33

I have registered a .com domain and received an e-mail from domainadmin.com, it looks extremely like a phishing e-mail, but after a research I am ultimately confused whether this thing is legitimate or not, it seems as something new for sure.

It basically asks you to click a button, where you agree to some terms and conditions that I don't want to read, as I've got other work to do. There is the contract: http://approve.domainadmin.com/registrant/index.cgi?action=contract

And this is the e-mail I received:

Please read this important e-mail carefully.

Recently you registered, transferred or modified the contact information for the following domain name:

domain.com

In order to ensure your domain name remain active, you must now click the following link and follow the instructions provided.

Did anyone come across?

  • 8
    Did you even Google it? The top three results explained what domainadmin.com is about, what the email means, and its legitimate status. In fact, Google's first search suggestion was "domainadmin.com legit". – Polynomial Mar 20 '15 at 15:21
  • 2
    It's not about google, I have read few pages that I've found on the web goggling before I've posted the question and none of them convinced me. Additionally, there is about 5 pages available with the sensible information about the domainadmin.com and the rest seems to be system generated websites telling you that the website seems trustworthy. – redCodeAlert Mar 20 '15 at 17:09
  • 30
    I find it funny that it looks like you're required to do exactly what every anti-phishing site would warn you against. It should not be up to do user to basically do research that the site is really affiliated with ICANN. That's just bad design, bad user experience and bad security. – domen Mar 20 '15 at 17:12
40

As Polynomial mentioned, this is part of ICANN-mandated WHOIS verification. The reason it goes to domainadmin.com is that ICANN doesn't actually run the verification -- rather, like just about all ICANN things, they set policies that are then implemented by others (remember, your .com domain is in a registry operated by Verisign, and was registered by a registrar who was neither ICANN nor Verisign). It's the registrar's job to verify certain WHOIS info; the relevant policy is here, and they must suspend your domain if they can't verify the info.

The reason you're seeing domainadmin.com is that whoever you bought your domain from is likely reselling them from OpenSRS (which basically exists as a platform for domain resellers), which is a label of Tucows. As the registrar, Tucows is responsible for WHOIS verification on domains bought from them; because OpenSRS is mostly a platform for resellers, they generally do so via domainadmin.com (which they own, and which is intentionally white-label). Source 1, and a discussion on their site about this domain choice.

So, this email is likely legitimate, and you need to do what it says or your domain will be suspended. domainadmin.com isn't affiliated with ICANN, it's affiliated with your registrar (you actually bought your domain from a reseller of this registrar). It's intentionally generic because some resellers want a generic thing; resellers who want non-generic have the option to make it non-generic, but most resellers don't want it showing OpenSRS or Tucows prominently.

14

It's legitimate. It's part of ICANN's registration process for certain domain providers.

References:

  • 7
    I visited those websites before I asked the question and to be fair I am confused why the information like this would not be posted at a really trusted website such as icann.org. All of these websites do not seem a valid source – redCodeAlert Mar 20 '15 at 15:32
  • 1
    @redCodeAlert From what I can tell, the site itself is not run by ICANN, but a 3rd party which handles ICANN registrations. – Polynomial Mar 20 '15 at 15:33
  • 3
    so they talk about the icann whois validation process and they're not icann? I'm pretty sure there's something wrong with this. Apart from the links you've added, the information about the website seems to be limited – redCodeAlert Mar 20 '15 at 15:34
  • 1
    Feel free to draw your own conclusions. Mine is that it's legit. – Polynomial Mar 20 '15 at 15:44
  • 4
    @redCodeAlert Keep in mind that ICANN doesn't register domains either, nor do they operate any part of the DNS infrastructure (they set policy and control the infrastructure, but the only zones they directly control are .arpa, .int, and the root zone). You registered your domain on a non-ICANN site, and it was placed in a non-ICANN-operated registry. It would be strange if ICANN directly ran whois verification on an ICANN domain; it's not strange that it's contracted out. – cpast Mar 20 '15 at 18:06
-1

Today I received this kind of email and it was not legitimate, there were two files attached as zip both contained virus as detected by gmail.

The original domainadmin.com is legitimate and we have to be aware of spoofing! I wonder why both answers not pointing for possibility of scam or phishing using this form of email, attackers used paypal, amazon, and many other legitimate sites to attract recipients that the email is valid.

Plesse be aware of such kind of email it might contain malicious file.

  • Always scan attachments.
  • Check if the link pointed to the same URL that appear to be? put the mouse on the link and see status bar to see if the URL is similar to what appear.
  • Check extension of the file, don't opne image.jpg.exe, .bat, .scr

From: Domain Date: Thu, Feb 2, 2017 at 3:22 PM Subject: VERIFICATION REQUIRED - Please verify your domain name(s) as soon as possible To: ** Please note that failure to complete the process outlined below will lead to the suspension/termination of your domain name and it cannot be transferred or rehost again. **

Dear Customer, Please read this important e-mail carefully. For all existing and recently registered domain name(s). ICANN requires all accredited registrars to verify your Domain Name by attached document. You can read about ICANN's new policy at: http://www.icann.org/en/resources/registrars/raa/approved-with-specs-27jun13-en.htm#whois-accuracy. Mydomain In order to ensure your domain name remain active, you must now download attached documents and click veirfy, this will be done automatically as soon you click verify. http://approve.domainadmin.com/registrant/?verification_id=4628489&key=Zf2ZgM2NwF&rid=105058 Failure to download the attached document and complete this process will eventually lead to the termination of your domain name(s) and server. If you have additional questions, please do not hesitate to get in touch. Please check your domain data attached. Thank you for your attention,

Domain HelpDesk Affiliates Internet Corporation for Assigned Names and Numbers ICCAN.ORG PostMaster/DomainNotice Icann logo Please visit our website http://www.icann.org

Attachments: enter image description here

The Virus

enter image description here

  • First, the comments go into the possibility of there being a phish. Second, the email you received was different from the one received by the OP. Third, the question was if it was legitimate, which it was. We can't outline how every single possible email can be a phish, because every one can. The correct answer is that it was legitimate. The fact that it is possible for any email to be a phish is not helpful (but still covered in the comments). – schroeder Feb 5 '17 at 15:55
  • People looking into answers quickly to check the email. as I did before, but hopefully my antivirus detected the viruses! otherwise because of above answers I might be falled into hell! – Akam Feb 5 '17 at 16:21
  • Right ... but again, the same could be said of any email. The question is if it is possible for the stated email to be real, not, if real, if it could be a phish. – schroeder Feb 5 '17 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.