Security Basics mailing list archives

Re: domain slamming(?)


From: Bob Jones <lists () pavlodarproductions com>
Date: Thu, 21 Dec 2006 22:16:28 -0600

Edmund,

Our business (providing systems and network administration services to small businesses (< 40 users)) has been dealing with these scams and similar ones for several years now. In our cases, there was nothing about China in the letters and faxes, just that the domain name was going to expire 'soon'. Usually, these notices come out in the 3-6 months before current registration expires (as gleaned from whois).

Our solutions were:
1) move domain registration to one of a few places -- ISP for those that had webhosting through their ISP, Networksolutions.com, or through us 2) educate the contact person at each client about what to look for -- mostly, which registrar is being represented, and is that different from the regular registrar.

Another thing to note, coming from the experiences of the first of our clients to be hit with the domain slammers and falling for it, is that when you are slammed and fall for it, there is generally a large amount of headache and extra work that was never done before -- you have to fill out statements on company letterhead and fax them to the 2 different registrars, answering questions like mother's maiden name, and the tip-off, being contacted by the current registrar being asked to confirm the registration transfer.

Hope this helps anyone else on the list.

Bob Jones,


cc wrote:
Dear All,

Awhile back, I received an e-mail and fax from this guy supposedly
representing this CNNIC accredited registrar stating (along the
lines of an unnamed Mainland China company submitting an application
to register some Internet Keywords and chinese domain name using
my company's (the company that I work for) English and Chinese name.
The guy even faxed a 'certificate of authorization' to me to 'prove'
that his company was accredited.  (This supposed certificate,
which I haven't bothered verifying its authentication, looks quite
'legit-like'. (think: Photoshop))

The letter appeared very 'urgent' and required 'immediate' attention.
(Reminds me of Nigerian Scams, btw).   I got a few responses here
but thought the better of it and ignored the guy completely.
He called and I just said we weren't interested.

Well, just recently another guy from the same 'accredited' registrar
called (and faxed) about another company (sister company to the
first one).  Again. Same M.O.

I did a search and came up with the following site:

http://www.legitiname.com/article.php3?id_article=152

The M.O. in the 'sample' letter in this site is similar to
the one I received, including the wanton sprinkling of the
CNNIC name in the letter.

While I doubt anyone in Europe or North America will have any
troubles with this CNNIC issue(unless your company's thinking
of moving into the Chinese market), it is still worth
paying attention how 'time-pressure' tactics work.   To
be truthful, I nearly did get fooled by the initial letter;
that is, until I read carefully and thought about it more.

So, the aforementioned site does makes a good suggestion.
Don't Panic.  Even if the letter gives the impression that
it's a do-or-die situation, calm down and think.


Edmund







Current thread: