Is Spyware Stealing Your Domain Names?

A friend recently looked into buying a domain name. She typed the domain into Internet Explorer and nothing came up. She typed the domain name into the search box at GoDaddy.com and the domain was available. But she didn’t buy it right away.

When checking the domain again the next day we saw that the domain had been registered by someone else just a few hours after she had searched for it. Because the name did not contain any English words (or real words in any language) we knew that it could not have been a coincidence.

My first thought was that GoDaddy had stolen the domain name and was kiting it — which would have been hypocritical because the CEO of GoDaddy had written a criticism of the practice on his blog. Further research indicated that domains were being stolen even without typing them into GoDaddy, so that ruled out GoDaddy.

The ICANN Wiki explains "domain kiting" or "domain tasting":

Because there is a 5 day grace period which for returning and receiving a refund on a domain, registrants are utilizing this to register domains, test them for traffic and keep the domains which are monetizable. This approach has the potential to be particularly lucrative and low risk because these businesses can test the residual traffic of a domain name before paying for it. In addition, the registrant can benefit from any residual income from the traffic received during the five day period even if the domain is refunded.

Sure enough, 5 days after the domain was stolen it was released and my friend was able to register it. We had already begun to investigate the issue of who stole her domain name.

The company that appears to have stolen her domain name and “tasted” it is called UltraRPM.com.

UltraRPM Whois

This is a screenshot of their home page:

UltraRPM

The UltraRPM.com home page says:

UltraRPM is a next generation, predictive data analysis company. UltraRPM seeks to use its proprietary algorithms to identify and create higher ROI online marketing opportunities.

Our products are still under development so please check back for more information once we have launched.

Internic shows that UltraRPM does business as Metapredict.com, but Metapredict.com does not resolve when typing it into a browser.

Metapredict.com

We began testing other domain names to see if they would be stolen and "tasted". For the first test, I booted up Damn Small Linux and and typed a domain into GoDaddy’s search box. I wanted to try it on a clean operating system. The test was not 100% clean though because my friend had also typed the domain into the address bar of Internet Explorer on her computer. Sure enough, the domain was registered by UltraRPM a few hours after searching for it.

In my research I came across a blog post on domaintools.com about stealing domain names. The article mentioned that ISPs sell Non-eXistent Domain (NDX) data to people. I began to suspect that my ISP might be stealing the domain names.

The DomainTools article didn’t seem to think that spyware was a common issue:

For any browser plug-in that is free, ask yourself why is it free and whether they send data back to a server. Avoid software on computers that reports data back to the Internet. Of course this is the most obvious advice, but I need to mention it. The likelihood of someone datamining domain name research from spyware is small. If they have spyware on your computer, it’s more likely they are going after credit cards numbers and social security numbers instead of domain research.

To test this, I typed a few non-existent domain names into my browser in Linux on the same Internet connection. Those domains were not registered and kited like the previous ones. That seemed to indicate that the ISP was not responsible. I recommended that my friend run AVG Anti-Spyware which is the strongest spyware/trojan scanner that I’ve found. AVG-Anti Spyware found many problems on her computer including a trojan. I didn’t see the list of scanned items though so I don’t know exactly what spyware was on the computer and whether it could have been responsible for stealing her domain names as she typed them into the address bar of Internet Explorer.

The original suspects in this case were GoDaddy, my ISP, and spyware. GoDaddy and the ISP seem to have been eliminated through my non-scientific experiments. At the moment I am suspecting that spyware may have been the problem in this case.

It would be great if readers could perform similar tests on their own computers. I recommend running your tests as follows:

  • Experiment with only one domain at a time
  • Don’t use dashes in the domains
  • Make up a domain that sounds like a brand name, possibly with a component that is not a real word.

The only other mention I’ve found of UltraRPM is on an article about companies who are exploiting the popularity of Madeleine McCann’s Web site (a child abducted in Portugal).

If you find anything interesting or have more information about UltraRPM and Metapredict, please leave a comment below. I’m also interested in more information about domain tasting and what is being done to stop it.

UPDATE: Thanks for the many comments. If this has happened to you and you are using Windows, please run the free trial of AVG Anti-Spyware on your computer and send me the log of any malware that the program finds. Finding a common piece of spyware (or lack of one) across many incidents it might shed some light onto this issue. To contact me, please use the contact form.

UPDATE: I’ve written additional articles about Metapredict.com and UltraRPM.

Popularity: 100% [?]

Share This:
  • Sphinn
  • Digg
  • del.icio.us
  • Reddit
  • StumbleUpon
  • Twitter
  • Facebook
  • Google Bookmarks
  • Mixx
  • Tumblr
  • FriendFeed
  • LinkedIn

123 Comments

  1. Richard Curry Mozilla Firefox Windows
    Posted May 22, 2007 at 10:24 pm | Permalink

    I’ve actually had this same thing happen and the same company registered the domain..

    I had searched to see if the domain was taken through http://ajaxwhois.com/ and they are also linked up through godaddy, so I’m wondering if this is what happened also.

    I actually registered the domain and 2 days later they somehow ended up with it? I even paid for it, so i’m working with my hosting company now to see what happened.

  2. Posted May 28, 2007 at 5:01 pm | Permalink

    I just had this happen to me, same company.. I actually found this post by googling for Metapredict. I’ve had my eye on a domain name for a few weeks now, but I do all my searching from my own server with ‘whois’. Last weekend I went to register it with GoDaddy, but as a result of a bank screwup I wasn’t able to complete the transaction. Monday morning I gave my bank manager an earfull and got the account unlocked. When I went to register my domain, I saw that these crooks had bought it less than 24 hours after my initial (failed) attempt. I can only hope they will release it after their 5 day trial is up, because I’ve already got my server ready to roll and paid for design work featuring the domain name.

    I found a link here: http://www.webhosting.info/registrars/reports/METAPREDICT.COM

    It shows the number of domains this company scoops up PER DAY, it’s in the hundreds of thousands. I really think this domain tasting business should be put to a screeching halt ASAP. It’s turning the internet into a parking lot.

  3. Posted May 30, 2007 at 10:28 pm | Permalink

    The same thing just happened to me. The same company. Any recourse that we can take?

    This is frustrating.

  4. Posted June 1, 2007 at 2:44 am | Permalink

    If all works out well (as in no traffic to the domain) – they might just drop it and you can get your intended domain back.

    Anyway, the number of domain permutation is only limited to our creativity ;) .

  5. Lapalissiano Mozilla Firefox Windows
    Posted June 5, 2007 at 7:26 pm | Permalink

    I registered my domain at godaddy.com, but I made a typo and registered the wrong name. The next day ultrarpm.com has registered the correct domain.

  6. downforce Mozilla Firefox Windows
    Posted June 8, 2007 at 6:14 am | Permalink

    Hrmmm very very interesting. I was looking at a domain name last week. Most of my searching was done through melbourneit.com.au but I’m sure I used one or two other “domain providers” who let you search.

    OK, I’ve checked some other names I was interested in that I know I only used melbourneit.com.au to check for and they are stlil available, so I’d safely rule them out (for now).

    Anyway, that name is now registered to this bunch.

    Luckily I decided it was a crap name and not going to use it, but little to say the practice is atrocious!

  7. Michael Mozilla Firefox Windows
    Posted June 8, 2007 at 5:33 pm | Permalink

    Same exact thing happened to me. I used the whois on Godaddy. Find out the name was available yesterday. Today it is taken by metapredict. Hope its released in 5 days.

  8. Sarah Mozilla Firefox Windows
    Posted June 8, 2007 at 6:30 pm | Permalink

    I checked a name through godaddy yesterday, went to buy it today and it is gone, registered to MetaPredict.
    I checked it last week through a NZ registrar and it was available.

  9. Joseph Internet Explorer Windows
    Posted June 9, 2007 at 10:55 am | Permalink

    this happened to my client today and metapredict got it. I am not sure if my client searched it through godaddy but there sure seems to be one common denominator in the posts here. it may be that godaddy is doing it or they are being exploited by a hole in their system or their server traffic activities are being scanned.

  10. Posted June 9, 2007 at 12:03 pm | Permalink

    Another possible common denominator is that people are using Windows machines with spyware installed.

    It would be great if you could all scan your computers for malware with AVG Anti-Spyware and email me the names of any detected malware. If the problem is spyware-related, we might be able to find a common spyware application between the incidents.

