I recently purchased a domain through a registrar which I won't name here. Within the first five minutes of logging in, I found a severe vulnerability that allows me access to all registration details of all users.

Simply put, I do not trust this registrar with any kind of business. But I'm unable to transfer the domain because, for some reason, it has to exist in its current state for 60 days. We're planning to launch the site this weekend - we can't wait 60 days. But I can not trust this registrar: if I found such a severe vulnerability in the first few minutes, how many more similar un-trustables will I find in those 60 days?

Is there a higher authority to whom I can submit a case to get my domain transferred to a different registrar?

1 Answer 1


If you have found a bug like that then Contact them immediately.

Is this a large company? If they fail to do anything name and shame them.

What is the TLD (.com or .co.uk etc)?

  • The TLD is a .com. My domain number is in the 9000's so I would assume they do have thousands of domains registered through them. I have contacted them and requested an immediate refund and transfer, as well as given them reproduction steps. It turns out not only could I view, I could also modify. (Obviously, the modifications made were ethically done and non-impacting.)
    – corsiKa
    Commented Oct 25, 2013 at 20:38
  • Potentially you could contact ICANN (I think they deal with .com) they may have procedures for dealing with this. Alternatively, and this is not a totally solid idea but you could forward the domain in "stealth mode" if they have that option and host the site under a new domain. What that means if you have domain xyz.com with this company, stealth mode will forward it to a new domain abc.co.uk If a user goes to xyz.com/about they will see that xyz.com url but they will actually be on the page abc.com/about. Then in 60 days, transfer the domain, remove stealth and SEO should be intact.
    – tim.baker
    Commented Oct 25, 2013 at 21:17
  • That should help protect you against any security woos you may have
    – tim.baker
    Commented Oct 25, 2013 at 21:17
  • I contacted the firm and reported the bug. I had a chat with the VP of Sales and Marketing who has released the lock on the record so I can transfer it at my leisure. (Well, when the new record gets propagated.) He's also refunding my purchase price as a "please don't write a blog post with our name in it" token gesture. :-)
    – corsiKa
    Commented Oct 25, 2013 at 21:47
  • Oh well that is very nice of them (with a hint of I would expect less)!
    – tim.baker
    Commented Oct 25, 2013 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.