Interesting Domain Registration Scam

Posted: January 12, 2021 | | Categories: Miscellaneous

I received an interesting email from this site this morning, a comment by someone who's trying to tell me that this site's registration WILL BE TERMINATED soon. Here's the text of the email I received:

Joe Miller (info@domainworld.com)

Notice#: 491343  
Date: 2021-01-12

YOUR IMMEDIATE ATTENTION TO THIS MESSAGE IS ABSOLUTELY NECESSARY!

YOUR DOMAIN johnwargo.com WILL BE TERMINATED WITHIN 24 HOURS

We have not received your payment for the renewal of your domain johnwargo.com

We have made several attempts to reach you by phone, to inform you regarding the TERMINATION of your domain johnwargo.com

CLICK HERE FOR SECURE ONLINE PAYMENT: https://domain-registration.ga/?n=johnwargo.com&r=a&t=1610385555&p=v1

IF WE DO NOT RECEIVE YOUR PAYMENT WITHIN 24 HOURS, YOUR DOMAIN johnwargo.com WILL BE TERMINATED

CLICK HERE FOR SECURE ONLINE PAYMENT: https://domain-registration.ga/?n=johnwargo.com&r=a&t=1610385555&p=v1

ACT IMMEDIATELY.

The submission notification johnwargo.com will EXPIRE WITHIN 24 HOURS after reception of this email

This wasn't a spam email, but a submission from the site's contact form; a different approach from the other junk I regularly get in my inbox.

I'm scared to think of all of the people who will fall for this email and plunk down money to renew the domain registration. Looking at the email, the renewal registration URL looks like a reputable domain, except for the '.ga' top level domain (TLD) which should give any recipient pause in every case. The URL includes a query string which makes it look like a valid URL. I didn't click the link, but when I opened the browser to the root domain (https://domain-registration.ga) I saw a generic page prompting visitors to re-register their domain for one year, two years, etc. as shown in the following figure:

Unfortunately this makes it really, really easy for people to give these criminals their money.

Notice the fake McAfee, TRUSTe and Norton images, falsely claiming validation from trusted companies. They're not links, which they would be in a valid, protected site.

This is really dangerous, and I hope people find this and skip clicking the link if they ever get an email like I did today.

Next Post: Starting a New Job Monday

Previous Post: PWA Webinar This Month

Header image: Photo by Marcos Paulo Prado on Unsplash