Phishy Corporate Communications

Received an email that looked phishy:

Greetings,

Please read this important e-mail carefully.

Recently you registered, transferred or modified the contact information for the following domain name:

ezrasf.com

In order to ensure your domain name remain active, you must now click the following link and follow the instructions provided.

http://verify.domain.com/registrant/?verification_id=999999&key=BFrrpxGDbb&rid=999999

Sincerely,

Domain Registrar

The web page listed my name and email address, so the riskiness of clicking it seemed low, but ALL KLAXONS were going off in my head about this being phishing. I also received another email threatening to suspend my domain if I did verify it.

The email headers really confirmed for me this was phishing:

Received: from mx.registrarmail.net (mx.registrarmail.net [216.40.35.248])
	by myemail-mx26.g.emailprovider.com (Postfix) with ESMTP id 999AA999999DDD
	for <myemail@mydomain.com>; Mon, 28 Mar 2016 05:43:25 -0700 (PDT)
Received: from cron01.endurance.prod.tucows.net (unknown [64.99.53.70])
	by mx1.registrarmail.net (Postfix) with SMTP id B5999999E51
	for <myemail@mydomain.com>; Mon, 28 Mar 2016 12:43:24 +0000 (UTC)
Received: by cron01.endurance.prod.tucows.net (sSMTP sendmail emulation); Mon, 28 Mar 2016 08:43:24 -0400
X-MP-Host-Origin: front04.endurance.prod.tucows.net
Message-Id: <999999.0.28Mar2016084324-osrs-registrant_verification-999999@endurance.registrarmail.net>
Date: Mon, 28 Mar 2016 08:43:24 -0400 (EDT)
X-OSRS-Id: osrs-registrant_verification-999999
From: "Domain Registrar" <support@registrar.com>
To: <myemail@mydomain.com>
Subject: Important: Please validate your domain name

The original sender is tucows.net? There’s no way a real company would be using such a site to send these emails. After all, that’s some lonely script kiddie in their mom’s basement BS. This had to be phishing.

One last check. I did a dig on verify.domain.com and compare that to the www for the company. Two very different IP spaces, but crucially the nameservers have “dyn” in the name which red flagged that it was one of those dynamic DNS services so it could be anything anywhere. Definitely not legitimate.

So I go to the registrar’s site to report this phishing and look at my domain’s record to see if anything really had changed. It had not, but I noticed there was a phone number I’ve not used since 2003, so I update the record. There is a notice that they need me to verify the information. I go looking for it and see… another copy of the phishing email at the time I updated the record. At this point, I suspect maybe I am completely wrong. Since the risk seems low, I do click the link and verify button and go back to the registrar’s site to see if the warning about needing to verify my information cleared. It did. Dammit!

Turns out the phishy email is actually ICANN not the registrar.