  11. Spiked Internet Explorer Windows
    Posted June 12, 2007 at 9:16 am | Permalink

    Hey guys, I had this happen to me too ofcourse, then I saw this thread. I searched around on my own and I believe I have found the culprit. Not spyware persay, it seems to be adware. A software package known to trendmicro as “Best Offers” and labeled adware seems to auto install itself using javascript from some websites. This software can also be installed to your machine thru a couple of different trojans. The “Best Offers” adware seems to be harmless at first glance, but it’s actually quite hard to get rid of; I don’t remember where I found all of those files. My pc at work had it, and so did my machine at home. After having my domain snatched up, I tested some other extensions, with and without the “Best Offers” adware on my machine, and the ones i ran a whois on after the removal were not snatched. This could be coincidence, ofcourse, many ppl need to look into this for it to be determined as THE cause. Also a side note: stay away from free services that will let you know when your domain is available. Yup, a legitimate domain registering company offered me that service after ultrarpm had taken my domain, and that company ended up registering the domain to themselves without ever letting me know it was available. Good luck friends, and have your servers and credit cards ready when using any domain register!

  12. Spiked Internet Explorer Windows
    Posted June 12, 2007 at 9:18 am | Permalink

    PS: I did not use GoDaddy for the domain that was snatched, however, I did use them to register a different domain later after my original domain was stolen twice.

  13. Brian Internet Explorer Windows
    Posted June 12, 2007 at 2:26 pm | Permalink

    I used the browser on my blackberry to see if a name was available. I am certain there is no spyware on my blackberry.
    I checked it on Godaddy so I can only assume that Godaddy is somehow responsible for this, or their server has been compromised and these guys are scanning the name queries and just registering any name that someone checks.

    I would love to know if there is any legal recourse.

  14. Mark Internet Explorer Windows
    Posted June 22, 2007 at 5:39 pm | Permalink

    Over the past days I had the same experience. MetaPredict “stole” my name, that I had requested just before (but the paper process took too long). I did not use any of the sites mentioned above and (as far as I know) my PC is not infected with Spyware. The only things I used were google and a domain-name-checker.

    Wouldn’t this be something the ICANN should take action into? Hundreds of thousands of names claimed a day…. That cannot be correct. Unless they pay for it (do we know?) this seems a strange situation.

  15. ginger Internet Explorer Windows
    Posted June 26, 2007 at 8:58 pm | Permalink

    I have a really horrible situation. I purchased internet advertising from the yellow pages. They published an ad with “my” web address in it. They did not, however, purchase the domain name. MetaPredict purchased it and has a gay porn site there. Thus, people going to “my” website from my yellow page ad end up at this porn site. Of course, I’m dealing with the yellow pages. But, I am desparate to get this site down. Any suggestions?

  16. Posted June 27, 2007 at 9:42 am | Permalink

    Ginger,

    I’m not sure I understand your situation. If the yellow pages site published a domain that you don’t own, why not just have it removed from your yellow pages listing?

  17. Posted June 29, 2007 at 6:57 pm | Permalink

    Unbelievable. Now I look like a total prat having told my client I have purchased a domain name we agreed on, not got round to it, and now UltraRPM have it. Roll on 5 days time or else I’m in trouble!!

  18. ginger Internet Explorer Windows
    Posted July 3, 2007 at 9:19 pm | Permalink

    I’m sorry, I should have explained that this ad, with this website, is published in the telephone book. The new book will not come out until April, 2008. However, I have been in contact with an internet attorney who is advising me regarding action I may be able to take as the website name is my common law trademark. We’ll see.

  19. pat Safari Mac OS
    Posted July 4, 2007 at 2:07 am | Permalink

    Exactly the same thing happened to me. I rabn a search for the name on Godaddy then went to my hosting company to register the name. During the registration process the name was taken by UltraRPM. I’m a Mac OS X user ; so it’s unlikely I have any spyware or trojans.

  20. Mehaf Mozilla Firefox Windows
    Posted July 12, 2007 at 10:33 am | Permalink

    They stole missyourob.com two days ago – obviously in light of everyone scouring the internet for hidden sites for the new “Cloverfield” film. I’m just glad I didn’t want to purchase it by some chance. Dirty mongrels.

  21. Joseph Internet Explorer Windows
    Posted July 20, 2007 at 9:13 am | Permalink

    They did this again to my client today. Many do this but how can you deal with it

    1) DONOT CONTACT THEM – EVER
    2) NEVER VISIT THE DOMAIN WEBSITE
    3) WAIT FOR 5 DAYS FROM REGISTRATION DATE (WHEN THEY DELETE IT)
    4) REGISTER THE DOMAIN IMMEDIATELY WHEN IT IS DELETED

    *Cross your fingers that they delete the domain name after 5 days. 98% do.

    These are common obvious tactics of these registrars who abuse the deletion grace period. They should be penalized by ICANN and prevented from deleting domain names so they go bankrupt or better yet cancel the registrar’s accreditation (for abuse of resources) if they decide to step on other people’s intellectual property (we thought of the domain first, right?).

  22. Posted August 3, 2007 at 10:31 am | Permalink

    2 minutes after I asked about the availability of above-named domain and got -already registered- as an answer, it was registered in the name of …. MetaPredict ! The whois-search made this perfectly clear. Such unfair buggers should be expelled as an offical registar by the ICANN. I put in already a complaint at its ombudsman and am (very) interested in his (serious ?) reply.

  23. SKD Internet Explorer Windows
    Posted August 3, 2007 at 4:40 pm | Permalink

    This just happened to me with GoDaddy. A company in the Caribbean now owns the domain name. Tried calling and emailing them but no answer.

  24. dana Internet Explorer Windows
    Posted August 3, 2007 at 5:33 pm | Permalink

    this is wrong, just happened to us also. Don’t know why (didn’t use godaddy)
    how can we stop this? is it legal?

  25. Helen Pang Mozilla Firefox Windows
    Posted August 5, 2007 at 9:52 am | Permalink

    I’m facing the same thing too, but I’m more serious as there were some problems from the previous registration, and the domain failed to register, now it was taken by Metapredict, I’ve contacted them several times, +1-626-796-1004, but no one picking up, it went into auto answering machine. I’ve emailed to domain@anondns.org as well, but no one replied, the domain name was registered at 2nd July 2007. My customer needs it very urgently, I don’t know what to do now, anyone please advice how to get in touch with them? Thanks.

  26. paul Safari Mac OS
    Posted August 6, 2007 at 1:49 pm | Permalink

    companies like metapredict are a cancer of the internet. the same thing happened to me when i checked if a domain was available then it was owned by metapredict. the powers that be should put a stop to this evil practice and heavy penalties and fines should be administered. the internet should be a liberator of people and these cancerous companies removed

  27. gr8pop Internet Explorer Windows
    Posted August 10, 2007 at 8:01 am | Permalink

    Just happened to me yesterday. I registered a unique business domain name (that my search at GoDaddy indicated was available) with a rep at GoDaddy. He made a “typo” when he registered the name and by the time I caught it in the confirmation letter from GoDaddy, my actual unique business domain name (that I had searched for and was available) was NO LONGER AVAILABLE. It had been registered several hours after GoDaddy screwed up the spelling. The name was snagged by Metapredict.com (AKA UltraRPM.com).

    What enables these crooks to remain in business???

  28. Deven Mozilla Firefox Windows
    Posted August 13, 2007 at 3:01 pm | Permalink

    Actually, they register domains for private parties. They are extremely reasonable about returning domain names that have been registered before. If you email them, they are one of the only companies out there that are willing to help you.

  29. Posted August 13, 2007 at 3:56 pm | Permalink

    Deven,

    Are you talking about metapredict.com / ultrarpm.com? They appear to be stealing people’s domain names just after they people type them into computers.

    Do you work for them? If you know something specific about the company, please be specific.

  30. hanspeterwurst Mozilla Firefox Mac OS
    Posted August 15, 2007 at 9:13 am | Permalink

    you houldnt believe deven. seems like he’s related to the company. he posted the same thing here:
    http://www.techchee.com/2007/07/19/spyware-steals-domain-name/ultrarpmcom-aka-metapredict-steals-unregistered-domain-names/

  31. Posted August 15, 2007 at 9:25 am | Permalink

    hanspeterwurst,

    Thanks for catching that and pointing it out.

