4

About 6 days ago I purchased a new domain under .org TLD from a local registrar.

Few days later, I have received this strange message (which BTW fell to Gmail spam bin), which looks like some kind of phishing to me.

Following is the e-mail contents (redacted the hashes in "unsubscribe" links and my domain for "example.org"):

Congratulations on your purchase of example.org

You MUST have accurate and updated contact information. Providing false or =
inaccurate contact information=20
can be grounds for the cancellation of your domain name registration as =
required by ICANN (More info below)=2E

You can also protect your brand by registering all related domain =
extensions (ie: .com,.net,.org...) before someone else does=2E

Check your your complimentary domain availability report now just click =
the link below:
http://www.namelock.org/?domain=3Dexample.org (Click on the link or copy & =
paste into your browser)


Key Domain Resources:

- For Domain Registration FAQ's: =
http://newregistrationhelp.com/knowledgebase.php
- For Domain Availability Report: =
http://www.namelock.org/?domain=3Dexample.org (Click on the link or copy & =
paste into your browser)
- For ICann Guidelines: http://www.icann.org/whois/wdrp-registrant-faq.htm

Sincerely,

Sophia Newman=20
Support Team @ NewRegistrationHelp.com

Please do not reply to this email. This email was sent from a =
notification-only address=2E
For customer service inquiries, please visit NewRegistrationHelp.com =
NewRegistrationHelp.com
1, Avenue Marronniers
Saint Ouen, Paris 93400
 All rights reserved - Copyright 2013=2E

If you prefer not to receive additional emails please unsubscribe now You =
are receiving this message because you recently made a domain name =
purchase. We hope you find these communications valuable however, if you =
would prefer to no longer receive emails from us, please copy and paste =
the following URL in your browser to unsubscribe: =
http://smtp235.newregistrationhelp.com/u.aspx?some/aZ09hashes

Not that it would be the traditional phishing in the sense that it would directly ask for credentials like "you need to reset your password" stuff, but there definitely is something funky about it:

  • it knows my domain name

  • it came few days after registering

  • it uses phrase "You MUST" in the first paragraph (trying to FUD me?)

  • it's from a completely different entity than any of those I know are involved (me, the local registrar, .org manager...?)

First explanation that came into my mind is that somebody has a list of .org domains (that probably once existed?) and keeps polling DNSes to find out when they were registered, then stealing e-mails from whois.

So is this some known / common kind of spamming/phishing technique? Should I act upon that? Does this "incident" speak against my registrar's credibility?

Edit just to finish the story with full irony:

Next to this message, there were two messages from a legitimate "registrar B" which I did not finish registration with that day: A lost activation mail, and a humble request for feed-back and offer to help with finishing the registration. Later I have reported and explained this to them.

So it came it to my mind that while this kind of crap may not be particularly dangerous, it seems to be quite successful in poisoning spam filters, making words like "registration" and "domain" effective V-words.

At the end of the day, it's not me being "phiscked", it's the poor other "registrar B" being "bayescked".

Improve this question
3
  • I ignore such emails regualarily. To answer the question where they have the information from: There is a whois service that you can ask. This service returns the full domain informations.
    – Uwe Plonus
    Jul 24, 2013 at 13:18
  • 1
    Whois services usually don't allow you to search specifically for new domains, so your answer doesn't explain how the spammer gets lists of domains which just got registred.
    – Philipp
    Jan 30, 2014 at 10:45
  • This just happened to me to. Thanks for your question and answer. I got one email in my inbox from "Joe" congratulating me on my new domain name then saying I am one 'reply' away from personalized professionals. No credentials. No business. Just a name. My reaction, who the hell is this "Joe" guy and how does he know I just bought this two days ago??? Another one came in the spam email threatening I would lose my domain. Glad I found this post and it makes a bit more sense.
    – user78853
    Jun 18, 2015 at 5:00

1 Answer 1

Reset to default
9

Get used to these. You will get them regularly. A lot of overpriced registrars make a living going around sending out e-mails and even snail mail like this to try to get website owners to pay for services from them. The services are generally legitimate but overpriced and often sent prior to actually being needed.

They are correct that you must keep your WHOIS information accurate and up to date or you could technically lose your domain, but that's something you have to communicate to the registrar you use, not some random third party registrar that you aren't involved with.

If a third party registrar contacts you about your domain, just ignore it. Google properly sorted it as SPAM.

Improve this answer
2
  • Thanks, I was hoping for such answer. I was a little suspicious because nothing like that happened to me when registering my two other domains before, but that was just luck (combined with other factors: long time ago, not a generic TLD, name less likely to have existed before...).
    – Alois Mahdal
    Jul 24, 2013 at 13:39
  • 1
    Yeah, there are some really dirty practices out there. Some less reputable places that let you check name availability will actually go and do short registrations on names you look for too and then try to sell them to you.
    – AJ Henderson
    Jul 24, 2013 at 13:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .