Joe Wein's blog

Comments from Tokyo, Japan

Search engine registration spam

July 3rd, 2013 · 1 Comment

Some spammers try to scare domain registrants with bogus “notifications” such as the following:

Expiration Notice

Order #: 111769336
Order Date: Jun 29, 2013
Bill To: [My Name]
[My details from the WHOIS record of my domain]

PROCESS PAYMENT NOW

Domain Name
[MY.DOMAIN.NAME]

Registration
Jun 29, 2013 – Jun 29, 2014

Price
$75.00

Term
1 Year

Domain: [MY.DOMAIN.NAME]

To: [My Name]

Don’t miss out on this offer which includes search engine submission for [MY.DOMAIN.NAME] for 12 months. There is no obligation to pay for this order unless you complete your payment by Jul 14, 2013. Our services provide submission and search engine ranking for domain owners. This offer for submission services is not required to renew your domain registration.

Failure to complete your search engine registration by Jul 14, 2013 may result in the cancellation of this order (making it difficult for your customers to locate you using search engines on the web).

Process Payment For
[MY.DOMAIN.NAME]
UNSUBSCRIBE INSTRUCTIONS

You have received this message because you elected to receive special notifications and offers. If you no longer wish to receive our special notices, please unsubscribe here, or mail us a written request to the attention of: Customer Contact Manager, PO Box 4668 New York, NY 10163. Please allow up to four weeks for the complete unsubscribe process to take place. NOTE: If you have multiple accounts with us, you must opt out for each one individually in order to fully stop receiving these notifications. This message is CAN-SPAM compliant.

Please do not reply to this email, as we are not able to respond to messages sent to this address.

Needless to say I never asked for this message and harvesting registrant details from WHOIS records for spamming purposes is a violation of ICANN terms.

It is easy to confuse this spam email with a domain registration expiry notice from a registrar, which it isn’t. You can safely delete this and similar messages. Do not hand your credit card details to spammers!

Here are some of the domains used by the spammers who run this scam:

ordertracking136456.com
ordertracking476475.com
ordertracking686342.com
securetrans12113.com
securetrans78922.com
securetrans92175.com
trksecure247546.com
trksecure972456.com
auibcu.com

The domains are hosted on IP address 220.164.140.243 in China.

The “search engine registration” they’re selling is pointless and no such registration is needed. Google isn’t going to forget about my domain just because I’m not going to send these crooks $75 essentially just for spamming me. If either your domain already shows up in Google and other search results or Googlebot or other crawlers are crawling it or there are existing links to it from other websites then you’re already in business.

A “search engine registration” will not protect your domain from accidental expiry, which is what registrants should be concerned about. If your domain is important, please check its expiry date with the registrar via a WHOIS lookup. If your registrar (like mine) offers an auto-renewal service for domain registrations, enable auto-renewal and check that the credit card expiry date is sufficiently far into the future. Otherwise mark a date a few weeks before the expiry date in your calendar so you won’t forget.

Tags: scams · spam

1 response so far ↓

  • 1 Joe Wein // Aug 14, 2013 at 15:18

    More scam domains on the same IP:
    ====
    annualreg747325.com
    order-tracking032128.com
    order-tracking203512.com
    order-tracking426813.com
    order-tracking428903.com
    order-tracking825277.com
    ordertracking465625.com
    ordertracking476475.com
    securetrans12113.com
    securetrans20953.com
    securetrans50998.com
    securetrans78922.com
    securetrans92175.com
    securetransaction18263.com
    securetransaction28470.com
    securetransaction38934.com
    securetransaction67655.com
    securetransaction81306.com
    trksecure235953.com
    trksecure247546.com
    trksecure937575.com

Leave a Comment