Marketo.com which is a very large marketing service had its domain expire. The Network Solutions registered domain held an expiration date of July 23, 2017 according to whois records. That day was reached and by July 25, 2017 name servers changed to PendingRenewalOrDeletion.com, standard practice for expired Network Solutions registered domains. That name server change is often what gets domain owners attention after failed email notifications of the pending expiration, well, because the website stops resolving, email stops working etc.
I’d bet the credit card on file for Marketo was expired and the reason an “auto renew” didn’t take place. Where the renewal emails went, potentially spam.
Now the crazy part of this story is, Travis Prebble, a self described geek, who is not associated with, nor did he have access to the Marketo.com domain name or account, RENEWED the domain! What? Travis stated he logged into Network Solutions, typing in the domain name and renewed it. He paid $73.98 to do so. $37.99 for the renewal and $35.99 for a “Reinstatement Fee” because the domain was past its renewal date.
I renewed your domain @Marketo . Hopefully things will be back up soon. pic.twitter.com/GIJaK7dekW
— Travis Prebble (@TravisPrebble) July 25, 2017
Yes, somebody with no actual access to the domain name renewed it! Wait a minute, What? That just seems crazy to me.
Based on a link on Network Solutions, called Renew Services: https://www.networksolutions.com/manage-it/bulk-renewal.jsp I typed in a known expired domain into the Renew Your Domain box that allows up to 200 domains and clicked Get Started. It prompts you to login and displays the domain you typed in and its expiration date or status.
So I logged in and had to click Quick Renew and re-enter the domain again, but then the following:
So I clicked the Renew button and:
I could renew Sovy.com by clicking the Secure Checkout button, a domain that is currently expired and on expired auction via NameJet. I do not own, nor am I associated with this domain in any way. Not my domain name. I tried again, with a different domain, also a known expired domain, Miho.com also on NameJet and not my domain name:
I could renew that domain as well… Different account number.
I could do some damage with this information and in no way should “anybody” be able to renew somebody’s domain name, nor be allowed to see the account number associated with the domain etc. Very troubling.
If I renewed Sovy.com and Mibo.com for an example, NameJet/Web.com/Tucows would be out $10’s of thousands of dollars that they likely would get for selling the expired domains on NameJet. My $147.96 would prevent that from happening for an example. It wouldn’t do me any good, as I wouldn’t “own the domains” but it would prevent them, at least for 1 year from doing it.
To note, I didn’t research what can be done with an “account number” at NSI but I’m sure one can do more with it, than without it.
Hat tip to CraftNames.com for the tip via Twitter.
WOW… That’s beyond DANGEROUS. Hope Network Solutions gets this taken care quicker than quick. Great find Jamie!
Hover allows anyone to renew a domain as well. However, displaying the domain’s account number seems like a horrible idea.
Ironically, I get @marketo.com emails from their sales team several times a month…
This has been possible for many years. About 5 yrs ago there was a domain we wanted to purchase and could not reach the owner so rather than let it expire and go to auction we renewed it to give us time to get in touch with the owner and make a deal to buy it. This strategy worked and we ended up with the domain name …. but we were shocked at our ability to do this and while it worked for us 🙂 don’t think it’s a good thing for Network Solutions to allow.
Get on customer chat with your domain name and account number in hand :-p
I think this is ok to allow. I had to renew a domain for the company I used to work because the previous guy left and he had it registered for 10 years, and even though it was not my job, I saw it was ready to expire. Who would even know the password etc. after that long especially since someone else managed it and left. Few stick around that long and if I had to jump through Netsol’s hoops first to renew something the delays would drive people away to other registrars. I know I moved all my names away from them for past hassles I had.
This has been available for years with different registrars ..I have done this before also.
Many companies have domains acquired via an acquisition and that have not yet been transferred so most registrar’s allow anyone to put down a credit card and renew a domain. But you do not get account login info or anything else. It’s not really a security issue, just a convince.