RE: [registrars] Grave Robbing and SEDO Fencing

["Lau" <richard@xxxxxxx>]

The Transfer Dispute Policy does not apply in cases like Raven.com where the
Admin Email was changed at the Losing Registrar.

The TDP looks at whether the Gaining Registrar verified that the controller
of the domain had permission to move the domain. Since the Admin Email had
already (allegedly) been fraudulently changed at the Losing Registrar, the
Gaining Registrar did the Transfer by the book and thus the Transfer would
not be reversed.

Am I wrong? (Please, someone, tell me that I am).

Richard


-----Original Message-----
From: owner-registrars@xxxxxxxxxxxxxx
[mailto:owner-registrars@xxxxxxxxxxxxxx] On Behalf Of Paul Lecoultre (CORE
secretariat)
Sent: 07 August, 2007 1:39 PM
To: 'Registrars Constituency'
Subject: Re: [registrars] Grave Robbing and SEDO Fencing

Hi,

Although I welcome initiatives, I don't think that a 60
days obligatory lock after every transfers, modifications
will help registrars, it will only complicate transfers
by adding an unnecessary burden. The authinfo code has
proved to be effective, even if exceptions are possible,
such the raven.com case. The 60 days automatic lock done
by Godaddy and others is an internal registrar rule that
neither ICANN nor the registries are requesting(at the
recent exception of PIR, if I'm right).

In case of exceptional cases, we still have the Transfer
dispute policy, which allow the registries to reverse
wrong or fraudulent transfers that occurred in the past
6 months. In addition the ICANN radars is providing the
direct email of people handling transfers and usually
such cases are solved in a timely manner.

I don't see the need to act in this specific case,
we only need to increase the already well working
communications between registrars (yes there are
exceptions...).

Best regards,
Paul Lecoultre



Tim Ruiz wrote:
> Thanks Donny. You're right, it does say *may.* So perhaps that's another
> thing the RC should consider trying to change. I realize it may pose an
> inconvenience for customers who want to flip names as you describe, but
> it wouldn't prevent it. What it would do is add a layer of protection
> against hijacking.
> 
> I think the raven.com issue illustrates the potential problem with
> assuming that if someone has the authcode, the name must be theirs. I
> thought the same way about the authcode at one time, but various
> experiences have changed my mind. I think authcodes are a good tool, but
> only one piece of the security issue. 
> 
> Tim 
> 
> 
> 
> -------- Original Message --------
> Subject: RE: [registrars] Grave Robbing and SEDO Fencing
> From: "Donny Simonton" <donny@xxxxxxxxxxxxxxx>
> Date: Tue, August 07, 2007 6:27 am
> To: "'Tim Ruiz'" <tim@xxxxxxxxxxx>,  "'Registrars Constituency'"
> <registrars@xxxxxxxxxxxxxx>
> 
> Tim,
> The ICANN transfer policy says that I "may" deny a transfer within the
> 60
> days after a domain is transferred to us, it doesn't say that we "must"
> deny
> the transfer. As more and more registrants start selling domains
> stopping
> them from transferring a domain just causes more problems. We have many
> customers who flip domains every day. With the hopes of making a few
> hundred bucks here and there.
> 
> Ever since Verisign switched to EPP, my rule has been if you have the
> auth-info code you can do whatever you want with the domain, because
> it's
> yours.
> 
> Donny
> 
> 
>