Is My Namecheap Account Hacked?

[Ken Strong]

Had a strange thing happen today... got a series of emails this morning giving me info about a hosting package I had signed up for at Namecheap. Only thing is, I didn't sign up for anything like that.

I do have an account at Namecheap, but only for domains. The email summary of the order shows the last four numbers of the cc that was used, and it's definitely not mine.

They could have gotten most of my contact info through Whois, but wouldn't they need my login info to open an account like this?

Sorry if this is a stupid question, but I've had a support ticket in since this morning marked "critical" and they haven't gotten back yet. Anyone else ever have something like this happen, or maybe someone who's more technically savvy has some insight into this...

Thanks!

[Dan C. Rinnert]

Did you see anything odd inside your NameCheap account? Did you change your password to be on the safe side?

Did the eMails give you any additional clues? A name or domain name or anything? I wonder if it could be something where someone entered their eMail address incorrectly and put yours in by mistake. By that, I mean it wouldn't be too much of a stretch to imagine KenStromh@email.dom accidentally typing KenStrong@email.dom. I've seen similar things happen before.

[Ken Strong]

Originally Posted by Dan C. Rinnert

Did you see anything odd inside your NameCheap account? Did you change your password to be on the safe side?

Did the eMails give you any additional clues? A name or domain name or anything? I wonder if it could be something where someone entered their eMail address incorrectly and put yours in by mistake. By that, I mean it wouldn't be too much of a stretch to imagine KenStromh@email.dom accidentally typing KenStrong@email.dom. I've seen similar things happen before.

I did change my password -- yes, the account is associated with a domain I purchased last week. Normally I take the privacy option but I left this one open because I was thinking of flipping it and wanted people to be able to contact me. My username is also in the emails, so seems like they had to have access to my account?

I talked to Namecheap's online chat briefly, and they told me to open a support ticket -- strange and lackadaisical response for such an odd situation, it seems to me. Maybe they think I'm trying to pull a fast one...

[Dan C. Rinnert]

Originally Posted by KenStrong

I did change my password -- yes, the account is associated with a domain I purchased last week. Normally I take the privacy option but I left this one open because I was thinking of flipping it and wanted people to be able to contact me. My username is also in the emails, so seems like they had to have access to my account?

I talked to Namecheap's online chat briefly, and they told me to open a support ticket -- strange and lackadaisical response for such an odd situation, it seems to me. Maybe they think I'm trying to pull a fast one...

That's definitely very odd. I don't think the username is shown publicly anywhere so, if that's true, the only way someone would know it is to have access to the account or make a good guess.

But, is there nothing inside the account itself that says you signed up for hosting?

Maybe it was a technical glitch that accidentally sent you the eMail instead of whoever actually signed up for hosting. In that case, it might not be hacking but a technical issue and that could be why they're not taking more rapid action.

At any rate, sounds very strange to me.

[Ken Strong]

Originally Posted by Dan C. Rinnert

But, is there nothing inside the account itself that says you signed up for hosting?

Yes, after getting the emails I went into my account and the hosting is listed in there as active. I guess it could be a technical glitch of some kind, but I can't figure out how it would have happened.

Thanks for your input, Dan.

[Dan C. Rinnert]

Originally Posted by KenStrong

Yes, after getting the emails I went into my account and the hosting is listed in there as active. I guess it could be a technical glitch of some kind, but I can't figure out how it would have happened.

That is very very odd. I suppose it could be a hacker carding a stolen credit card number, but there would be ways of doing that that wouldn't leave a trail. That'd be an odd glitch too, though stranger things have happened.

Keep us posted. I'll be interested to learn what NameCheap has to say.

[Michele Miller]

The other day while I was on namecheap they warned about a phishing attack on many of their customers, and to not click on the link in the emails. It sounds like that's what it was.

[MizzCindy]

You know, if they don't get back to you in a reasonable amount of time, I'd tweet them as well (@NameCheap). That doesn't sound kosher and I would want some sort of resolution sooner rather than later.

Good luck!
Cindy

[ExRat]

Hi Ken,

Kind of similar to what Michelle is saying, have you checked over the email to make sure it is actually from namecheap and not a spoof?

(When signed into your account, is it actually showing signs that you have a hosting account with them?

Presumeably there would be a link inside the account to your new hosting account?)

Edit - Oops just noticed you've already confirmed this. I'd go with either a technical glitch, or Michelle's theory that you have been compromised previously. Personally, I would assume the support person was off the ball, and I would try them again, emphasising that if you HAVE been compromised, you want it sorted ASAP because they could transfer domains and you would have issues getting them back.

