Forum

Hello,

my account on dynadot was hacked, and idiot which hacked my account( i don't know how ) was transfered domains to other registrar. Dynadot account managers gave me my account back, but there are not all domains.

What now? Would dynadot account managers give me back transfered domains or what?

br

This isn't something we can work out over forums.  Please email your account manager at [email protected].

You should contact the registrar where your domains were transferred to without your permission. Ask Dynadot to help you and verify that the domains were stolen. It may be difficult for you to get back any domains that were stolen like this, but if not you should return here and list what registrars would NOT return your domains. This will warn others about the problem.

Dynadot is the registrar for all of my domains and has exceptional customer service (particularly when compared with my previous registrar), but you should never expect a registrar to be able to reverse transfered domains that are now registered through another domain registrar.  It just isn't going to happen absent a court order and you'll wind up wasting a lot of time without achieving any results.  

Which brings us to the nub of the problem: this is a now a legal rather than a customer service issue. You are the victim of a serious crime in most jurisdictions.  The value of the stolen domains will usually not determine the severity of the offense under investigation since the underlying crime is not the theft but the unauthorized access and identity fraud.
You need to find out how your account was hacked and who did it (or at least the ip address the account was accessed from).  I am assuming the new owners of the transferred domains are now hidden behind "who is" privacy protection.  Dynadot account managers should have access to this information.  

You should file a police report with your local law enforcement agency. This is important if you later decide to file a UDRP or court case to recover the domains and sue for damages.  But don't just call your local precinct and say I want to report a domain theft.  Do some research and find out which division within your local law enforcement agency handles fraudulent schemes.  If you are lucky, they will have a unit devoted to cyber crime.  Depending on their work load you might have difficulty convincing them that the case is  worth pursuing, but be persistent.  Emails sent to a general delivery contact email address are too easy to ignore, so be sure to take the time to put everything in writing through overnight delivery or certified snail mail.  Prepare a cover letter with a request to investigate the case and send it certified in addition to attaching it to an email.  Make sure you get the name of a detective to send correspondence  about your request for an investigation.  If you can't get the name of a detective then send your correspondence addressed by name  to the head of the police unit you want to investigate your case. You should also copy your contact person's immediate supervisor with your correspondence. Follow up your letter with a phone call.  

Most fraudsters count on the fact that the average domain owner doesn't have the resources or the inclination to spend thousands of dollars in legal fees litigating the theft of a few domain names.  However, a lawyer can frequently get responses from law enforcement that an average citizen can't.  If the fraudulently transfered domains were valuable or being used for a revenue generating online business, it might be worth while to get an assessment of your options from an attorney who specializes in domain law.  An initial demand letter would not be very expenses and the costs of filing a UDRP are  much less expensive than litigating a case in Federal court.   If the person who fraudulently transferred your domains has deep pockets (i.e., has assets that can be attached in the event of a judgment) you might be able to find an attorney willing to take the case on a contingency basis.  In the United States punitive damage awards in fraud cases can be very, very substantial.

Many people trying to  recover fraudulently transferred domains incorrectly assume that they can rely on the mandatory obligations imposed on registrars by ICANN's registrar agreement. Although  ICAN's registrar agreement was originally intended to protect consumers, ICANN  rendered those protections meaningless when they agreed to the inclusion of a  provision containing a third party beneficiary exclusion.  This means that ICANN has contracted away the ability of consumers to take registrars to court  to enforce the affirmative obligations imposed by their agreement with ICANN.  Since ICANN does not investigate individual consumer complaints, and has a poor enforcement record against individual registrars that are not in the process of imploding, the ICANN registrar agreement is largely a worthless document when it comes to protecting consumers from unscrupulous or incompetent registrars.

Nick Hentoff
www.NickHentoff.com