Is Spyware Stealing Your Domain Names?

Share This

A friend recently looked into buying a domain name. She typed the domain into Internet Explorer and nothing came up. She typed the domain name into the search box at GoDaddy.com and the domain was available. But she didn’t buy it right away.

When checking the domain again the next day we saw that the domain had been registered by someone else just a few hours after she had searched for it. Because the name did not contain any English words (or real words in any language) we knew that it could not have been a coincidence.

My first thought was that GoDaddy had stolen the domain name and was kiting it — which would have been hypocritical because the CEO of GoDaddy had written a criticism of the practice on his blog. Further research indicated that domains were being stolen even without typing them into GoDaddy, so that ruled out GoDaddy.

The ICANN Wiki explains "domain kiting" or "domain tasting":

Because there is a 5 day grace period which for returning and receiving a refund on a domain, registrants are utilizing this to register domains, test them for traffic and keep the domains which are monetizable. This approach has the potential to be particularly lucrative and low risk because these businesses can test the residual traffic of a domain name before paying for it. In addition, the registrant can benefit from any residual income from the traffic received during the five day period even if the domain is refunded.

Sure enough, 5 days after the domain was stolen it was released and my friend was able to register it. We had already begun to investigate the issue of who stole her domain name.

The company that appears to have stolen her domain name and “tasted” it is called UltraRPM.com.

UltraRPM Whois

This is a screenshot of their home page:

UltraRPM

The UltraRPM.com home page says:

UltraRPM is a next generation, predictive data analysis company. UltraRPM seeks to use its proprietary algorithms to identify and create higher ROI online marketing opportunities.

Our products are still under development so please check back for more information once we have launched.

Internic shows that UltraRPM does business as Metapredict.com, but Metapredict.com does not resolve when typing it into a browser.

Metapredict.com

We began testing other domain names to see if they would be stolen and "tasted". For the first test, I booted up Damn Small Linux and and typed a domain into GoDaddy’s search box. I wanted to try it on a clean operating system. The test was not 100% clean though because my friend had also typed the domain into the address bar of Internet Explorer on her computer. Sure enough, the domain was registered by UltraRPM a few hours after searching for it.

In my research I came across a blog post on domaintools.com about stealing domain names. The article mentioned that ISPs sell Non-eXistent Domain (NDX) data to people. I began to suspect that my ISP might be stealing the domain names.

The DomainTools article didn’t seem to think that spyware was a common issue:

For any browser plug-in that is free, ask yourself why is it free and whether they send data back to a server. Avoid software on computers that reports data back to the Internet. Of course this is the most obvious advice, but I need to mention it. The likelihood of someone datamining domain name research from spyware is small. If they have spyware on your computer, it’s more likely they are going after credit cards numbers and social security numbers instead of domain research.

To test this, I typed a few non-existent domain names into my browser in Linux on the same Internet connection. Those domains were not registered and kited like the previous ones. That seemed to indicate that the ISP was not responsible. I recommended that my friend run AVG Anti-Spyware which is the strongest spyware/trojan scanner that I’ve found. AVG-Anti Spyware found many problems on her computer including a trojan. I didn’t see the list of scanned items though so I don’t know exactly what spyware was on the computer and whether it could have been responsible for stealing her domain names as she typed them into the address bar of Internet Explorer.

The original suspects in this case were GoDaddy, my ISP, and spyware. GoDaddy and the ISP seem to have been eliminated through my non-scientific experiments. At the moment I am suspecting that spyware may have been the problem in this case.

It would be great if readers could perform similar tests on their own computers. I recommend running your tests as follows:

  • Experiment with only one domain at a time
  • Don’t use dashes in the domains
  • Make up a domain that sounds like a brand name, possibly with a component that is not a real word.

The only other mention I’ve found of UltraRPM is on an article about companies who are exploiting the popularity of Madeleine McCann’s Web site (a child abducted in Portugal).

If you find anything interesting or have more information about UltraRPM and Metapredict, please leave a comment below. I’m also interested in more information about domain tasting and what is being done to stop it.

UPDATE: Thanks for the many comments. If this has happened to you and you are using Windows, please run the free trial of AVG Anti-Spyware on your computer and send me the log of any malware that the program finds. Finding a common piece of spyware (or lack of one) across many incidents it might shed some light onto this issue. To contact me, please use the contact form.

UPDATE: I’ve written additional articles about Metapredict.com and UltraRPM.

117 Comments

  1. Richard Curry Mozilla Firefox Windows
    Posted May 22, 2007 at 10:24 pm | Permalink

    I’ve actually had this same thing happen and the same company registered the domain..

    I had searched to see if the domain was taken through http://ajaxwhois.com/ and they are also linked up through godaddy, so I’m wondering if this is what happened also.

    I actually registered the domain and 2 days later they somehow ended up with it? I even paid for it, so i’m working with my hosting company now to see what happened.

  2. Posted May 28, 2007 at 5:01 pm | Permalink

    I just had this happen to me, same company.. I actually found this post by googling for Metapredict. I’ve had my eye on a domain name for a few weeks now, but I do all my searching from my own server with ‘whois’. Last weekend I went to register it with GoDaddy, but as a result of a bank screwup I wasn’t able to complete the transaction. Monday morning I gave my bank manager an earfull and got the account unlocked. When I went to register my domain, I saw that these crooks had bought it less than 24 hours after my initial (failed) attempt. I can only hope they will release it after their 5 day trial is up, because I’ve already got my server ready to roll and paid for design work featuring the domain name.

    I found a link here: http://www.webhosting.info/registrars/reports/METAPREDICT.COM

    It shows the number of domains this company scoops up PER DAY, it’s in the hundreds of thousands. I really think this domain tasting business should be put to a screeching halt ASAP. It’s turning the internet into a parking lot.

  3. Posted May 30, 2007 at 10:28 pm | Permalink

    The same thing just happened to me. The same company. Any recourse that we can take?

    This is frustrating.

  4. Posted June 1, 2007 at 2:44 am | Permalink

    If all works out well (as in no traffic to the domain) - they might just drop it and you can get your intended domain back.

    Anyway, the number of domain permutation is only limited to our creativity ;).

