When a registrar sends a transfer request to the registry operator (and
the name is not on Registrar LOCK), the registry operator sends a
confirmation email to both the losing and gaining registrar.
Here is the copy of the email Melbourne IT received.
From email@example.com Sun Jan 9 12:40:35 2005
Received: from verisign-grs.org (snoopy.verisign-grs.net
by galahad.inww.com (8.12.9/8.12.9) with SMTP id j091eYgt003545
for <>; Sun, 9 Jan 2005
Thanks for providing a copy of the e-mail Bruce. You've been
extraordinarily forthcoming on NANOG. I wish that Dotster, as the losing
registrar, was as willing to discuss the hijack of panix.com as you as a
representative of the gaining registrar, Melbourne IT, have been.
According to http://www.eweek.com/article2/0,1759,1751981,00.asp
there were actually several other domains hijacked over the weekend
(aem.com, f3.com) in addition to panix.com. While those other domains
were transfered to different registrar (not MIT), apparently all of
them were previously with Dotster. Hmm...