  32. Chaz Mozilla Firefox Windows
    Posted August 16, 2007 at 8:38 am | Permalink

    It seems a lot are suspicious of godaddy. FWIW I registered my .com domain with them and have not seen anything out of the ordinary.
    I used their search to check a couple domains, discussed them with a friend and then decided which one a day or two later.
    However I don’t use IE, my AV updates and scans daily and spyware/adware scans are twice per week. I run “startuplist” and HiJackThis twice per month on all my boxes.
    I also sit behind a firewall that denies all traffic unless specifically allowed in my ACL.
    The PC I used to register my domain mentioned above is:
    WinXP using FF 2.0.0.6
    The only addons I have are user agent switcher and SU.
    I only save my AV results for the current month but checking those show no threats or infections yet this month.
    Yeah ok, so I’m a paranoid geek….sue me :P

    My best guess? This problem is due to spyware/adware/trojan rather than godaddy.

  33. Chaz Mozilla Firefox Windows
    Posted August 16, 2007 at 9:14 am | Permalink

    I just forced my spyware scans and my AV just ran showing no issues on either.

    I went directly to godaddy and searched for two .com TLD’s I have been debating registering and they are available at this time.

    We shall see what tomorrow brings.

  34. Yo Deho Mozilla Firefox Mac OS
    Posted August 16, 2007 at 2:52 pm | Permalink

    I’m having the same problem. Checked godaddy for a domain. Free :) A few day’s later I tried to register it. And guess what…Metapredict.com registered the domain. (I’m working on a Mac by the way)

  35. Chaz Netscape Navigator
    Posted August 18, 2007 at 9:55 pm | Permalink

    Well I just checked them again. Third time actually and they are still available.

    First domain was as not even a real word (it is a SN I used to use on IRC) and the second one was three small words in a sort of catchy phrase.

    This makes me feel more comfortable about having my domains with godaddy.

  36. Justin Mozilla Firefox Windows
    Posted August 20, 2007 at 10:39 pm | Permalink

    You may add me to this list of people that metapredict has taken a domain name… but I think because I checked a name out, just prior to the 5 day deadline, they went ahead and really registered it… to keep me from getting it… because it makes it look like it is a wanted domain now… Piece of crap company!!

  37. Chaz Mozilla Firefox Ubuntu Linux
    Posted August 22, 2007 at 9:09 am | Permalink

    I just checked both domains again and both are still available. I am convinced this has nothing to do with godaddy and is a spyware/adware issue.

    No offense meant but those of you who claim “I am a Mac user” and that makes you immune to these things, please think again.

  38. Posted August 22, 2007 at 9:13 am | Permalink

    Chaz,

    I agree, and I don’t think that GoDaddy is the reason that this is happening.

    GoDaddy’s Office of the President recently contacted me with the following statement:

    “We understand your concerns regarding this issue. We have made ICANN aware of the problem several times as well. Unfortunately, it is difficult to determine exactly from where the information used to register names for this purpose actually comes. Whois queries involve multiple parties – the originating site, the registrar (if different), and the registry.

    We can tell you that GoDaddy.com is no way associated with Metapredict.com or UltraRPM dba. However, we cannot comment on this practice with any further details.”

  39. Posted August 23, 2007 at 7:22 am | Permalink

    I’m another victim. In my case, I checked domain name availability through streamline.net. I checked again today (3 days later) and found the name registered by metapredict – all I can hope is that it’ll be released after the 5 days. I’ve run an AVG spyware scan and found several tracking cookies but no malware. Could tracking cookies provide this info to metapredict?

  40. Chaz Mozilla Firefox Windows
    Posted August 25, 2007 at 8:19 pm | Permalink

    Sorry for the off topic post (sort of) but relying on one spyware removal tool is insane. I have seen too many times that running a different one will pick up what the first one missed.

    Used regularly on my machines;
    Spybot, Adaware, Startuplist and HiJackThis.

    Update and scan with AV daily!

  41. Posted August 29, 2007 at 6:32 pm | Permalink

    The odd statement above from the President of Godaddy is that he ends the statement with “…However, we cannot comment on this practice with any further details.”

    We cannot comment on this practice? How about condemning the practice outright. This is either poor communication or they do have something up their sleeve. I don’t use godaddy.com to search for domains anymore because it happened to me about a year ago. I registereed gamepicasso.com, and then I wanted to register gamepicaso.com with a single “s” and it was gone the next day. Sheesh!

  42. Alex Mozilla Firefox Mac OS
    Posted September 7, 2007 at 9:14 pm | Permalink

    I am on a mac and despite what a previous poster said, there simply is not much spyware for mac, I used namecheap.com to look for it and BAM you know who got it a day later. I don’t blame the scumbags really, They can’t help being scummy theives, it’s who they are.

    I blame ICANN. If your apartment is infested with rats, you can’t rightly blame the rat for being a rat. It’s the landlords fault for not getting rid of them.

  43. Alex Mozilla Firefox Mac OS
    Posted September 7, 2007 at 9:39 pm | Permalink

    One further note. Not to defend those dirtbags… but contrary to what some people say, they don’t actually steal anything. You decided you didn’t want it and they snatched it (ok the claims on here of them snatching it WHILE you are trying to register it aside)

    None the less. I wish someone would write a bot that would check say a couple hundred nonsense names at a time (I know they block that practice but hear me out) and then visit the site repeatedly for 5 days, hopefully with a dynamic IP. Then they would buy up all those nonsense and worthless names. That would serve em right. Just dreaming out loud i guess.

  44. Posted September 8, 2007 at 11:10 am | Permalink

    Not to defend those dirtbags… but contrary to what some people say, they don’t actually steal anything. You decided you didn’t want it and they snatched it

    They appear to be stealing business intelligence from your computer. It is information that no one should have access to. Some people don’t buy domains right away, but like to sleep on it. No other company should have access to that information.

  45. Alex Mozilla Firefox Mac OS
    Posted September 9, 2007 at 8:24 am | Permalink

    That’s only if they are indeed getting it from your computer.(they didn’t get it from my mac)

    If they are getting it from the registar then it is just shady. Unless the site promises you some sort of specific privacy about what your are about to enter, your entry in that text box can be used by them any way they like and it’s not stealing.

    It’s just a very scummy practice. Just cuz I don’t think it technically qualifies as stealing doesn’t mean i don’t think it is a dirtbag practice.

  46. John Jay Mozilla Firefox Windows
    Posted September 17, 2007 at 2:27 pm | Permalink

    Is there any movement afoot to remove the 5 day grace period? This was originally intended, I think, for the more innocent days when people registered domains and maybe made mistakes or changed their minds or whatever. Instead, it’s turned into a 5-nights-free motel that displaces regular consumers.

    Perhaps this is out of scope but I was wondering if anyone is keeping up with this policy. Thanks.

  47. Don Mozilla Firefox Windows
    Posted September 20, 2007 at 6:17 am | Permalink

    Same thing happened to me. Searched for availability of a domain name for a client and a couple of days later UltraRPM had it. I would like get back at these guys and run a bot on an infected machine and run up the domain registration into the 10’s of millions. Someone ie.the US Gov’t should step in….

  48. Katie Internet Explorer Windows
    Posted September 22, 2007 at 8:01 pm | Permalink

    The same thing happened to me and I was using Register.com.

  49. julia Mozilla Firefox Windows
    Posted September 27, 2007 at 1:22 am | Permalink

    they stole mine as well, but my hosting account deleted my domain by mistake ,without my permission, so if dont get It back I will sue them as my name was very very importnat for my business.
    Unfortunately they put a lot of bad content where my site used to be so they will probably not release it.

  50. Posted October 8, 2007 at 8:39 am | Permalink

    I cannot stop google ads from running on my site from the same company. You can block URLs in google adsense, but they have some sort of re-direct so you can’t indentify the url and the ads still run all over my site.

    The ads are for a sweepstakes and they dont offer any sweepstakes.

  51. Dan Safari Mac OS
    Posted October 16, 2007 at 2:21 pm | Permalink

    I just had the same thing happen to me, not more than 2 minutes after doing a lookup. My circumstances:

    - I’m using OS X and an open wifi network
    - I used GoDaddy for the lookup
    - whois shows the domain was registered via centralregistrar.com aka domainmonger.com
    - there is no contact data on the whois entry and no nameserver: “Domain not found. Code FW-1: Whois data not currently available for “. I’m assuming it hasn’t propagated yet.

    This is absolute bullshit. I’ll be looking again in 5 days and registering it IMMEDIATELY.