  5. Lapalissiano Mozilla Firefox Windows
    Posted June 5, 2007 at 7:26 pm | Permalink

    I registered my domain at godaddy.com, but I made a typo and registered the wrong name. The next day ultrarpm.com has registered the correct domain.

  6. downforce Mozilla Firefox Windows
    Posted June 8, 2007 at 6:14 am | Permalink

    Hrmmm very very interesting. I was looking at a domain name last week. Most of my searching was done through melbourneit.com.au but I’m sure I used one or two other “domain providers” who let you search.

    OK, I’ve checked some other names I was interested in that I know I only used melbourneit.com.au to check for and they are stlil available, so I’d safely rule them out (for now).

    Anyway, that name is now registered to this bunch.

    Luckily I decided it was a crap name and not going to use it, but little to say the practice is atrocious!

  7. Michael Mozilla Firefox Windows
    Posted June 8, 2007 at 5:33 pm | Permalink

    Same exact thing happened to me. I used the whois on Godaddy. Find out the name was available yesterday. Today it is taken by metapredict. Hope its released in 5 days.

  8. Sarah Mozilla Firefox Windows
    Posted June 8, 2007 at 6:30 pm | Permalink

    I checked a name through godaddy yesterday, went to buy it today and it is gone, registered to MetaPredict.
    I checked it last week through a NZ registrar and it was available.

  9. Joseph Internet Explorer Windows
    Posted June 9, 2007 at 10:55 am | Permalink

    this happened to my client today and metapredict got it. I am not sure if my client searched it through godaddy but there sure seems to be one common denominator in the posts here. it may be that godaddy is doing it or they are being exploited by a hole in their system or their server traffic activities are being scanned.

  10. Posted June 9, 2007 at 12:03 pm | Permalink

    Another possible common denominator is that people are using Windows machines with spyware installed.

    It would be great if you could all scan your computers for malware with AVG Anti-Spyware and email me the names of any detected malware. If the problem is spyware-related, we might be able to find a common spyware application between the incidents.

  11. Spiked Internet Explorer Windows
    Posted June 12, 2007 at 9:16 am | Permalink

    Hey guys, I had this happen to me too ofcourse, then I saw this thread. I searched around on my own and I believe I have found the culprit. Not spyware persay, it seems to be adware. A software package known to trendmicro as “Best Offers” and labeled adware seems to auto install itself using javascript from some websites. This software can also be installed to your machine thru a couple of different trojans. The “Best Offers” adware seems to be harmless at first glance, but it’s actually quite hard to get rid of; I don’t remember where I found all of those files. My pc at work had it, and so did my machine at home. After having my domain snatched up, I tested some other extensions, with and without the “Best Offers” adware on my machine, and the ones i ran a whois on after the removal were not snatched. This could be coincidence, ofcourse, many ppl need to look into this for it to be determined as THE cause. Also a side note: stay away from free services that will let you know when your domain is available. Yup, a legitimate domain registering company offered me that service after ultrarpm had taken my domain, and that company ended up registering the domain to themselves without ever letting me know it was available. Good luck friends, and have your servers and credit cards ready when using any domain register!

  12. Spiked Internet Explorer Windows
    Posted June 12, 2007 at 9:18 am | Permalink

    PS: I did not use GoDaddy for the domain that was snatched, however, I did use them to register a different domain later after my original domain was stolen twice.

  13. Brian Internet Explorer Windows
    Posted June 12, 2007 at 2:26 pm | Permalink

    I used the browser on my blackberry to see if a name was available. I am certain there is no spyware on my blackberry.
    I checked it on Godaddy so I can only assume that Godaddy is somehow responsible for this, or their server has been compromised and these guys are scanning the name queries and just registering any name that someone checks.

    I would love to know if there is any legal recourse.

  14. Mark Internet Explorer Windows
    Posted June 22, 2007 at 5:39 pm | Permalink

    Over the past days I had the same experience. MetaPredict “stole” my name, that I had requested just before (but the paper process took too long). I did not use any of the sites mentioned above and (as far as I know) my PC is not infected with Spyware. The only things I used were google and a domain-name-checker.

    Wouldn’t this be something the ICANN should take action into? Hundreds of thousands of names claimed a day…. That cannot be correct. Unless they pay for it (do we know?) this seems a strange situation.

  15. ginger Internet Explorer Windows
    Posted June 26, 2007 at 8:58 pm | Permalink

    I have a really horrible situation. I purchased internet advertising from the yellow pages. They published an ad with “my” web address in it. They did not, however, purchase the domain name. MetaPredict purchased it and has a gay porn site there. Thus, people going to “my” website from my yellow page ad end up at this porn site. Of course, I’m dealing with the yellow pages. But, I am desparate to get this site down. Any suggestions?

  16. Posted June 27, 2007 at 9:42 am | Permalink

    Ginger,

    I’m not sure I understand your situation. If the yellow pages site published a domain that you don’t own, why not just have it removed from your yellow pages listing?

  17. Posted June 29, 2007 at 6:57 pm | Permalink

    Unbelievable. Now I look like a total prat having told my client I have purchased a domain name we agreed on, not got round to it, and now UltraRPM have it. Roll on 5 days time or else I’m in trouble!!

  18. ginger Internet Explorer Windows
    Posted July 3, 2007 at 9:19 pm | Permalink

    I’m sorry, I should have explained that this ad, with this website, is published in the telephone book. The new book will not come out until April, 2008. However, I have been in contact with an internet attorney who is advising me regarding action I may be able to take as the website name is my common law trademark. We’ll see.

  19. pat Safari Mac OS
    Posted July 4, 2007 at 2:07 am | Permalink

    Exactly the same thing happened to me. I rabn a search for the name on Godaddy then went to my hosting company to register the name. During the registration process the name was taken by UltraRPM. I’m a Mac OS X user ; so it’s unlikely I have any spyware or trojans.

  20. Mehaf Mozilla Firefox Windows
    Posted July 12, 2007 at 10:33 am | Permalink

    They stole missyourob.com two days ago - obviously in light of everyone scouring the internet for hidden sites for the new “Cloverfield” film. I’m just glad I didn’t want to purchase it by some chance. Dirty mongrels.

