Hosting Note - Spam or Real?

vsh

Hi guys.

I manage a website for our business, and got the following email today.

==


Dear Sir/Madam,



We have received a request for the registration of the website www.**hostname**.com Our system shows that you are the owner of www.**hostname**org. This can have far-reaching consequences for you in the future. We are therefore under the obligation to contact you, in order to offer you the first right of registration. This means that we will reject the application of the third party and the website:


www.**hostname**.com

After agreement we will link this website to:

www.**hostname**.org

This means that you will have the first option on the domain name, in order to avoid possible future problems.

We are usually under the obligation to register the domain name and to protect it for a period of 10 years. The annual price for this extension is € 19.95 per year. This means a one-off payment of € 199.50. When the link has been completed, all the Internet traffic that goes to the new extension, will be automatically linked to your current extension and website. This process will take a maximum of 24 hours. This domain name will then have a worldwide reach. The third party will be rejected and can no longer use your domain name.

Important information:
- You will receive a one-off invoice of € 199.50, exclusive of VAT, for a term of 10 years.
- This contract can be cancelled at all times after the first term of one year. The paid amount for the remaining number of years will be refunded to your account.

If you agree to our offer, please send an agreement by email within 48 hours after receipt of this email, stating your name, address and VAT number in a reply to this e-mail address.

The third party will subsequently be rejected by us, and we will then complete the link. You will receive a confirmation and all the information you need by email on the same day.

With kind regards,

Sean Walsh
IDS Ireland
www.idsireland.com

==



IDS Ireland have a real webpage and claim to have an office address in Dublin.


Doing a whois lookup of idsirealnd.com I see that they're owned by GoDaddy. When I check with GoDaddy if www.**hostname**.com is available for purchase, it's not, but I can launch an enquiry to see if they owner will sell it to me.

When I do a whois lookup on www.**hostname**.com I see that it's owned by http://www.meshdigital.com , which brings me to the website https://www.heg.com/ , who were bought out by GoDaddy in 2016.

https://aboutus.godaddy.net/newsroom/news-releases/press-release-details/2016/GoDaddy-Acquires-Host-Europe-Group-Becomes-Market-Leader-In-Europe-For-Small-Business-Cloud-Services/default.aspx



Looking up the Ordmond Building on Google Maps it seems that this building is just a bunch of meeting rooms.


https://www.google.com/maps/place/Ormond+Building,+Ormond+Quay+Upper,+Northside,+Dublin+7/@53.3456937,-6.2713715,2a,75y,40.76h,70.39t/data=!3m6!1e1!3m4!1s6FwnAydmg3WHhgnP3-nWlw!2e0!7i13312!8i6656!4m5!3m4!1s0x48670c2864685117:0xcbdccefb1b8afa22!8m2!3d53.3458355!4d-6.2713829


(funnily, it looks like there's a guy about to light up a spliff on the pavement outside...!)



The company doesn't seem to show up on Google anywhere i can see.


Currently the page www.**hostname**.com redirects to my page www.**hostname**.org

So what do you think? I hate responding to fishing emails like this but it is a genuine concern if the .com page starts to be used.

With thanks,
Vsh

biko

Has many of the vectors for spear phishing, especially the short timeline to make sure you don't think twice.
I'd say to don't even respond.

However, do check what the reply-to mail address is. If this is a generic gmail address then it's spam for sure.

vsh

Thanks. It's not a gmail address, it's @idsireland.com

In any case the 48 hours have expired and I have not replied, interesting to see what happens next.

mneylon

It's a scam. See https://blacknight.blog/stop-domain-scam.html

biko

So it's not a scam and not spear phishing. It's just IDSireland chancing their arm?

While they may not be entirely fraudulent, these emails are certainly dishonest and misleading,

mneylon

biko wrote: »

So it's not a scam and not spear phishing. It's just IDSireland chancing their arm?

Based on our research we'd classify it as a scam. They've been doing this is multiple European markets and targeted Ireland for the first time back in January.

scamalert

did anyone tried to lookup source IP where email originated, lame scam but still good to be aware of.