The problem is, the process of building your own self-hosted blog is (almost always) not free and is considered complicated. So most newbies will choose the easier path and never give themselves a chance to experiment.

I personally believe that experience is the best teacher (and that you should never consider yourself a cool person if you’ve never tried to “build” a blog).

So, if you are in an adventurous mood right now and willing to take up the challenge, I’ll show you how to easily set up a free Wordpress blog site.

Some of you might ask, “Why Wordpress?” I could go on and explain how cool it is, how it has grown from a simple blogging platform into an advanced CMS (Content Management System) and still stay simple and free, how you can expand it into virtually everything by adding plugins and themes; but to save you the time, I’ll just go with “Why not?”

Getting your own domain name

The first step in our little project is obtaining a domain name. But with zero budget, you shouldn’t expect to be able to snatch a dot com – or any other popular dots like org, net, name or tv. For this experimental purposes, we’ll go with a less popular but free alternative.

The free service that I always use for quick and free domain names is www.co.cc. This service will provide you with 2 free domain names (with .co.cc suffixes) for personal use. (But that doesn’t mean that you can’t register for more with different email addresses. Wink!)

Visit the site and search for the availability of your chosen domain name(s). I’ve registered buildablog.co.cc for this article so you can’t claim that one.

If your chosen name is available, please check whether it’s available for free because there are names which are not free. Then continue with the registration.

If you’ve been here before, you can log in with your account. Newcomers click “Create an account now“.

After completing the registration process, you need to set up your domain. This step should be done within 48 hours or they will delete the domain. So click the set up button now.

Finding yourself a host

To be able to set up the domain, you need a webhost. So, we’ll postpone the domain set up process for a while and find ourselves a webhost first. I stumbled on a service which provides free webhosting without ads called 000webhost. You won’t get premium features, but 1.5GB of disk space and 100GB of data traffic per month should be sufficient for our project.

Sign up for free hosting with your registered domain name from the previous step, and you’ll get the DNS addresses needed for the domain set up – both in the confirmation email and in the website. Armed with that information, we are ready to go back to our postponed task.

Please note that the host set up process could take a long time (up to 24 hours). So be patient here and refresh the page often.

Setting up the domain

Back at the “Manage Domain” page, choose the number one: “Name Server” option and write down these values:

- Name server 1: ns01.000webhost.com
- Name server 2: ns02.000webhost.com

Then click “Set Up“, and you’ll go into another waiting game.

Installing Wordpress

After the host and the DNS settings are active, we can log in to the cPanel to install Wordpress. You can log in using your email address and password.

Find the Software section inside the cPanel and choose Fantastico, then select Wordpress and provide the admin name with the chosen password. The Fantastico installation script will make the Wordpress installation easier by automatically building and linking the database for you.

You have to decide where you want to install Wordpress. If you leave the sub-folder blank, then Wordpress will be installed in the root folder: your domain name and you can access it using –> http://www.your-domain.co.cc. But if you put name in the sub-folder, then Wordpress would be installed in that folder and accessible via http://www.your-domain.co.cc/foldername

Customization and final notes

You can customize your Wordpress installation using plugins and themes and upgrade it to the latest build via FTP. The details of the FTP is available in the welcome email and in the cPanel. I won’t go into detail here because discussing that topic would require another one or two more articles.

With all that said and done, I have to emphasize that the free domain name and free hosting service will only go that far: as an experiment tool. If you want to do this seriously, you have to go with the paid service as they will provide you with more necessary bells and whistles.

But let me share one last trick here: you don’t have to settle with the price that web hosting company offer you. You can get a far cheaper price by applying for a web host reseller account. Normally, this kind of account is not opened to the general public and also not free. But I found one which is free for everybody to join called Resellers Panel. (The link will put me as your referrer, but you can go directly to their website if you want)

By applying to become a reseller, not only you can get the cheapest price for domain names and hosting but you could also start your own business by reselling the service with the market price.

Do you use Wordpress? Have you tried to install one on the web server? Share your experience using the comment below, and don’t forget to check out our article on installing Wordpress locally in your hard drive.

Did you like the post? Please do share your thoughts in the comments section!