  52. Posted October 16, 2007 at 5:01 pm | Permalink

    Hey, fellow SEOer here. Just happen to me today damn. LOL, it’s an 8 letters 2 words domain. I think this could be because I left a tab for Domainbank.com open with 7 other domains that I unintentionally refresh every time I load Firefox??? The thing is, though, MetaPredict only register the 8 letter domain, when there are 3-4 other 2-words domains with 10-12 letters in the batch.

    Hmn…This has never been a problem to me, since I check domains in batch. I guess now I’ll try what I did before to see if they register this fake batch =P…Will see…

  53. Netochka Internet Explorer Windows
    Posted October 19, 2007 at 11:05 pm | Permalink

    I found this page by looking up MetaPredict. I was researching them because I typed in 6 domains names last night to see if they were avaialble. I went back to register one today only to find that Metapredict registered it today! Ithought it was strange because there was nothing special about the domain name. So, After finding this page, I tped in the other domains I researched last night only to find that MetaPredict registered them all today!!! Unbelievable!

  54. Posted October 27, 2007 at 2:00 pm | Permalink

    they are stealing my domains i was searching for domain and after few days they take it the are bad ppl damm thm

  55. DCP Mozilla Firefox Windows
    Posted October 31, 2007 at 7:31 am | Permalink

    This is terrible. The same thing happened to me. I told a client to go to my godaddy reseller account (branded with our company name) to look for some domains. We discussed several and he was planning to buy one, but you know the story.

    The worst part was that the godaddy reseller account is branded with our company information and this makes us look real bad. While there isn’t proof that this is godaddy related it seems from numerous sources that the vast majority of people having this problem were using godaddy.

    So what do we do? Does anyone know of a safe way to look up domains? Is dnsstuff.com safe? Any other ideas?

  56. Posted October 31, 2007 at 11:51 am | Permalink

    So what do we do? Does anyone know of a safe way to look up domains? Is dnsstuff.com safe? Any other ideas?

    I’m not sure if it’s 100% safe, but I use http://www.pcnames.com/

    If the domain that I want is available I buy it immediately. I don’t search unless I am ready to buy. It is worth the $6 investment to guarantee that you will not have the domain name stolen.

  57. Posted November 2, 2007 at 11:30 am | Permalink

    yep…it just happened to me again — also after checking availability with GoDaddy. I wouldn’t put anything past those slime dogs. Bob Parsons talks a good game but his company doesn’t practice what he preaches; at least not in my personal experience.

  58. Metapredict Is Evil Internet Explorer Windows
    Posted November 9, 2007 at 12:07 pm | Permalink

    These dirtbags just nabbed the domain name I was about to register after looking it up a few days ago.

  59. David Internet Explorer Windows
    Posted November 11, 2007 at 2:47 pm | Permalink

    Well, the same just happened to me. The same company snatched the domainname I was looking into. But I didn’t use godaddy, but eurodns.com. I HAVE NO SPYWARE, as the PC I am using now was NEW (just out of the box), had never surfed on the net before and had F-Secure installed.

    I will have to check with Eurodns tomorrow as I know the guys personally.

  60. Posted November 21, 2007 at 12:11 pm | Permalink

    Slight variant on this – A remote user connects through a VPN to our internal network and uses Outlook connected to our email server. Outlook stopped connecting, and it turns out that this outfit had registered the FQDN of our internal mail server! What a bunch of turkeys!

  61. OneHelplessMan Internet Explorer Windows
    Posted November 21, 2007 at 2:16 pm | Permalink

    Hey same thing happen to me i set up 2 websites and sold them on for $2000 (i work from home and i was so clumzy and lazy to register the domain names straight away but cmon the domain names where so unrealted to anything!? and then 3 hours after it said not avalibe i checked to find out that it was the same people that registered both of them lets just hope after 5 days it will be relesaed otherwise i just lost 2 months of work and $2000!! EDIOTS!”

  62. Dave Mozilla Firefox Windows
    Posted November 22, 2007 at 10:06 am | Permalink

    I will join the chorus – Metapredict registered two domains I had searched through Godaddy. I looked them up on Monday, went back on Wednesday to buy them and saw Metapredict snatched them on Monday sometime after I had searched them. I then typed the domains into my address bar to see what was there (prior to learning about all this); I hope that hasn’t ruined my chances of them releasing the domains after five days.

    The “ends” (registering domains) is not illegal, but the “means” by which they did so (viewing private data either via spyware on someone’s personal computer or through intercepting that data somehow on Godaddy or through servers or browsers or whatever) is ILLEGAL. ICANN should strip enom (and enom’s affiliates/partners), the registrar that Metapredict used to register my domains, of accreditation. Further, the government needs to step in.

  63. Simon Hingley Internet Explorer Windows
    Posted November 23, 2007 at 3:51 pm | Permalink

    Take a look at this thread: http://www.tiscali.co.uk/forums/showthread.php?t=138326 as far as I know the site http://www.lordwasstevessegshop.com hasn’t been mentioned anywhere other than in these forum but was registered by the aforesaid company shortly after appearing on the thread. Some kind of trawling spybot maybe?

  64. Phil Mozilla Firefox Windows
    Posted November 23, 2007 at 7:16 pm | Permalink

    Same thing just happened to me; I used 1and1.com to check domain, visited it in address bar, and have no spyware/adware on my PC.

    Lamers

  65. noname Internet Explorer Windows
    Posted November 26, 2007 at 10:15 pm | Permalink

    Ginger if the ad you have in the telephone book is an ad that children have access too, the people who stole your name you have in the yellow pages if they do not cancel it then they will be wholey and completely responsible for allowing children to view porn without legal right.
    In otherwords little does this company know your ad in the telephone book we be held responsible for allowing children to view porn you will then be able to sue the yellow pages and the company in a class action suit for damaging little lives by not doing anything about it and being fully aware they are allowing it.
    That would be against the law on their part once they are made known of the circumstances. Then you can report them to the attorney general who will then have the proper authority to shut them down and close their internet site. Before they will be able to get back online they will have to go through all sorts of paperwork which could take years once the attorney general gets involved, REPORT them NOW TO THE ATTORNEY GENERAL before 08 when the ad comes out in the yellow pages. Do not worry about whoyou sue just do it!

  66. Mr Pissed Off Safari Mac OS
    Posted December 2, 2007 at 11:24 am | Permalink

    I too am a ‘victim’ of Ultrarom’s practices of snatching and squatting. I am on MAC OSX and used namecheap for the search and sure enough, I found they took it less than 24 hours later. I wrote them an email telling them what I think of them before I found this post – I see I’m not alone… Internet Neutrality? nope.

  67. bryan Internet Explorer Windows
    Posted December 5, 2007 at 9:47 am | Permalink

    My client said she already pay for the domian then got refunded!! guess who has the domain name now…

    “MetaPredict” owns about 15,150 other domains

  68. Posted December 6, 2007 at 2:57 am | Permalink

    Another victim here. I’m so furious right now, I shouldn’t even be writing but I’ll keep it clean. Is there ANYTHING we can do about this? Class Action or anything, lol. I can’t believe this I’m so upset. I really hope it’s released after 5 days.

  69. Posted December 6, 2007 at 2:58 am | Permalink

    By the way, I was using AjaxWhois (who goes through godaddy?) No spyware. Seems like a lot of us are using the same service.

  70. Posted December 6, 2007 at 11:44 am | Permalink

    I have apparently been victimized by these people too, but I didn’t register with godaddy. I actually registered artstamales.com with 3ix.com yesterday. I log in to my account with the provider today and it appears I never even bought hosting through them at all, let alone the add on domains I have purchased.

    Good luck to you all.

  71. Posted December 7, 2007 at 5:49 pm | Permalink

    Stolen when I allowed AT & T to build me a webpage.

  72. OnePissedOffGuy Mozilla Firefox Windows
    Posted December 7, 2007 at 8:12 pm | Permalink

    This just happened to me too about 2 days ago. What’s even worse is, they’ve registered it for a whole year and I have a product coming out in 2008 that was gonna be reliant on that domain name and I spent hundreds of dollars on trademarks, copyrights and business paperwork for this name as a legit business. Now all that is useless cause of these guys parking the domain. Something seriously has to be done about these guys being able to do this. And believe me the domain name in question is nothing they would just pull off the top of their head and say hey, we should register this. It’s theft….period!

