firestars

When I request domain transfer forms why do Nominet

a) request my name?
b) request the address that the forms should be sent too?

Should they not just send to whatever name/address is listed in the whois?

admin

Interesting point, otherwise they could fall into the wrong hands.

Maybe it is because some whois records show duff information.

__________________
9p Domains | Domain Appraisal | Droplists | Domain Brokerage | Find Valuable Domains | Link to us | Domain Software
New to UK Domain Names? - Go Here | Check Drop Dates | Domain Transfers | Game Consoles
Make more money from your Domain Names with SedoPro - PM for a free activation code!

apd

I sold a domain to a well know internet company years ago and to my amazement they had ordered the Nominet form, filled it in and sent it to me. I thought that wasn't possible but apparently it is.

bb99

Aye, it is possible for anyone to request a transfer form for any domain.

Anybody want to really give the system a test by asking for a transfer form for nominet.org.uk??

__________________
Gazebo | Murcia Golf Apartment | Bouncy Castles | Self Storage Guide | The Colosseum, Rome | Professional Indemnity Insurance | Alloy Wheel Repairs in Leeds

Jac

For the sake of clarity, the domain name transfer procedure is set up to protect the legal registrant and the person the domain name is being transferred to. Nominet has to (by law) establish beyond reasonable doubt who is asking for the transfer and who is accepting it. If (as admin has hinted) there is wrong information in the whois record, then it is doubly important that Nominet establish who is legally entitled to the domain.

The requirements in a domain name transfer are legally binding and if Nominet makes a mistake and gives someone else's domain name away to a usurper, then Nominet could quite rightly be held to account for such a mistake.

Whilst the procedure may look a bit austere, it is there to protect YOUR rights as a registant, and the rights of the party taking over the domain.

Regards
James Conaghan
[PAB Member]

LeeOwen

Hello,

Do you fancy sharing your views on this exploit as well >>>

Domain "kiting"

Cheers
Lee

bb99

I think you've misunderstood James... The point is that Nominet will send out a transfer form for any domain to anybody that asks for one.

Hopefully the Nominet transfer process itself will prevent any foul play - but still, sending out transfer forms to anyone who asks does in itself increase the risk that a fraudulent transfer will occur later down the line.

__________________
Gazebo | Murcia Golf Apartment | Bouncy Castles | Self Storage Guide | The Colosseum, Rome | Professional Indemnity Insurance | Alloy Wheel Repairs in Leeds

invincible

I've commented about this before on here. Make an advanced search on this forum for the key word "transfer" together with my username "invincible". Then read my comments in both the "snocap.co.uk stolen from me?" and "The tag for my domain name has been changed without my permission" threads. Domain Names have been "stolen" by people performing fraudulent transfers in the past. I have argued that paper based transfers are possibly less secure then electronic ones because anyone can request the paperwork, complete it and sign it. Nominet don't have any way of validating a signature and they don't phone or email you to check you really want to make the transfer.

This is why I have stated that in order to protect your valuable domain names you should either operate your own tag or have a great relationship with your tag holder. The tag holder, not the Registrant, will be notified of any registrant change via a PGP signed email. If you run your own tag, and someone does this, you can act immediately. If your domain names are on someone elses tag, the first you might know about a false transfer is when you WHOIS the domain name or try to make use of it somehow. If you've parked the domain name somewhere, you might not notice for ages. I think this is dreadful.

Jac

I didn't misunderstand per se but I guess I confused the issue by just stating the procedure. In reply to your specific point about preventing foul play, Nominet say they; "rigorously check the authenticity of any transfer between domain name holders. Nominet carefully checks that the transfer request is genuine and that the correct authority has been given. It is vital, therefore, that registrants ensure that all the information requested on the transfer form is provided correctly in order to avoid delays in processing requests".

Further details here:
http://www.nic.uk/registrants/maintain/transfer/form/

I hope that clarifies the issue of security and foul play?

Regards
James Conaghan
[PAB Member]

Jac

I checked your comments and those of "bobby sands" who says he lost the domain; but unfortunately there are very few facts to go on in the thread. Someone mentioned that Nominet had supplied the facts regarding this transfer but that it would not be prudent to post them here.

My own experience (and that of some clients) has been that electronic transfers are far more prone to fraud than paper ones. IMHO it is much too easy for a reseller to go into their account with opensrs or another Top Level Registrar and change the registrant name (on a .COM) to themselves; and getting a fraudulently transferred .COM back is a lot more hassle than getting a .CO.UK one back. Sticking my neck out a bit (cos I haven't checked with dah management) I would say if you make Nominet aware that a fraudulent transfer has taken place, they will act immediately to correct the situation and if they didn't, I'd want to know why. However, see my comments below!

A tag holder is supposed to check the validity of each Tag Transfer request. Some do this by letter or fax, others may allow username/password access to an online system, and others by 'email of record'. Theoretically, if you keep your whois (contact) information up to date, this goes a long way to protecting your registrations. Whilst I agree that any fraudulent transfer is "dreadful", it's one of those issues where I'd need more evidence to suggest how best to combat the problem.

However, some of the problems I have personally encountered are where the current registrant hasn't (for whatever reason) updated the registrant field or the contact details. Legally, the person in the registrant field; whether they have sold on a domain name or not; can claim it back at any time. Then it's a court battle to decide if it was actually sold on in the first place because the person legally entitled to hold the registration is the one named in the registrant field.

This is why it is essential that domain names that are 'sold on' are transferred correctly so that the person buying it is actually cited as the registrant. I am referring back to what I was told about "sales" of domain names under 100 quid being accomplished simply by tag transfer, and not your actual proper 30 quid domain name process. Anyone doing it, is leaving the new registrant (whom they extracted said 100 quid from) open to all sorts of problems in the future and all for the want of a 30 quid transfer.

Them's the facts guys, so if you're doing it, please think twice before doing it again; cos sure as eggs are eggs, an accident waiting to happen eventually happens; and someone will eventually get sued over the practice; and all for the want of a 30 quid transfer.

Regards
James Conaghan
[PAB Member]