Sulit.com.ph redirected to Sedo

Earlier today, a friend texted me asking what happened to Sulit.com.ph, the free classified ads site and forum. The site appears to have expired and has been put on sale at Sedo.

I did a quick whois query on the domain registration and some more background checks which led me to believe it was a malicious and successful attempt to take over the domain.

The domain is still registered up to July 26, 2010 so this is not a case where the owner just forgot to renew a recently expired domain. Besides, an expired domain will show a generic dotPH landing page for about 30 days after expiration. It should not have pointed to Sedo.
It wasn’t a case of poisoned DNS as well since the whois record showed the nameservers were changed from ns1.sulit.com.ph and ns2.sulit.com.ph to that of Sedo. Since nameservers were self-hosted, a poisoned DNS would still show a sulit.com.ph NS with a Sedo IP address. This doesn’t seem to be the case.
A cracked/hacked dotPH Domain Manager account by the owner of Sulit.com.ph is the most probable cause. The malicious individual could have gained access to the dotPH account, changed the password and re-pointed the domain to Sedo.

Sedo has nothing to do with this. They are just a domain parking and marketplace service. People use Sedo to generate revenue from traffic of unused domains or as a marketplace to sell some high-profile domains.

How the intrusion was done is still unknown but it could have been one of several ways.

A brute force attack on the password. It could also have been guessed by the intruder after numerous attempts. It depends how strong the password is.
A bug in the Forgot Password system of dotPH. The login email is readily available/searchable and all that is needed is to correctly answer the Password Question.
Social Engineering. The individual, to gain access, might have submitted a formal request for change of Primary Email by forging the request form. A notarized form and signature can be forged and the individual might have pretended that he’s the owner of Sulit.

I believe dotPH is also doing their own investigation of the incident. They’ll be the only one that can clarify how it all happened. There’s a similar case last week that happened to MakeUseof.com.

Abe Olandres

Abe is the founder and Editor-in-Chief of YugaTech with over 20 years of experience in the technology industry. He is one of the pioneers of blogging in the country and considered by many as the Father of Tech Blogging in the Philippines. He is also a technology consultant, a tech columnist with several national publications, resource speaker and mentor/advisor to several start-up companies.

https://www.yugatech.com

27 Comments

Mike Abundo says:

16 years ago

Maybe the owner just gave up on the Philippine online bargains market.

All things considered, I wouldn’t blame him.
- Reply
RJ says:

16 years ago

Here is our official announcement that is being updated as we get additional information:

http://www.sulit.com.ph/forum/viewtopic.php?t=41415

For those being redirected to sedo, please use this:

http://67.228.219.34/forum/viewtopic.php?t=41415

@Sir Mike
There are too much opportunities in the online bargains market (or classifieds in general) just to give up.

@Sir Abe
Thanks for the great analysis of the different possibilities. I hope domains.ph will be able to clear this issue. I’ll be surprised if they can do it before Monday next week.
- Reply
Patrick says:

16 years ago

Works fine to me now.

http://www.sulit.com.ph/

A link to the said site in the article would have been nice. Interesting analysis though. :)
- Reply
Patrick says:

16 years ago

My previous comment got caught by Akismet because I linked to the website in question?

But anyway.. the site works fine to me now.

A link to the said site in the article would have been nice. Interesting analysis though. :)
- Reply
Abe Olandres says:

16 years ago

@RJ – let us know of any new developments.

@Patrick – it’s not resolving from my end so I didn’t want to send any more traffic and link to the Sedo page.
- Reply
Andre Marcelo-Tanner says:

16 years ago

want to find out who it is, find out who added it to their sedo account
they know who added it.
- Reply
Gwapito.com says:

16 years ago

The culprit is Bayantel subscriber, so it could not be me. I use Globelines. :D
- Reply
Naya Nalasin says:

16 years ago

Wow, great analytic article. It considered several possibilities. And you were right on the domain hacking, as discovered later by Sulit admin.
- Reply
Jaypee says:

16 years ago

When I read the first part of the article I immediately thought about what happened to MakeUseOf.com, didn’t know you’d also mention it at the bottom of the post.

Anyways, this is a good reminder to all blog/domain owners to be vigilant and make sure that you keep your passwords strong and safe.

Good thing Sulit.com.ph is back online and to its rightful owner.
- Reply
charles says:

16 years ago

Losing a website in a blink of an eye is a very big loss to the owner of that said website. I am currently backing up my accounts to prevent a total loss.
- Reply