain access.

Your domain account information

• List your name for the administrative contact, and use yourfull name.

• Create a complex password with letters (both upper case andlower case) and numbers. Don`t use any real words or personalinformation in it. Make it long. Make it unique – don`t use thesame password for anything else. Change it periodically.

• Keep your domain login name, account number, and password in aplace where only trusted people can access it.

• Use a valid contact email address that doesn`t use the domainit`s for. Be sure that this email account also has a complexpassword. If you`re going to be offline for more than a fewdays, have someone else check the email for this account.

• Don`t use a free email address such as a Hotmail or Yahooaddress. Domain hijackers target domains with free emailaddresses in the Whois records. After they`ve cracked your emailaccount password, the support you need to get your email accountback will probably be slow, giving the hijackers plenty of timeto take over your domain.

• Update your Whois record whenever the information in itchanges.

Your domain account features

• Choose a domain registrar that sends registrants transferpending notifications when a domain transfer is taking place.

• Consider protecting your Whois details with a registrar thatoffers a private domain name record. With this feature, yourregistrar`s data appears with your Whois record rather than yourdata. The downside of using this feature is that your businessmay have less credibility because you`re hiding who you are.

• Register your domain for a long time period, and set upcalendar reminders to renew it before it expires.

• Set up your domain to be renewed automatically if yourregistrar offers this feature.

• Use the Registrar-lock mechanism if it`s available throughyour registrar. When a domain is locked, it cannot be modifiedor transferred unless the registrant unlocks it or follows thedomain transfer process.

Other domain security measures

• Set up a free Whoismonitoring alert email service and add your domain to yourmonitoring list. You will receive email notifications wheneverthe expiration date, registrar, or status of a monitored domainchanges. (Whois does not have data on all domain extensions.)

• Make sure that someone checks your website every few days,preferably daily.