New on Twitter ? Now you can follow MakeUseOf on Twitter too.

• The 5 Free Wordpress Templates To Dress Up Your Blog (15)
• How To Install A Wordpress Blog Locally On Your Computer (23)
• Wordpress.tv – The Best Wordpress Tutorials Ever! (9)
• Wordpress Exploit Scanner Helps Administrators Scan Their Database For Malicious Files (10)
• Top 7 Easy and Free Web Hosting Services (138)

Luckily, I have a resource for you that can conduct a domain name search for those which were recently released or deleted. People forget to renew domains or companies go out of business. With JustDropped, we can which domains have become available in the last day, week or even hour.

The site is very easy to use but it does require registration. But as always, you can check out BugMeNot for a user name and password. If you will be using this service constantly, I suggest registering for your own set of credentials.

Once you are logged in, you will see this on your screen:

As you can see, the search engine has lots of available options. I started with filling in the “Domain should contain” field and put in a word I wanted in my domain name. Then, I chose the check box that says “contains only words”. Next, I made the maximum length 15 characters and then I clicked on the Domain Availability drop-down list.

I like to use Deleted so that I can see what I can buy right now. Choose your extensions that you want to search for, I strictly use .com. So my options looked like this:

Finally, hit the Show The Domains! button at the bottom and you will see the results from the domain name search on screen, like so:

It pulled up a list with more than 2000 items, and that is the maximum number of results displayed. But what I like to do is create a search and then have JustDropped email me a text file with all the names. I can then go through them in Excel. To do this, all you have to do is click this button at the bottom of your results page:

That emails me a list that looks something like this:

To me, this is an invaluable domain name search tool. They even offer some more paid services besides domain searching. But we won’t go into that here. Do you have a free tool you use to help you find domain names? If you do we would love to hear about it in the comments!

Haven’t got a clue for your new domain name? Check out 6 Domain Generators To Find That Killer Domain Name. From our directory, take a look at DomainTyper and BustaName.

Did you like the post? Please do share your thoughts in the comments section!

New on Twitter ? Now you can follow MakeUseOf on Twitter too.

• How To Setup A Self-hosted Wordpress Blog for Free (60)
• How To Make Short URL’s on Your Domain with Google Apps (14)
• How To Easily Create A Favicon For Your Blog (13)
• Find Other Sites Running on your Hosting Server with YouGetSignal (15)
• Feelin’ a Little Cocky? Grade Your Website! (8)

The majority of the employed today, have somewhat of a commute. Whether it be 10 minutes or 45, some type of audio activity is necessary to keep us from falling asleep at the wheel. Audiobooks are slowly becoming an extremely popular option for this and LibriVox brings you a free option to listen to them.

LibriVox is a user driven public domain audiobook library for any and all to listen to. They allow anyone to take any one of the thousands of public domain audiobooks, record their own voice, and distribute for all to listen to. We’ve briefly mentioned LibriVox in 2007, talking about “Joining The User-Generated Content Revolution“, but I thought it needed a little more recognition.

What separates LibriVox from audiobook sites like Audible, is the fact that a majority of the books are read by several different readers, usually by chapter. It makes the book not only unique, but keeps your interest, because you never know what that next reader’s voice is going to sound like. Such as in the below example of Aesop’s Fables, each read by four different people.

As you can see in the above screenshot as well, you have a few different audio formats to choose from, including a lower and higher quality MP3, plus OGG as well. Nothing to sign-up for or register, all audio files can be directly downloaded right from the website.

Librivox allows you to browse to the entire catalog yourself, or use their handy search engine to find what you’re looking for by author, or by title. The interface isn’t all that pretty, but it gets the job done. According to Wikipedia, in March of 2009, the site had 2000+ recorded titles ranging from short fiction stories, to lengthy novels, and even poetry. At last count, there are recordings in 45+ languages.

Some of the more famous titles you might recognize include the 9/11 commission report, Pride and Prejudice, Capital and their most popular title “The Return of Native” by Thomas Hardy. There are even religious titles, including an English version of the Koran, and several reads of the Holy Bible. Just about every genre is covered in their collection.