[Ken Strong]

Well, now someone's created an account at APlus for me, as well as successfully changed my Clickbank password.

They're using their own credit card, and I'm getting the emails with the new passwords, etc. so I can't figure out what the point is.

I have Spybot, Zone Alarm, and A-Squared all running... nothing suspicious reported in my computer. Is there something else I should be checking? Or is this just someone's idea of a joke?

[Dan C. Rinnert]

Originally Posted by KenStrong

Well, now someone's created an account at APlus for me, as well as successfully changed my Clickbank password.

They're using their own credit card, and I'm getting the emails with the new passwords, etc. so I can't figure out what the point is.

I have Spybot, Zone Alarm, and A-Squared all running... nothing suspicious reported in my computer. Is there something else I should be checking? Or is this just someone's idea of a joke?

Are you sure they successfully changed your Clickbank password? When you change (or forget) your Clickbank password, you have to fill out a form with your username and eMail address. But, to activate the new password, you have to click a link on the eMail they send you.

It's possible someone knows your username and eMail address and could have submitted that form, but if the eMails are coming to you, they would not have been able to confirm the change.

[Ken Strong]

Originally Posted by Dan C. Rinnert

Are you sure they successfully changed your Clickbank password? When you change (or forget) your Clickbank password, you have to fill out a form with your username and eMail address. But, to activate the new password, you have to click a link on the eMail they send you.

It's possible someone knows your username and eMail address and could have submitted that form, but if the eMails are coming to you, they would not have been able to confirm the change.

Right, that's why I'm not terribly concerned about this, but it's still a bit creepy, since at this point it appears to be more than a simple glitch at one website. And I don't know enough about computer security to know whether there's anything else I should be paying attention to.

[Sfrew]

I have had very good service from namecheap over the years, so I would expect they will try to determine the problem and take fairly prompt action.

I tend to believe this is a technical glitch of some sort rather than a hack because obviously someone bought the domains and they actually turned up in your account as I understand it. That does not sound like an attempt to rip someone off, because the domains actually were received in the name they were supposedly purchased under. Now, if domains were disappearing, that would sound more like a rip-off.

[Dan C. Rinnert]

I wonder if it's possible to setup an account at Namecheap using your eMail address but a different login? That way, the confirmation eMail would go to you. But, then would that transaction show up in your existing account? Is there some overlapping of accounts based on eMail address, thus you can see that transaction and maybe the other person can see what's in your account?

Doesn't seem likely, but this is very strange. If you were hacked, you'd think they'd be doing more than setting up accounts in your name.

Maybe they are doing this to hide their activities? Does anything you've received tell you the domain names being used on these accounts? I wonder if these are phishing or fraudulent sites, being set up under your name, being paid for with (perhaps) a stolen credit card number.

[Ken Strong]

Originally Posted by Sfrew

I have had very good service from namecheap over the years, so I would expect they will try to determine the problem and take fairly prompt action.

I tend to believe this is a technical glitch of some sort rather than a hack because obviously someone bought the domains and they actually turned up in your account as I understand it. That does not sound like an attempt to rip someone off, because the domains actually were received in the name they were supposedly purchased under. Now, if domains were disappearing, that would sound more like a rip-off.

It was a hosting account that was created for me at Namecheap, nothing to do with domains... and I updated above that the same thing has happened through a couple of other sites, so it doesn't appear to have anything to do with Namecheap itself.

[Dan C. Rinnert]

Originally Posted by Sfrew

I tend to believe this is a technical glitch of some sort rather than a hack because obviously someone bought the domains and they actually turned up in your account as I understand it. That does not sound like an attempt to rip someone off, because the domains actually were received in the name they were supposedly purchased under. Now, if domains were disappearing, that would sound more like a rip-off.

A glitch doesn't explain why they tried to change his Clickbank password, assuming, of course, that the two incidents are related.

[rosetrees]

Ok - probably a totally daft suggestion. You didn't discuss some kind of JV with someone, did you? Could they be setting up hosting accounts, assuming that you are both going to be producing sites for the project.

Sorry if this sounds totally off the wall.

[cashcow]

They're using their own credit card, and I'm getting the emails with the new passwords, etc. so I can't figure out what the point is.

So it's like the opposite of getting ripped off? They're actually buying accounts for you?

[Ken Strong]

Originally Posted by rosetrees

Ok - probably a totally daft suggestion. You didn't discuss some kind of JV with someone, did you? Could they be setting up hosting accounts, assuming that you are both going to be producing sites for the project.

Sorry if this sounds totally off the wall.

No, that wouldn't be it...

Originally Posted by cashcow

So it's like the opposite of getting ripped off? They're actually buying accounts for you?

I guess so... seems weird.