Domain has been hijacked

pdrew · #1 (**permalink**) 04-03-2004, 09:20 AM

Greetings:

Came into the studio this morning, turned on the computer, fetched my email and discovered a message from a client that my website was down.

I opened IE6, typed in my URL, and sure enough, my DNS has been hijacked by www.pacanka.com.

Now, the wrinkle in this is that my site is/was being hosted on another company's server for whom I've done work. The only other site on the server is the host's company site. That site is gone, too, replaced by pacanka.com. Last year, the company let their IT guy go, so the server was basically running unattended.

The gods had smiled on this unattended server until this morning. The name (a first name repeated twice) before the @-sign in the email address provided on pancanka.com is the same as the IT guy who used to work at the company that's hosting my site! So, I emailed him asking if he's the same guy and for an explanation. I don't have high hopes for a reply. I've put in a call to the owner of the company who owns/runs the server and hope to speak to him by Monday.

Anyway, since my DNS has been stolen/co-opted, does this mean my domain name www.peterdrewvo.com is now gone and no longer available to me? Would it work if I got another host? Any guidance as to how to handle this situation would be most appreciated.

Thanks.

rawdist · #2 (**permalink**) 04-03-2004, 09:56 AM

If you are Peter D. Fenstermacher (pdrew@portone.com)
then the name is yours (try looking it up at www.whois.com) All the contacts (admin, billing etc) except technical are registered to the guy above, hope this helps

pdrew · #3 (**permalink**) 04-03-2004, 10:06 AM

Thanks for the information, Dave.

A little confusted by this phrase: "All the contacts (admin, billing etc) except technical are registered to the guy above, hope this helps."

Which guy? The hijacker? When you say contacts, what does that mean? Would you elaborate?

Thanks.

paulhiles · #4 (**permalink**) 04-03-2004, 12:07 PM

Hi Peter,

Please check on the following link, http://www.whois.sc/peterdrewvo.com
and you'll see the email contact info that Dave is referring to... it's only the technical email that goes elsewhere.. (ehost at networkcommerce.com)
It looks on the face of it, more of a hosting issue.. maybe the server that you thought was so quiet all this time, now has a new owner?

NB: I'm deleting the post you left in Web Programming, as it's identical to this one, and we like to avoid cross-posting as a rule.

kikkertm · #5 (**permalink**) 04-03-2004, 10:53 PM

Hi Peter,

being quite experienced in assisting rightfull owners getting back control over their domain names I would advice you move the domain name to a different domain name registar. The admin contact email address is the determining factor in the ease of transfering the name and getting back full control. If you have access to 'pdrew@portone.com' than it should be fairly straightforward. Find a domain name registrar, choose their 'transfer' option, put in your domain name and you should receive a transfer confirmation from them. They should then kick off the transfer for you.

You might have to pull off your current content and setup some new hosting as well as it looks like (as other poster indicated) that your webspcace got hijacked.

Come to think of it..It might just be fixed by moving host. Do you have access to your domain name control panel with accountsupport.com (your current Nameserver holder) ? if yes, just sign up for some hosting space and change the Nameservers in the accountsupport.com control panel. That might fix it as well.

Elite Skills · #6 (**permalink**) 04-04-2004, 05:43 PM

Conditionals:
1. The domain registrar has a redirect to that site instead of your server.
2. The hosting service was jacked and the index redirects to the other site.

1.
-If you own all controls over the domain name you fix make sure all settings are as they should be and contact your the support team of the registrar to report the incident.
-If you do not have control over the settings as the domain name was bulk registered by a third party send a written affadivit stating you are owner of the domain and you would like the settings transfered to a new account where you can maintain it. Fax and mail it with confirmation mail.

2. Switch hosting to another server and upload the contents then redirect the domain information to your new host.

Privacy.net has it's own little section on what to do if you want to switch registrars to be safe. It's actually pretty common.