The other part of Librivox that can keep you entertained, is where you can actually take part in recording your own book. As long as it falls into “Public Domain“, with a audio recording application like Audacity, and a PC microphone or headset, you can delve into recording your own voice for a chapter, or an entire book! They require no prior experience either. As long as your voice is audible, you can volunteer and release your voice to the world.

There really is no other site out there like LibriVox that I could find. There are a few free audiobooks and audiobook sites out there, but none that are driven by you, the everyday reader. It’s very unique in that way, and I know I will one day dive into reading my very own audiobook, and let my voice be heard.

Do you have any free audiobook sites that you like? Do you see yourself recording your very own book one day?

Did you like the post? Please do share your thoughts in the comments section!

New on Twitter ? Now you can follow MakeUseOf on Twitter too.

• Who Needs The Amazon Kindle When You Have A Netbook? (26)
• Track Your Reading and Catalogue Books with BookTomb [Win] (13)
• The 8 Best Book Review Sites (18)
• Mobipocket – An Awesome ebook Reader Which is Free (14)
• Make Your Own eBooks with eBook Hood (3)

You can see the whole story on our temporary blog makeuseof-temporary.blogspot.com/

I wasn’t planning to publish anything about the incident or cracker (person who steals domains) and how he managed to pull it off unless I was completely sure about it myself. I had a good feeling it was a Gmail security flaw but wanted to confirm it before posting anything about it on MakeUseOf. We love Gmail and giving them bad publicity is not something we would ever want to do.

So why write about this now then?

Several things have happened in the last two days that have made me believe that Gmail has a serious security flaw and everyone should be aware about it. Especially during the times when individuals like Steve Rubel tell you How To Make Gmail Your GateWay To The Web. Now, don’t get me wrong here, Gmail is an AWESOME email program. The best probably. The problem is that it might not be a reliable one when it comes to security. That being said, it doesn’t necessarily mean that you will be better off with Yahoo or Live Mail.

Incident 1: MakeUseOf.com – November 2nd

When our domain was stolen, we suspected that the hacker used some hole in Gmail but we were not sure about it. Why did I suspect that it was something to do with Gmail? Well for one thing I am rather cautious about security and rarely run anything I am not sure about. I also keep my system up to date and have all essentials including 2 malware monitors, an antivirus and 2 firewalls. I also tend to use strong and unique passwords for every one of my accounts.

The hacker did access my Gmail account and set up some filters there that eventually helped him to get access to our GoDaddy account. What I didn’t know is how he managed to do that. Was it a security hole in Gmail? Or was it a keylogger on my PC? I wasn’t sure about it. After the incident I scanned my system with a number of malware removals and didn’t find anything. I also went through every running process as well. All semed to be clean.

So, I am inclined to believe the problem was with Gmail.

Incident 2: YuMP3.org – November 19th

On November 18′th, I got an email from someone named Edin Osmanbegovic who runs the site yump3.org. (He probably found my email through Google as the incident with MakeUseOf was covered on several popular blogs, many of which included my email ID.) In his email, Edin told me that his domain was stolen and moved to another registrar. I quickly googled the yoump3 and saw that a rather established website was now serving a link farm page (exactly like in our case).

Google (on last index):

YouMP3.org hompage (present):

Here is a copy of the very first email I got from Edin:

Hello,
I have the same problem with my domain.
The domain has transfered from Enom to GoDaDDy.
I have immediately send support ticket regarding that problem.

The whois of new domain owner is :

Name: Amir Emami
Address 1: P.O. Box 1664
City: League City
State: Texas
Zip: 77574
Country: US
Phone: +1.7138937713
Email:

Administrative Contact Information:
Name: Amir Emami
Address 1: P.O. Box 1664
City: League City
State: Texas
Zip: 77574
Country: US
Phone: +1.7138937713
Email:

Technical Contact Information:
Name: Amir Emami
Address 1: P.O. Box 1664
City: League City
State: Texas
Zip: 77574
Country: US
Phone: +1.7138937713
Email:

Email is : webs@domainsgame.org
Yesterday the guy from that email adress had contacted me via Gtalk.
He said that he want 2000$ for the domain.
I need advice please,I have contacted the Enom.

Thank you.

