Auto parts firm’s domain stolen and held for ransom

Thief stole Florida firm’s domain and asked for 10 bitcoin ransom.

A thief stole a domain name from an online auto parts firm and demanded 10 bitcoin to get the domain name back.

Florida firm XPort Auto Parts, Inc. woke up in the middle of last month to find that its domain name XPortAutoParts.com had been stolen and transferred from GoDaddy to Reg.ru. It received a ransom email stating:

Your domains were taken by me and your empty GoDaddy account was closed. As a result, your business stopped working. Your shop is nothing if you don’t have your trusted domain name.

While you’re reading this EMail, you’re losing orders and AdWords money, cuz I turned off your ECommerce platform on your website as you can see.

You made 400k$ Gross for the past 6 months, so my price of this and all other domains is 10BTC. It’s not a big deal for you, since you [expletive] up and [expletive] up hard…

Ten bitcoin is regarding $100,000 USD. When XPort Auto Parts got its GoDaddy account back (but not the domain), the thief raised the price to 20 bitcoin.

XPort Auto Parts sued (pdf) in Florida court, and a judge there issued a temporary restraining order (pdf) that requires Reg.ru to transfer the domain back to the victim’s GoDaddy account. If Reg.ru does not compy within 24 hours, .com registry Verisign is ordered to comply. [Update: The domain is now back at GoDaddy as of 9/13.]

While the auto parts firm will still have to litigate the matter, the legal strategy asking for a temporary restraining order and getting the domain back this quickly is something I haven’t seen in a while. Assuming Verisign views this as a valid court order, this was a shrewd move.