Registrant data to UDRP imposter — Name.com provides
Imposter spoofed UDRP provider to get client information and lock domain.
On today’s DNW Podcast, John Berryhill mentioned a developing situation with a client’s domain name. You can listen to the entire discussion regarding the issue starting at 34:00 of today’s show.
In a nutshell, name.com sent an email to a client informing him that his two-letter .com domain had been locked since a UDRP was filed. It’s standard procedure for domain registrars to lock domains upon receiving a UDRP notice.
The registrant reached out to John, asking him to look into the UDRP.
Normally, a domain owner will receive a communication from the UDRP provider informing them of the dispute. These can land in spam folders or otherwise not arrive, though.
In this case, the domain owner didn’t receive anything. John looked for recently filed cases at WIPO, FORUM, and Czech Arbitration Court, but could not find a case involving the domain. There are a couple of other modest UDRP providers that don’t publish fresh case information.
For some reason, name.com wouldn’t tell the client which UDRP forum sent the notice.
This created a headache for the client. What if someone filed a case with one of these other UDRP providers, the registrant didn’t receive the notice, and it resulted in a default decision?
When I recorded the podcast interview on Friday, John stated he was going to have to file a lawsuit against a John Doe to prevent this from happening.
John gave a couple of other theories regarding what might have happened. He stated it’s possible that someone spoofed a UDRP provider to trick name.com into locking the domain. Making it worse, when a registrar receives a UDRP notice, they must respond with the registrant’s information.
Well, today, John found out this hypothesis was correct. Someone tricked a name.com representative with an email pretending to be from a UDRP forum. Worse, name.com provided the domain owner’s information to the imposter.
Name.com sent an email to the client, notifying him:
On March 23, we received notice of a UDRP complaint for your domain. The notice purported to come from a frequently used domain dispute resolution provider. Pursuant to our standard processes, we responded to the notice providing your registration information and locked the domain. If this had been a legitimate request, you (and we) would have received further information regarding the complaint shortly thereafter from the case manager.
We subsequently investigated and determined that the notice we received did not come from a valid email address associated with the domain resolution provider and instead appears to have come from an unknown third party. We have not been notified of a legitimate UDRP action regarding your domain.
We don’t know why the perpetrator sent the UDRP notice. But knowing the client’s information creates an attack vector for domain theft. It could also be someone who wanted to get contact information to try to buy the domain.
There are a couple of takeaways from this situation.
First, I don’t know how good this spoof was, but there needs to be some sort of check in place ahead of a registrar sends client data in response to an email.
Second, there’s no reason a registrar shouldn’t tell a client which UDRP forum sent the notice. This would have saved the client a lot of time (and perhaps money) by resolving the issue sooner.
