Cyber-thief Sold Stolen Domain to NBA Player, Police Charge

A 25-year-old New Jersey man is the state's first person to be arrested for domain name theft.

Daniel Goncalves of Union Township was busted July 30 on charges that he stole the domain name P2P.com three years ago. After the theft, Goncalves reportedly went on eBay and sold the domain to NBA player Mark Madsen, a forward for the Los Angeles Clippers, who was unaware that the domain name was stolen. 

"The domain name industry is in some respects still like the Wild West," said Col. Rick Fuentes, superintendent of the New Jersey State Police. "Many of the rules are not yet codified into state laws, let alone federal or international laws."

The investigation by the state police Cyber-Crimes Unit began in October 2008, after representatives from P2P complained that the company's domain name had been stolen from its Go Daddy account in May 2006. P2P began its own investigation into the theft in May 2007 after being contacted by a member of the "domaining" community who observed irregularities in the p2p.com site content. "A check of the P2P ... corporate Go Daddy domain account revealed that the domain name had been transferred without their knowledge" back in 2006, said a New Jersey State Police news release.

After determining that the suspect was in New Jersey, P2P contacted the state police.

Click here to read about hacker Max Ray Butler's guilty plea in connection with credit card and identity theft.

Goncalves is believed to have illegally accessed P2P's Go Daddy account and transferred the domain name to his own personal account. "Records obtained from GoDaddy verified that the same IP address utilized to log into the [P2P] account and initiate the transfer was used to log into Goncalves' own Go Daddy account and receive the transferred domain," the release said.

According to the state police, "attempts were made shortly thereafter to transfer the domain away from Go Daddy to a different registrar, but ICANN [Internet Corporation for Assigned Names and Numbers] rules prohibited this transfer for 60 days. Nine days after the ... transfer prohibition was concluded, it is charged that Goncalves moved the domain name to a different registrar."

Afterward Goncalves allegedly "waited the mandatory 60 days and listed the name for sale on eBay in September 2006, where it was purchased [by Madsen] for just over $111,000."

Goncalves is charged with "theft by unlawful taking or disposition, theft of identity and computer theft." He was released on $60,000 bail. The domain name is now the subject of ongoing civil litigation and at this time has not been returned to the original owners, police said. 

"There is no deed for ownership of a domain name," Fuentes said. "In most cases they are protected solely by a log-in and password for the site through which they are registered. Nevertheless, theft is theft, and [there is] law that can be applied whenever possession of an ownable thing is improperly transferred for gain."