IT.COM

warning Scam Email Purportedly From NameCheap

NameSilo
Watch

TestCase

Note: Doesn't play well with others.Top Member
Impact
2,381
BE ALERT!!!

I received the following SCAM/Phishing email (see attached) that is purportedly from NameCheap. The domain in the "from" address is "notifications@namecheap.WS" and it was registered a couple of days ago.

They seem to be trying to obsfuscate some of the text for whatever reason (spam filters maybe?!?!?) because when I tried to do a copy & paste the body of the email I ended up with a LOT of gibberish. It took a minute to understand what they had done.

For example, the last paragraph reads, "We take your security and privacy very seriously...." but when I tried to copy and paste it I saw this,
W0687034230e0687034230 0687034230t0687034230a0687034230k0687034230e0687034230 0687034230y0687034230o0687034230u0687034230r0687034230 0687034230s0687034230e0687034230c0687034230u0687034230r0687034230i0687034230t0687034230y0687034230 0687034230a0687034230n0687034230d0687034230 0687034230p0687034230r0687034230i0687034230v0687034230a0687034230c0687034230y0687034230 0687034230v0687034230e0687034230r0687034230y0687034230 0687034230s0687034230e0687034230r0687034230i0687034230o0687034230u0687034230s0687034230l0687034230y0687034230.0687034230 0687034230W0687034230e0687034230 0687034230a0687034230p0687034230o0687034230l0687034230o0687034230g0687034230i0687034230z0687034230e0687034230 0687034230f0687034230o0687034230r0687034230 0687034230a0687034230n0687034230y0687034230 0687034230i0687034230n0687034230c0687034230o0687034230n0687034230v0687034230e0687034230n0687034230i0687034230e0687034230n0687034230c0687034230e0687034230 0687034230c0687034230a0687034230u0687034230s0687034230e0687034230d0687034230.


After focusing my eyes for a moment, I realized what they did was,
W0687034230e0687034230 0687034230t0687034230a0687034230k0687034230e0687034230 0687034230y0687034230o0687034230u0687034230r0687034230....

So be careful!!!!

Ps. Does anyone know what the "0687034230" is all about and why it doesn't appear?
This is the first time I've ever encountered this particular "hidden/invisible" code/text.
 

Attachments

  • NC_ScamEmail.jpg
    NC_ScamEmail.jpg
    171.9 KB · Views: 304
Last edited:
3
•••
The views expressed on this page by users and staff are their own, not those of NamePros.
I have also received this phishing email yesterday and already alerted NameCheap about this with raw email headers. They haven't replied yet!
phishing_email_alert.png
 
2
•••
Does anyone know what the "0687034230" is all about and why it doesn't appear?
This is the first time I've ever encountered this particular "hidden/invisible" code/text.
Maybe the numbers are coloured the same as the background then the whole text is tracked back until the letters are together?
 
1
•••
Maybe the numbers are coloured the same as the background then the whole text is tracked back until the letters are together?
You got me thinking so I went back and looked at the underlying html of the content and discovered this,
<span style="font-size:0px;">0687034230</span>
So that "splains" it!

Now it has me wondering if those are random digits or they are unique and specific to each individual email.

Hmmmm...

@deebong - Can you take a look at the html in your email and see if the number is the same or if your's is different?
 
Last edited:
2
•••
@deebong - Can you take a look at the html in your email and see if the number is the same or if your's is different?

For me, it's a different combination:

<span style="font-size:0px;">26899705987345</span>
 
2
•••
It doesn't matter what the characters are. The fact that the style sheet has attributed a font size of "0" means whatever it is, it won't show.

There's probably quite a few ways to do something like this. You'd think spam filters would pick these things up.


Edit: I just realised you're looking at whether the numbers have significance.
See signature :xf.smile:
 
Last edited:
1
•••
1
•••
For me, it's a different combination:

<span style="font-size:0px;">26899705987345</span>
I realized the unique numbers might not have any real relevance to the specific email as it would make sense to assign random numbers to each and every email so that spam filters would have a difficult time singling them out/picking them up.
 
1
•••
@tamar I believe is the namecheap rep.

UPDATE:
I contacted live support and was told to submit a ticket to their legal/abuse department...

Why? When I'm chatting with a live friggin person?
Whatever
 
Last edited:
3
•••
@tamar I believe is the namecheap rep.

UPDATE:
I contacted live support and was told to submit a ticket to their legal/abuse department...

Why? When I'm chatting with a live friggin person?
Whatever
I just forwarded the email I received to "[email protected]" and I got an auto-response saying that it had been received and someone would be in contact with me.

But I sooooo understand your point about being in a chat with a CSR. So much for the CS part...
 
Last edited:
2
•••
2
•••
2
•••
Back