-
Security incident: ISF was recently accessed by intruders. Please change your password, and change it anywhere else you used it. Read more
www.stopsylviabrowne.com hacked?
- Thread starter Powa
- Start date
-
- Tags
- hacked stop sylvia browne
- Status
RSL's better half
RSL Groupie
- Joined
- Jun 3, 2007
- Messages
- 1,167
Ducky:
Robert has been having to deal with TONS of spam the last several months - someone in Germany, I think, has been sending spam using @StopSylviaBrowne.com in their return address. Could this have something to do with this attack?
Robert has been having to deal with TONS of spam the last several months - someone in Germany, I think, has been sending spam using @StopSylviaBrowne.com in their return address. Could this have something to do with this attack?
ExMinister
RSL Acolyte
- Joined
- Jul 11, 2007
- Messages
- 2,982
Might be a good question to ask Mrs. RSL.
I have quite a few of the articles saved as Word documents.Not likely, but I am unfamiliar with his accounts, how his email is set up, or where the godaddy registration was told to email things. These are questions you should ask those that are helping you directly, as I am not in the loop on this. I can't see how simple spam would do anything unless they managed to sneak a virus through that would keylog his passwords. This seems unlikely to me. Robert never struck me as the type to open attachments he's unfamiliar with or run windows without antivirus.
On a side note: People, hosting is not the issue. You can mirror the site 100,000 times over but if the DNS is wrong, then all the traffic garnered for the registered domain is now wasted. Even if the domain is a loss and a new one is put in place, mirroring will not do anything to change that. The data is safe, the site is still up. The internet just doesn't know the right address to point at because it appears to have either been lost or hijacked (my personal opinioon is hijacked.)
Thanks for the offers, but the focus here is to get the DNS fixed, not to mirror. I am sure those working on it are doing so diligently and will have some sort of solution soon.
Last edited:
I work for a global ecommerce company. It is not feasable to keep archive logs of things not required to stay in compliance for longer than x days. You *may* get lucky with access logs on a backup tape somewhere, but it's not a bet I would make.
ETA: To be clear, we have much less the global footprint in terms of datacenters and servers as godaddy. On the scale we're talking about, it's just not feasable to keep all logs for any length of time. I am part of a team that admins roughly 3700 unix (Solaris) servers in 7 datacenters worldwide and I know Godaddy is larger than my company.
Last edited:
LostAngeles
Penultimate Amazing
- Joined
- May 22, 2004
- Messages
- 10,109
Fairly close to me as well. I don't think that posting the address was the best idea myself, though.
So can we just confirm that, other than the discussion taking place here, there is someone or a group who is/are actively pursuing this through useful channels and we just need to be patient while they sort out what's happened??
If there's any idea of a timeframe can someone advise. I've currently removed my blog links to the domain but my site is not even a pimple on the internet's bum. If the solution is likely to take time, should other sites remove links where possible in order to shift the current site down in Google's results? (Or are there likely to be too many links embedded around the place (like every related discussion in JREF) for that to make any difference?
Also, if a solution may take time, would a mirror site prove useful to link to in the meantime?
If there's any idea of a timeframe can someone advise. I've currently removed my blog links to the domain but my site is not even a pimple on the internet's bum. If the solution is likely to take time, should other sites remove links where possible in order to shift the current site down in Google's results? (Or are there likely to be too many links embedded around the place (like every related discussion in JREF) for that to make any difference?
Also, if a solution may take time, would a mirror site prove useful to link to in the meantime?
erlando
Master Poster
- Joined
- Apr 23, 2007
- Messages
- 2,432
There hasn't been posted anything that isn't publicly available via a simple whois-request.
Yes.
No idea for a timeframe. But you've highlighted why the problem is more about the DNS than the site itself. Even if we were to shift to .NET it would take a long time to regain the traffic normality SSB has come to expect, and link repairs from so many sites would be difficult to orchestrate quickly.
No, because the timeframe is still short enough that whatever solution to be put in place will still just revolve around the site that sits out on RSL's host provider anyway. I'll let those that are taking care of this situation address further details, as I am not directly in the loop (though I have spoken with those taking care of this.)
That's where the libel lawyers come in. The press won't print any accusations of those particular things without assurances from a legal team that they're not actionable. Which would probably require a successful prosecution, that's the best evidence to back up a claim.
So, if that is what's happening here, would it be prudent for someone to file a police report?
Beeg Seestor
RSL Groupie
- Joined
- Aug 20, 2008
- Messages
- 73
Good Morning, Everyone -
Like all of you, I am beyond appalled that all of this is going on while Robert is unable to defend himself. I am very grateful to our JREF family for jumping on this. Unfortunately, I don't understand anything that is being discussed except phrases like "possibly highjacked" and particularly "scum bag". I would gladly add to the descriptive pool for this AH but I'm sure it would not please the mods.
