Fake Enom (& Other Registrars) "Warning" Email

[TestCase]

Just received the email quoted below (actually copied from the DI link). Seemed fishy to me-- as in "Spear-Fishy" . Did a quick Google and found the link below. Looks like I was right. I suspect other registrars will be spoofed in the coming days as well.

http://www.domaininvesting.com/enom-spear-phishing-email-received/

EDIT:
I see that NP'er ITCorp received a similar email from NameBright and posted about it here,
https://www.namepros.com/threads/warning-new-namebright-fishing-email.888348/

Update #2:

Read the comments for the above link as others registrars ARE being spoofed as well. (I love it when I'm right...)

(Subject: Domain [redacted.COM] Suspension Notice

Dear Sir/Madam,

The following domain names have been suspended for violation of the ENOM, INC. Abuse Policy:

Domain Name: [redacted.COM]
Registrar: ENOM, INC.
Registrant Name: DOMAIN ADMINISTRATOR

Multiple warnings were sent by ENOM, INC. Spam and Abuse Department to give you an opportunity to address the complaints we have received.

We did not receive a reply from you to these email warnings so we then attempted to contact you via telephone.

We had no choice but to suspend your domain name when you did not respond to our attempts to contact you.

Click here and download a copy of complaints we have received.

Please contact us by email at mailto:[email protected] for additional information regarding this notification.

Sincerely,
ENOM, INC.
Spam and Abuse Department
Abuse Department Hotline: 480-124-0101

 

[forge]

I just got a warning today from Moniker about spoof emails now circulating.

Best keep your guard up.

 

[FPForum]

Yup - Got a few of these as well. Specifically for 6N.com's I have registered. Beware everyone, they are faking them from all registrars.

 

[Joseph Green]

Dynadot too:

From: DYNADOT LLC <[email protected]>

Received: from hcm-cp83.vnn.vn (hcm-cp83.vnn.vn. [222.255.124.83])
Received-SPF: permerror (google.com: permanent error in processing during lookup of [email protected]) client-ip=222.255.124.83;

Subject: Domain EXAMPLE.COM Suspension Notice

Dear Sir/Madam,

The following domain names have been suspended for violation of the DYNADOT LLC Abuse Policy:

Domain Name: EXAMPLE.COM
Registrar: DYNADOT LLC
Registrant Name: [Redacted]

Multiple warnings were sent by DYNADOT LLC Spam and Abuse Department to give you an opportunity to address the complaints we have received.

We did not receive a reply from you to these email warnings so we then attempted to contact you via telephone.

We had no choice but to suspend your domain name when you did not respond to our attempts to contact you.

Click here and download a copy of complaints we have received.

Please contact us for additional information regarding this notification.

Sincerely,
DYNADOT LLC
Spam and Abuse Department
Abuse Department Hotline: 480-142-7893

"Click here and download" is a link to http://aldc.com.au/abuse_report.php?EXAMPLE.COM (do not visit).

 

[Beezy]

Just bumping this so more people see it. Got some Dynadot ones today.

 

[carob]

Also received via Namesilo domains whois email address.

Did get a warning email from Dynadot about the scam.

 

[KDN]

Got a NameBright email too.