Domains being listed in someone elses Afternic account

B

baldidiot

Member
Joined
Jul 8, 2024
Posts
97
Reaction score
77
Trophy points
18
This happened to me today and it's wound me right up. Someone has added one of our domains to afternic with a BIN price so that it's showing on godaddy.

The domain is for one of our active sites and definitely not for sale, nor is it in our afternic account.

What's annoyed me is that they've said the only way to remove it is to add the domain to our afternic account, verify ownership and then delete it. So rather than getting the person who has it in their afternic account to verify that they own it, we have to prove that they don't own it.

Also once I've deleted the domain, I'm pretty sure there's nothing to stop someone else adding it to afternic. Meaning that if that happened, I'd have to go back and add it again and re-verify. Or I have to leave a domain listed in afternic that I don't want to sell.

Surely the sensible option here is to make everyone verify their domains as they add them and not end up in a position where people could be scammed into losing their domains - thankfully it's not registered with godaddy, but I am concerned that if it was and someone did the BIN then afternic/godaddy would just do the fast transfer and whip the domain out of the account without permission.

I'm half tempted to just go and do the BIN myself to see what happens...
 
Last edited:
Just a little warning chaps.

Not only are there parasites listing other people's domains on the Afternic platform, registrars are partnering with Afternic and introducing the 'Afternic Fast Transfer' option on their platforms. It works when the registrar receives a request from Afternic asking them to 'enable' fast transfer on a specifically targeted domain name. So a parasite lists your name and Afternic requests the registrar to enable the fast transfer option. If this option is active and someone purchases your domain on the Afternic platform, your domain is immediately transferred out of your account without you having to lift a finger. I have had the Afternic request 3 times on 3 different valuable domains. My domains are currently listed on their platform even thought they have been warned by me. Each time Afternic makes the request, I get an email from my registrar telling me I need to either Opt in or Op out. I am going to transfer every domain out of my current registrar to one that is not partnering with Afternic when I receive future requests. Be warned!
 
It's a little 'worse' than Jack makes out, as the 'fast transfer' flag remains set at numerous registrars, even after a domain changes registrant.

This can mean you don't get the Afternic listing request at all ( all registrars will pass those on, but not all partake in the 'fast funnel to GD' system ).

The upshot of FT is that should a GD platform decide its sold, the domain is gone, with limited ( and costly ) routes to get back - old registrant listings, listings of names since dropped, your previous listings, scammer listings etc all mean it can be whipped away instantly, often without you knowing and without you getting paid.

It's a several years long recurring scam where scum will list names they scrape from other platforms, lists they d/load from sales reporting sites and even now we're starting to see them target names on known 'sale platform' nameservers.

GoDaddy/AfterNIC are well aware they are complicit in domain thefts and not remotely interested in resolving an issue that clearly makes them money.
 
Yes this is one of the things I'm worried about. The opt in message was actually how I discovered that it had been added to afternic.

There also doesn't seem to be an easy way to make sure that a domain is opted out of fast transfer with the registrar once it's opted in, or even a way to tell if a domain has been opted in. And like you say, this causes problems if you purchase a domain that has previously been opted in and you might not even realise it.

Is there a list of registrars who do not support fast transfer?

The ridiculous thing is that it sounds like the best way to protect your domains is to add your whole portfolio to afternic, and then set the listings to hidden. But who wants to do that?
 
baldidiot said:
There also doesn't seem to be an easy way to make sure that a domain is opted out of fast transfer with the registrar once it's opted in,
Click to expand...
Are you sure that this is the case? I am, of course, open to the fact that I might be wrong, but this is my assessment of the structure of this but not the actual implementation of the transfers themselves:

It seems as though, on the registrar I just checked on, that you have to accept the terms of afternic fast transfer for your account on said registrar in order to enable it on your domains therein.

To have afternic fast transfer enabled for your account without your knowledge is equivalent to having the terms and conditions accepted by someone else without your knowledge by someone else.

The acceptance of the terms are not on an individual domain basis from what I can tell.
 
In my experience I've had to opt-in to fast transfer at godaddy/afternic for my non .uk names - but you do indeed lose control after that point if you've got a BIN price, someone checks out and the domain is enabled with fast transfer. A few years ago, a price update on a domain was reverted by someone at GD and the domain sold and it was helluva an adventure to bust the sale and get the domain returned.
 
username said:
Are you sure that this is the case? I am, of course, open to the fact that I might be wrong, but this is my assessment of the structure of this but not the actual implementation of the transfers themselves:

It seems as though, on the registrar I just checked on, that you have to accept the terms of afternic fast transfer for your account on said registrar in order to enable it on your domains therein.

To have afternic fast transfer enabled for your account without your knowledge is equivalent to having the terms and conditions accepted by someone else without your knowledge by someone else.

The acceptance of the terms are not on an individual domain basis from what I can tell.
Click to expand...

I'm talking about when you opted in yourself, if you then wanted to opt out of it at a later date.

Looking at godaddy, just as an example, there's absolutely nothing to identify whether fast transfer is enabled or not. Their terrible new help AI said you can't disable it once enabled (although I suspect that might not be true).