If there is anything that any of the Lancaster's can do ...send letters or emails... anything, please let us know.
And again, thank you all for the help and support you continue to give to Robert, Susan and the rest of the Lancaster's. I am very proud that Robert has affected so many lives in such a positive way. Who knew growing up that the annoying little rug rat would have such an impact! All too often I get weepy eyed reading your posts. I hope to meet some of you some day.
A very grateful big sister,
Janie
Like all of you, I am beyond appalled that all of this is going on while Robert is unable to defend himself. I am very grateful to our JREF family for jumping on this. Unfortunately, I don't understand anything that is being discussed except phrases like "possibly highjacked" and particularly "scum bag". I would gladly add to the descriptive pool for this AH but I'm sure it would not please the mods.
If there is anything that any of the Lancaster's can do ...send letters or emails... anything, please let us know.
And again, thank you all for the help and support you continue to give to Robert, Susan and the rest of the Lancaster's. I am very proud that Robert has affected so many lives in such a positive way. Who knew growing up that the annoying little rug rat would have such an impact! All too often I get weepy eyed reading your posts. I hope to meet some of you some day.
A very grateful big sister,
Janie
Maybe not, but the address is freely available to anyone who wants to look, so reposting it here is going to make scant difference.
M.
This depends on what Spec finds, and we haven't gathered enough information to determine my speculation to be accurate. Given facts like the payment for this domain went through and was renewed, it would seem likely, and if it turns out to be a hijacking and not a monumental cock-up by Godaddy then it may be prudent to file a police report.
Again, this could all be a misunderstanding, it could be fraud/identity theft. Those investigating will be able to tell more than I.
Big Hi from Melbourne, Australia, Beeg Seestor
I personally hope Robert's improvement proceeds apace. That's the main thing right now. I understand that the issue of the SSB site is being addressed by responsible people, and I wish them well.
Best regards,
M.
chillzero
Penultimate Amazing
- Joined
- Dec 11, 2002
- Messages
- 15,547
Currently, the mods will probably overlook that for that reason.
If you read Darat's notice about the revised MA and FAQs, you will see that in future, it would be removed.
Information like this should meet a few criteria for publishing here. It should already be publicly available - which it is - but also it should be pertinent and important to the discussion at hand - which it is not. We don't want to see that information being used for wrongdoings (no more mentions of calling around, for example).
Anyway - there's a thread in Forum Mgt on this, if you need any further clarification.
Hopefully this situation with the website will be resolved quickly, and even better if the address can be retained. I just wish I wasn't so technophobic, so I could be of some use.
krelnik
Graduate Poster
No, that's fairly unlikely. Spammers use spoofed origin email addresses to get past "whitelist" spam filters. (A whitelist only allows known email addresses or domains to get through). Many harvest addresses they can find on the web in an attempt to use addresses that are already whitelisted.
A bunch of skeptic sites including whatstheharm.net and randi.org were recipients of "bounced" spam messages recently. (Mine all happened on October 1st and October 3rd, with none since).
Its vaguely possible this was some sort of attempt to discredit the skeptic movement, but more likely it was just random. Probably one of the spammer's web crawlers that harvests addresses just happened to get into some skeptic sites all at once.
logical muse
LogMu
- Joined
- Oct 24, 2005
- Messages
- 2,050
Clues that the domain name was transferred or renewed, rather than lapsed/reregistered:
The current expiry date (21-aug-2009) is an anniversary of the creation date (21-aug-2006). If a domain name registration lapses, then it's back on the market for anyone to register. In that case, the new registration has its own start date, with a corresponding expiry date. If the domain name's registration had lapsed, then one way this new expiry date could be possible is if it was reregistered on the day it lapsed. Read on to learn why this can't happen. The only way this could happen is if it was renewed before expiry, or up to 30 days after expiry during the "redemption period", or transferred.
I don't have any experience with this domain name registrar, godaddy, but I own a lot of domain names and there is a period of a few weeks beyond the expiry date in which I can renew a registration. During this time, the domain name is still mine. If I haven't renewed it after this period, I lose it and the name is back on the market. It's important to understand that this does not happen on the date listed as the expiry date. It's back on the market 30 days after the expiry date.
At that point, several weeks after the listed expiry date, if someone wants it, they can pay the $10 and register it, but the registration will be from that date, and for a year or two hence. It is not registered from the previous expiry date, and the new expiry date will not be an anniversary of the previous expiry date.
