123-reg "Strange" Domains

moonrakerz

Would be interested in anyone's thoughts on this one !

My wife received an e-mail from [EMAIL="sales@123-reg.co.uk"]sales@123-reg.co.uk[/EMAIL] with an invoice for registering 11 domain names with them, it said no payment was required as the amount had been paid. The e-mail looks genuine enough - correct addresses, links etc.
The e-mail was addressed to [EMAIL="fredbloggsandco@mywifesdomain.co.uk"]fredbloggsandco@mywifesdomain.co.uk[/EMAIL]. However she has never dealt with 123-reg or fredbloggsandco !

If you enter the domain addresses into firefox a banner comes up saying "suspected web forgery" !

Today she received an e-mail from "nominet" acknowledging the .co.uk domain amongst the 11domains in the original e-mail.

Has anyone come across anything like this before ! I would appreciate any thoughts.

isofa

Sounds a bit weird! If you view the source, or hover over the links in the email, are they genuine, or do they route somewhere else entirely?

The main support e-mail for 123-reg is: support@123-reg.co.uk But this will get through to their automated response thread system, rather than a specific person.

The .co.uk which you've received a nominet e-mail from, did your wife actually register this one?

TechTerry

Do you allready have a domain?

superscaper

I once had a kind of similar email from nominet adding another domain to my nominet account. Not really quite the same situation but in my case it was simply because the person who was renewing their domain used my email address as their address, they put [EMAIL="name@myname.co.uk"]name@myname.co.uk[/EMAIL] instead of [EMAIL="name@my-name.co.uk"]name@my-name.co.uk[/EMAIL]. That was enough for nominet to associate it with my account online. Maybe something similar has happened here. They may just innocently accidentally put your wife's domain as their existing one when maybe their actual one is slightly different spelling.

Although the suspected web forgery is odd but then maybe that extends from the confusion of contact details typos and now showing "two owners" on their records.

chunter

what's it showing when you do a whois?
http://www.internetters.co.uk/whois_search.php

It may be whoever registered them got the contact email wrong (co.uk instead of .net or something along those lines)
Quite a mistake..

If you're getting the nominet email, I'd suggest that's the likeliest answer.

moonrakerz

I'll try and answers the questions:

isofa: The e-mail from 123 does look genuine. All the links etc behave correctly.

TechTerry/isofa: My wife has never registered a domain. I have through 1 & 1, everybody we deal with gets their own individual address: ie: [EMAIL="bt@mydomain.co.uk"]bt@mydomain.co.uk[/EMAIL], [EMAIL="britishgas@mydomain.co.uk"]britishgas@mydomain.co.uk[/EMAIL].
The address on both e-mails is ???????@mydomain .co.uk. ??????? is the name of a surfing equipment supplier !

chunter: That comes up with what you would expect if she/I had actually registered the domain name through 123.


The domain names are all virtually the same: extract from 123's e-mail below.

"Description Net
*******.co.uk (2 years) 5.58
*******.me.uk (2 years) 5.58
*******1.co.uk (2 years) 5.58
*******1.org.uk (2 years) 5.58
*******1.me.uk (2 years) 5.58
*******3.co.uk (2 years) 5.58
*******3.org.uk (2 years) 5.58
*******3.me.uk (2 years) 5.58
*******4.co.uk (2 years) 5.58
*******4.org.uk (2 years) 5.58
*******4.me.uk (2 years) 5.58

---

Net Total 61.38
VAT Total 10.74
Total 72.12"

******* appears to be a made-up name.
I might try e-mailing 123 support to see if they can throw any light on it.

Stop Press:

I have just found a reference to ******** in what appears to be a make-believe NatWest website address; on a site called PhishTank

JOel_2

I would definatly visit the 123reg support option. Just for your own protection, and to flag up if there is a real problem.

The amount of scams and fiddles related to domain names these days is phenominal. I have to deal with at least 5-6 fake requests a week from registrars contacting me about someone registering domains that are similar, or a different / odd TLD (Top Level Domain) to our main domains, I've had a couple where we have had fake payment information sent back similar to what you have had.

The main deal behind the scams is the dodgy registrars want you to buy the names though them at an inflated price, or skim your payment details to pass on.

It could be a wrong address they have used, as a geniune mistake, or it could be something more sinister. Either way, I'd let 123-reg look into it.

Joel

isofa

Contact Nominet too, explain the situation, they'll be able to check all the register records and see what's been happening too.