Warning about letting your domains expire

marusia

Compromised Account
Joined
Oct 25, 2010
Messages
1,138
Reaction score
2,353
Hey everyone,

I just wanted to give everyone a little warning about something that you may or may not already know about. I registered an expired domain a few days ago and when I checked the catch-all email today, I noticed an email from Payoneer about a payment which was deposited into the account. Now this was not meant for me, so I just let them know through their contact page what happened, but if someone really wanted to, I am sure they could have been a little more malicious.

Because we are BlackHatters, most of us deal with a lot of "throw away" domains, which we use and abuse for a few weeks, and then we let expire without a second thought. Its just part of the game for us. But this habit can get us into a lot of trouble because someone else could come along later and register one of our domains that we tied to PayPal or Amazon or a Google account, and get access to a lot of our money and personal information. This is especially important to think about with PayPal, because they let you add multiple emails to your account.

So I urge you check your accounts. Check your PayPal, think about all of your important accounts or past expired domains, and if you may have tied those domain email accounts to anything important. Someone could be stealing clients, receiving affiliate commission on your behalf or who knows what else.

I am sure this is old news for a lot of people, but it was something I never even thought about until today, so I am sure there are others who don't think too much about it.


Here's another site I found saying basically the same thing:

Code:
http://techcrunch.com/2011/05/18/security-breach-heres-how-expired-domains-expose-you-to-embarrassment-and-theft/
I hope this helps at least one person!

Cheers,
Mary :)
 
Last edited:
Thanks for the reminder! I actually just had a domain expire last week and never removed it from my paypal account, it wasn't my main email on the account but still!
 
Why not purchase these 'thrown away' domains with a prepaid CC? That way, you dont have to worry about them 'ever again' in the future.
 
Why not purchase these 'thrown away' domains with a prepaid CC? That way, you dont have to worry about them 'ever again' in the future.

I think you didn't get the point. Let's say you register a domain example.com and create an email address using the new domain - [email protected]. Then you create accounts on different websites with this email and forget about it. After 1 year your domain has expired and somebody else registers it. Now the new owner can create the same email and use "forgot password" function on those websites and get access to your accounts.
 
I think you didn't get the point. Let's say you register a domain example.com and create an email address using the new domain - [email protected]. Then you create accounts on different websites with this email and forget about it. After 1 year your domain has expired and somebody else registers it. Now the new owner can create the same email and use "forgot password" function on those websites and get access to your accounts.

Ah I see what you mean.
The reason why I didnt think that way is because i dont use '@mydomain.com" for account registration. As many others recommend, i prefer going 'generic' or 'public' service.

I was thinking "Paypal" account when OP mentioned account creation (dont ask me why). That is why I thought even if the new user access my paypal account, they probably couldnt drain anything out of it, because the only thing thats attached to my paypal is a VCC - which my balance will probably be used up by then?

Just my 2 cents. Thanks
 
Back
Top