In fact, ICANN have a "redemption period" policy, formalising the process I outlined above.
http://www.icann.org/en/registrars/redemption-proposal-14feb02.htm
It allows the owner of a domain name up to 30 days after any other grace period, or expiry or deletion of a domain name, in which to recover it. In this case, recovery is by paying a renewal fee, plus a service fee.
Note that it's a renewal fee, not a reregistration fee. This means that the registration is renewed, for a period of one or two years, taking effect from the listed expiry date. In this case, the new expiry date will be an anniversary of the creation (and expiry) date.
According to the ICANN page:
This is usually done by faxing a note saying that you are the original registrant.
Also, please note that the "updated date", 23-oct-2008, which many of you are excited about, is meaningless. Updated means any update to the registry database, such as changing the lock status, setting a new DNS, changing the email address or phone number of the admin contact for the domain name, etc. It's not necessarily related to the renewal date.
It doesn't look like a renewal, since it's now in a different name.
It doesn't look like a lapse/reregistration, since the new expiry date is an anniversary of the creation date.
It looks like a transfer.
In summary:
The new expiry date is an anniversary of the creation date.
This does not occur when a domain name's registration lapses and is then reregistered.
It happens when a domain name's registration is renewed, but then the owner doesn't change.
It happens when a domain name's registration is transferred, in which case there will be a new owner.
Of course, godaddy.com, the registrar in this case, may do things completely differently. Maybe they don't honour the redemption period. That would be bad.
The current expiry date (21-aug-2009) is an anniversary of the creation date (21-aug-2006). If a domain name registration lapses, then it's back on the market for anyone to register. In that case, the new registration has its own start date, with a corresponding expiry date. If the domain name's registration had lapsed, then one way this new expiry date could be possible is if it was reregistered on the day it lapsed. Read on to learn why this can't happen. The only way this could happen is if it was renewed before expiry, or up to 30 days after expiry during the "redemption period", or transferred.
I don't have any experience with this domain name registrar, godaddy, but I own a lot of domain names and there is a period of a few weeks beyond the expiry date in which I can renew a registration. During this time, the domain name is still mine. If I haven't renewed it after this period, I lose it and the name is back on the market. It's important to understand that this does not happen on the date listed as the expiry date. It's back on the market 30 days after the expiry date.
At that point, several weeks after the listed expiry date, if someone wants it, they can pay the $10 and register it, but the registration will be from that date, and for a year or two hence. It is not registered from the previous expiry date, and the new expiry date will not be an anniversary of the previous expiry date.
In fact, ICANN have a "redemption period" policy, formalising the process I outlined above.
http://www.icann.org/en/registrars/redemption-proposal-14feb02.htm
It allows the owner of a domain name up to 30 days after any other grace period, or expiry or deletion of a domain name, in which to recover it. In this case, recovery is by paying a renewal fee, plus a service fee.
Note that it's a renewal fee, not a reregistration fee. This means that the registration is renewed, for a period of one or two years, taking effect from the listed expiry date. In this case, the new expiry date will be an anniversary of the creation (and expiry) date.
According to the ICANN page:
This is usually done by faxing a note saying that you are the original registrant.
Also, please note that the "updated date", 23-oct-2008, which many of you are excited about, is meaningless. Updated means any update to the registry database, such as changing the lock status, setting a new DNS, changing the email address or phone number of the admin contact for the domain name, etc. It's not necessarily related to the renewal date.
It doesn't look like a renewal, since it's now in a different name.
It doesn't look like a lapse/reregistration, since the new expiry date is an anniversary of the creation date.
It looks like a transfer.
In summary:
The new expiry date is an anniversary of the creation date.
This does not occur when a domain name's registration lapses and is then reregistered.
It happens when a domain name's registration is renewed, but then the owner doesn't change.
It happens when a domain name's registration is transferred, in which case there will be a new owner.
Of course, godaddy.com, the registrar in this case, may do things completely differently. Maybe they don't honour the redemption period. That would be bad.
Last edited:
I apologize, then. Won't happen again.
My intention wasn't to publish the address, but to show the connection between "Boris" and "Cathy." In hindsight, though, I should have kept my fingers off the keyboard.
M.
Thanks muse. Can you comment on the link I posted earlier in which it appears GoDaddy had the domain up for auction?
Domain Name: stopsylviabrowne.com
STOPSYLVIABROWNE.COM
Description:
Time Left:
Start Time: CLOSED
End Time: 09/25/2008 11:52 AM (PDT)
Sale Type: Auction
Category(s):
Includes Website: No
Perhaps the "Start Time: CLOSED" is significant? It just looks odd.
Last edited:
- Status