I was under the impression it was done per domain though, because I've had notices about enabling fast transfer for a new domain when other domains on the account had previously had it enabled. It also lists the domains that it's enabling it for in the email.

If not then it's even worse, because it means that if you had fast transfer enabled for one domain, someone could steal domains you're not trying to sell by adding them to afternic as the fast transfer would already be enabled. So I bloody hope it's done at the domain level.
 
In the case of godaddy - the names I've got listed for fast transfer are in my godaddy account. The weakness of the system - which you have identified is that there appears to be no verification done when adding domains which are in a different registrar account (like my Nom tag) - adding them to afternic the first time seems to involve no verification - if you bought a name (or someone had previously listed your name) you then have to add DNS records to verify ownership. I suspect they do this for simplicity but this is the downside of the system. I'm not sure if they support fast transfer for .uk names held in a godaddy/partner registrar account - but the benefits of the system - quick sales, fast ownership for the buyer come alongside lots of other risks for the seller like mispricing (either through a fat finger or if something changes that suddenly makes your chat.co.uk name 10x more valuable :). I'd have encouraged you to buy your name - but you'd likely get a barrage of sales calls to finalise the deal and no prize at the end!
 
Even if the domains were in godaddy I'm pretty sure there would be no verification done by afternic if someone else added them (not unless you've linked your godaddy and afternic accounts and listed the domains for sale).

Here's a simple solution that would retain the ability for people to add domains without verification but would stop domains getting stolen via the fast transfer scam: require domains to be verified before they can use fast transfer.
 
I'm certainly not going to defend their system - it's done to make it easy, which is why it makes it easy to make mistakes (and thats when using it in the way it was anticipated to be used). I know from my experience having a name taken out of my account, sold, receiving funds - all along telling them I hadn't changed the price on the name, that the onus falls on the domain holder to sort it out - I'm also sure that if I had made the price change they'd have referred me to a tick box t&c's I once checked which had the clause - 'tough luck'. For buyers it's great - removes a lot of the pinch points in the process - negotiation, transfer etc for sellers it's great because a lot of buyers find it easier to make a y/n BIN decision. Nonetheless, my first thoughts after selling any name through the fast transfer system are always a few seconds of sellers remorse - that must have been too cheap or you could have got a bit more - followed by the reality that most names in a portfolio actually never sell and if it was so cheap it's unlikely it would have languished for years unsold. Funny business this domain stuff.
 
Fast transfer isn't the issue. The lack of adequate security protocols at afternic is the problem.
 
baldidiot said:
Looking at godaddy, just as an example, there's absolutely nothing to identify whether fast transfer is enabled or not. Their terrible new help AI said you can't disable it once enabled (although I suspect that might not be true).
Click to expand...

I just spoke to godaddy support. They said that to disable fast transfer once it's been activated with the registrar, you have to do it via afternic.

Which makes absolutely no sense.

Basically means that if you buy a domain and don't change the registrar you need to add it to afternic so you can see if fast transfer has been previously is enabled, then disable it, then remove it from afternic.

Absolutely ridiculous system...

Also does anyone see how you actually disable it in afternic? I see something saying that it's enabled, but no option to turn it off.
 
Surely it is not the case that any registrar will adhere to GoDaddy's instructions to transfer a domain out of someone's account without it being confirmed in the account they're taking it out of. In that case they could request a name even if nobody ever activated fast transfer. So that would render all domains with a registrar vulnerable to transfer without permission.
 
If you can price it - then I think a price of over $100k disables it from fast transfer - so maybe $100 mil and if someone really fancies it then let it go to a new home?
 
username said:
Surely it is not the case that any registrar will adhere to GoDaddy's instructions to transfer a domain out of someone's account without it being confirmed in the account they're taking it out of. In that case they could request a name even if nobody ever activated fast transfer. So that would render all domains with a registrar vulnerable to transfer without permission.
Click to expand...

I'm talking about if fast transfer were previously enabled. To disable it you have to do it via afternic.
 
getmein said:
If you can price it - then I think a price of over $100k disables it from fast transfer - so maybe $100 mil and if someone really fancies it then let it go to a new home?
Click to expand...

Slightly missing the point here, because the issue is that someone else has added the domain to their afternic account without your knowledge. So you wouldn't have the ability to set the price.

To do what you're talking about you would need to add it to your own afternic account and verify it, after which you can do what you like. Including just removing it from afternic (ie: by the time you'd got to that point, there's no need to set a really high value).

Obviously this is the hoop we have to jump through, and the one I've literally just been forced into doing to protect my domain, but the biggest issue is when you don't realise someone has added it to their afternic account.
 
baldidiot said:
I'm talking about if fast transfer were previously enabled. To disable it you have to do it via afternic.
Click to expand...
And then once cancelled on their side - nothing to worry about... Hopefully? Cause otherwise that would constitute resetting the domain up for fast transfer, which would only be possible on a per domain basis for the domain in question if you have it in your account. Not possible for someone who does not.
 
I'm saying that afternic can have a record on their end that fast transfer is enabled, but if it's not agreed to on the registrar end for that specific domain then it's meaningless, right?
 
You must log in or register to reply here.
Back
Top