Recent Posts
- The Swiss can register .swiss domains from next week
- .ai up to 425,000 domains
- A million “free” .music domains up for grabs
- D3 to get $5 million in crypto to apply for .ape gTLD
- Alibaba hit with ICANN breach notice
- New Vegas conference “Davos for Web3 interoperability”
- ICANN content policing power grab may be dead
- Cable company unplugs its dot-brand after acquisition
- Germany crosses 10,000 dot-brand domains milestone
- Founders out as Com Laude gets equity injection
- PIR’s Diaz to leave domain industry
- Some registrars have already quit ICANN’s Whois experiment
- ICANN opens $217 million Grant Program
- Internet could get one-letter gTLDs (but there’s a catch)
- .ai registry fights deadbeats with tweaked auction rules
- Amazon and Google among .internal TLD ban backers
- .ai registry advises buyers not to use GoDaddy
- .post liberalizes with new sunrise period
- Team Internet spends $41 million on content farm
- Epik backtracks on Kiwi Farms claim after legal threat
- .austin names launch on blockchain
- Freenom shuts down 12.6 million domains — report
- GoDaddy’s next .xxx contract may not be a done deal
- GlobalBlock blocking 2.5 million domains
- Microsoft moving its cloud apps from .com to .microsoft
- ICANN 79: anonymous trolls and undercover lawyers
- ICANN scores win in single-letter .com lawsuit
- Cosmetics brand terminates its gTLD
- Up to 70 jobs on the line at Nominet as .uk regs dwindle
- Governments back down on new gTLD next round delay
- Private auctions could be banned in new gTLD next round
- ICANN meeting venue “insensitive and hurtful”
- GoDaddy to start selling graphic.design domains
- GAC spinning up new gTLD curveball at ICANN 79?
- GoDaddy’s GlobalBlock supports blockchain names
- Police .uk domain takedowns dive in 2023
- GoDaddy wants to cut the bullshit from .xxx
- Dueling domain blocking services to launch at ICANN 79
- Freename tries to bridge DNS and blockchain
- Olive retires from ICANN
- Whois policy published without life-saving disclosure rule
- UK gov takes its lead from ICANN on DNS abuse
- Tucows reports 2023 results
- Twitter “completely unresponsive” on clickable domains
- ICANN spends $5 million more than planned in first fiscal half
- .art takes a million domains off its premium list
- KeyTrap ‘the most devastating vulnerability ever found in DNSSEC’
- Freenom settles $500 million Meta lawsuit and will exit domain business
- New gTLD lottery to return in 2026
- First GlobalBlock prices revealed — they ain’t cheap
- Domain universe grows on new gTLDs despite .com shrinkage
- D3 signs up crypto gTLD client number five
- GoDaddy reports strong domains growth
- How to qualify for a $40,000 gTLD
- Registry service provider evaluation handbook published
- WebUnited inks deal to “mirror” country’s TLD in the blockchain
- GoDaddy project unveils brand-blocking calculator
- Report: Monster “misappropriated” millions from Epik
- .com is shrinking but Verisign raises prices again anyway
- D3 announces fourth crypto new gTLD client
- Donald Trump loses second UDRP case
- UK cybersquatting complaints hit record low
- No excuses! PIR to pay for ALL registries to tackle child abuse
- ICANN insists it is working on linkification
- Namecheap sues ICANN over .org price caps
- GoDaddy offers free Ethereum blockchain integration
- Epik reveals who is running the company
- Epik gets acquired again! The plot thickens…
- Airline gTLD crashes and burns
- First chunks of new gTLD Applicant Guidebook drop
- Epik to reveal its owners soon
- Another crypto firm to apply for a new gTLD
- Monster and Royce are NOT involved in Epik?!
- Nominet to overhaul .uk registry, turn off some services
- Russia blames DNSSEC, not Ukraine, for internet downtime
- Team Internet says revenue beat estimates
- Sold for over $20k, insure.ai and dog.ai back in .ai’s expired names auction
- .ai helps UDRP cases rise in 2023, WIPO says
- Freenom’s domains land at Gandi after termination
- .ru domains fly off the shelf as Western sanctions bite
- ICANN picks its first ever Supreme Court
- Lebanon’s ccTLD going back to Lebanon after ICANN takeover
- ICANN picks the domain it will never, ever release
- ICANN approves domain takedown rules
- Has Epik gone “woke”?
- First bits of new gTLD Applicant Guidebook expected next week
- ICANN bans closed generics for the foreseeable
- You can’t use money to buy .box domains
- After 14 years, ICANN practices what it preaches on IDNs
- Weak demand for private Whois data, ICANN data shows
- .ing doing way better than .meme
- DNS Women barred from ICANN funding?
- Dev releases free open-source TLD registry platform
- INCO flips a gTLD to Identity Digital
- Anguilla fears the .ai junk drop
- Five more gTLDs get launch dates
- $10 million of ICANN cash up for grabs
- Almost 50,000 .ai domains sold in a quarter
- ICANN threatens to regulate your speech [RANT]
- Life insurance company kills dot-brand
- ICANN finds new home for Lebanon’s TLD after founder’s death
- ICANN begs people to use its new Whois service
- Shiba Inu outs itself as crypto new gTLD applicant
- Over 50,000 .ai domains sold in three months
- Amazon planning new push into registrar market?