  21. Joseph Internet Explorer Windows
    Posted July 20, 2007 at 9:13 am | Permalink

    They did this again to my client today. Many do this but how can you deal with it

    1) DONOT CONTACT THEM - EVER
    2) NEVER VISIT THE DOMAIN WEBSITE
    3) WAIT FOR 5 DAYS FROM REGISTRATION DATE (WHEN THEY DELETE IT)
    4) REGISTER THE DOMAIN IMMEDIATELY WHEN IT IS DELETED

    *Cross your fingers that they delete the domain name after 5 days. 98% do.

    These are common obvious tactics of these registrars who abuse the deletion grace period. They should be penalized by ICANN and prevented from deleting domain names so they go bankrupt or better yet cancel the registrar’s accreditation (for abuse of resources) if they decide to step on other people’s intellectual property (we thought of the domain first, right?).

  22. Posted August 3, 2007 at 10:31 am | Permalink

    2 minutes after I asked about the availability of above-named domain and got -already registered- as an answer, it was registered in the name of …. MetaPredict ! The whois-search made this perfectly clear. Such unfair buggers should be expelled as an offical registar by the ICANN. I put in already a complaint at its ombudsman and am (very) interested in his (serious ?) reply.

  23. SKD Internet Explorer Windows
    Posted August 3, 2007 at 4:40 pm | Permalink

    This just happened to me with GoDaddy. A company in the Caribbean now owns the domain name. Tried calling and emailing them but no answer.

  24. dana Internet Explorer Windows
    Posted August 3, 2007 at 5:33 pm | Permalink

    this is wrong, just happened to us also. Don’t know why (didn’t use godaddy)
    how can we stop this? is it legal?

  25. Helen Pang Mozilla Firefox Windows
    Posted August 5, 2007 at 9:52 am | Permalink

    I’m facing the same thing too, but I’m more serious as there were some problems from the previous registration, and the domain failed to register, now it was taken by Metapredict, I’ve contacted them several times, +1-626-796-1004, but no one picking up, it went into auto answering machine. I’ve emailed to domain@anondns.org as well, but no one replied, the domain name was registered at 2nd July 2007. My customer needs it very urgently, I don’t know what to do now, anyone please advice how to get in touch with them? Thanks.

  26. paul Safari Mac OS
    Posted August 6, 2007 at 1:49 pm | Permalink

    companies like metapredict are a cancer of the internet. the same thing happened to me when i checked if a domain was available then it was owned by metapredict. the powers that be should put a stop to this evil practice and heavy penalties and fines should be administered. the internet should be a liberator of people and these cancerous companies removed

  27. gr8pop Internet Explorer Windows
    Posted August 10, 2007 at 8:01 am | Permalink

    Just happened to me yesterday. I registered a unique business domain name (that my search at GoDaddy indicated was available) with a rep at GoDaddy. He made a “typo” when he registered the name and by the time I caught it in the confirmation letter from GoDaddy, my actual unique business domain name (that I had searched for and was available) was NO LONGER AVAILABLE. It had been registered several hours after GoDaddy screwed up the spelling. The name was snagged by Metapredict.com (AKA UltraRPM.com).

    What enables these crooks to remain in business???

  28. Deven Mozilla Firefox Windows
    Posted August 13, 2007 at 3:01 pm | Permalink

    Actually, they register domains for private parties. They are extremely reasonable about returning domain names that have been registered before. If you email them, they are one of the only companies out there that are willing to help you.

  29. Posted August 13, 2007 at 3:56 pm | Permalink

    Deven,

    Are you talking about metapredict.com / ultrarpm.com? They appear to be stealing people’s domain names just after they people type them into computers.

    Do you work for them? If you know something specific about the company, please be specific.

  30. hanspeterwurst Mozilla Firefox Mac OS
    Posted August 15, 2007 at 9:13 am | Permalink

    you houldnt believe deven. seems like he’s related to the company. he posted the same thing here:
    http://www.techchee.com/2007/07/19/spyware-steals-domain-name/ultrarpmcom-aka-metapredict-steals-unregistered-domain-names/

  31. Posted August 15, 2007 at 9:25 am | Permalink

    hanspeterwurst,

    Thanks for catching that and pointing it out.

  32. Chaz Mozilla Firefox Windows
    Posted August 16, 2007 at 8:38 am | Permalink

    It seems a lot are suspicious of godaddy. FWIW I registered my .com domain with them and have not seen anything out of the ordinary.
    I used their search to check a couple domains, discussed them with a friend and then decided which one a day or two later.
    However I don’t use IE, my AV updates and scans daily and spyware/adware scans are twice per week. I run “startuplist” and HiJackThis twice per month on all my boxes.
    I also sit behind a firewall that denies all traffic unless specifically allowed in my ACL.
    The PC I used to register my domain mentioned above is:
    WinXP using FF 2.0.0.6
    The only addons I have are user agent switcher and SU.
    I only save my AV results for the current month but checking those show no threats or infections yet this month.
    Yeah ok, so I’m a paranoid geek….sue me :P

    My best guess? This problem is due to spyware/adware/trojan rather than godaddy.

  33. Chaz Mozilla Firefox Windows
    Posted August 16, 2007 at 9:14 am | Permalink

    I just forced my spyware scans and my AV just ran showing no issues on either.

    I went directly to godaddy and searched for two .com TLD’s I have been debating registering and they are available at this time.

    We shall see what tomorrow brings.

  34. Yo Deho Mozilla Firefox Mac OS
    Posted August 16, 2007 at 2:52 pm | Permalink

    I’m having the same problem. Checked godaddy for a domain. Free :) A few day’s later I tried to register it. And guess what…Metapredict.com registered the domain. (I’m working on a Mac by the way)

  35. Chaz Netscape Navigator
    Posted August 18, 2007 at 9:55 pm | Permalink

    Well I just checked them again. Third time actually and they are still available.

    First domain was as not even a real word (it is a SN I used to use on IRC) and the second one was three small words in a sort of catchy phrase.

    This makes me feel more comfortable about having my domains with godaddy.

  36. Justin Mozilla Firefox Windows
    Posted August 20, 2007 at 10:39 pm | Permalink

    You may add me to this list of people that metapredict has taken a domain name… but I think because I checked a name out, just prior to the 5 day deadline, they went ahead and really registered it… to keep me from getting it… because it makes it look like it is a wanted domain now… Piece of crap company!!

