Newtek domain theft has major impact on clients

Clients have to make quick switch to avoid security risk and potential outages.

I frequently write regarding domain name theft. Usually, the only loss in the theft is the domain name. But it can be much worse.

Three domain names belonging to Newtek Business Services Corp. (NASDAQ:NEWT) were recently stolen, as Brian Krebs explains in a post today. Unfortunately, clients used these domain names to access and point to their web services, potentially leading to outages and leaked information.

Krebs details Newtek’s bungled response in his post, but let’s dig a bit deeper into the domain theft.

The three stolen domains were webcontrolcenter[dot]com, thesba[dot]com, and crystaltech[dot]com.

Looking at historical Whois records at DomainTools brings up many interesting points.

First, Newtek is a Tucows reseller and managed all of these domains through its reseller account. I wonder if it also helped clients register domains through its reseller account and if any client domains were also susceptible to the hack.

Second, the thief or thieves moved the domain names to three different registrars: P.A. Viet Nam Firm Limited, INET Corporation and GMO Internet, respectively. There are a few possible reasons for this:

• There were multiple thieves
• The domains were moved to multiple registrars to make it more difficult to recover them quickly
• Three different registrars were used to reduce the chances of detection during the theft

Third, the theft of at least one domain occured a couple weeks ago and went undetected. DomainTools has a historical record for CrystalTech[dot]com dated January 31, 2018 that shows the domain had by now been transferred to GMO.

Firms (especially web service providers) ought to always track their registrations through a service such as DomainTools or DomainIQ to be alerted if their domains change.

Fourth, all three domains had the same registrant contact email. This could have been a source of the hack, although NewtekOne.com, the firm’s main domain name, was not stolen and used the same address.

Amazingly, Newtek’s stock opened up to begin the day. It has been relatively quiet regarding the domain theft, but it’s something investors ought to dig into to understand its impact.