Enom spoof emails

[Peter]

Just received the following email. I nearly fell for it until I noticed the URL the links lead too. The main reason I thought it genuine as I have received a spate of whois confirmation emails from enom today.

The url's actually lead too enom.com.com92.biz/ (this post automatically links the web address in the email however they are linking to enom properly).

Dear user,

On Tue, 28 Oct 2008 22:24:28 +0200 we received a third party complaint of invalid domain contact information in the Whois database for this domain Whenever we receive a complaint, we are required by ICANN regulations to initiate an investigation as to whether the contact data displaying in the Whois database is valid data or not. If we find that there is invalid or missing data, we contact both the registrant and the account holder and inform them to update the information.

The contact information for the domain which displayed in the Whois database was indeed invalid. On Tue, 28 Oct 2008 22:24:28 +0200 we sent a notice to you at the admin/tech contact email address and the account email address informing you of invalid data in breach of the domain registration agreement and advising you to update the information or risk cancellation of the domain. The contact information was not updated within the specified period of time and we canceled the domain. The domain has subsequently been purchased by another party. You will need to contact them for any further inquiries regarding the domain.

PLEASE VERIFY YOUR CONTACT INFORMATION - http://www.enom.com

If you find any invalid contact information for this domain, please respond to this email with evidence of the specific contact information you have found to be invalid on the Whois record for the domain name. Examples would be a bounced email or returned postal mail. If you have a bounced email, please attach or forward with your reply or in the case of returned postal mail, scan the returned letter and attach to your email reply or please send it to:

Attn: Domain Services 14455 N Hayden Rd Suite 219 Scottsdale, AZ 85260


LINK TO CHANGE INFORMATION - http://www.enom.com


Thank you,
Domain Services

[IncidentID:49989]

 

[FreshAvails.com]

and enom is in seattle and godaddy in arizona

 

[Peter]

and enom is in seattle and godaddy in arizona

Indeed, in fact the address they have put in the email is in fact Godaddy's address. I personally did not know where eNom were based and many others are probably the same.

 

[kleszcz]

I got an another spoof email. The url leads to www(dot)enom(dot)comcom82(dot)biz. :td:

Dear eNom Customer,

Starting at 1 AM PT on Saturday, November 1st, 2008 until 4 AM PT, we will be conducting maintenance on our database and datacenter resulting in the following sites and services being unavailable:

* Main site
* All web hosting services
* Email services
* Communication with the registry affecting new registrations, renewals, and transfers

For access your account follow this link - http://XXXXXX

The following services will not be affected and will continue to be fully operational:

* DNS will resolve normally - although operational through this downtime, any changes to DNS settings may be delayed intermittently for a period of up to 24 hours from the start of the maintenance period
* Email forwarding and site redirection will operate normally

We anticipate the maintenance will only last up to 3 hours. We apologize for any inconvenience during this short maintenance and thank you for your patience.

Sincerely,
eNom Tech Support

 

[SlimPickins]

UGHHHH! well, glad you got the email before me cuz i might have taken the bait! thanks for the warning! sp

 

[weblord]

i've reported to
http://www.google.com/safebrowsing/report_phish/

on firefox it will trigger a popup saying "suspected web forgery"
whenever you open that site.

 

[Prosperous]

Yup, got one too... Didn't fall for it.

Google for more info:
http://www.google.com/search?hl=en&q="com82.biz"&btnG=Search (com82.biz)
http://www.google.com/search?hl=en&q="com92.biz"&btnG=Search (com92.biz)
(etc.)

 

[instance]

My company received one today as well with the same poorly punctuated email. The address was enom.com.sys85.biz. Firefox identifies it as a forgery site as well.

 

[somebody_rb]

ohh..i think many would fall for it...thanks for warning us all

 

[riks.rocks]

thanx for warning!!!!