  37. Chaz Mozilla Firefox Ubuntu Linux
    Posted August 22, 2007 at 9:09 am | Permalink

    I just checked both domains again and both are still available. I am convinced this has nothing to do with godaddy and is a spyware/adware issue.

    No offense meant but those of you who claim “I am a Mac user” and that makes you immune to these things, please think again.

  38. Posted August 22, 2007 at 9:13 am | Permalink

    Chaz,

    I agree, and I don’t think that GoDaddy is the reason that this is happening.

    GoDaddy’s Office of the President recently contacted me with the following statement:

    “We understand your concerns regarding this issue. We have made ICANN aware of the problem several times as well. Unfortunately, it is difficult to determine exactly from where the information used to register names for this purpose actually comes. Whois queries involve multiple parties - the originating site, the registrar (if different), and the registry.

    We can tell you that GoDaddy.com is no way associated with Metapredict.com or UltraRPM dba. However, we cannot comment on this practice with any further details.”

  39. Posted August 23, 2007 at 7:22 am | Permalink

    I’m another victim. In my case, I checked domain name availability through streamline.net. I checked again today (3 days later) and found the name registered by metapredict - all I can hope is that it’ll be released after the 5 days. I’ve run an AVG spyware scan and found several tracking cookies but no malware. Could tracking cookies provide this info to metapredict?

  40. Chaz Mozilla Firefox Windows
    Posted August 25, 2007 at 8:19 pm | Permalink

    Sorry for the off topic post (sort of) but relying on one spyware removal tool is insane. I have seen too many times that running a different one will pick up what the first one missed.

    Used regularly on my machines;
    Spybot, Adaware, Startuplist and HiJackThis.

    Update and scan with AV daily!

  41. Posted August 29, 2007 at 6:32 pm | Permalink

    The odd statement above from the President of Godaddy is that he ends the statement with “…However, we cannot comment on this practice with any further details.”

    We cannot comment on this practice? How about condemning the practice outright. This is either poor communication or they do have something up their sleeve. I don’t use godaddy.com to search for domains anymore because it happened to me about a year ago. I registereed gamepicasso.com, and then I wanted to register gamepicaso.com with a single “s” and it was gone the next day. Sheesh!

  42. Alex Mozilla Firefox Mac OS
    Posted September 7, 2007 at 9:14 pm | Permalink

    I am on a mac and despite what a previous poster said, there simply is not much spyware for mac, I used namecheap.com to look for it and BAM you know who got it a day later. I don’t blame the scumbags really, They can’t help being scummy theives, it’s who they are.

    I blame ICANN. If your apartment is infested with rats, you can’t rightly blame the rat for being a rat. It’s the landlords fault for not getting rid of them.

  43. Alex Mozilla Firefox Mac OS
    Posted September 7, 2007 at 9:39 pm | Permalink

    One further note. Not to defend those dirtbags… but contrary to what some people say, they don’t actually steal anything. You decided you didn’t want it and they snatched it (ok the claims on here of them snatching it WHILE you are trying to register it aside)

    None the less. I wish someone would write a bot that would check say a couple hundred nonsense names at a time (I know they block that practice but hear me out) and then visit the site repeatedly for 5 days, hopefully with a dynamic IP. Then they would buy up all those nonsense and worthless names. That would serve em right. Just dreaming out loud i guess.

  44. Posted September 8, 2007 at 11:10 am | Permalink

    Not to defend those dirtbags… but contrary to what some people say, they don’t actually steal anything. You decided you didn’t want it and they snatched it

    They appear to be stealing business intelligence from your computer. It is information that no one should have access to. Some people don’t buy domains right away, but like to sleep on it. No other company should have access to that information.

  45. Alex Mozilla Firefox Mac OS
    Posted September 9, 2007 at 8:24 am | Permalink

    That’s only if they are indeed getting it from your computer.(they didn’t get it from my mac)

    If they are getting it from the registar then it is just shady. Unless the site promises you some sort of specific privacy about what your are about to enter, your entry in that text box can be used by them any way they like and it’s not stealing.

    It’s just a very scummy practice. Just cuz I don’t think it technically qualifies as stealing doesn’t mean i don’t think it is a dirtbag practice.

  46. John Jay Mozilla Firefox Windows
    Posted September 17, 2007 at 2:27 pm | Permalink

    Is there any movement afoot to remove the 5 day grace period? This was originally intended, I think, for the more innocent days when people registered domains and maybe made mistakes or changed their minds or whatever. Instead, it’s turned into a 5-nights-free motel that displaces regular consumers.

    Perhaps this is out of scope but I was wondering if anyone is keeping up with this policy. Thanks.

  47. Don Mozilla Firefox Windows
    Posted September 20, 2007 at 6:17 am | Permalink

    Same thing happened to me. Searched for availability of a domain name for a client and a couple of days later UltraRPM had it. I would like get back at these guys and run a bot on an infected machine and run up the domain registration into the 10’s of millions. Someone ie.the US Gov’t should step in….

  48. Katie Internet Explorer Windows
    Posted September 22, 2007 at 8:01 pm | Permalink

    The same thing happened to me and I was using Register.com.

  49. julia Mozilla Firefox Windows
    Posted September 27, 2007 at 1:22 am | Permalink

    they stole mine as well, but my hosting account deleted my domain by mistake ,without my permission, so if dont get It back I will sue them as my name was very very importnat for my business.
    Unfortunately they put a lot of bad content where my site used to be so they will probably not release it.

  50. Posted October 8, 2007 at 8:39 am | Permalink

    I cannot stop google ads from running on my site from the same company. You can block URLs in google adsense, but they have some sort of re-direct so you can’t indentify the url and the ads still run all over my site.

    The ads are for a sweepstakes and they dont offer any sweepstakes.

  51. Dan Safari Mac OS
    Posted October 16, 2007 at 2:21 pm | Permalink

    I just had the same thing happen to me, not more than 2 minutes after doing a lookup. My circumstances:

    - I’m using OS X and an open wifi network
    - I used GoDaddy for the lookup
    - whois shows the domain was registered via centralregistrar.com aka domainmonger.com
    - there is no contact data on the whois entry and no nameserver: “Domain not found. Code FW-1: Whois data not currently available for “. I’m assuming it hasn’t propagated yet.