  73. j Mozilla Firefox Mac OS
    Posted December 8, 2007 at 7:53 am | Permalink

    I got kited as well by the same guys this last weekend, I have written a cease and desist and demanded my domains back. I can’t think how this happened except it is the first pair of domains I ever registered without a hyphenated name. I bought and paid for them within seconds after going to hostgator, and I am on a Mac. Admittedly they are in a popular keyword area, which was why I was trying to aim for that niche. The only contact is that guy trent@metapredict.com so will see if I get any luck with it. At last count they had registered over 600k domains!
    Good luck to everyone else trying to get their domains back, and I would warn anyone saying that they are thinking about getting a domain, to not just think but pay for it asap. Hostgator takes payment through pay pal, so we are talking a 1 minute window of opportunity, and I STILL got kited.
    I do feel totally sorry for those of you who say you already even had the design work done and got kited. Thieving a domain name is theft of intellectual property at the very least.

  74. Posted December 8, 2007 at 2:40 pm | Permalink

    j,

    Just checking to make sure I understand what happened in your situation:

    You searched for a domain name and it was available — and then minutes later when you went to register it, Metapredict had taken it? Was the registration date/time on their registration the same time as you tried to register the domain?

  75. Christopher Mozilla Firefox Windows
    Posted December 8, 2007 at 2:48 pm | Permalink

    I used namecheap to do a simple domain search two days ago and the next day it was gone. (Surprise surprise ;~) Now I’m curious how much luck the previous posters are having in getting their domains registered after the “5 day wait”…

  76. Posted December 11, 2007 at 6:17 am | Permalink

    I am another one who has just been caught out by Metapredict. I checked the domain availablity with the hosting company Fasthosts. I then told my client the web address was available and when I returned to buy it, it was gone- to Metapredict! I was also using a Mac computer which seems to be a common thread with the last couple of posted comments.

  77. Ted Internet Explorer Windows
    Posted December 12, 2007 at 2:16 am | Permalink

    Add me to the pile. I checked a couple of variants on the domain name pursuant to the nature of the business. It was registered 3 days ago by MetaPredict. I think I will see if F***MetaPredict.com and .biz is available so they can register that, too.

  78. I got riped Mozilla Firefox Windows
    Posted December 16, 2007 at 7:39 pm | Permalink

    I can’t believe this I just got done as well, I searched for a domain and about two hours later they had it. Then I waited 5 days to register but as soon as it deregistered it was registered again by a company called Rook Analytics. I wa also searching for another domain name at the same time and it got taken by another company. I have a feeling they aren’t using spyware but possibly they have backend access to the servers that are checking the domains.

  79. Posted December 17, 2007 at 8:42 am | Permalink

    I’ve come across this website while trying to find out how my MSN is somehow being used for spamming.

    Interesting stuff. Somehow not surprised. I hate to admit that the internet needs some policing.

  80. Just lil ole me Mozilla Firefox Windows
    Posted December 21, 2007 at 8:55 pm | Permalink

    happened to me also… gotta love it though, what a great legal scam!
    is the same with company names/websites.. ie create a company and a data-harvester will buy the website before the confirmation letter arrives.. buy the website and someone will buy the company name!
    you’d think the government would want to offer small starting businesses (that can’t afford to outlay their cash so early on, on names and ideas they originally created) some kind of protection.

  81. newbie Internet Explorer Windows
    Posted December 22, 2007 at 4:26 pm | Permalink

    I did a search for my preferred domain name on http://www.internic.net/, run by ICANN. I was pleased to see the name I had in mind was available, but I didn’t register it immediately. A few days later I checked back and found it had been registered by someone via godaddy. Godaddy lists the registrant as

    Amit Sharma
    sharma_amit@mac.com
    J-1,RDC,Rajnagar
    Ghaziabad, UP 201001
    India
    919871117111

    I don’t think this is just a coincidence because the domain name is just a derivative of letters from my name, and there is nothing Indian about it.

    Godaddy says it is registered for a year:

    Created on: 18-Dec-07
    Expires on: 18-Dec-08
    Last Updated on: 18-Dec-07

    Godaddy also has a link that says: “Use a Domain Buy Agent to get this name”, and the option of backordering the name, i.e., they will monitor the name and if it expires or is cancelled they will “try to grab it the instant it becomes available.”

    The name was very important to me, and I’m pissed off, but I feel pretty helpless, especially because I’m pretty new to all of this. Does anyone have suggestions for what to do?

  82. Posted December 22, 2007 at 7:53 pm | Permalink

    @newbie

    Try running AVG Anti-Spyware on your computer and please let us know if it finds anything. I recommend running that specific program.

  83. newbie Internet Explorer Windows
    Posted December 22, 2007 at 8:58 pm | Permalink

    Josh,
    I ran AVG anti-spyware and found nothing except a bunch of cookies that avg said were medium risk. No keyloggers or trojan horses, etc. I deleted all the cookies. My feeling is that it wasn’t done with spyware on my computer.

    If someone has had their domain name kidnapped like this, what is the list of recommended steps to get it back if possible, and what is the list of things NOT to do to endanger it further?

    Any recommendations regarding godaddy’s “Use a Domain Buy Agent to get this name”, or the other option they offer which is “backordering” the domain name? If godaddy is somehow complicit in this, using either of these two approaches would be playing right into their hands.

    Also, I don’t remember all the posts here, but it seems a common thread among most, if not all of them, in some capacity, is godaddy. Is that just a coincidence?

  84. Posted December 22, 2007 at 10:49 pm | Permalink

    If someone has had their domain name kidnapped like this, what is the list of recommended steps to get it back if possible, and what is the list of things NOT to do to endanger it further?

    Don’t visit the URL for 5 days. Try to register it in 5 days.

    Any recommendations regarding godaddy’s “Use a Domain Buy Agent to get this name”, or the other option they offer which is “backordering” the domain name?

    I don’t use any of GoDaddy’s services. I don’t know if they have anything to do with the stealing of domain names, but I recommend avoiding them just because in my experience their services are low quality.

    EDIT: for ordering a registered domain try Sedo or Snapnames.com. Check out dnforum.com or namepros.com for more advice on that.

  85. Dale Internet Explorer Windows
    Posted December 27, 2007 at 10:11 pm | Permalink

    Well add me to the list. I already have a website but wanted another domain parked to direct traffic. I checked on a name and sat on it over Christmas and yep, it was taken by MetaPredict. Of course, before I read this site, I tested it by typing in the url seeing where it would go. I hope I didn’t screw up the chance of getting it back in 5 days.

  86. MacGuy Safari Mac OS
    Posted December 30, 2007 at 8:14 pm | Permalink

    Just to add to this thread, I was looking up a domain using Register.com and just had it grabbed by these clowns as well. I’m on a Mac, no spyware, etc. They are either somehow intercepting domain lookups, or they are in legion with the registrars. Oh I found this thread by googling “Metapredict” the same way a lot of people here did after seeing their domain name get jacked.

  87. Posted December 30, 2007 at 10:22 pm | Permalink

    @MacGuy

    If it’s not spyware could it be ISPs selling NDX data?

    I originally suspected spyware because domains were only being stolen on my friend’s Windows computer and not my Linux installs.

    If people who have had their domains stolen could list their ISPs it would be appreciated.

  88. Posted January 1, 2008 at 7:46 pm | Permalink

    Exploiting people through whois data is one thing, but exploiting the Madeleine McCann case is just sick. Here’s excerpts of an e-mail sent to MetaPredict recently:

    “You are a c**t.”

    That’s all for now.

  89. Posted January 6, 2008 at 6:05 pm | Permalink

    Metapredict took my domain the day before I had registered it. The particular name had taken serious research and thought and was specific to my line of business. I wrote an email to the email asking whether they can transfer the domain name to me. Some people don’t mind making others miserable just to become millionaires. It will be their loss.

  90. Posted January 6, 2008 at 10:24 pm | Permalink

    Today I was in the process of registering my name (Doug Soderstrom) as a domain name when I happened to find out that dougsoderstrom.com has already been registered by UtraRPM Inc. DBA MetaPredict.com with MetaPredict as the registrant. So I began asking myself why would someone like UltraRPM/MetaPredict want to register my name as one of “their own domain names?” I am not saying that what has taken place is illegal, but it, at least in that of my own mind, does raise a few questions.

  91. Posted January 7, 2008 at 12:30 pm | Permalink

    I got an email back from the one I sent and have now purchased the desired domain name…

    Here is the email (it is automated because it left out any name after “dear…”

    Dear:

    We are in receipt of your e-mail concerning the domain name
    GOOGLE.COM. After reviewing your email and investigating the
    situation, we have dropped the domain so that you can purchase it in the
    open market, and use the domain as you please.

