Time to vent (TSW stolen)

[Comey]

So, some of you are aware of TotalSportsWorld, a site Mark Cooley and I founded a couple of years ago. It was a collection of online leagues in many different sports and many different genres. There were two FOF leagues there, two BBCF leagues, a few OOTP leagues, etc. It was a thriving site, and a great place to spend your hobby time.

Yesterday, someone from San Diego decided that hobbytime was over. He hacked into Cooley's account, and transferred all of his domains to himself. He then turned TSW into a hardcore porn site.

The guy even went so far as to call Cooley last night, and gloated about it.

Normally, one would think that GoDaddy could fix this. But, because the guy did it from Cooley's account (despite the fact that this guy did it from an IP address different from Cooley's account, and one that has never accessed his account before), there is nothing they can do.

TSW will return, I think, as will all of the other sites that were stolen. But they'll return under different names, of course, and the work that has to be done in order to get them running again is going to be insane. This comes at a time when the leadership of TSW was under transfer.

I'm ridiculously pissed off. The fact that we are totally helpless here has me frustrated more than anything.

[gstelmack]

Call the FBI, or even your local police department which will often have a cybercrimes unit.

[MikeVic]

How can nothing be done! This seems ridiculous.

[Comey]

I read up on the issue, which seems to help this d-bag. The interstate transfer here gets things a little muddied.

GoDaddy basically told Cooley that it would cost him a hefty chunk of change to try to get the names back.

I found this link of something happening now, which further illustrates the difficulties the law has in these issues:

BREAKING: First Ever Criminal Prosecution for Domain Name Theft Underway | Domain Name News (http://www.domainnamenews.com/featured/criminal-prosecution-domain-theft-underway/5675)

[Comey]

By the way, if anyone is living in San Diego, call up 619-365-8390. A douchebag with an Indian accent will answer you.

[SirFozzie]

Hell, look at this:

Sex.com - Wikipedia, the free encyclopedia (http://en.wikipedia.org/wiki/Sex.com)

[RomaGoth]

Yes, do what gstelmack said. Find a way to get the fucker that did this. I hate shit like this, people who hack into stuff and steal are nothing but bottom feeders of society. :rant:

[gstelmack]

If you have a phone number that would seem to immeasurably help police, as that may break open other cases they may have open.

Or just hand him over to The Smoking Gun...

[Comey]

Hell, look at this:

Sex.com - Wikipedia, the free encyclopedia (http://en.wikipedia.org/wiki/Sex.com)

Of course it blew up like that. Look at how much the site was making.

The point here is...the commishes of the leagues were chipping in a few bucks of month for hosting. We weren't making any money off the site. The value of our site was in the enjoyment everyone got from the community and joining multiple leagues under one roof.

Nobody has the fiscal ability to go after this guy. If we were making a severe profit, of course we would pursue action. But because the cost to anyone at TSW of pursuing civil action (which seems to be the extent that one can pursue here) would cost far more than they would see back...well, you get the idea.

[Draft Dodger]

again, call the cops.

[BishopMVP]

Or just hand him over to The Smoking Gun...+1 - at least do this. Shouldn't affect any potential legal recourse you can take later, and should make his life uncomfortable/focus some attention on him.

[Subby]

(619) 365-8390
Type: Land Line
Provider: Time Warner Communications
Location: Coronado, CA

[DaddyTorgo]

call cops. give cops phone number.

[Comey]

I put in a complaint with the FBI's cybercrimes division.

The problem on MY end is that the domains were not in my name, but Cooley's. So, where I sit...my hands are kind of tied. Cooley may already have tried the police. When he's on again, I'll find out.

[cuervo72]

This is just the domain, right - not his account with his provider (which would have league data, etc)?

[Comey]

Just the domains. I think there were four of them in all. We got some workaround to get back to the forums. I don't remember it at the moment.

[JediKooter]

Call Time Warner and inform them they have a customer violating their terms of use of their internet policy.

[DanGarion]

Do you know if he did this via a Time Warner / RR IP addresss? Hit me up on PM if you know, I might be able to get you in touch with the San Diego abuse department. I'm looking into contact info in SD now, hopefully we can get this guy.

[molson]

I put in a complaint with the FBI's cybercrimes division.

The problem on MY end is that the domains were not in my name, but Cooley's. So, where I sit...my hands are kind of tied. Cooley may already have tried the police. When he's on again, I'll find out.

Good move. It's not just domain main stealing, but potentially identity theft as well. Maybe there's nothing that can be done, but at the very least, let this be a another number/complaint with the FBI, so it's known how big a problem this is.

[DanGarion]

And yes you need to contact the FBI or your local police immediately.

