As a prolific Webmaster, I have noticed a disturbing new trend in phishing scam emails this week. What is most disturbing is that I appear to be the latest target of these scammers.
In order to maintain control of my domain registrations, I have one email address that I use solely for this purpose. As anyone who has had a domain name registered for more than a few months will know, domain registrars send out emails periodically to all registered owners, asking them to confirm or update their registration details in order to comply with ICANN regulations and maintain current, accurate registration data.
The emails that are sent out are worded in an official way and carry a link to the registrar’s website so that the domain registrant can check their details and amend if necessary. Once you have seen a few of these, it is almost a reflex to just click the link and confirm the details, especially if you know they haven’t changed. There are always more important things to do, so it is just another admin task that can be dealt with quickly and then forgotten. Not any more.
Over the years I have registered domains with various different registrars, both for myself and for my clients. As more competition entered the domain registration market, prices have fallen and I have tested most of them out, not only for price, but also for ease of maintenance and customer service. Although most of my domains are now centralized in one of my two favorite registrar accounts at GoDaddy.com and NameCheap.com, I still have a few scattered round at Network Solutions, Tucows and country specific registrars like 123-Reg in the UK and Hostinet in Spain.
This week, as usual, emails arrived to my domains@ email account asking me to confirm my registration details. All I can say is, thankfully, I was on the ball. It has now become a habit for me to check the information that pops up when I hover over a link in an email, in order to confirm that the link actually goes where it says it is going, before I click on it. I consider this a good habit and I do it faithfully every time, regardless of how professional or genuine the email looks.
So far this week I have received scam emails purporting to be from Enom.com (NameCheap.com’s registrar) and Network Solutions. I have no doubt that over the next few days I shall receive more emails that claim to be from other registrars and I shall be on my guard, as you should be if you have domains registered. Just like the Bank phishing emails, it is easy to spot a fake one when you know you don’t have an account with that institution but when you get one from “your bank” it is tempting to just check it out.
So, webmasters and website owners, be warned. You will still be getting genuine ICANN compliance emails but before you click on any link in any email check it out. The phishing emails will display a link that looks like www.myregistrar.com but the underlying shortcut will take you to something like www.myregistrar.com.update08.cn. Anything that appears after the .com should immediately ring alarm bells. If you have the time, contact your registrar and inform them of the email you received and they will provide you an email address where you can forward the bogus message so that they can try to trace the sender from the header information.
© Andy Smith 2008