And guess what, it’s the same guy who earlier this month stole MakeUseOf.com. We too were contacted from the same email address: webs@domainsgame.org. Edin also emailed me today and confirmed that the guy also got access to his domain account through his Gmail account. So it’s again Gmail.

In his last email (received today) Edin included a quick recap of the events

I have the history of how he did everything.

On 10th of November I was the owner.
On 13th of November Mark Morphew.
On 18th of November Amir Emami.

He used webs@domainsgame.org on both persons.

I have send yesterday also everythig to Moniker.
They will investigate.

Incident 3: Cucirca.com – November 20th

This last email was the main reason for this post. It came from Florin Cucirka, the owner of cucirca.com. The site has an alexa rank of 7681 and according to Florin receives over 100,000 visits daily.

First email from Florin:

Hi Aibek

I’m in the same situation makeuseof.com got out.

I am Cucirca Florin and my domain www.cucirca.com was
transfered from my godaddy account without my permission.

It seems that the thief knew my gmail password which is odd.
He managed to create some filters to my account.

I’ve attached 2 screenshots.

Can you help me? Give me some details on how I could get
out of this bad dream? I just found today about this and I
don’t think I’m able to sleep tonight.

Thanks in advance.

Florin Cucirca.

I emailed Florin and asked him some details about his domain, whether he contacted GoDaddy and whatever information he got on the domain cracker (term used for domain stealer) guy so far.

Second email from Florin:

The hacker had access to my email account (gmail). The domain was hosted on godaddy.
I used gmail notifier extension on firefox. maybe there is the big bug.
He transfered the domain to register.com

I haven’t talk to the hacker. I want to get it back legally and if there is not other solution maybe i’ll pay him

www.cucirca.com has an Alexa Rank of 7681 and over 100 000 visits daily.

I will attach you 2 screenshots of my gmail account.

joy.hock@gmail.com and in the second screen domain.selln@gmail.com

If you do a google search of domain.selln@gmail.com you will find this:

http://www.domainmagnate.com/2008/08/11/788-domains-stolen-including-yxlcom/

I think someone should stop them.

I emailed undo@godaddy.com and waiting for a reply.

What do you think? Will i get my domain back?

Looks like it’s Gmail again! Here are the partial screenshots from what he sent me:

In Florin’s case the hacker changed ownership of the domain several month ago. The cucirca.com was transfrred from GoDaddy to Register.com. Since the hacker was intercepting his emails and never changed nameservers I assume Florin had no idea that something was wrong. When I asked him how come it took him that long to find out he send me following:

And again it seems to be the same guy! Why do I think so? If you check that link that Florin included in one of his emails (i added it below as well) you’ll see that in some other similar incidents (who knows how many more domains he has stolen like this) email address domain.selln@gmail.com was mentioned together with the name ‘Aydin Bolourizadeh’. That same email also appeared in the forward rule in Florin’s Gmail account (see first screenshot).

When MakeUseOf.com was taken from us, the cracker was asking me for 2000$. And when I asked him where and how he wants to get paid, he told me to send money via Western Union to the following address:

Aydin Bolourizadeh
Turkey
Ankara
Cukurca kirkkonaklar mah 3120006954

screenshot from http://www.domainmagnate.com/2008/08/11/788-domains-stolen-including-yxlcom/

I am pretty pretty that it was the same guy in all 3 incidents and probably 788 others mentioned in the above link, including domains such as yxl.com, visitchina.net and visitjapan.net.

When I searched for that address on Google, I also discovered that he owns the following domains (probably stole them as well):

Elli.com – http://whois.domaintools.com/elli.com
Ttvx.net – http://www.dnforum.com/post252-post-1399775.html

I assume the guy is indeed from Turkey, and is likely to reside somewhere in the following area.

Cukurca kirkkonaklar mah 3120006954
Ankara, Turkey

We also know that he uses webs@domainsgame.org as his email. So if we know who stands behind domainsgames.org we might just get one step closer. In fact, he emailed several days ago and asked me to remove all instances of his email from the website and if we don’t comply he would DDOS us.