    Kind Regards,
    UltraRPM, Inc.”

    Hope others have the same luck!

  92. Posted January 8, 2008 at 1:51 am | Permalink

    The domain was stolen by Metapredict. Caused lots of yelling and screaming and unhappiness. I have so much money invested into printed materials with this domain name its not funny. The funny thing is that the company is a small medical office for the underserved people on a small island in indonesia. do they really need my domain name? Really? I want to see someone sue them for this kind of practice. It cause so much grief in family and in patient community.

  93. Burned Internet Explorer Windows
    Posted January 18, 2008 at 3:08 am | Permalink

    Add me to the shocked and kited by UltraRPM/MetaPredict. Only I searched on Jan 14 (through Earthlink’s web hosting check utility) to see if my new domain name was available and it was, so on Jan 15 I called my ISP (Earthlink) and had them register it for web hosting – their confirmation email is dated 1/15 at 10:07 – and tonight when I came home and looked for evidence that my domain had been set up on their servers, discovered an advertising google-like results webpage active at my unusual domain name! I immediately went to http://www.nic.com to check WHOIS – nothing – so I checked WHOIS INTERNATIONAL and discovered these squatters UltraPRM/MetaPredict have registered it for 1 year as of Jan 17 at 13:02 – 2 days after my ISP supposedly registered it during my phone call. Of course I checked it several times over the last two days looking for evidence that ELN had set it up, so created “traffic” (drat!). I have had Earthlink host websites and register domains for me for over 10 years and never had anything like this happen. From NIC WHOIS, I notice that these scumbags are listed with an address in Pasadena California, right around the corner from where I work, so I think I might just stop in on Monday and ask a few questions. I also am speaking at an informatics conference in Washington DC in April, and think a visit to each of my congressional representatives is in order. This is not capitalisim; this is greed and theft. Thank you for your information.

  94. Stella Au Internet Explorer Windows
    Posted January 18, 2008 at 10:24 am | Permalink

    They stole a domain for one of our brands. They are demanding a final asking price of US $2,000!!!!

  95. Mark Internet Explorer Windows
    Posted January 20, 2008 at 3:47 pm | Permalink

    Just happened to me too. Checked a name yesterday through whois.net, went to register it today. Gone. Registered by UltraRPM/MetaPredict. Bastards.

  96. heidi Mozilla Firefox Mac OS
    Posted January 24, 2008 at 10:40 am | Permalink

    I was told by arishost.com that my website was approved. When I called arishost to say my website was not loading correctly they explained that the website was purchased by someone else because I improperly typed my phone number into the phone number field on the registration. Of course the company that purchased the website is none other then metapredict

  97. MEEM ALAME Mozilla Firefox Windows
    Posted January 25, 2008 at 2:17 pm | Permalink

    HERE IS HOW WE CAN GET BACK AT METADATA & GODADDY.

    FIRST CALL THEM AT 1-626-796-1004 AND TELL THEM WE ARE ON TO YOU. THEN CALL GODADDY AND TELL THEM THE SAME. CONTACT ANY NEWS AGENCY OR ….

    SECOND CONTACT THE WEBSITES THAT WRITE ARTICLES ON PROBLEMS LIKE THIS. THIS ISNT SPYWARE THIS IS GODADDY.COM BEING GREEDY AND WORKING WITH OTHER LITTLE COMPANIES TO MAKE MONEY.

    LAST WHEN YOU GO TO CHECK ON BUYING A DOMAIN JUST BUY IT.

  98. Richard Internet Explorer Windows
    Posted January 30, 2008 at 5:12 am | Permalink

    Unfortunatly we were caught out by this as well. For us it could have been catatrophic as it’s our own domain name that was hijack. We thought we has a virus or some adware as we kept getting redirected to CNOMY. It seems to be sorted now as we were able to buy it back but it could have been far worse. The lesson we have learnt is keep an eye on all your Domain names and make sure you buy then before they expire and lock them down so noone can move them or change them.

  99. Posted January 30, 2008 at 9:16 am | Permalink

    Ditto with me… I searched in domainsbot.com and pressed the buy button by mistake. Next day, the domain name was registered to metapredict.com.

  100. Kevin Mozilla Firefox Windows
    Posted February 4, 2008 at 1:48 pm | Permalink

    Also be aware that Network Solutions does a very similar thing, but they have a whois lookup to collect the data. If a website is not already registered, they will buy it and offer it to you for $40, all BEFORE the search is complete!

    Somebody please start one of those petition things so that everyone can sign against this type of theft!!!!

  101. MrPissedOff Mozilla Firefox Windows
    Posted February 5, 2008 at 11:03 am | Permalink

    Where are all the DOS-ers when we need em? Let’s take UltraRPM/MetaPredict down.

  102. dan Internet Explorer Windows
    Posted February 6, 2008 at 11:13 pm | Permalink

    I am shocked that this happened and can only pray I can get it back. I did an AVG search and had over 30 threats: trojan horse downloader.generic6.agde. dont know if that has anything to do with it. btw i mostly used internic and some godaddy and some whois.com

  103. Iowa Guy Internet Explorer Windows
    Posted February 7, 2008 at 2:58 pm | Permalink

    This happened to us, we went to buy a domain, first we checked to see if it was available then went to the Board and said it was available. Went back online and it was registered to Metapredict. BUT…5 days after they registered it, they gave it up! THANK GOD!!!

  104. what-2-do-OH-MY Internet Explorer Windows
    Posted February 9, 2008 at 2:16 am | Permalink

    I use Earthlink as my ISP, used Networksolutions and GoDaddy to search for availability, possibly Dotster also.

    Feb 6, 2008 probably the same day, these Intelectual and Trademark theives took my idea. I was actually supprised that the name was available and did a little shopping around for a low priced host/registration provider on eBay actually asking them if they had the privacy feature to keep my personal contact info discrete… how ironic.

    I also looked for another domain availability using both Dotster and possibly GoDaddy around Mid January trying to take advantage of Dotsters promotion of 99cent/yr domain registration using a ( *.info ) -By the way, the computer I believe I used has AVG updates and scans daily.

    I realized the same thing happened to me twice and started poking around finding this webpage. Thank you and I hope to add more information in regards to this company , how they do this, and how we can make it end.

    Congressmen..ICANN… whoever gets class action suits started…. activists… not sure yet what may be a good strategy, but I am going to ask a friend that has made thier way around the court and legal system in this country, and knows quite a few things about networking AND some laws that may pertain.

    I myself am trying some experiments, and keeping a detailed record. I will most likely post what I am trying and ask others try to reproduce and expand on mine.

    hahaha.. I was thinking, maybe if we all “TRY” to register and abort using domain names of extremely large and protective, even litigiously active corporations.. using all the LESS USED, BUT available domain extensions that might be construed as trademark infringement… such as, Microsoft.?*?, ( .mobi, .tv, .biz, .us .biz* .ws .name* .ag .at .be .cc .cn .de .eu .fm .jobs* .jp .ms .nu .nz .tc .tw .uk .vg ) … hmmm a previous post here, I may have misunderstood, but did they mean to say they tried to register “GOOGLE” ?

    Sony, Apple, Mac, ABC, DISNEY, PayPal ..hey, it’s late for me, past my bed time! hahaha Y’know especially companies that already have a BIG we presence! Then send messages to contact representatives of these companies, giving them a “heads UP !” , and maybe one of them will start legal proceedings.

    Sincerly,
    OH-MY!

  105. what-2-do-OH-MY Internet Explorer Windows
    Posted February 11, 2008 at 9:46 pm | Permalink

    I ran an experiment. I use Earthlink ( the may be selling log files to UltraRPM for domains that don’t resolve when a earthlink user types them into the address bar ).

    I experimented with the address bar, GoDaddy, and Dotster – three days in a row.

    ~~~~~
    typed in these made-up names in GoDaddy,

    tired-meat-balls
    inspiredlaundry
    bear-folks
    take-bath
    daddydaddygo
    ~~

    and in Dotster I typed,

    suckersays
    ladyladyhello
    currygoop
    currytaste
    cellstarz
    ~~~

    And in the Address Bar,

    loadcheese.com
    fastgamerppl.com
    yahoome.com
    bakebakecrazy.com
    clientjokers.com
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    DAY TWO, same results, domains were available or didn’t resolve….

