{"id":90084,"date":"2021-06-30T15:04:57","date_gmt":"2021-06-30T09:34:57","guid":{"rendered":"https:\/\/blogs.quickheal.com\/?p=90084"},"modified":"2023-08-08T18:14:47","modified_gmt":"2023-08-08T12:44:47","slug":"phishing-scam-alert-domain-name-expiration-notices-stealing-data-through-phishing-site","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/phishing-scam-alert-domain-name-expiration-notices-stealing-data-through-phishing-site\/","title":{"rendered":"Phishing Scam Alert: Domain Name Expiration Notices stealing data through phishing site"},"content":{"rendered":"

Have you received an email notification that your domain is about to expire? Most website owners have. But do you pay close attention to who it is from and the renewal fee? If not, you may be throwing money away to a scammer.<\/p>\n

Quick Heal<\/a> Security Labs has recently come across a phishing scam related to domain names. And we want to give some insights on ways to identify the scam and protect yourself from falling victim.<\/p>\n

Security researchers say expired domains can put data at risk. Hackers use expired domains to steal credit card data or contact information. Or they may target email accounts linked to the domain to scam clients and steal company secrets.<\/p>\n

What is Phishing? <\/strong><\/h2>\n

Phishing is a fraudulent attempt to obtain sensitive information such as usernames, passwords, and payment information by disguising oneself as a trustworthy entity in an electronic communication.<\/p>\n

In other words, phishing is a type of online scam<\/a> where criminals or attackers send an email that appears to be from a legitimate source or company and ask you to provide sensitive information.<\/p>\n

There is a new phishing attack<\/a> going on, which you need to be aware of a recent phishing email<\/a> out there, the \u2018Domain Name Expiration Scam.\u2019 <\/b><\/strong>The target of this scam is to trick people with fake Domain Name Expiration to steal sensitive payment information from consumers or make payments to them.<\/p>\n

\"\"Fig. 1 Phishing attack flow<\/em><\/p>\n

 <\/p>\n

We observed a phishing mail attack<\/a> during our analysis. The victim received multiple phishing emails on his registered mail from different Mail IDs. In the mail, attackers mentioned \u201cDomain Services Expiration Date.\u201d<\/strong> Attackers send fake Domain services expiration notices to the user. This date is not a correct expiration date.<\/p>\n

\"\"<\/p>\n

Fig.2 Phishing Email<\/em><\/p>\n

 <\/p>\n

In the above mail, shortened malicious URL is embedded which leads to a phishing attack.<\/p>\n

https[:]\/\/bit.ly\/3l2vkND<\/b><\/strong><\/p>\n

This bitly URL redirects the user to another phishing website-<\/p>\n

URL: \u00a0https[:]\/\/webdomainsrvcs.com<\/b><\/strong><\/p>\n

 <\/p>\n

Information about the above URL and their respective:<\/b><\/strong><\/p>\n

URL:<\/strong>\u00a0\u00a0https[:]\/\/webdomainsrvcs.com<\/p>\n