Here are his exact words:

Hi,
I ask you to remove my email address (webs@domainsgame.org) from your website !
Do it if you want to dont have any problem in the future, Otherwise firstly I’ll start to have the big DDOS on your website and will make it down…
Im very seriuos so remove my email and domainsgame.org name

So, it seems if we can get to the ID behind domainsgame.org we might get our guy and probably uncover many more domains he has stollen. Read more on it below. Now let’s talk about Gmail.

Gmail Vulnerability

Does anyone remember what hapeened with David Airey last year? His domain was stolen too. The story was all over the web.

- WARNING: Google’s GMail security failure leaves my business sabotaged
- Collective effort restores David Airey.com

Both we and David managed to get the domain back. But I am not sure if everyone is as lucky as we are. Unfortunately, registrars won’t really cooperate with you on this unless the story gets some attention. So, I have no doubt there are hundreds of people out there left with no chance but to either give their domain name or pay the guy.

Anyways, back to Gmail.

In his first article David Airey was referring to a Gmail vulnerability that was (if I am not mistaken) mentioned here several months earlier. To sum up:

The victim visits a page while being logged into GMail. Upon execution, the page performs a multipart/form-data POST to one of the GMail interfaces and injects a filter into the victim’s filter list. In the example above, the attacker writes a filter, which simply looks for emails with attachments and forward them to an email of their choice. This filter will automatically transfer all emails matching the rule. Keep in mind that future emails will be forwarded as well. The attack will remain present for as long as the victim has the filter within their filter list, even if the initial vulnerability, which was the cause of the injection, is fixed by Google.

original page: http://www.gnucitizen.org/blog/google-gmail-e-mail-hijack-technique/

Now, the interesting part is that update on the above GNU Citizen link states that vulnerability was fixed before 28 September 2007. But in David’s case, the incident took place in December, 2-3 months later.

So, was the exploit really fixed back then? Or was it a new exploit in David’s case? And most importantly is there a similar security flaw in Gmail NOW?

What should you do now?

(1) Well, my very first advice would be to check your email settings and make sure your email is not compromised. Check fowarding options and filters. Also make sure to disable IMAP if you don’t use it. This also applies to Google Apps accounts.

(2) Change contact email in your sensitive web accounts (paypal, domain registrar etc.) from your primary Gmail account to something else. If you own the website then change the contact email for your host and registrar accounts to some other email. Preferably to something that you aren’t logged in to when browsing web.

(3) Make sure to upgrade your domain to private registration so that your contact details don’t show up on WhoIS searches. If you’re on GoDaddy I’d recommend going with Protected Registration.

(4) Don’t open links in your email if you don’t know the person they are coming from. And if you decide to open the link make sure to log out first.

UPDATE:

I discovered some good articles discussing potential security flaw in response to MakeUseOf’s article:

- Gmail Security Flaw Proof Of Concept
- Comments About This on YCombinator
- (Nov. 26′th) Gmail Security and Recent Phishing Activity [Official Response from Google]

Help Us Catch The Guy!

Apart from above mailing address, we also know that he uses webs@domainsgame.org as his email. So if we find out who now owns the domainsgames.org we might get one step closer. or at the very least return the domains he stole to their respective owners.

Now the thing is the domain name domainsgames.org is protected by Moniker and they hide all the contact info for it.

Domain ID:D154519952-LROR
Domain Name:DOMAINSGAME.ORG
Created On:22-Oct-2008 07:35:56 UTC
Last Updated On:08-Nov-2008 12:11:53 UTC
Expiration Date:22-Oct-2009 07:35:56 UTC
Sponsoring Registrar:Moniker Online Services Inc. (R145-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:MONIKER1571241
.
.
.
.
Name Server:NS3.DOMAINSERVICE.COM
Name Server:NS2.DOMAINSERVICE.COM
Name Server:NS1.DOMAINSERVICE.COM
Name Server:NS4.DOMAINSERVICE.COM

I already emailed (so did Edin) them about it and will update you here as soon as I hear something from them.

I also have some requests to following companies that are now providing their services to that individual.

1- To Gmail Team:

When going through header files in several emails it was clear that hacker was using Google Apps. Please look into it. The domain is domainsgame.org. And also please FIX! the Gmail.

