Title: How a Domain Theft Unfolded: Lessons from a 2012 High-Traffic Asset Sold to InternetBS
I’m sharing a difficult experience in hopes it helps others prevent or recover from similar incidents. English isn’t my first language, but I want to be clear about what happened and what you can do.
Background
– A high-traffic domain registered in 2012 became a primary source of income for the owner.
– The original registrar was PublicDomainRegistry (PDR). The domain was subsequently transferred to Internet.bs (InternetBS).
What happened, step by step
1) July 25: The domain’s registered email address was changed without the owner’s knowledge.
2) The owner immediately alerted their reseller and registrar, emphasizing that they did not authorize any email address changes. Email logs indicated no compromise of the owner’s email or reseller accounts.
3) Shortly after, the Whois information was altered so the contact details pointed to the scammer.
4) A few days later, the registrar reported being contacted by someone claiming they had lost access to the domain’s email and requested a transfer from the reseller to the registrar’s own direct account (resellerclub/publicdomainregistry).
5) The registrar asked for ownership verification documents. Because the Whois information was public, the scammer fabricated documents in the owner’s name and submitted them. The registrar reviewed the falsified documents and changed the domain’s email to the scammer’s address, after which the scammer filed a request to change Whois information again.
6) The owner provided evidence of ownership, and the registrar froze the domain and opened an investigation. Documentation from the owner and the reseller was supplied.
7) A few days later, the registrar confirmed the fraudster’s documents were fake and returned the domain to the reseller; the owner could once again manage the domain.
8) On August 6, the owner checked Whois and discovered the domain appeared under InternetBS as the registrar. It appeared the fraudster had somehow completed a transfer to InternetBS.
9) It was learned that the scammer, while controlling the domain from the original registrar, obtained the transfer key. After the registrar released the transfer lock at the end of the investigation, the fraudster used the key to move the domain to InternetBS. The transfer took about six days to finalize.
10) The scammer copied the owner’s website and hosted it via a cloud hosting service, then implemented 301 redirects to another site. In the meantime, the site’s ranking started affecting search results under the new domain.
Current status and communications
– On August 6, the owner notified InternetBS about the theft. The registrar also informed InternetBS, which said it froze the domain for transfer and began an investigation.
– By August 14, InternetBS reported that the fraudster had not provided evidence of a good-faith transfer. Since then, there has been little to no progress updates.
– The owner’s registrar has indicated they are not kept informed of ongoing developments in the investigation.
– The owner connected with four additional victims on forums who experienced the same scammer; all affected domains share a common pubid associated with AdSense.
What I’m asking the community
– What steps should be taken next to recover a hijacked domain when the new registrar seems unresponsive?
– How long do investigations typically take with registrars like InternetBS, and what milestones indicate progress?
– Are there successful prior recoveries from this registrar or similar situations, and what actions were crucial to those outcomes?
– What additional remedies exist beyond registrar communications, such as coordinating with the hosting provider, search engines, or legal avenues?
Notes for others
– If you encounter a similar issue, document every change (WHOIS, registrar communications, transfer requests) and preserve all correspondence.
– Engage both the original registrar and the current registrar as early as possible, and request formal transfer audits and logs.
– Consider reaching out to your hosting provider, search engines, and any ad networks to mitigate misrepresentation and redirects while the investigation continues.
Thank you to anyone who can share experiences, guidance, or proven strategies for reclaiming a compromised domain and mitigating ongoing effects on traffic and revenue.
