Domain Name Expire Could Lead to Identity Theft — Letting Your

…or other shenanigans.

OK, the headline is a bit sensational. But the truth is if you let a domain name expire that is tied to any sort of online accounts, you’re putting yourself at extreme risk.

Why the soapbox? I just finished reading this post from Ben Reyes regarding how he used an expired domain to get access to someone’s entire history of Gmail, Google calendar, contacts, etc., and this gave him a key to unlock the person’s other online accounts like Amazon.

Basically, Reyes tried to use his newly registered domain for a Google Apps account. When he did so he was told sorry, the domain is by now in use with Google Apps. That’s since a previous owner used it. Reyes went through an Apps account reclaiming process and voila — he was in.

Expired domains also make it easier to steal domain names. People will look for expired domain names that are used as part of the email in the whois contacts for other domain names. They register the expired domain, set up an email to copy the whois record email domain, then request a transfer out. That’s what happened to ChicagoRestaurant.com.

An easier approach to steal a domain? Look for expired Hotmail usernames tied to existing domain registrations. Open an account with that same Hotmail name. And you’re in.

Be careful.