laurentio
1st November 2008, 06:03 PM
Here is a "lovely" fraudulent fishing email, targeting those of us who own domain names - websites.
They use a very clever domain name that took me a minute to catch. Always beware of emails like this.
This email phishing scam was targeting Network Solution customers in this particular case and sadly, at least a few will fall for it.
The safest thing to do when you get emails that are supposedly from your webhost, bank, credit card company, etc. is to go to that site directly from a bookmark or typing in the url. Never go from links in your email to important services like these described above.
Dear Network Solutions Customer,
On Thu, 30 Oct 2008 23:23:17 +0100 we received a third party complaint of invalid domain contact information in the Whois database for this domain Whenever we receive a complaint, we are required by ICANN regulations to initiate an investigation as to whether the contact data displaying in the Whois database is valid data or not. If we find that there is invalid or missing data, we contact both the registrant and the account holder and inform them to update the information.
Please note: ICANN (the Internet Corporation for Assigned Names and Numbers) regulations state that the WHOIS Administrative Contact may initiate and approve domain name registration transfers from your Network Solutions account to other Registrars. If you are not listed as the WHOIS Administrative Contact a transfer can occur without your knowledge if Domain Protect is not enabled for the domain name registrations listed above.
To change the WHOIS Administrative Contact Information for any of your domains, please login to Account Manager:
1. Log in to Account Manager at: http://www.networksolutions.com. (Because I didn’t want to give a link to this thieving site, the url showed the correct address in print, but when you hovered over it, the actual destination url was http://www.networksolutions.com.sys44.biz/ so the fraudulent domain is actually sys44.biz
2. Click on the “Profile & Accounts” tab in the left navigation menu to be taken to a page listing your account details.
3. Click on “Accounts” and select the account you wish to edit.
4. Click “View/Edit WHOIS Contacts” to make your updates.
If you believe someone requested this change without your consent, please contact Customer Service.
If you would like to order additional services or to update your account, please visit us online.
Thank you for choosing Network Solutions. We are committed to providing you with the solutions, services, and support to help you succeed online.
Sincerely,
Network Solutions Customer Support
I have also received one related to Bicester Computers but if my domain had really been transferred/taken over (like the email claims) then I wouldn't even be able to log into my email account. (My email account is through my domain name)
So the fact that I even received that spam-fishing email in the first place contradicts the scam.
A major help comes from Mozilla Firefox browser. In case you click directly on the link from the spam email Mozilla would automatically flag it as a dangerous link (see attached screenshot)
Hope this email answers to most of our customers and not only.
All the best, L:cool:
p.s.
These types of scammers are constantly changing their urls as they are constantly being shut down or blocked by ISP’s.
The first one I posted sys44.biz was registered on 10/30 and sys58.biz was registered earlier yesterday, 10/31
They use a very clever domain name that took me a minute to catch. Always beware of emails like this.
This email phishing scam was targeting Network Solution customers in this particular case and sadly, at least a few will fall for it.
The safest thing to do when you get emails that are supposedly from your webhost, bank, credit card company, etc. is to go to that site directly from a bookmark or typing in the url. Never go from links in your email to important services like these described above.
Dear Network Solutions Customer,
On Thu, 30 Oct 2008 23:23:17 +0100 we received a third party complaint of invalid domain contact information in the Whois database for this domain Whenever we receive a complaint, we are required by ICANN regulations to initiate an investigation as to whether the contact data displaying in the Whois database is valid data or not. If we find that there is invalid or missing data, we contact both the registrant and the account holder and inform them to update the information.
Please note: ICANN (the Internet Corporation for Assigned Names and Numbers) regulations state that the WHOIS Administrative Contact may initiate and approve domain name registration transfers from your Network Solutions account to other Registrars. If you are not listed as the WHOIS Administrative Contact a transfer can occur without your knowledge if Domain Protect is not enabled for the domain name registrations listed above.
To change the WHOIS Administrative Contact Information for any of your domains, please login to Account Manager:
1. Log in to Account Manager at: http://www.networksolutions.com. (Because I didn’t want to give a link to this thieving site, the url showed the correct address in print, but when you hovered over it, the actual destination url was http://www.networksolutions.com.sys44.biz/ so the fraudulent domain is actually sys44.biz
2. Click on the “Profile & Accounts” tab in the left navigation menu to be taken to a page listing your account details.
3. Click on “Accounts” and select the account you wish to edit.
4. Click “View/Edit WHOIS Contacts” to make your updates.
If you believe someone requested this change without your consent, please contact Customer Service.
If you would like to order additional services or to update your account, please visit us online.
Thank you for choosing Network Solutions. We are committed to providing you with the solutions, services, and support to help you succeed online.
Sincerely,
Network Solutions Customer Support
I have also received one related to Bicester Computers but if my domain had really been transferred/taken over (like the email claims) then I wouldn't even be able to log into my email account. (My email account is through my domain name)
So the fact that I even received that spam-fishing email in the first place contradicts the scam.
A major help comes from Mozilla Firefox browser. In case you click directly on the link from the spam email Mozilla would automatically flag it as a dangerous link (see attached screenshot)
Hope this email answers to most of our customers and not only.
All the best, L:cool:
p.s.
These types of scammers are constantly changing their urls as they are constantly being shut down or blocked by ISP’s.
The first one I posted sys44.biz was registered on 10/30 and sys58.biz was registered earlier yesterday, 10/31