    This is absolute bullshit. I’ll be looking again in 5 days and registering it IMMEDIATELY.

  52. Posted October 16, 2007 at 5:01 pm | Permalink

    Hey, fellow SEOer here. Just happen to me today damn. LOL, it’s an 8 letters 2 words domain. I think this could be because I left a tab for Domainbank.com open with 7 other domains that I unintentionally refresh every time I load Firefox??? The thing is, though, MetaPredict only register the 8 letter domain, when there are 3-4 other 2-words domains with 10-12 letters in the batch.

    Hmn…This has never been a problem to me, since I check domains in batch. I guess now I’ll try what I did before to see if they register this fake batch =P…Will see…

  53. Netochka Internet Explorer Windows
    Posted October 19, 2007 at 11:05 pm | Permalink

    I found this page by looking up MetaPredict. I was researching them because I typed in 6 domains names last night to see if they were avaialble. I went back to register one today only to find that Metapredict registered it today! Ithought it was strange because there was nothing special about the domain name. So, After finding this page, I tped in the other domains I researched last night only to find that MetaPredict registered them all today!!! Unbelievable!

  54. Posted October 27, 2007 at 2:00 pm | Permalink

    they are stealing my domains i was searching for domain and after few days they take it the are bad ppl damm thm

  55. DCP Mozilla Firefox Windows
    Posted October 31, 2007 at 7:31 am | Permalink

    This is terrible. The same thing happened to me. I told a client to go to my godaddy reseller account (branded with our company name) to look for some domains. We discussed several and he was planning to buy one, but you know the story.

    The worst part was that the godaddy reseller account is branded with our company information and this makes us look real bad. While there isn’t proof that this is godaddy related it seems from numerous sources that the vast majority of people having this problem were using godaddy.

    So what do we do? Does anyone know of a safe way to look up domains? Is dnsstuff.com safe? Any other ideas?

  56. Posted October 31, 2007 at 11:51 am | Permalink

    So what do we do? Does anyone know of a safe way to look up domains? Is dnsstuff.com safe? Any other ideas?

    I’m not sure if it’s 100% safe, but I use http://www.pcnames.com/

    If the domain that I want is available I buy it immediately. I don’t search unless I am ready to buy. It is worth the $6 investment to guarantee that you will not have the domain name stolen.

  57. Posted November 2, 2007 at 11:30 am | Permalink

    yep…it just happened to me again — also after checking availability with GoDaddy. I wouldn’t put anything past those slime dogs. Bob Parsons talks a good game but his company doesn’t practice what he preaches; at least not in my personal experience.

  58. Metapredict Is Evil Internet Explorer Windows
    Posted November 9, 2007 at 12:07 pm | Permalink

    These dirtbags just nabbed the domain name I was about to register after looking it up a few days ago.

  59. David Internet Explorer Windows
    Posted November 11, 2007 at 2:47 pm | Permalink

    Well, the same just happened to me. The same company snatched the domainname I was looking into. But I didn’t use godaddy, but eurodns.com. I HAVE NO SPYWARE, as the PC I am using now was NEW (just out of the box), had never surfed on the net before and had F-Secure installed.

    I will have to check with Eurodns tomorrow as I know the guys personally.

  60. Posted November 21, 2007 at 12:11 pm | Permalink

    Slight variant on this - A remote user connects through a VPN to our internal network and uses Outlook connected to our email server. Outlook stopped connecting, and it turns out that this outfit had registered the FQDN of our internal mail server! What a bunch of turkeys!

  61. OneHelplessMan Internet Explorer Windows
    Posted November 21, 2007 at 2:16 pm | Permalink

    Hey same thing happen to me i set up 2 websites and sold them on for $2000 (i work from home and i was so clumzy and lazy to register the domain names straight away but cmon the domain names where so unrealted to anything!? and then 3 hours after it said not avalibe i checked to find out that it was the same people that registered both of them lets just hope after 5 days it will be relesaed otherwise i just lost 2 months of work and $2000!! EDIOTS!”

  62. Dave Mozilla Firefox Windows
    Posted November 22, 2007 at 10:06 am | Permalink

    I will join the chorus - Metapredict registered two domains I had searched through Godaddy. I looked them up on Monday, went back on Wednesday to buy them and saw Metapredict snatched them on Monday sometime after I had searched them. I then typed the domains into my address bar to see what was there (prior to learning about all this); I hope that hasn’t ruined my chances of them releasing the domains after five days.

    The “ends” (registering domains) is not illegal, but the “means” by which they did so (viewing private data either via spyware on someone’s personal computer or through intercepting that data somehow on Godaddy or through servers or browsers or whatever) is ILLEGAL. ICANN should strip enom (and enom’s affiliates/partners), the registrar that Metapredict used to register my domains, of accreditation. Further, the government needs to step in.

  63. Simon Hingley Internet Explorer Windows
    Posted November 23, 2007 at 3:51 pm | Permalink

    Take a look at this thread: http://www.tiscali.co.uk/forums/showthread.php?t=138326 as far as I know the site http://www.lordwasstevessegshop.com hasn’t been mentioned anywhere other than in these forum but was registered by the aforesaid company shortly after appearing on the thread. Some kind of trawling spybot maybe?

  64. Phil Mozilla Firefox Windows
    Posted November 23, 2007 at 7:16 pm | Permalink

    Same thing just happened to me; I used 1and1.com to check domain, visited it in address bar, and have no spyware/adware on my PC.

    Lamers

  65. noname Internet Explorer Windows
    Posted November 26, 2007 at 10:15 pm | Permalink

    Ginger if the ad you have in the telephone book is an ad that children have access too, the people who stole your name you have in the yellow pages if they do not cancel it then they will be wholey and completely responsible for allowing children to view porn without legal right.
    In otherwords little does this company know your ad in the telephone book we be held responsible for allowing children to view porn you will then be able to sue the yellow pages and the company in a class action suit for damaging little lives by not doing anything about it and being fully aware they are allowing it.
    That would be against the law on their part once they are made known of the circumstances. Then you can report them to the attorney general who will then have the proper authority to shut them down and close their internet site. Before they will be able to get back online they will have to go through all sorts of paperwork which could take years once the attorney general gets involved, REPORT them NOW TO THE ATTORNEY GENERAL before 08 when the ad comes out in the yellow pages. Do not worry about whoyou sue just do it!

