CAUTION: Phishing email attempts to hijack NetSol accounts

[Theo]

CAUTION: the following URL is a spoof site attempting to hijack NetSol accounts. Report this domain to Yahoo - the registrar:

http://whois.domaintools.com/networksolutlon.com


*****************************************
Important ICANN Notice Regarding Your Domain Name(s)
*****************************************

Dear User,

it is that time of year again. ICANN(the Internet Corporation for Assigned Names and Numbers) annually requires that all accredited registrars (like Network Solution) ask their domain administrators/registrants to review domain name contact data, and make any changes necessary to ensure accuracy. According to our records you are the ADMINISTRATIVE CONTACT for one or more domains registered at NetworkSolution.com, Inc. as of November 3rd, 2009.

To review/update your Account data, simply:
+ Login to [ link deleted ]
+ You will be taken to a landing page and asked to enter your account information
Please take a look that your account and domain information is up to date.

If, however, your domain contact information is inaccurate, you must correct it. (Under ICANN rules and the terms of your registration agreement, providing false contact information can be grounds for domain name cancellation.) To review the ICANN policy, visit: http://www.icann.org/whois/wdrp-registrant-faq.htm

Should you have any questions, please email us at [email protected] or call our customer support line at (480) 505-8877.

Thanks for your attention and thank you for being a GoDaddy.com, Inc. customer.

Sincerely,
GoDaddy.com, Inc. Domain Support


If you are the domain administrator of more than one GoDaddy.com domain account, you may receive this notice multiple times.
---------------------------------------------------------------------------------------------
Copyright (c) 2008 GoDaddy.com, Inc. All rights reserved.




++++++

The following domains are all on the same server; the content is mostly Iranian.

Koolac.com
Officialvpn.com
24charger.com
30morgh-gsm.com
7sms.biz
8shop.ir
Andishehbookbank.com
Aria-games.com
Ariagroup.ir
Asrenovin.com
Besttoday.ir
Dlfox.com
Drhostname.com
E-linux.net
Ebankpasargad.com
Fanzone.ir
Farazclub.com
Fazaha.com
Frdos57.com
Ganjinehgroup.com
Goodlife.ir
Gostaresh-dpa.com
Graphictools.ir
Ham3da.net
Homayooni.com
Host3erver.com
Host98.net
Ir00.com
Iran-king.com
Iranbolt.com
Irantrance.com
Iranwz.com
Isfmarket.net
Itba.ir
K1sajedi.com
Lianteam.com
Linkgardi.com
Linksbazar.com
Mahabad-design.ir
Mahtabmarket.com
Majid-zamani.com
Mehdix.com
Mehranjameh.com
Milad094.com
Mjjacademy.com
Mohandes-bakhshi.ir
Mrolympia.ir
Mub.ir
Music3ara.com
Musicironi.info
Mysqld.ir
Naslearia.com
Novinavaran.com
Omid1.com
Omransh.ir
P30daily.com
Parsipeople.org
Parsooa.com
Pedramshanehsaz.com
Perperuk.com
Persianclickers.com
Persianjoomla.ir
Peydayesh.ir
Picnama.ir
Picsfm.com
Poprap.ir
Rosepack.org
S4m.ir
Saeidpc.ir
Sardian.ir
Shopi.ir
Shopmop.net
Sparksun.com
Ssces-pwut.com
Syndrome.ir
Tachar.ir
Tafrihclub.com
Takfun.com
Takfun.ir
Tehransat.ir
Tehranvps.com
Teribun.com
Top-host.ir
Topcenter.ir
Vankitchensystem.com
Vbsaz.ir
Vbskin.ir
Vbteam.ir
Vivvo.ir
Warezhost.biz
Webforumtalk.ir
Wrestlingonline.ir
Yahoo-hacking.com
Yahoo-hacking.net
Ytg-co.com
Ytg.ir
Zarmarket.com
Zikzak.ir
Be3tshop.info
Parsclas.ir
Shopmop.ir
E-cwf.com

 

[Biggie]

question


why does the email reference godaddy, when it was supposedly coming from netsol as a whois update reminder?

or am i misreading it?

 

[stewie]

...signed Godaddy too.

 

[Theo]

Don, you're reading it right. And that was a reason why I simply viewed the headers and saw it was a phishing attempt.

 

[Biggie]

Don, you're reading it right. And that was a reason why I simply viewed the headers and saw it was a phishing attempt.

and that's why "reading" is still fundamental

good eye Theo!

 

[Theo]

Another one, this one spoofing eNom

http://whois.domaintools.com/enomcentiral.com

Same DNS servers