Also I was really digging the pictures until the very last two, of the chick smashing cupcakes on her boobs and the one that had nipples the size of a penis...

[RomaGoth]

Good move. It's not just domain main stealing, but potentially identity theft as well. Maybe there's nothing that can be done, but at the very least, let this be a another number/complaint with the FBI, so it's known how big a problem this is.

It may go without saying, but all owners of the domain should put a lockdown on their credit cards, especially the ones on file with the domain registrar.

[Comey]

I'm certain LB and Cooley did that immediately.

Dan, I have your IM. I'll have to wait to find out from Cooley if we have an IP from him. If we do, I'll send it your way.

[DanGarion]

I'm certain LB and Cooley did that immediately.

Dan, I have your IM. I'll have to wait to find out from Cooley if we have an IP from him. If we do, I'll send it your way.

Great, I have a contact at the SD abuse department, once the story is fleshed out a bit more with information I can work with you on contacting them.

[DaddyTorgo]

this is when i really <3 having DanGarion on the board (actually i'm not one of those people who ever dislikes having him).

[Comey]

Dan, I IMed you...but am not sure if you are near that, so I PMed you too.

Interestingly enough, we have a lawyer down in the SD area now. So we're gonna try to get the ball rolling on this, and see what we can accomplish.

[MacroGuru]

Another thing you can do and it could be fun work is contact every one of his affiliate programs he is a member of and notify them of his violation of their ToS.

He will immediately lose all his money making capacity. The Adult affiliate systems are way against this as it does give their webmasters a bad name and they are trying to fight it at all costs.

[DanGarion]

this is when i really <3 having DanGarion on the board (actually i'm not one of those people who ever dislikes having him).

Thanks! :), I'm trying to change people's views about TWC one person at a time! j/k

[DaddyTorgo]

Another thing you can do and it could be fun work is contact every one of his affiliate programs he is a member of and notify them of his violation of their ToS.

He will immediately lose all his money making capacity. The Adult affiliate systems are way against this as it does give their webmasters a bad name and they are trying to fight it at all costs.

oooh yes!!! this sounds like a GREAT idea!!!

hit him in his pocketbook where it hurts!!

[Comey]

There's a thread over at the OOTP forums about this too. The wheels are moving.

[DanGarion]

Another thing you can do and it could be fun work is contact every one of his affiliate programs he is a member of and notify them of his violation of their ToS.

He will immediately lose all his money making capacity. The Adult affiliate systems are way against this as it does give their webmasters a bad name and they are trying to fight it at all costs.

I hadn't even thought of that one, but that is an awesome one to do.

[DaddyTorgo]

you should get time warner on it too - that way he'll lose his money-making ability and his internet

[DanGarion]

you should get time warner on it too - that way he'll lose his money-making ability and his internet

From my understanding, TWC can only help at this time if there is proof that he used TWC internet services to transfer the domains. I could be wrong but that is how I understand it. Just because he calls from a phone # that is owned by TWC doesn't really say much yet, other then that he could be or have been a TWC digital phone customer.

[DaddyTorgo]

right right *nods*

[Comey]

Since I'm not too up on the internet porn industry, how would I go about finding out who his affiliates are? I'm going to give that one a try.

[MacroGuru]

Since I'm not too up on the internet porn industry, how would I go about finding out who his affiliates are? I'm going to give that one a try.

Basically, each one of those main images are going to a sub gallery, then in the sub gallery click on the one of the pictures....

It will pull up a thumbnail gallery showing an ad towards his sponsor and it might show his affiliate ID up top..

For example....I noticed frozenjag was one of his names in one of the galleries...

He also has an affiliate ID of 1883422 with one of his other ones.

[Comey]

I saw the frozenjag too...I have that email. I wasn't sure if I should email that.

[Subby]

I don't understand how Mark cannot send identification verification to GoDaddy and have them transfer the account information back to him.

[Alan T]

I don't understand how Mark cannot send identification verification to GoDaddy and have them transfer the account information back to him.

I think it is because of legal reasons. Whatever GoDaddy's confirmation system is, they have to do it before the transfer is done. Once they have verified to their own liking that the person doing the transfer is allowed to do so, they process the request.

The domain is then transfered to a completely different registrar for ownership and GoDaddy no longer has any authority to do anything at all with it. They can't tell some other company what they should do. So if there is any fault with GoDaddy here, it is perhaps their security (I have no idea how the account was broken into and if it was Mark's fault or GoDaddy's fault), or their confirmation system (of course whoever did this hack could have hacked Mark's email and then went from there which is what allowed them to do this entire transaction perhaps).

So it is hard for me to fault GoDaddy in this, I actually don't legally know how they can do much here. If anyone can help it would be the new registrar that now owns this domain, but I'm not sure what type of information they will need to be able to do much. (Who is to say that mark didn't sell these accounts and is now trying to rip their customer off for instance)...