  66. Mr Pissed Off Safari Mac OS
    Posted December 2, 2007 at 11:24 am | Permalink

    I too am a ‘victim’ of Ultrarom’s practices of snatching and squatting. I am on MAC OSX and used namecheap for the search and sure enough, I found they took it less than 24 hours later. I wrote them an email telling them what I think of them before I found this post - I see I’m not alone… Internet Neutrality? nope.

  67. bryan Internet Explorer Windows
    Posted December 5, 2007 at 9:47 am | Permalink

    My client said she already pay for the domian then got refunded!! guess who has the domain name now…

    “MetaPredict” owns about 15,150 other domains

  68. Posted December 6, 2007 at 2:57 am | Permalink

    Another victim here. I’m so furious right now, I shouldn’t even be writing but I’ll keep it clean. Is there ANYTHING we can do about this? Class Action or anything, lol. I can’t believe this I’m so upset. I really hope it’s released after 5 days.

  69. Posted December 6, 2007 at 2:58 am | Permalink

    By the way, I was using AjaxWhois (who goes through godaddy?) No spyware. Seems like a lot of us are using the same service.

  70. Posted December 6, 2007 at 11:44 am | Permalink

    I have apparently been victimized by these people too, but I didn’t register with godaddy. I actually registered artstamales.com with 3ix.com yesterday. I log in to my account with the provider today and it appears I never even bought hosting through them at all, let alone the add on domains I have purchased.

    Good luck to you all.

  71. Posted December 7, 2007 at 5:49 pm | Permalink

    Stolen when I allowed AT & T to build me a webpage.

  72. OnePissedOffGuy Mozilla Firefox Windows
    Posted December 7, 2007 at 8:12 pm | Permalink

    This just happened to me too about 2 days ago. What’s even worse is, they’ve registered it for a whole year and I have a product coming out in 2008 that was gonna be reliant on that domain name and I spent hundreds of dollars on trademarks, copyrights and business paperwork for this name as a legit business. Now all that is useless cause of these guys parking the domain. Something seriously has to be done about these guys being able to do this. And believe me the domain name in question is nothing they would just pull off the top of their head and say hey, we should register this. It’s theft….period!

  73. j Mozilla Firefox Mac OS
    Posted December 8, 2007 at 7:53 am | Permalink

    I got kited as well by the same guys this last weekend, I have written a cease and desist and demanded my domains back. I can’t think how this happened except it is the first pair of domains I ever registered without a hyphenated name. I bought and paid for them within seconds after going to hostgator, and I am on a Mac. Admittedly they are in a popular keyword area, which was why I was trying to aim for that niche. The only contact is that guy trent@metapredict.com so will see if I get any luck with it. At last count they had registered over 600k domains!
    Good luck to everyone else trying to get their domains back, and I would warn anyone saying that they are thinking about getting a domain, to not just think but pay for it asap. Hostgator takes payment through pay pal, so we are talking a 1 minute window of opportunity, and I STILL got kited.
    I do feel totally sorry for those of you who say you already even had the design work done and got kited. Thieving a domain name is theft of intellectual property at the very least.

  74. Posted December 8, 2007 at 2:40 pm | Permalink

    j,

    Just checking to make sure I understand what happened in your situation:

    You searched for a domain name and it was available — and then minutes later when you went to register it, Metapredict had taken it? Was the registration date/time on their registration the same time as you tried to register the domain?

  75. Christopher Mozilla Firefox Windows
    Posted December 8, 2007 at 2:48 pm | Permalink

    I used namecheap to do a simple domain search two days ago and the next day it was gone. (Surprise surprise ;~) Now I’m curious how much luck the previous posters are having in getting their domains registered after the “5 day wait”…

  76. Posted December 11, 2007 at 6:17 am | Permalink

    I am another one who has just been caught out by Metapredict. I checked the domain availablity with the hosting company Fasthosts. I then told my client the web address was available and when I returned to buy it, it was gone- to Metapredict! I was also using a Mac computer which seems to be a common thread with the last couple of posted comments.

  77. Ted Internet Explorer Windows
    Posted December 12, 2007 at 2:16 am | Permalink

    Add me to the pile. I checked a couple of variants on the domain name pursuant to the nature of the business. It was registered 3 days ago by MetaPredict. I think I will see if F***MetaPredict.com and .biz is available so they can register that, too.

  78. I got riped Mozilla Firefox Windows
    Posted December 16, 2007 at 7:39 pm | Permalink

    I can’t believe this I just got done as well, I searched for a domain and about two hours later they had it. Then I waited 5 days to register but as soon as it deregistered it was registered again by a company called Rook Analytics. I wa also searching for another domain name at the same time and it got taken by another company. I have a feeling they aren’t using spyware but possibly they have backend access to the servers that are checking the domains.

  79. Posted December 17, 2007 at 8:42 am | Permalink

    I’ve come across this website while trying to find out how my MSN is somehow being used for spamming.

    Interesting stuff. Somehow not surprised. I hate to admit that the internet needs some policing.

  80. Just lil ole me Mozilla Firefox Windows
    Posted December 21, 2007 at 8:55 pm | Permalink

    happened to me also… gotta love it though, what a great legal scam!
    is the same with company names/websites.. ie create a company and a data-harvester will buy the website before the confirmation letter arrives.. buy the website and someone will buy the company name!
    you’d think the government would want to offer small starting businesses (that can’t afford to outlay their cash so early on, on names and ideas they originally created) some kind of protection.

  81. newbie Internet Explorer Windows
    Posted December 22, 2007 at 4:26 pm | Permalink

    I did a search for my preferred domain name on http://www.internic.net/, run by ICANN. I was pleased to see the name I had in mind was available, but I didn’t register it immediately. A few days later I checked back and found it had been registered by someone via godaddy. Godaddy lists the registrant as

    Amit Sharma
    sharma_amit@mac.com
    J-1,RDC,Rajnagar
    Ghaziabad, UP 201001
    India
    919871117111

    I don’t think this is just a coincidence because the domain name is just a derivative of letters from my name, and there is nothing Indian about it.

