CAUTION: .ca owners!

[mis_chiff]

I just came across this on the CIRA site,
although rare for .ca's, it does happen!

Network Solutions Customer - Godaddy Address - Enom Link
all in one email!

October 30, 2008
Phishing Attack Warning for Domain Name Holders

The Canadian Internet Registration Authority (CIRA) received reports of phishing scam e-mails designed to collect information relating to domain name registrations. The e-mails were made to appear to be coming from various domain name Registrars.

This is a targeted phishing attack. CIRA is advising domain name holders to not respond to these e-mails.

If you have questions regarding your domain name please contact your Registrar directly.

You can see copies of e-mails below:

Dear Network Solutions Customer,

We recently notified you that the registration period for your Network Solutions domain name had expired. As a benefit of having previously registered a domain name(s) with Network Solutions, you are eligible to receive a percentage of the net proceeds that were generated from the renewal and transfer of the domain name you chose not to renew. Since you have chosen not to renew the domain name listed below during the applicable grace period, we were successful in securing a backorder for this domain name on your behalf and it has been transferred to another party in accordance with the Service Agreement.

Renew your domain now - PHISHING URL REMOVED

You must click on the following link, enter your domain name, and confirm your contact information in order to claim these funds. If your contact information is not correct, you must enter Account Manager and make the appropriate changes prior to clicking “submit” from the confirmation screen. If you do not do this, you will be confirming inaccurate information and will not receive any payment. Checks will only be made payable and mailed to the Account Holder of record.

Sincerely,

Network Solutions® Customer Support

Dear user,

On Tue, 28 Oct 2008 23:25:34 +0300 we received a third party complaint of invalid domain contact information in the Whois database for this domain. Whenever we receive a complaint, we are required by ICANN regulations to initiate an investigation as to whether the contact data displaying in the Whois database is valid data or not. If we find that there is invalid or missing data, we contact both the registrant and the account holder and inform them to update the information.

The contact information for the domain which displayed in the Whois database was indeed invalid. On Tue, 28 Oct 2008 23:25:34 +0300 we sent a notice to you at the admin/tech contact email address and the account email address informing you of invalid data in breach of the domain registration agreement and advising you to update the information or risk cancellation of the domain. The contact information was not updated within the specified period of time and we canceled the domain. The domain has subsequently been purchased by another party. You will need to contact them for any further inquiries regarding the domain.

PLEASE VERIFY YOUR CONTACT INFORMATION - PHISHING URL REMOVED

If you find any invalid contact information for this domain, please respond to this email with evidence of the specific contact information you have found to be invalid on the Whois record for the domain name. Examples would be a bounced email or returned postal mail. If you have a bounced email, please attach or forward with your reply or in the case of returned postal mail, scan the returned letter and attach to your email reply or please send it to:

Attn: Domain Services
14455 N Hayden Rd
Suite 219
Scottsdale, AZ 85260

LINK TO CHANGE INFORMATION - PHISHING URL REMOVED

Thank you,
Domain Services

What is Phishing?

Phishing is a practice of luring unsuspecting Internet users to a fake web site by using an authentic looking e-mail in an attempt to steal passwords, account information or other sensitive data.

The owner's info for com42.asia
networksolutions.com.com42.asia (note the sub domain in front)

Registrant Name:Shestakov Yuriy
Registrant Organization:Shestakov Yuriy
Registrant Address:Lenina 21 16
Registrant Address2:
Registrant Address3:
Registrant City:Mirniy
Registrant State/Province:MSK
Registrant Country/Economy:RU
Registrant Postal Code:102422
Registrant Phone:+7.9218839910
Registrant Phone Ext.:
Registrant FAX:+7.9218839910
Registrant FAX Ext.:
Registrant E-mail:[email protected]

Always contact the registrar directly Do Not Click The Links

 

[whitebark]

I don't think they were specifically targeting .ca's. I got the network solutions one this morning.

 

[mis_chiff]

I don't think they were specifically targeting .ca's. I got the network solutions one this morning.

I agree that's it's probably not just for .ca's
CIRA was the only place I saw this at though
and 3 of the emails I got, were for my .ca's!

 

[liquidcherry]

why the heck are you buying .ca domains anyway???????????

LOL, just kidding

Cheers

Frank

 

[mis_chiff]

why the heck are you buying .ca domains anyway???????????

LOL, just kidding

Cheers

Frank

Cause I know if I don't get em first..you will

 

[Peter]

Just to let you know mis_chiff i have removed the phishing links just in case people do click on them

These same people have been doing godaddy phishing scams as well as other eNom scams so be weary of any emails supposedly from your registrar.

 

[mis_chiff]

Thanks Peter
I forgot to remove them before I posted [slaps self]

 

[Steven Pilditch]

Thanks.