2- To GoDaddy.COM & ENOM & Register.COM

First of all, please help Edin and Florin get their domains back. One smart thing to do would be to check the account login IP addresses for all similar reported cases. For instance, both in Edin’s case and ours (not sure about Florin ) the hacker was using 64.72.122.156 IP address. (Which by the way turned out to be a compromised server on Alpha Red Inc.) Or even easier, just lock the domain name and ask the current account holder to prove his identity. Since the hacker was using different identities everywhere it would be impossible for him to do that. It’s in your best interests to ensure that this person is no longer using your services.

3- To Moniker.COM:

Close his account! (that is the one for domainsgame.org). Any additional info or assistance that you can provide will be appreciated.

4- To Domainsponsor.COM

I am not really sure but I think DomainSponsor is the company that monetizes those domains that this guy steals. It happened with MakeUseOf.com and now hapening with YouMP3.org.

5- To PayPal.COM: (Your SUPPORT IS AWFUL)

I am sure they won’t even read this so I’ll just tell you instead. I sent an email to spoof@paypal.com and warned them that the person who stole our domain and blackmailed us earlier was using a.npaypal@gmail.com account (he uses some other accounts as well). I just asked them to look into it. Instead I get an email which has nothing to do with what I said. Basically it’s an email template that was meant to look genuine and sent to the people who got spoofed. C’mon! We are paying 3% commision fee on every transaction, can’t you people provide better customer support?

That’s all I got!

Once again I am deeply sorry for what has happened to Florin and Edin. I trully hope they will get their domains back soon. It’s all in the hands of the respective registrars now. But most importantly, I want to see something get done by big corps (not the customers) to catch that person. I am sure every blogger out there would appreciate that and probably even write about it on his/her blog.

It’s time for CHANGE

best regards
Aibek

image credit: thanks to machine for top ‘Mr Cracker’ image

Did you like the post? Please do share your thoughts in the comments section!

New on Twitter ? Now you can follow MakeUseOf on Twitter too.

• Check if Your Gmail Account is Hacked with Activity Monitor (38)
• Are you Sure your Email isn’t being Hacked? (91)
• Wordpress Exploit Scanner Helps Administrators Scan Their Database For Malicious Files (10)
• Top 5 Websites To Learn How To Hack Like A Pro (44)
• Steal Your Friends Passwords and Software Licenses! (32)

GmailAssistant allows you to completely customize your notification options. You can choose to have it find all mail, unread in the Inbox, and even mail with specific labels. You can even choose different alert methods…i.e. popup message, chime, blink keyboard LED.

Features

Single-File – GmailAssistant is launched from just one file. All you need to run it is contained in that one executable .jar file.
No Installation – GmailAssistant is packaged into one executable .jar file, which means it runs on any Operating System.
Leave It – GmailAssistant does not modify any system settings in any way. Everything needed for it runs in the .jar file.
Convenience – Always on top, SOCKS proxy, save/load program and account settings in encrypted profiles, automatic profile loading, adjustable mail check frequency, persistent and navigable popup messages
Updates – Easily update GmailAssistant with one click.
License – GNU General Public License version 2.

What it looks like

Here is the GmailAssistant Main form. From this page you can configure your various Gmail accounts.

Listed below is the “Account Form” where you specifiy your specific details for your various Gmail or Gmail for Domains accounts. This is where you’ll also set up the specific privileges about how you want GmailAssistant to notify you and alert you to your accounts.

Last but not least, is the view from the system tray. Here you’ll see the small GmailAssistant icon where it will display your alerts.

(By) Travis is a husband, engineer, entrepreneur, technology swami, visual communicator, WordPress lover and writer in his spare time. You can check out his personal blog at TQuizzle.com.

Did you like the post? Please do share your thoughts in the comments section!

New on Twitter ? Now you can follow MakeUseOf on Twitter too.

• 19 Tools and Tips to improve Google Reader (32)
• What’s new in Gmail: Imports, Images, Previews, Translations and more (11)
• Ultimate GMail Collection: over 80 Tools and Tips (80)
• Notify – An Elegant Gmail New Email Notifier [Mac] (22)
• iContact – Bring your Gmail Contacts to the Desktop (13)