Scam Registrar login info scam.

[miked]

Hi,

I thought you might all want to know about this: I've received an eMail asking me to click on a link to my registrar and alter whois data for a domain I own. My registrar is 123-reg , but of course it could apply to any registrar. I should say that I have no doubt that 123-reg did not send this message. The text is as follows, my details edited out:

Dear Valued Customer,

ICANN, the organization responsible for the stability of the Internet,
requires that each domain name registrant be given the opportunity to
correct any inaccurate contact data (WHOIS data) associated with a domain
name registration. Our records for your domain are as follows:
<<DOMAIN HERE>>

<<WHOIS DETAILS HERE>>

Registration Service Provider:
PIPEX Communications Uk Ltd, [email protected]
+44.115-917-0000
http://www.123-reg.co.uk/
This company may be contacted for domain login/passwords,
DNS/Nameserver changes, and general domain support questions.

Record last updated on 01-Sep-2005.
Record expires on 31-Aug-2008.
Record created on 31-Aug-2005.

Domain servers in listed order:
NS.123-REG.CO.UK
NS2.123-REG.CO.UK

Domain status: REGISTRAR-LOCK

To review and update your WHOIS contact information, please log into
our management interface at: https://www.123-reg.co.uk/secure/

If any of the information above is inaccurate, you should correct it.
If all of the information above is accurate, you do not need to take any action.
Please remember that under the terms of your registration agreement,
the provision of false WHOIS information can be grounds for cancellation
of your domain name registration.

If you have any questions or comments regarding ICANN's policy, please contact
them directly at [email protected].

Thank you for your attention.

Best regards,
PIPEX Communications Uk Ltd
NOTE: Please do NOT reply to this message. This is an outgoing message only.

Of course I'll be forwarding it to 123-Reg.

Anyone seen anything like this before?

Mike.

 

[wwwdomain.name]

......................

 

[netserve]

EH?

All registrars send out an email to the admin contact once each year asking them to confirm the details are correct.

What you've got there looks fine, there's no evidence that the links are to a third party site that isn't 123-reg

 

[aqls]

Don't click on the link but instead cut and paste it to your browser, that way you avoid hidden urls that mask you away to some dark place.

Just to be sure.

-aqls-

 

[mibut]

They are not asking you to alter your whois info.
They are asking you to check that it is correct and if not, to correct it.
Perfectly normal

 

[miked]

Hi Guys,

Thanks for your replies. I agree that this might be legit: I wrote this in a rush on my way out, and probably should have called it a possible scam.

That said, the thing that worried me on this is the impersonal nature of it. One of the things I've always looked out for with scam eMails is the use of phrases like 'Dear Valued Customer' instead of specifically naming the addressee. Add to this the fact that this seemed to be from a different eMail address than 123-reg have used before (explainable, I know), and that they were asking me to click on a link to log in, and I got worried.

I'll keep you posted on what 123-Reg say if they get back to me. However many weeks that takes...

Mike.

 

[retired_member11]

A Russian domain napper perhaps? Russia is an IP minefield to be avoided.