    DAY THREE — Struck oil!!!

    GoDaddy and Doster were “clean” those domains were still available. But the prospective “domains” I made up and put in the Address Bar, most have been registered!!!

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    SO, IF ANYBODY READING THIS WANTS TO SNARE THESE GUYS INTO SPENDING MONEY on domains that have traffic, we should creat traffic for a bunch of stupid domain names. Forward them in email for your friends or family to click on these “tasted” links also. In addition, if they try this within the 5 day grace period, they might also click on one of the advertised links. But not much more than that because ULTRArpm will then generate significant revenue for those advertisers, making this a viable practice.

    ~~~~~~~~~

    Please let me know if you appreciate and want to participate in this effort.

    alow 37796 ( at ) mypacks.net

    thats the email address, (no spaces, and of course use the @ symbol, not the word “at”, or the parentheses ! )

    ………and forgive me if I am mispelln eny stuf!

    Thanks thanks thanks

  106. Posted February 12, 2008 at 2:58 am | Permalink

    @what-2-do-OH-MY

    Did you scan your computer with AVG Anti-Spyware? What were the results?

    Could you please try booting up a Linux live CD and try the same experiment to see if it is your operating system or if it’s the ISP?

    Or alternatively have someone connect with a Mac on your Internet connection and try the same experiment?

  107. my2cents Mozilla Firefox Windows
    Posted February 17, 2008 at 2:01 am | Permalink

    My domain was also “stolen” by MetaPredict and thankfully was released ~5 days later. After reading some of the comments above, I decided to run my own little test too.

    I performed a whois lookup on some made up domain names that I knew weren’t registered.

    whois.sc 02/12/08
    —————–
    ubuntutheories.com
    meowservices.com
    beingtallproductions.com
    cigilivery.com

    godaddy.com 02/12/08
    ——————
    loudmeows.com
    verysharpclaws.com
    roomfullofrockingchairs.com
    taffeon.com

    firefox address bar 02/12/08
    ——————
    koooties.com
    moremadeupwords.com
    laughstudios.com
    mochastripes.com

    Results: 02/14/08
    The domains I looked up using whois.sc and godaddy.com were still unregistered, but ALL the domains I looked up in my firefox address bar were registered by MetaPredict.

    After seeing this, I scanned my PC with AVG Free Anti-Virus (found Trojan horse PSW.OnlineGames.ADUS). I also scanned with Ad-Aware (no viruses found) and AVG Anti-Spyware (this one found over 30 viruses that were hidden in my “System Volume Information” folder).

    After removing all known viruses, I performed the address bar test again, this time in both firefox and IE, checked 2 days later, and none were registered!

    I can finally rest in peace. Hope this helps.

  108. Posted February 17, 2008 at 2:53 am | Permalink

    @my2cents

    Thanks for running that test. The results are very interesting.

    I’ve been leaning towards the idea that ISPs are selling people’s data, but there have been mixed results. If you have your spyware scan logs could you please email them to me?

    It would be useful if someone who is getting domains stolen on a spyware infected machine could run a sniffer on the traffic to see what information the spyware is sending.

  109. my2cents Mozilla Firefox Windows
    Posted February 18, 2008 at 7:20 pm | Permalink

    @Josh

    I couldn’t find any logs, I’ll try to keep them next time. Also, my previous test has failed. I’m apparently still infected. :(

    firefox address bar 02/14/08
    ——————
    mochaservices.com
    jinrocompany.com
    seaez.com
    haircombsolutions.com
    spotsicle.com

    This is from when I re-tested after removing the viruses found earlier. Only the domains from my firefox address bar were affected, and not the ones from my IE address bar. Perhaps it’s a firefox addon that is harvesting the information. I’ll continue to check the ones I’ve tested in IE, and will also run some more tests and will report back here when I get results.

  110. my2cents Mozilla Firefox Windows
    Posted February 18, 2008 at 7:23 pm | Permalink

    Just to clarify, all the domains from when I re-tested firefox address bar 02/14/08 are registered to MetaPredit.

  111. Posted February 22, 2008 at 10:01 pm | Permalink

    Same thing happened to me…but with Register.com…and it was 1 day before my AVG software removed: trojan horse dropped.generic.RGQ. AVG details added TCN after generic…This is a bunch of crap…so I have decided to register dumb@ss names to throw them off my domain name that I want back!!!! Metapredict sucks!

  112. my2cents Mozilla Firefox Windows
    Posted February 23, 2008 at 4:34 pm | Permalink

    Update:

    I retested under the original FF (FireFox) profile, as well as a new FF profile, IE (Internet Explorer), whois.sc, and godaddy.com. I waited for a few days, checked all the domains, and none were registered, not even the ones from the original FF profile. This was a complete surprise, and it tells me that it’s not related to my ISP nor an FF addon. It’s probably spyware that was installed while visiting some website(s), which effected my browser.

    Before retesting, I ran the following programs:

    - AVG AntiVirus: No viruses found.
    - AVG AntiSpyware: Found some spyware junk.
    - AdAware: Found some spyware junk.

    I think many of you can attest to this, but usually anti spyware programs (especially AdAware) will always return some miscellaneous junk, and we all just assume it’s nothing more than junk, but we have it cleaned anyway as safe precaution. Sometimes it’s more serious, but most times it’s just something like harmless cookies.

    I guess the question now is, which one of those “harmless” pieces of junk is responsible for harvesting data for MetaPredict.

    My only conclusion is that some time ago, an unfriendly website must have installed spyware on my computer which allowed MetaPredict to do this. That would be for the first time around. And for the second time, I have a feeling it was because while I was researching who they were I must have visited a website that re-infected me, and I’m willing to bet it was metapredict.com that did it.

    I don’t know if I have anymore energy for this. My advice for anyone seeking is to use AVG AntiSpyware and AdAware, and to avoid metapredict.com, and to perform a scan every so often. Good luck!

  113. SpiritsDancing Internet Explorer Windows
    Posted February 27, 2008 at 9:11 pm | Permalink

    Wow! I’m so thankful I found this blog! About a year ago, I had hoped to reserve a domain name using my real first name, and as some have noted above, it’s a very unusual name so I naturally figured, who else would want it? The first time I looked, it was still available. A month later (around March), it was registered at GoDaddy to some strange entity. I saw that it was due to expire in May, so on that same day in May, I checked back and it had been renewed for another year. I was puzzled and of course, disappointed.

    Out of the blue last week, I decided to see if someone had posted a website with that domain name, and it referred to one of those “this domain might be for sale” ads. I checked WHOIS and bingo, there was Metapredict. They’d registered the site on 2-17-2008. I’d never heard of them and when I googled “metapredict,” it led me here.

    I was shocked to read all the horror stories, but equally glad to learn that there was hope it might be released in five days if there was no further traffic.

    I resisted all temptation and on Saturday, the 22nd (the morning after Day Five), I went straight to a domain name registrar and tried to register it. It was available and I can happily report that I now have it secured, along with the .net and .org versions as well.

    I cannot begin to thank you and the others who have posted here for the advice. I can only hope Metapredict will find itself on the losing end of a class action lawsuit one of these days. I wish you all the very best.

  114. Sarah C Internet Explorer Windows
    Posted March 1, 2008 at 7:06 am | Permalink

    I am based in the UK. Between checking our desired domain name was free and instructing our web company to purchase it, Metapredict registered it instead.

    We have now managed to register it back to us, and have been greatly helped in this by comments from others on this site. Thank you for your help.

    To add our experience: Do not visit the site or click on any of their links (obviously)

    Don’t bother to contact them (we did by email and phone to no avail)

    Be clear about when the 5 day period is up and be ready to register then.

    Our website company assumed that there would be the usual 30 day cooling off period after the site was released before we could purchase it (normal when someone else has owned a site) but infact this 30 day period does not apply in cases where the domain name has been returned after only 5 days.

    Our website domain came up for sale four hours AFTER the end of the fifth day, so be prepared.

  115. BALAN Mozilla Firefox Windows
    Posted March 25, 2008 at 11:59 am | Permalink

    I tried a some urls to find out that which names are not registered by using web browser mozilla firefox. And find some urls are unregistered and it was shown by megaclick website. Within a day I found that urls are registered in metapredict. Then only I assume that the only possiblity of stealing that urls are by megaclick(the megaupload byproduct addon).Then I send a email to mozilla firefox about this scam and I complectely erase the addon megaupload. The giants like Mozilla firefox could not allow this cheap stealer(megaupload addon)and give permisson for their addons. This will stop lot of scams in future.

