Beware of your website domain being hijacked through a GMail email address.

Recently, some webmasters' domains have been hijacked by hackers using Google's GMail service. A domain is the foundation of a website and, like art, it appreciates in value over time. Therefore, I advise everyone to stay vigilant and take precautions to prevent your domain from inadvertently becoming someone else's.

Some people say that the hackers exploited an overflow vulnerability in GMail (Cross-Site Request Forgery exploit: CSRF), while Google engineers claim it was phishing websites. I don't know which scenario is true, but both share one common factor: after you log into GMail, you visit a malicious site.

The malicious site will quietly set up automatic GMail filters to forward the emails you receive to the hacker’s own email account, while simultaneously deleting the new emails you receive.

Next, the hacker will check if your email address is the contact email for any domain. If so, they will log into the domain registration website (such as godaddy.com or name.com), reset the domain password, and have it sent to your email. Of course, you won’t see this email because it has already been forwarded to the hacker.