- Registries and registrars vote ‘Yes’ to new DNS abuse rules
- ICANN predicts flattish 2025 for domain industry
- Fast-growing Gname buys another 150 registrars
- GoDaddy service to let you block domains in over 650 TLDs
- Did I find a murder weapon in a zone file?
- ICANN drops the “man” from Ombudsman
- Have your say on police domain takedown powers
- Most registrars are shunning ICANN’s new Whois system
- Nominet to take over .gov.uk
- ICANN picks Istanbul for 2024 meeting
- ICANN’s private Whois data request service goes live
- .au regs slide on 2LD anniversary
- ICANN accused of power grab over $271 million auction fund
- A registrar is getting blamed for an Israeli war propaganda site
- Two more dot-brands bite the dust
- Google sells five-figure AI domain and six-figure .ing hack
- .blackfriday is still a bit rubbish
- Internet Naming Co acquires five more gTLDs
- Domain universe grows despite .com drag
- Did somebody spend a million bucks on a Google domain hack?
Three-letter .com owned by hospital “hijacked”
A California hospital has seen its three-letter .com domain reportedly hijacked and transferred to a registrar in China.
Sonoma Valley Hospital, a 75-bed facility north of San Francisco, was using svh.com as its primary domain until earlier this month, when it abruptly stopped working.
The Sonoma Index-Tribune reports that the domain was “maliciously acquired”, according to a hospital spokesperson.
It does not seem to be a case of a lapsed registration.
Historical Whois records archived by DomainTools show that svh.com, which had been registered with Network Solutions, had over a year left on its registration when it was transferred to BizCN in early August.
BizCN is based in China and has around 711,000 gTLD domains under management, having shrunk by about 300,000 names over the 12 months to April.
The Sonoma newspaper speculates that the domain may have been hijacked via a phishing attack. It’s not clear whether the hospital or NetSol, part of the Web.com group, was the target.
Three-letter .com names are highly prized, usually selling for tens of thousands of dollars.
Domain investors should obviously steer clear of svh.com, which will is probably already up for sale.
Not only is there a possibility of attracting unwelcome legal attention, but there’s also the moral implications of paying somebody who would steal from a hospital.
The hospital in question has now changed its name to sonomavalleyhospital.org. This transition, which includes migrating the email addresses of all of its staff, seems to have taken several days.
Anyone sending personal medical information to the old svh.com email addresses may find that information in the wrong hands.
This is such a crock of shit and our industry needs to fix it.
Domain Hijacked. We need to stop thinking of it like this.
The domain name was stolen.
And lets be honest. Domains are not like a piece of art where they disappear when they are stolen. We know exactly where it is. And we know exactly what the history of it is.
It’s time we pull our heads out of our asses and start doing whats right. This domain should be put back in the hands of its rightful owner.
All too often we get tied up in our own policies and procedures and throw our hands up and say there is nothing we can do.
How about we create an “undo transfer” command for Registrars. It has the effect of instantly undoing a transfer to another Registrar. Puts the domain name back.
At the same time, it launches an investigation by a third party. The third party looks at who is right and decides where the domain should live. Loser pays a stiff fee to cover the cost of the third party investigation. That would stop abuse of using the undo transfer command.
If transferring it back is just too much for most people to comprehend, then how about we have a command that lets the losing Registrar put the OLD DNS on the record at the registry and lock it until the investigation is done. In effect, that would restore the domain to use by the proper client so web and email worked, and then let a quick investigation occur.
It’s time to stop ignoring doing whats right in the name of policy and figure out some common sense solutions to domain name theft.
I own fullname.com and fullname.nl. But eventually I settled for .nl because then at least I could contact the registry if my domain gets stolen. Who will then intervene, contact the registrars, verify the old and existing whois records, undo the mutation and give a symbolic fine to the gaining registrar. I love how .com has a transfer lock and asks for email verification before a transfer, but that wont help you if your account get compromised.
Im sure Verisign earns enough that they can afford to do some oversight as well.
Sounds like maybe you should take this to the GNSO.
What you describe already exists (in gTLD world). See https://www.icann.org/resources/pages/tdrp-2016-06-01-en (before 2016 there were even 2 steps, first one being the registry itself arbitrating the dispute, before going to an external provider)
There is no need to a specific “undo” transfer, as it is just a transfer in opposite direction (and the registry can force it to go through). There are underlying operations to remember also (like transfer of in-bailiwick host objects if they exist), and one may have to adjust the expiration date. As for your final suggestion to let the old registrar change nameservers on a domain not sponsored by it anymore, this is ripe for abuse in the opposite case.
It looks like this specific issue might be getting resolved as we speak, but it’s not clear how or why.
I noticed the registrar whois for svh.com shows this domain name with cloudflare.com nameservers, which point to the same mailserver as sonomavalleyhospital.org and the webserver of cloudflare.com seems to be set to redirect to https://www.sonomavalleyhospital.org.
But: that’s only in the registrar whois. At Verisign this has not been updated yet.
The Whois site for BizCN doesn’t even resolve for me.
Nameservers in whois are often outdated, and thus not much use for this type of investigation.
Shame we got rid of owner info in whois isn’t it…
Nameservers in whois are often outdated, and thus not much use for this type of investigation. Much better to use a live DNS lookup such as dig on the command line.
Shame we got rid of owner info in whois isn’t it…