tirsdag 24. april 2012

SE Services - Expiring domain name scam

Ever got an email with the title being something like this "YourDomainName.com Notice of Registration Soon" ?

They will write something like this:


"To: Domain Owner


Your order #23511877 has been received and is currently processing. Registration includes SE submission for YOURDOMAINNAME.COM for 12 months. There is no obligation to pay for this order unless you complete your payment by May 8, 2012. SE Services provides submission services and search engine ranking organization for domain owners.


Failure to complete your search engine registration by May 8, 2012 may result in the cancellation of this order (making it difficult for your customers to locate you using search engines on the web)."


What's wrong with it?

  1. According to any whois-site (for example:  http://whois.domaintools.com), your domain name probably doesn't expire yet. And before it's about to expire, the company you bought the domain from will most likely remind you that you have to pay if you want to keep ownership. 
  2. But then again, it's a bit vague what you will actually lose if you don't pay according to this email. In truth, you will lose nothing if you don't pay. They claim that they are already providing you with services that will make you visible in search engines etc., but this is a lie. 
  3. What company is this? Does the email say? Does the payment web site say? No. If you're gonna transfer money to someone you'd prefer to know who it is, right? 1 place it the email it is referred to "SE Services", but I'm not sure if that's supposed to be a company name or not. You'd expect them to have a logo, like any other company. 
  4. "They have all my information, like name and address, this must be legit, right??" - This is public information connected to your domain name. A whois-search (described in pt 1) will expose this information.
  5. They link to a "secure payment" web site. This page/site is not secure at all. Your web browser usually contains an image of a padlock or show HTTPS:// in front of the web site url IF the web site has been loaded through a secure socket. You should familiarize your self with this on your favorite browser. 
  6. When trying to enter credit card information, it shows that they've put a little effort into the field validation. For example, if you just write 1234123412341234 as credit card number, they will know that the card is not correct. Why did they do this? Well, perhaps to make it look more real and to make sure they usually have real information when they contact their payment provider to steal your money. 
  7. Their domain name, urlregisdomai.com, is registered at moniker.com, which hosts many domains used for frauds. It also seems to allow them to register domains under false names and addresses. 
  8. A Google search for their domain name shows me that this site has been reported for fraud on many forums and web sites.
  9. If I type "http://urlregisdomai.com" I get redirected to another site  http://iglobalmerchantservice.com/contact ... See how they transfer you directly to the /contact page? Convenient, since most of the people that goes to this site probably has a complaint. If you want to complain, you just have to fill in some more information about your credit card. 
  10. The site also have a phone number on top. Have not tried it, but I assume it doesn't take you to a company called iGlobal Merchant Service. 
  11. I googled some of the text on iGlobal's web site. And found out that they stole it from a legit company called CCBill (now see, CCBill has secure web sites, and they don't even ask about your credit card details if you need to contact support!) (see comparison below)
  12. I'm not sure what they do with the card information they collect on iglobalmerchantservice.com, but I wouldn't be surprised if they some how try to get more money out of you.
  13. There is not a single link on iglobalmerchantservice.com. Not a single link. (They haven't bothered to have more than one web page?)
iGlobal Merchant Service's first page text (fraud):
"iGlobal was created to serve the needs of consumers looking for a fast, safe and convenient way to purchase online services. iGlobal has been a trusted payment processor since 2004, processing millions of online transactions each year and earning its reputation as a leader in the industry."

CCBill's support page text (legit):
"CCBill was created to serve the needs of consumers looking for a fast, safe and convenient way to purchase access to online venues. CCBill has been a trusted E-Merchant since 1998, processing millions of online transactions each year and earning its reputation as a leader in the industry.





6 kommentarer:

  1. Thanks for the details mate. I received the same email but from the domain http://registrationsubmit.com/, which is obviously another domain used for fraud.

    SvarSlett
  2. I just got one too from registrationsubmit.com - for a domain I had actually only registered a week ago! Just a BIT suspicious... ;)

    SvarSlett
  3. Keep adding the domains here so that people can find this page and become aware of it :)

    SvarSlett
  4. I just got it from ordertrk.com

    SvarSlett
  5. Domain Services Inc Fake Domain Renewal Scam Record
    http://www.newsreporter.in/fake-domain-renewal-fraud-by-domain-services-inc-83631

    SvarSlett

Comments containing links unrelated to this blog post will not be approved and will never show on this site.