Sophos News

Perl.com gets its domain back – normal service restored!

Good news, everybody!

Two weeks ago, we wrote that the well-known and widely-used domain perl.com had been taken over by persons unknown.

Perl, now more than 30 years young, is amongst the most popular and prevalent programming languages out there, and websites that serve the world of Perl are therefore popular, too.

So, even though the official home of the language itself is perl.org, the perl.com website has been a well-known companion in the Perl community for many years.

You can imagine why, if the original owner had allowed their registration of the domain to lapse, either by mistake or because they felt they no longer needed it, a new owner might be keen to snap it up.

(Indeed, four-letter dot-COM domains are rare and expensive these days if they don’t spell out a well-known word, and even if they can’t be pronounced as a word at all.)

In this case, however, the domain’s takeover was as unlikely as it was unexpected.

That’s because perl.com had been registered for years to widely respected US-based Perl guru Tom Christiansen, and it hadn’t expired.

So it was difficult to figure out how any domain registrar would have been inclined to believe that Christiansen, or tchrist as he is widely known, would voluntarily have relinquished the domain…

…especially to someone who immediately redirected the domain to pretty much nothing at all:

Redirected perl.com site visited directly (and insecurely) on 2021-01-29.

Yet that is what happened at the end of January 2021, when the domain registration suddenly switched to a privacy-protected registrant based in Moldova:

[WHOIS data for PERL.COM, retrieved 2021-01-29]

Domain Name: perl.com
Registry Domain ID: 432086_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.rrpproxy.net
Registrar URL: http://www.key-systems.net
Updated Date: 2021-01-27T12:43:15Z
Creation Date: 1994-08-16T04:00:00Z
Registrar Registration Expiration Date: 2031-01-26T15:26:42Z
Registrar: Key-Systems GmbH
[...]
Registry Registrant ID: REDACTED FOR PRIVACY
Registrant Name: REDACTED FOR PRIVACY  
Registrant Organization: REDACTED FOR PRIVACY
[...]
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: Chisinau
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: MD [Moldova]
[...]
Admin Name: REDACTED FOR PRIVACY  
Admin Organization: REDACTED FOR PRIVACY
[...]]
Admin City: REDACTED FOR PRIVACY
Admin State/Province: REDACTED FOR PRIVACY
Admin Postal Code: REDACTED FOR PRIVACY
Admin Country: REDACTED FOR PRIVACY

For a short while after the domain takeover, according to reporters at IT news site The Register, domain name reseller Afternic was offering the suddenly blanked-out perl.com domain for sale for the impressive sum of $190,000.

(By the time we looked, on the day after The Register published its report, the domain was still out of tchrist‘s control but no longer up for sale on any publicly visibly domain broker’s site we could find.)

The good news

We don’t know exactly how this takeover was achieved, and what collateral was used to convince the relevant domain registrars to authorise the transfer, but we are pleased to report that normal service has been resumed.

The perl.com domain is now back under tchrist‘s control, and the registration details are no longer hidden behind a privacy shield, so you can check them out for yourself:

[WHOIS data for PERL.COM, retrieved 2021-02-07]

Domain Name: PERL.COM
Registry Domain ID: 
Registrar WHOIS Server: whois.networksolutions.com
Registrar URL: http://networksolutions.com
Updated Date: 2021-02-05T19:59:16Z
Creation Date: 1994-08-16T04:00:00Z
Registrar Registration Expiration Date: 2031-02-05T16:54:08Z
Registrar: Network Solutions, LLC
[...]
Registry Registrant ID: 
Registrant Name: Tom Christiansen Perl Consultancy
Registrant Organization: Tom Christiansen Perl Consultancy
[...]
Registrant City: BOULDER
Registrant State/Province: CO
Registrant Postal Code: 80304-1022
Registrant Country: US
[...]
Admin Name: Tom Christiansen Perl Consultancy
Admin Organization: Tom Christiansen Perl Consultancy
[...]
Admin City: BOULDER
Admin State/Province: CO
Admin Postal Code: 80304-1022
Admin Country: US

And, of course, the site is back to normal:

Main page of perl.com visited directly on 2021-02-07.

During the domain takeover, the perl.org site leapt to the rescue by serving the content of perl.com via perldotcom.perl.org (try reading that sentence out aloud quickly!), and that “emergency” URL still works, but it is once again safe to visit perl.com directly.

Result!