    Godaddy says it is registered for a year:

    Created on: 18-Dec-07
    Expires on: 18-Dec-08
    Last Updated on: 18-Dec-07

    Godaddy also has a link that says: “Use a Domain Buy Agent to get this name”, and the option of backordering the name, i.e., they will monitor the name and if it expires or is cancelled they will “try to grab it the instant it becomes available.”

    The name was very important to me, and I’m pissed off, but I feel pretty helpless, especially because I’m pretty new to all of this. Does anyone have suggestions for what to do?

  82. Posted December 22, 2007 at 7:53 pm | Permalink

    @newbie

    Try running AVG Anti-Spyware on your computer and please let us know if it finds anything. I recommend running that specific program.

  83. newbie Internet Explorer Windows
    Posted December 22, 2007 at 8:58 pm | Permalink

    Josh,
    I ran AVG anti-spyware and found nothing except a bunch of cookies that avg said were medium risk. No keyloggers or trojan horses, etc. I deleted all the cookies. My feeling is that it wasn’t done with spyware on my computer.

    If someone has had their domain name kidnapped like this, what is the list of recommended steps to get it back if possible, and what is the list of things NOT to do to endanger it further?

    Any recommendations regarding godaddy’s “Use a Domain Buy Agent to get this name”, or the other option they offer which is “backordering” the domain name? If godaddy is somehow complicit in this, using either of these two approaches would be playing right into their hands.

    Also, I don’t remember all the posts here, but it seems a common thread among most, if not all of them, in some capacity, is godaddy. Is that just a coincidence?

  84. Posted December 22, 2007 at 10:49 pm | Permalink

    If someone has had their domain name kidnapped like this, what is the list of recommended steps to get it back if possible, and what is the list of things NOT to do to endanger it further?

    Don’t visit the URL for 5 days. Try to register it in 5 days.

    Any recommendations regarding godaddy’s “Use a Domain Buy Agent to get this name”, or the other option they offer which is “backordering” the domain name?

    I don’t use any of GoDaddy’s services. I don’t know if they have anything to do with the stealing of domain names, but I recommend avoiding them just because in my experience their services are low quality.

    EDIT: for ordering a registered domain try Sedo or Snapnames.com. Check out dnforum.com or namepros.com for more advice on that.

  85. Dale Internet Explorer Windows
    Posted December 27, 2007 at 10:11 pm | Permalink

    Well add me to the list. I already have a website but wanted another domain parked to direct traffic. I checked on a name and sat on it over Christmas and yep, it was taken by MetaPredict. Of course, before I read this site, I tested it by typing in the url seeing where it would go. I hope I didn’t screw up the chance of getting it back in 5 days.

  86. MacGuy Safari Mac OS
    Posted December 30, 2007 at 8:14 pm | Permalink

    Just to add to this thread, I was looking up a domain using Register.com and just had it grabbed by these clowns as well. I’m on a Mac, no spyware, etc. They are either somehow intercepting domain lookups, or they are in legion with the registrars. Oh I found this thread by googling “Metapredict” the same way a lot of people here did after seeing their domain name get jacked.

  87. Posted December 30, 2007 at 10:22 pm | Permalink

    @MacGuy

    If it’s not spyware could it be ISPs selling NDX data?

    I originally suspected spyware because domains were only being stolen on my friend’s Windows computer and not my Linux installs.

    If people who have had their domains stolen could list their ISPs it would be appreciated.

  88. Posted January 1, 2008 at 7:46 pm | Permalink

    Exploiting people through whois data is one thing, but exploiting the Madeleine McCann case is just sick. Here’s excerpts of an e-mail sent to MetaPredict recently:

    “You are a c**t.”

    That’s all for now.

  89. Posted January 6, 2008 at 6:05 pm | Permalink

    Metapredict took my domain the day before I had registered it. The particular name had taken serious research and thought and was specific to my line of business. I wrote an email to the email asking whether they can transfer the domain name to me. Some people don’t mind making others miserable just to become millionaires. It will be their loss.

  90. Posted January 6, 2008 at 10:24 pm | Permalink

    Today I was in the process of registering my name (Doug Soderstrom) as a domain name when I happened to find out that dougsoderstrom.com has already been registered by UtraRPM Inc. DBA MetaPredict.com with MetaPredict as the registrant. So I began asking myself why would someone like UltraRPM/MetaPredict want to register my name as one of “their own domain names?” I am not saying that what has taken place is illegal, but it, at least in that of my own mind, does raise a few questions.

  91. Posted January 7, 2008 at 12:30 pm | Permalink

    I got an email back from the one I sent and have now purchased the desired domain name…

    Here is the email (it is automated because it left out any name after “dear…”

    Dear:

    We are in receipt of your e-mail concerning the domain name
    GOOGLE.COM. After reviewing your email and investigating the
    situation, we have dropped the domain so that you can purchase it in the
    open market, and use the domain as you please.

    Kind Regards,
    UltraRPM, Inc.”

    Hope others have the same luck!

  92. Posted January 8, 2008 at 1:51 am | Permalink

    The domain was stolen by Metapredict. Caused lots of yelling and screaming and unhappiness. I have so much money invested into printed materials with this domain name its not funny. The funny thing is that the company is a small medical office for the underserved people on a small island in indonesia. do they really need my domain name? Really? I want to see someone sue them for this kind of practice. It cause so much grief in family and in patient community.

  93. Burned Internet Explorer Windows
    Posted January 18, 2008 at 3:08 am | Permalink

    Add me to the shocked and kited by UltraRPM/MetaPredict. Only I searched on Jan 14 (through Earthlink’s web hosting check utility) to see if my new domain name was available and it was, so on Jan 15 I called my ISP (Earthlink) and had them register it for web hosting - their confirmation email is dated 1/15 at 10:07 - and tonight when I came home and looked for evidence that my domain had been set up on their servers, discovered an advertising google-like results webpage active at my unusual domain name! I immediately went to http://www.nic.com to check WHOIS - nothing - so I checked WHOIS INTERNATIONAL and discovered these squatters UltraPRM/MetaPredict have registered it for 1 year as of Jan 17 at 13:02 - 2 days after my ISP supposedly registered it during my phone call. Of course I checked it several times over the last two days looking for evidence that ELN had set it up, so created “traffic” (drat!). I have had Earthlink host websites and register domains for me for over 10 years and never had anything like this happen. From NIC WHOIS, I notice that these scumbags are listed with an address in Pasadena California, right around the corner from where I work, so I think I might just stop in on Monday and ask a few questions. I also am speaking at an informatics conference in Washington DC in April, and think a visit to each of my congressional representatives is in order. This is not capitalisim; this is greed and theft. Thank you for your information.

