Lapsed domain registration allows spammer to hijack site
Alameda Police officers were dispatched to the Mastick Center on Thursday November 2, and readers of the Mastick newsletter from Alameda’s Recreation and Park Department (ARPD) noticed an unusual statement in the most recent issue sent last Friday.
“When searching for the Mastick Senior Center website, please use this link below ONLY: www.alamedaca.gov/Departments/Recreation-Parks/Mastick-Senior-Center. This ensures that you will receive the most accurate and up-to-date information regarding Mastick Senior Center programming.
Also, please DO NOT visit or donate to the following website: mastickcenter.com
It is no longer affiliated with the City of Alameda Recreation and Park Department.”
A cursory view of the now-disavowed site shows a front page like the site design that has characterized the site since it first launched in 2016, with bright photos of the center and members appreciating the programming and services. But the date in the upper right corner is from September 2022.
And when you click on some of the links in the navigation bar, the once-familiar pages are a mishmash of text links for hard-core pornography, erectile dysfunction medications, baldness treatments, and other drugs, rather than information about the Center and their programs. Some pages remain untouched, but others are just a wall of illicit spam ads.
Domain hijacking comes to Alameda
How did this happen? Neither the City nor ARPD are in the business of pornography or illegal drug sales, and they did not condone the changes to the site. What seems to have happened is that the registration of the domain name mastickcenter.com, which has been held by the City since 2004, was not renewed when it expired on March 21, 2023.
Subsequently, another organization purchased the domain, set up a cloned version of the original website on a new server, and altered the content to try and make a few dollars off confused internet users. This is a practice called domain hijacking, and happens often when a website’s domain becomes available, even if the site is targeted at a small audience or has low levels of traffic.
Our research was not able to determine the name of the organization or person who registered the site. The only available public information states that the domain was registered with GoDaddy on March 23 of this year and will expire on February 6, 2024. The hijacked spam version of the site is hosted on a server that also hosts 826 other websites. At this point, there is little the City, ARPD, or the APD can do to prosecute the domain hijacker, nor to force them to return the domain to the City.
However, there remains a small chance that the City and ARPD will be able to get control of the mastickcenter.com domain again. Once a domain name is registered, it’s available exclusively to the registrant until their registration lapses. If the spammer loses interest and decides not to renew in March 2024, an agent of the City could purchase it. But as long as the hijacker(s) pay the registration fee, they remain in control of mastickcenter.com
Don’t try this at home
Curious web users might want to go and check out the carnage at mastickcenter.com for themselves, but I would strongly caution against it. Even accidentally clicking on any of the spam links displayed on the site could expose your device to viruses or malware, and it’s just not worth the risk.
Please follow the advice of ARPD and visit www.alamedaca.gov/Departments/Recreation-Parks/Mastick-Senior-Center for all your Mastick information needs.
Adam Gillitt is the Publisher of the Alameda Post. Reach him at [email protected]. His writing is collected at AlamedaPost.com/Adam-Gillitt.