  116. Posted March 26, 2008 at 4:18 am | Permalink

    Hi everyone,

    Thanks for leaving your comments. Here is an update on UltraRPM d.b.a. Metapredict:

    It looks like UltraRPM (Metapredict) is funded by Maples Investments (Mike Maples, Jr.). Maples Investments also appear to back Digg and Twitter.

    Here is a screenshot – click the image for a full list view:

    Ultrarpm, Maples Investments

    If you would like to complain directly to Mike, send a message about what you think about UltraRPM / Metapredict to mike@maples.net (the email address on his Web site).

    Another apparent investor in UltraRPM is Tugboat Ventures. You can complain to Dave Whorton at the email address listed on his site: ideas@tugboatventures.com

    UltraRPM is also listed on this page (“Start-Up Resources has set up 100+ startups”)

    Don’t forget that you can also call UltraRPM at +1 (626) 796-1004 and/or email trent@metapredict.com.

    Good luck in getting your domains back.

    To read more about UltraRPM on PocketSEO click here. See also the new post on RookAnalytics.com which appears to be another one of their sites.

  117. Posted May 6, 2008 at 1:12 pm | Permalink

    Update: It looks like Maples Investments has removed the mention of UltraRPM from their portfolio.

    Current screenshot (6 May 08) of Maples Investments’ portfolio with the UltraRPM listing now gone:

    Image of Mike Maples Investments' portfolio

    Does anyone know if they still invest in UltraRPM, or has Maples Investments abandoned support of the company?

  118. TommyWillB Mozilla Firefox Mac OS
    Posted June 3, 2008 at 9:41 pm | Permalink

    Note that GoDaddy is the registrar for UltraRPM.com:

    http://www.networksolutions.com/whois/results.jsp?domain=UltraRPM.com

    However ULTRARPM INC. is also their OWN REGISTRAR!

    http://www.networksolutions.com/whois/results.jsp?domain=metapredict.com

    So this means they have direct insight into the master domain name servers.

  119. Posted June 18, 2008 at 12:42 am | Permalink

    I haven’t seen many searches for metapredict or ultrarpm lately. I wonder if they are still in business, or if they are using a different business name to register people’s domains.

    Was their business model killed by Google or ICANN?

    Has anyone here noticed domains being taken by a different registrant?

  120. Ben Safari Mac OS
    Posted December 19, 2008 at 8:02 am | Permalink

    Fight Fire with Fire

    These people are domain tasting and then returning the domains after the five day grace period. Why not do the same thing with domains you are considering? Make a list of domains you might want. Register them all. Then decide which one you really want to use and return the rest. Make a habit of working your possible names out on paper before you ever type them into a browser, godaddy, etc.

  121. Posted May 13, 2009 at 12:56 am | Permalink

    Awesome research tactics. I often suspected that this was done.

  122. chicago Mozilla Firefox Windows
    Posted August 6, 2009 at 6:20 pm | Permalink

    I searched several domain names to see if they are available and when I picked one that sounded the best on godaddy.com I entered all my personal information such as name and address to get my desired domain ( which was available ) and register it.

    I lost internet connection briefly, and when I logged in back to continue with registration – within a matter of minutes – my CHOSEN domain was registered under MY NAME and someone else’s address.

    The registered information was as following:

    [Querying whois.internic.net]
    [Redirected to whois.melbourneit.com]
    [Querying whois.melbourneit.com]
    [whois.melbourneit.com]

    You see here melbourneit.com? This was a page I was looking previously before going on godaddy.com It is possible that page was minimized on my screen while I was on godaddy.com doing search. However melbourneit.com could not have my name to register anything if godaddy.com did not provide my personal information during the registration to them.

    Until I accessed godaddy.com even when I was on melbourneit.com nothing was registered.

    It was registered only AFTER I provided my name at godaddy.com. So it is clear that godaddy.com has something to do with it after I searched for domains on their website.

    Here is the example:

    Creation Date…….. 2009-01-04
    Registration Date…. 2009-01-04
    Expiry Date………. 2010-01-04

    The date was incorrect. It was set back a few months earlier.

    Organisation Name…. MY PERSONAL INFORMATION WAS POSTED HERE ( MY ACTUAL NAME )

    Organisation Address. PO Box 61359
    Organisation Address.
    Organisation Address. Sunnyvale
    Organisation Address. 94088
    Organisation Address. CA
    Organisation Address. US

    This is their address and the rest of it is their information.

    Admin Name……….. Admin PrivateRegContact
    Admin Address…….. PO Box 61359
    Admin Address……..
    Admin Address…….. Sunnyvale
    Admin Address…….. 94088
    Admin Address…….. CA
    Admin Address…….. US
    Admin Email………. contact@myprivateregistration.com
    Admin Phone………. +1.5105952002
    Admin Fax…………

    My name was provided against my permission.

    Instead of calling, I simply registered another domain with better company and decided not to do business with godaddy.com. I also made sure to tell other people not to search for domains on their website.

    Out of curiosity I searched who and what is behind this godaddy.com scam. I found out things that I did not know which surely influence my decision with whom I will do business and spend my money, and after I experienced myself things that should not have happened that I explained here, I came to a conclusion that company godaddy.com isn’t professional nor honest.

    ( according to my research CEO of godaddy.com allegedly approves of torture to obtain information, the fact that my desired domain name was taken during search on go daddy.com by another identity almost instantly, godaddy.com provided my personal information to other, other identity registered my desired domain using my name and their I address ).

    I think our President Barack Hussein Obama ( and whoever registered his website with godaddy.com ) should transfer his domain to some other hosting company and do something about it, helping people about this problem is very important!

    Registering my desired domain name on my name under someone else address is beyond my mind!

    If anyone in legal field is reading this, I hope they can collectively do something about it. My contact information is provided. I hope somebody does something about it.

  123. Posted August 6, 2009 at 9:17 pm | Permalink

    @chicago

    Have you considered the possibility that you might be the owner of that domain name? Check your credit card statement.

    Did you enter any information into melbourneit’s website?

14 Trackbacks

  1. By Does Domain Hijacking Spyware Exist? - HTNet on May 21, 2007 at 11:12 pm

    [...] was reading this post on Pocket SEO, and think that I should share it with my [...]

  2. [...] Actually it’s UltraRPM doing business as MetaPredict. Someone else had a similar experience here. The company has over 360,000 domains registered under them. The question really boils down to who [...]

  3. [...] happened to that domain name, I also found couple of guys also had this bad experience before on Josh’s SEO blog. It tells that the domain name has been stolen. And they seemed to have answers that the company [...]

  4. By Pocket SEO - DomainRenewalOnline.com Scam on August 13, 2007 at 4:47 pm

    [...] in the series on domain scams is the story of [...]

  5. [...] mentioned in my previous post, Is Spyware Stealing Your Domain Names?, Metapredict.com / UltraRPM.com is a company that is mysteriously stealing people’s domain [...]

  6. [...] gotten a large response from my original post on UltraRPM, and wanted to write a little more about what I’ve found in my research on this [...]

  7. [...] read more | digg story [...]

  8. [...] Is Spyware Stealing Your Domain Names?: After reading this article you’ll want to double check your computer to make sure you don’t have any spyware infections that could be siphoning your business. [...]

  9. [...] day period, some company decided to register the domain through Verisign. Finally, I stumbled upon this. The same company (Metapredict) was the one stealing my domain! What am I hoping to do? Wait out [...]

  10. [...] friend of mine experienced the domain tasting problem, we have searched for the company and found this and similar posts. In that moment we knew that domain tasting company have bought the [...]

  11. [...] Domain tasting is a serious problem and has led to issues like the ones mentioned in my article on metapredict.com. [...]

  12. [...] I believe it’s called domain tasting . Like NetSol but worse as you don’t even need to do a search on their site – Don’t know how they’re getting them – not clear if malware or other parties are involved – but it’s happening. Found this on the issue: http://pocketseo.com/domains/7 [...]

  13. By Is Rook Analytics Metapredict? - Pocket SEO on March 24, 2008 at 2:38 am

    [...] was mentioned in a comment on my Metapredict post. Basically, they are a company that swipes peoples’ domain names right [...]

  14. [...] only gotten a partial return of my rankings though, because I am at #97 for a search for “metapredict” when I used to be [...]

Post a Comment

Your email is never published nor shared. Required fields are marked *

*
*