  94. Stella Au Internet Explorer Windows
    Posted January 18, 2008 at 10:24 am | Permalink

    They stole a domain for one of our brands. They are demanding a final asking price of US $2,000!!!!

  95. Mark Internet Explorer Windows
    Posted January 20, 2008 at 3:47 pm | Permalink

    Just happened to me too. Checked a name yesterday through whois.net, went to register it today. Gone. Registered by UltraRPM/MetaPredict. Bastards.

  96. heidi Mozilla Firefox Mac OS
    Posted January 24, 2008 at 10:40 am | Permalink

    I was told by arishost.com that my website was approved. When I called arishost to say my website was not loading correctly they explained that the website was purchased by someone else because I improperly typed my phone number into the phone number field on the registration. Of course the company that purchased the website is none other then metapredict

  97. MEEM ALAME Mozilla Firefox Windows
    Posted January 25, 2008 at 2:17 pm | Permalink

    HERE IS HOW WE CAN GET BACK AT METADATA & GODADDY.

    FIRST CALL THEM AT 1-626-796-1004 AND TELL THEM WE ARE ON TO YOU. THEN CALL GODADDY AND TELL THEM THE SAME. CONTACT ANY NEWS AGENCY OR ….

    SECOND CONTACT THE WEBSITES THAT WRITE ARTICLES ON PROBLEMS LIKE THIS. THIS ISNT SPYWARE THIS IS GODADDY.COM BEING GREEDY AND WORKING WITH OTHER LITTLE COMPANIES TO MAKE MONEY.

    LAST WHEN YOU GO TO CHECK ON BUYING A DOMAIN JUST BUY IT.

  98. Richard Internet Explorer Windows
    Posted January 30, 2008 at 5:12 am | Permalink

    Unfortunatly we were caught out by this as well. For us it could have been catatrophic as it’s our own domain name that was hijack. We thought we has a virus or some adware as we kept getting redirected to CNOMY. It seems to be sorted now as we were able to buy it back but it could have been far worse. The lesson we have learnt is keep an eye on all your Domain names and make sure you buy then before they expire and lock them down so noone can move them or change them.

  99. Posted January 30, 2008 at 9:16 am | Permalink

    Ditto with me… I searched in domainsbot.com and pressed the buy button by mistake. Next day, the domain name was registered to metapredict.com.

  100. Kevin Mozilla Firefox Windows
    Posted February 4, 2008 at 1:48 pm | Permalink

    Also be aware that Network Solutions does a very similar thing, but they have a whois lookup to collect the data. If a website is not already registered, they will buy it and offer it to you for $40, all BEFORE the search is complete!

    Somebody please start one of those petition things so that everyone can sign against this type of theft!!!!

  101. MrPissedOff Mozilla Firefox Windows
    Posted February 5, 2008 at 11:03 am | Permalink

    Where are all the DOS-ers when we need em? Let’s take UltraRPM/MetaPredict down.

  102. dan Internet Explorer Windows
    Posted February 6, 2008 at 11:13 pm | Permalink

    I am shocked that this happened and can only pray I can get it back. I did an AVG search and had over 30 threats: trojan horse downloader.generic6.agde. dont know if that has anything to do with it. btw i mostly used internic and some godaddy and some whois.com

  103. Iowa Guy Internet Explorer Windows
    Posted February 7, 2008 at 2:58 pm | Permalink

    This happened to us, we went to buy a domain, first we checked to see if it was available then went to the Board and said it was available. Went back online and it was registered to Metapredict. BUT…5 days after they registered it, they gave it up! THANK GOD!!!

  104. what-2-do-OH-MY Internet Explorer Windows
    Posted February 9, 2008 at 2:16 am | Permalink

    I use Earthlink as my ISP, used Networksolutions and GoDaddy to search for availability, possibly Dotster also.

    Feb 6, 2008 probably the same day, these Intelectual and Trademark theives took my idea. I was actually supprised that the name was available and did a little shopping around for a low priced host/registration provider on eBay actually asking them if they had the privacy feature to keep my personal contact info discrete… how ironic.

    I also looked for another domain availability using both Dotster and possibly GoDaddy around Mid January trying to take advantage of Dotsters promotion of 99cent/yr domain registration using a ( *.info ) -By the way, the computer I believe I used has AVG updates and scans daily.

    I realized the same thing happened to me twice and started poking around finding this webpage. Thank you and I hope to add more information in regards to this company , how they do this, and how we can make it end.

    Congressmen..ICANN… whoever gets class action suits started…. activists… not sure yet what may be a good strategy, but I am going to ask a friend that has made thier way around the court and legal system in this country, and knows quite a few things about networking AND some laws that may pertain.

    I myself am trying some experiments, and keeping a detailed record. I will most likely post what I am trying and ask others try to reproduce and expand on mine.

    hahaha.. I was thinking, maybe if we all “TRY” to register and abort using domain names of extremely large and protective, even litigiously active corporations.. using all the LESS USED, BUT available domain extensions that might be construed as trademark infringement… such as, Microsoft.?*?, ( .mobi, .tv, .biz, .us .biz* .ws .name* .ag .at .be .cc .cn .de .eu .fm .jobs* .jp .ms .nu .nz .tc .tw .uk .vg ) … hmmm a previous post here, I may have misunderstood, but did they mean to say they tried to register “GOOGLE” ?

    Sony, Apple, Mac, ABC, DISNEY, PayPal ..hey, it’s late for me, past my bed time! hahaha Y’know especially companies that already have a BIG we presence! Then send messages to contact representatives of these companies, giving them a “heads UP !” , and maybe one of them will start legal proceedings.

    Sincerly,
    OH-MY!

  105. what-2-do-OH-MY Internet Explorer Windows </