Domain registration renewal scams

Post Reply
User avatar
c۞g
Posts: 10927
Joined: Mon Jan 05, 2009 4:02 am

Domain registration renewal scams

Post by c۞g » Mon Mar 19, 2012 3:28 am

A user posted a warning - Thanks!
Which contained identifiable information about them - prohibited in the Forum Guidelines

Here is a screen capture of a link received through spam email which attempts to acquire credit card information for a "domain renewal"
Image

The sender / site is not the recipients registrar, nor a registrar at all.
The data is collected on a non-secure protocol; HTTP
The domains are relatively new, certainly not "since 2004" as one would have you believe. (iglobalmerchantservice.com)

The domains have bogus whois registrant data; different names / email addresses referencing similar address in Beverly Hills, CA USA

AS4134 - CHINANET Zhejiang province network
Registrar: MONIKER ONLINE SERVICES, INC.

Phishing / scams
[massrate]
[red]annualregistrat.com
annualurl.com
annualurldom.com
annuladomai.com
annularegistra.com
domaiannula.com
domairegistra.com
domaiurlregis.com
domannual.com
domannualurl.com
domurlannual.com
iglobalmerchantservice.com
regisdomaiurl.com
urlannualdom.com
urldomannual.com
urlregisdomai.com[/red]
[/massrate]

Cataloged on Wiki Forum Discussion Scams page

User avatar
Jennifer_33
Posts: 7
Joined: Tue Jan 24, 2012 3:31 am

RE: Domain registration renewal scams

Post by Jennifer_33 » Sun Apr 22, 2012 11:58 pm

This company is a scam I do not have anything to do with them yet they send me reminder with my details. Want then to know I'm a Jamaican born and cannot be fool easily.
Bill To: Novelette Novalis
Southwark,
,
+44.02072528734
PROCESS SECURE PAYMENT

Domain Name
NOVELETTEE-NOVALIS.COM
Registration
Apr 20, 2012 - Apr 20, 2013
Price
$75.00
Term
1 Year

Domain Name: NOVELETTEE-NOVALIS.COM

To: Novelette Novalis

Your order #22932758 has been received and is currently processing. Registration includes SE submission for NOVELETTEE-NOVALIS.COM for 12 months. There is no obligation to pay for this order unless you complete your payment by May 5, 2012. SE Services provides submission services and search engine ranking organization for domain owners.

Failure to complete your search engine registration by May 5, 2012 may result in the cancellation of this order (making it difficult for your customers to locate you using search engines on the web).
For Domain Name:
NOVELETTEE-NOVALIS.COM
PROCESS SECURE PAYMENT


UNSUBSCRIBE INSTRUCTIONS

You have received this message because you elected to receive special notifications and offers for NOVELETTEE-NOVALIS.COM. If you no longer wish to receive our special notices, please unsubscribe here

, or mail us a written request to the attention of: Customer Contact Manager, Po Box 5111 Astra, Ontario K0K 3W0. Please allow up to four weeks for the complete unsubscribe process to take place. NOTE: If you have multiple accounts with us, you must opt out for each one individually in order to fully stop receiving these notifications.

Please do not reply to this email, as we are not able to respond to messages sent to this address.

User avatar
c۞g
Posts: 10927
Joined: Mon Jan 05, 2009 4:02 am

RE: Domain registration renewal scams

Post by c۞g » Mon Apr 23, 2012 2:35 am

redirects to:

Code: Select all

http://<red>iglobalmerchantservice.com</red>/contact

[red]60.190.222.224

invoicetracking6549830f.com
invoicetracking775hdkj567.com
invoicetracking875hjf.com
invoicetrackingfjghjk4787.com[/red]

User avatar
NotBuyingIt
Posts: 3301
Joined: Fri Mar 11, 2011 6:21 pm

RE: Domain registration renewal scams

Post by NotBuyingIt » Sun Jan 19, 2014 7:51 pm

"iGlobal Merchant Services" 1-866-438-2434
[red]
220.164.140.243
hdf573rjhdvjf.com
hdhh72jsu179yd.com
order-tracking032128.com
order-tracking203512.com
order-tracking34682.com
securetrans20953.com
securetrans78922.com
securetrans92175.com
[/red]
screenshot: (source: https://www.phishtank.com/phish_detail. ... id=2238843 )
Image

See also:
https://www.phishtank.com/phish_detail. ... id=2238804
https://www.phishtank.com/phish_detail. ... id=2238840