So this type of thing can be tough to handle unfortunately I fear and almost always involves some kind of legal battle.

[Subby]

That makes sense - I thought the thief still had the domains registered through GoDaddy - didn't realize they had been transferred.

I coach a kid whose dad is a higher up at Network Solutions and he said that GoDaddy is notorious for lax security.

[MacroGuru]

That makes sense - I thought the thief still had the domains registered through GoDaddy - didn't realize they had been transferred.

I coach a kid whose dad is a higher up at Network Solutions and he said that GoDaddy is notorious for lax security.

I don't know...I think it is still hosted with GoDaddy after I ran a whois on the domain name it looks like it.

[Dr. Sak]

That makes sense - I thought the thief still had the domains registered through GoDaddy - didn't realize they had been transferred.

I coach a kid whose dad is a higher up at Network Solutions and he said that GoDaddy is notorious for lax security.

That's because they spend all their money getting Danica Patrick to show off her cleavage.

[Alan T]

I don't know...I think it is still hosted with GoDaddy after I ran a whois on the domain name it looks like it.


It might be, sometimes it takes a few days for updates on registrar information to get updated though, so I was assuming that is not the case.

If it is, I am guessing GoDaddy has more ability to help, but I can't speak for what their policy is on this type of thing. They are one of the more affordable registrar options out there for a reason.

But I was assuming it was transfered out of there.

[RainMaker]

Are you sure that the domain didn't just expire and this guy came swooped in and grabbed it? That happens a lot more frequently than someone stealing a domain.

If it's stolen, your best bet is to contact the registrar and tell them of what happened. FBI and police don't give a shit. Whoever did it is probably in Russia somewhere.

[Izulde]

FBI doesn't care unless it's linked to terrorism in some way.

The greatest TV show of all time taught us that!

[Comey]

Are you sure that the domain didn't just expire and this guy came swooped in and grabbed it? That happens a lot more frequently than someone stealing a domain.

If it's stolen, your best bet is to contact the registrar and tell them of what happened. FBI and police don't give a shit. Whoever did it is probably in Russia somewhere.

The person who did it is in San Diego. He has an Indian accent. As said above, he called Cooley last night and gloated about the acquisition.

The domain did not expire. This guy stole it.

The registrar (GoDaddy) was already contacted, as also stated in the original post, and told Cooley there's nothing they can do.

[Danny]

The person who did it is in San Diego. He has an Indian accent. As said above, he called Cooley last night and gloated about the acquisition.

The domain did not expire. This guy stole it.

The registrar (GoDaddy) was already contacted, as also stated in the original post, and told Cooley there's nothing they can do.

reading FTW

[RainMaker]

The person who did it is in San Diego. He has an Indian accent. As said above, he called Cooley last night and gloated about the acquisition.

The domain did not expire. This guy stole it.

The registrar (GoDaddy) was already contacted, as also stated in the original post, and told Cooley there's nothing they can do.
To get stolen, the guy would have to essentially transfer the domain to his own account. You would have received e-mails about this most likely.

Nonetheless, I'm talking about the new registrar which is NameCheap. Calling them with a detailed account of what happened. Explain to them the ludicrousness of that domain becoming a porn site. How it's extremely unlikely that you would transfer a domain to a porn site. If they say there is nothing they can do, inform them that you will be contacting ICANN and filing a complaint about them.

How did you get this guys phone number? I've essentially found out who he is online and am working on either getting his full info or him dropped from various affiliates. I used to be a large affiliate in adult years ago so I do have some good contacts there still.

[JediKooter]

I used to be a large affiliate

I'm sure you told that to all the ladies, didn't you? ;)

[Izulde]

How did you get this guys phone number?

Your assistance is cool, but your reading comprehension is ghastly, man.

From the OP:


Yesterday, someone from San Diego decided that hobbytime was over. He hacked into Cooley's account, and transferred all of his domains to himself. He then turned TSW into a hardcore porn site.

The guy even went so far as to call Cooley last night, and gloated about it.

[RainMaker]

Sorry. Been a long day of work. My mind is fucking fried right now.

[Comey]

Rain, I appreciate the help. But you might want to rest, before you fry my brain with your reading. ; )

Knowing NameCheap is good. I don't know if Cooley is aware of that. I'll send that his way.

We'll have our lawyer (ie our Atlanta Braves owner in the eMLB) contact them and rattle some cages.

[RainMaker]

ICANN is also a place you'd want to send your complaints to. All registrars like NameCheap need to be accredited by ICANN. Sending in complaints can hurt that status and force them to either be investigated or have their accredited status removed. Unlikely to happen, but if they have received other complaints about harboring domain thieves, you never know.

[sterlingice]

FBI doesn't care unless it's linked to terrorism in some way.

The greatest TV show of all time taught us that!

Sam Malone was a secret FBI agent? I must have missed that episode ;)

SI

[Comey]

ICANN is also a place you'd want to send your complaints to. All registrars like NameCheap need to be accredited by ICANN. Sending in complaints can hurt that status and force them to either be investigated or have their accredited status removed. Unlikely to happen, but if they have received other complaints about harboring domain thieves, you never know.

I fired off complaints to both places. And I'm going to get others to do it too.

[stevew]

Its a sporting goods site now?

Total sports world dot com?

[stevew]

Nevermind

[Comey]

Well, I wrote something up. Hopefully some of you will help us. We are all in the same community. Hopefully what we could show, in numbers, will help us get back what is ours.

(I posted this on our backup site.)

---

Hello,

If you're as pissed off as I am that someone has taken our home from us, go to this link:

http://reports.internic.net/cgi/regi...lem-report.cgi (http://reports.internic.net/cgi/registrars/problem-report.cgi)

Write up a complaint. Copy and paste this if you wish:

Hello,

I am writing to complain about NameCheap Inc., who is harboring a domain thief. Someone stole five domains from our administrator (the biggest of which are www.totalsportsworld.net (http://www.totalsportsworld.net/) and www.gridiron-glory.net (http://www.gridiron-glory.net/)) and have used them to distribute hardcore pornography.

The person who took our websites decided to call our administrator and gloat about his "acquisition", adding that there was nothing we could do about it.

We are not a for-profit group, and therefore, we do not have the resources available to fight this legally. We are simply a sports gaming website. Nothing in "Total Sports World" screams porn.

Hopefully you can assist us, and return to us what is rightfully ours. It is unjust that someone with a little technical know-how can outright take someone's online community with no recourse.

We hope that it stops here, and that justice prevails.

Thank you for reading, and we look forward to any and all assistance you provide.

Sincerely,

(Insert Your Name)

----

In order to make this work, we need numbers. Enlist everyone you can. It will take very little on your part to help our cause. It will take very little on anyone's part to help our cause.

Please, help us fight for the community we all love so much.

Thanks,
John

[RainMaker]

I've gotten word back from both the owner of the site that it's being redirected to and the host (who is a highly respected, honest guy in the hosting industry) that the person who hijacked the domain is not the same person as the one it's being redirected to.

It could be someone trying to scam the site in a traffic trade. I'll ask if they can check that.

Otherwise, do you guys have any enemies at all who may be able to figure out the password? It could be as simple as an old e-mail address that someone could gain access to for password reminders. A competitor's site that you used the same password on.

I bring that up because the guy calling you is odd. If it's a true domain hijacking for traffic, they wouldn't call you. They wouldn't draw attention to what they did. It happens a lot and they'd rather fly well under the radar. It's also not a highly trafficked site or one of major internet prestige. That's what makes me think it's personal.

[Antmeister]

Ummmmm.....what the hell!?!?!?!

[RainMaker]

Just a suggestion, but I would contact NameCheap directly before bombarding them with e-mails. See what they say over the phone and if they can help.

I'll ask my business partner in the morning if he has any good contacts at NameCheap. He's pretty into domaining so he knows a lot of guys in that industry.

[Comey]

I wrote NameCheap directly. I informed them that I had contacted ICANN as well. (I also wrote CNet because, well, this is a social issue with gray areas. And I've seen them help in these kind of situations before.)

But this new information is, well...interesting, to say the least. And there's only one person I can think of with this.

We get more traffic than most think...but we are, for all intents and purposes, a niche community. So...this is rather eye-raising.

I am off to bed for this evening...but will be checking this out in the morning, and tomorrow afternoon.

If I get any information, I will update you all. I can't tell you how much I appreciate your help and support.

Thanks,
John

[Passacaglia]

That sucks. Someone didn't get the team they wanted in Gridiron Glory?

[stevew]

If those are porno links at the moment, you probably want to hxxp them just in case.

[Comey]

NameCheap has locked the sites in question, saying that GoDaddy is supposed to do something (FOA, form of authorization) in this case.

That is all well and good...but GoDaddy has already claimed that there is nothing they can do. That may put us between a rock and a hard place, until we can get something that gets us some more information on our hacker (ie an injuction or some kind of claim that nets us his IP, or name, etc).

[Comey]

If you are a TSW member, you can access the forums by going to this link:

Total Sports World Forums - Powered by vBulletin (http://209.160.65.106/~wwwtot/forums/index.php)

We're working on ways around this mess...but it's going to take awhile.