Domain expiration scam

[serialCoder]

recently got an email, and below is the content...

Domain Name: xxxx.COM

To: Domain Owner

Your order #21341502 has been received and is currently processing. Registration includes SE submission for xxxx.COM for 12 months. There is no obligation to pay for this order unless you complete your payment by Apr 16, 2012. SE Services provides submission services and search engine ranking organization for domain owners.

Failure to complete your search engine registration by Apr 16, 2012 may result in the cancellation of this order (making it difficult for your customers to locate you using search engines on the web).

they want you to click the link, that is pretty obvious but new users might be succeptible to. below is the link it goes to.

domannualurl.com

Now i'm not sure if this is new or old (this is the first time i got this) just wanted to give everyone a heads up

 

[ScamHunter]

Some info on the probable scammer

Seems to be a big operation involving:

1. A registar:
   MONIKER ONLINE SERVICES, INC. (Whois Server: whois.moniker.com)
   
   
2. Several Domains:
   REGISDOMAIURL.COM
   URLREGISDOMAI.COM
   DOMANNUAL.COM
   DOMANNUALURL.COM
   
   
3. The same person:
   Registrant [3684802]:
   Administrative Contact [3684802]:
   Billing Contact [3684802]:
   Technical Contact [3684802]:
   
   T Jackson
   269 South Beverly Drive
   Beverly Hills
   CA
   90210
   US
   Phone: +1.3103894789
   
   Email: [email protected]
   
   

:bingo:

 

[lothos]

Now i'm not sure if this is new or old (this is the first time i got this) just wanted to give everyone a heads up

It's pretty well known, it's for "search engine registration" and not for your domain registration.

Seems to be a big operation involving:

1. A registar:
   MONIKER ONLINE SERVICES, INC. (Whois Server: whois.moniker.com)

:bingo:

I highly doubt Moniker is involved, more than likely they just happen to be the registrar the domain is registered at.

 

[Tempor]

I highly doubt Moniker is involved, more than likely they just happen to be the registrar the domain is registered at.

Quite possible, they just registered the sites listed below, all used by the same Chinese scammer.

But business is business :sold: :hehe:

The above Domain Registration scam takes you first to DOMANNUALURL.COM, then to 60.190.222.224 where your credit card info is harvested. Insecurely (HTTP) mind you, but who gives a damn, you're being scr*wed anyway.

inetnum: 60.190.222.128 - 60.190.222.255
netname: NINBO-LANZHONG-LTD
country: CN
descr: Ninbo Lanzhong Network Ltd
descr:
admin-c: TD206-AP
tech-c: CS64-AP
status: ASSIGNED NON-PORTABLE
changed: [email protected] 20100105
mnt-by: MAINT-CN-CHINANET-ZJ-SX
source: APNIC

role: CHINANET-ZJ Shaoxing
address: No.9 Sima Road,Shaoxing,Zhejiang.312000
country: CN
phone: +86-575-5136199
fax-no: +86-575-5114449
e-mail: [email protected]
remarks: send spam reports to [email protected]
remarks: and abuse reports to [email protected]
remarks: Please include detailed information and times in UTC
admin-c: CH109-AP
tech-c: CH109-AP
nic-hdl: CS64-AP
mnt-by: MAINT-CHINANET-ZJ
changed: [email protected] 20031204
source: APNIC
changed: [email protected] 20111114

person: Taichun Du
nic-hdl: TD206-AP
e-mail: [email protected]
address: Shaoxing,Zhejiang.Postcode:312000
phone: +86-574-88311333
country: CN
changed: [email protected] 20100105
mnt-by: MAINT-CN-CHINANET-ZJ-SX
source: APNIC

Naturally, someone will highly doubt the above entities are involved ...

:notme:

Registered sites: :lala:

annualregistrat.com
annualurl.com
annualurldom.com
annuladomai.com
annularegistra.com
domaiannula.com
domairegistra.com
domaiurlregis.com
domannual.com
domannualurl.com
domurlannual.com
iglobalmerchantservice.com
regisdomaiurl.com
urlannualdom.com
urldomannual.com
urlregisdomai.com


Why do I feel like I'm going to be banned shortly?

_\|/_ _\|/_ _\|/_

a.k.a. admins...