User avatar
c۞g
Posts: 10927
Joined: Mon Jan 05, 2009 4:02 am

RE: Domain registration renewal scams

Post by c۞g » Mon Jan 20, 2014 11:49 pm

<quote user="notbuyingit">
"iGlobal Merchant Services" 1-866-438-2434
[red]220.164.140.243[/red][/quote]
more domains residing on IP: [red]220.164.140.243[/red]

[massrate]
[red]185hdfjjarubc47.com
gs528uyehsjk27.com
jdjf73vbjdo746.com
order-tracking18254.com
order-tracking426813.com
order-tracking428903.com
order-tracking73167.com
order-tracking825277.com
order-tracking83112.com
order-tracking89234.com
securetrans12113.com
securetrans50998.com
securetransaction18263.com
securetransaction28470.com
securetransaction38934.com
securetransaction67655.com
securetransaction81306.com[/red]
[/massrate]


User avatar
c۞g
Posts: 10927
Joined: Mon Jan 05, 2009 4:02 am

RE: Domain registration renewal scams

Post by c۞g » Sun May 25, 2014 3:09 pm

<quote user="notbuyingit">
"iGlobal Merchant Services" 1-866-438-2434[/quote]

[red]iglobalmerchantservices.com[/red]
(866) 438-2434
1516 Elmhurst Road, #171, Mount Prospect, IL 60056

source:
BBB - FL
BBB - IL


[red]210.87.246.15
imsbiz.com[/red]
aka:
[red]biznetvigator.biz
biznetvigator.com
businessnetvigator.net[/red]

providing:
server:
[red]223.197.12.169[/red]

hosting:
[massrate]
[red]
185hdfjjarubc47.com
gs528uyehsjk27.com
hdf573rjhdvjf.com
hdhh72jsu179yd.com
jdjf73vbjdo746.com
order-tracking032128.com
order-tracking18254.com
order-tracking203512.com
order-tracking234534.com
order-tracking34682.com
order-tracking34682.com
order-tracking426813.com
order-tracking428903.com
order-tracking73167.com
order-tracking73167.com
order-tracking825277.com
order-tracking83112.com
order-tracking83112.com
order-tracking876534.com
order-tracking89234.com
order-tracking975749.com
securetrans6575222.com
securetrans7733452.com
securetrans9823189.com
securetransaction18263.com
securetransaction28470.com
securetransaction38934.com
securetransaction67655.com
securetransaction81306.com
[/red]
[/massrate]


User avatar
NotBuyingIt
Posts: 3301
Joined: Fri Mar 11, 2011 6:21 pm

RE: Domain registration renewal scams

Post by NotBuyingIt » Sun May 25, 2014 5:20 pm

Whilst the "iGlobal Merchant Services" webpage template is mostly the same, a different telephone number is being displayed for the newly discovered sites hosted at IP 220.164.140.243 (Yunnan province) and IP 210.87.246.15 (Hong Kong):

"iGlobal Merchant Services" 1-855-572-8396

User avatar
A440
Posts: 2318
Joined: Sat Nov 20, 2010 1:56 am

RE: Domain registration renewal scams

Post by A440 » Mon Apr 25, 2016 2:18 am

Here is another one that popped up today:
[red]domainsregora.com[/red]

User avatar
williKi
Posts: 519
Joined: Thu Oct 01, 2015 6:52 pm

RE: Domain registration renewal scams

Post by williKi » Mon Apr 25, 2016 2:26 pm

Traces to Wuhou, China. Wherever that is. Per ICANN, the domain admin contact address is a residential area in China. "xiang zou qu cui xiang jie dao 716, zhu hai Guangdong 519000". Wherever that is.

User avatar
c۞g
Posts: 10927
Joined: Mon Jan 05, 2009 4:02 am

RE: Domain registration renewal scams

Post by c۞g » Mon Apr 25, 2016 3:23 pm

<quote user="a440">
Here is another one that popped up today:
[red]domainsregora.com[/red]
[/quote]
The domain "Make Payment" opens up a form via:

Code: Select all

https://secure.authorize.net/gateway/transact.dll

IP: [red]103.193.149.189[/red]
[massrate][red]
domainsregblog.com
domainsregco.com
domainsregeo.com
domainsregie.com
domainsregify.com
domainsreging.com
domainsregio.com
domainsregit.com
domainsregme.com
domainsrego.com
domainsregora.com
domainsregsy.com
domainsrinator.com
idomainsreg.com
[/red][/massrate]

This one's been around for a few years; Googled

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests