It all started bright and early, before the kids even got up, while I was enjoying my first cup of coffee in a quiet house, with an automated email telling me that my domain, www.theinklingsoflife.com would auto-renew in something like 2 weeks. The email said I didn't need to do anything, just sit back and continue to own The Inklings of Life with a smile on my face and not a care in my world (well, not in those exact words, but you get me).
I never trust auto-renew stuff, so, like I do every single year, I went to log into my account to manually renew my domain so that I could rest assured that Inklings would remain mine.
Only... Wait. Why is it saying that my email address isn't registered to admin my domain? That's funny. Maybe I typed it in wrong. Maybe my caps lock was on when I entered my password.
Nope. Still saying that my email address isn't set up as the admin to my account. Okay, breathe. Let me find the email associated with my domain registration and double check... yep. My email address is the email address for the admin of my website. Hmmm. Let me check the forum and see what's up.
Sweet. I can sneak in the backdoor of my account with this generic admin email address, reset the password and get this said and done, just like the help forum said.
WHAT? GENERIC ADMIN EMAIL HAS BEEN DELETED FROM MY ACCOUNT?? What the... I didn't even know about the generic admin email until I read the help forum, so how in the hell could I have deleted it?
Panic seriously set in at this point. My brain raced with possible next steps.
The section of the website that handled the money associated with my domain renewal last year. That's it!! I
logged in, found the receipt for last year's renewal, just click the link here, and...
Error. Subscription does not exist.
The fuck it doesn't exist. I just got the email from this company saying my domain subscription would auto-renew. How does the subscription not exist if it's supposedly going to auto-renew in 2 weeks? Oh, hell no, where's the customer service number...
After explaining everything to the dude on the customer service line, he put me on hold for what felt like forever. He came back and told me there was nothing he could do, that I'd have to talk to the people who run the admin section. Okay, fine, but can you at least tell me why I got the email saying it would auto-renew and now it's saying there's no subscription? Nope, he can't explain it, and I just need to call the admin people as soon as possible.
Oh hellfire. As soon as possible sounds bad. Really bad.
I call the admin people, and I need a pin number to speak to a human being. I can find the pin number in the admin section of my account.
Hey, assmunch. I can't get into the admin section of my account because, at this point, I'm 99% sure I've been hacked. So, I press 0 to speak to an operator like on every other customer service line in the world.
"We're sorry, that is not a valid pin number." "No shit, Sherlock. I don't have a pin number, just let me speak to a human being," I yell into my phone.
The automated recording goes on to explain where I can find my pin number, and if I didn't have a pin number, I'd have to send in an online ticket like everyone else.
I need my pin number in my admin account to talk to a person about how I can't get into my admin account. Catch 22 anyone? FML.
At this point, I'm in tears. Hubby is waking up, asking me what's going on, to which I burst into tears and crumble in his arms. I tried explaining everything through sobs, and he just held me. Someone had hacked into my admin account, deleted my subscription, and blocked me from taking control again. 3 years of work on Inklings was disappearing before my eyes.
I regained my composure and sent in the online ticket, complete with screenshots showing the error messages I was receiving. While I waited for a reply, I went ahead and called the domain registrar company, even though I thought chances were slim to none that they'd be able to help, because the company my account was with just used them to secure the domain address. I didn't actually have an account with them.
That guy was awesome. Unfortunately, just as I had thought, there was nothing they could do without the pin number to identify me as the admin. But, he put my mind at ease by explaining to me that once the domain expired, I had 12 days to renew it without penalties, and that's me and only me. If I don't renew it in the 12 days, I had another 30 days to renew it with penalties. So, that gave me a 42 day window to regain control of my website before some asshole bought it out from under me.
Unless, of course, the person was posing as me. Which, I didn't find out until a few hours later, was the case.
I calmed down a bit (not knowing the info yet that the person posed as me) and had breakfast with my family and took Ariya to the doggie park. While at the park, my email alert sounded. My troubleshooting ticket had a resolution.
We raced home, where I read the mail and followed the directions just as it said. They had seen that the email address I was using was the one I set up the account with, and one that they had previously verified was me. So, they reset the admin password on their end, added my existing email back to the profile (as it had been deleted) and sent me the current admin log in email being used. That's when I realized someone was posing as me, as they used my name in the email (something I never do). At this point, though, they had been locked out, and I was back in.
I sent a reply email to the troubleshooting crew, asking if it looked like everything was done on their end, and about 15 minutes later, my phone rang. The amazing lady who helped me through this was calling me, putting my mind at ease that everything was under my control again, the admin log in was mine again, and gave me some info on preventing this from happening ever again.
Apparently, it looked like the person had hacked into my email and set up my messages to be sent to their email account, something I would have never thought to look at. I had already changed my email password when this all started, just in case, but now I knew how to shut down the uplink so the person was no longer in my email. I changed my password once again, just in case.
I changed my passwords on every important account I owned, and set up mobile phone alerts when anything happens on my account period, even if I do it. I also put in another email for everything to be sent to if suspicious activity occurs.
So, The Inklings of Life is still mine, thank goodness. Still baffles me as to what douche canoe goes to the extent of trying to steal a mom blog. There really are some sad, pathetic people in the world.
I never got all of the answers I wanted, which, after a week, I'm okay with. They know the hack occurred in May of last year, but they had switched over systems since then, so they had no idea who it was, or even where the person was located. Now, with their new system, every time a log-in attempt is made on my account, they can at least tell where it's coming from. That puts my mind at ease a bit.
If you own a website, take some advice from me. Randomly check in on your account every now and then. Had I trusted the automated email that was sent out, I would never have known someone had hacked in. Even though they tried to pose as me, they don't know anything about me- especially how I don't trust automated anything.
And be sure that your passwords contain an upper case letter, a lower case letter, a number, a symbol, a spot of your blood for DNA, the date you lost your virginity, the name of the heartthrob you wanted to marry when you were in 7th grade, and is between 27 and 42 characters long, and you'll be safe.
Better make it 43 characters, just in case.