About 6 days ago I purchased a new domain under .org TLD from a local registrar.
Few days later, I have received this strange message (which BTW fell to Gmail spam bin), which looks like some kind of phishing to me.
Following is the e-mail contents (redacted the hashes in "unsubscribe" links and my domain for "example.org"):
Congratulations on your purchase of example.org You MUST have accurate and updated contact information. Providing false or = inaccurate contact information=20 can be grounds for the cancellation of your domain name registration as = required by ICANN (More info below)=2E You can also protect your brand by registering all related domain = extensions (ie: .com,.net,.org...) before someone else does=2E Check your your complimentary domain availability report now just click = the link below: http://www.namelock.org/?domain=3Dexample.org (Click on the link or copy & = paste into your browser) Key Domain Resources: - For Domain Registration FAQ's: = http://newregistrationhelp.com/knowledgebase.php - For Domain Availability Report: = http://www.namelock.org/?domain=3Dexample.org (Click on the link or copy & = paste into your browser) - For ICann Guidelines: http://www.icann.org/whois/wdrp-registrant-faq.htm Sincerely, Sophia Newman=20 Support Team @ NewRegistrationHelp.com Please do not reply to this email. This email was sent from a = notification-only address=2E For customer service inquiries, please visit NewRegistrationHelp.com = NewRegistrationHelp.com 1, Avenue Marronniers Saint Ouen, Paris 93400 All rights reserved - Copyright 2013=2E If you prefer not to receive additional emails please unsubscribe now You = are receiving this message because you recently made a domain name = purchase. We hope you find these communications valuable however, if you = would prefer to no longer receive emails from us, please copy and paste = the following URL in your browser to unsubscribe: = http://smtp235.newregistrationhelp.com/u.aspx?some/aZ09hashes
Not that it would be the traditional phishing in the sense that it would directly ask for credentials like "you need to reset your password" stuff, but there definitely is something funky about it:
it knows my domain name
it came few days after registering
it uses phrase "You MUST" in the first paragraph (trying to FUD me?)
it's from a completely different entity than any of those I know are involved (me, the local registrar, .org manager...?)
First explanation that came into my mind is that somebody has a list of .org domains (that probably once existed?) and keeps polling DNSes to find out when they were registered, then stealing e-mails from whois.
So is this some known / common kind of spamming/phishing technique? Should I act upon that? Does this "incident" speak against my registrar's credibility?
Edit just to finish the story with full irony:
Next to this message, there were two messages from a legitimate "registrar B" which I did not finish registration with that day: A lost activation mail, and a humble request for feed-back and offer to help with finishing the registration. Later I have reported and explained this to them.
So it came it to my mind that while this kind of crap may not be particularly dangerous, it seems to be quite successful in poisoning spam filters, making words like "registration" and "domain" effective V-words.
At the end of the day, it's not me being "phiscked", it's the poor other "registrar B" being "bayescked".