Domain Name Service Scams

If you click on the link in this email to "Verify Your Email", and enter your email and password into what you think is your actual GoDaddy account (but it's not, even though the website may look legitimate), you've just given the scammers your password. They can go in and hijack your website, transfer your domain name, make charges on the credit card on file, and a lot more.

I clicked on the link and it took me to a website that looked quite a bit like GoDaddy, although of course the website address in the browser address bar was not GoDaddy's. By the time I went back to take a screenshot for this blog, the website was gone and a security warning was in its place.

Sometimes there are little things in these emails that give away the fact that its a scam (but often the email looks perfectly legit). In this case, the company name "Godaddy" in the "from" email was misspelled (the first "D" should be capitalized). The pricing was in British pounds (even though my client is in the U.S.), the support phone number was in the U.K., and of course hovering over the "Verify Your Email" link showed on the bottom left side of my browser screen that the link was going to a weird website address that has nothing to do with GoDaddy.

This one is easy to mistake for legitimate because "email synchronization" sounds technical, so it must be important, right? But like the example above, hovering over the "Complete Synchronization" link shows a website address in the lower left corner of the browser that's not GoDaddy. Another login theft scam. There's also a British spelling of a word in the email.

This type of scam is one of the oldest, and has been around since the 1990s. The scammer sends these official looking letters out to companies whose domain names are coming up for renewal, or even just anyone who has a domain name. What they don't tell you is that they are NOT your current domain registrar. They just want you to transfer your domain to their company, where they will charge you double, sometimes triple, what your current registrar is charging. Sometimes these scammers are indeed "real" domain registrars that just charge exorbitantly overpriced fees, sometimes they're not and they just want to steal your domain name, or they're credit card thieves. This particular company does have a website that provides domain services, but their Terms of Service are concerning; for instance, if your account gets hacked, you have to pay them $50 per hour to investigate and get your domain name back! So more than likely your account will indeed end up getting hacked... by their own people!

The reason why these types of domain name scams are so successful is that nobody ever reads them, particularly the ones (the majority of them) that say, in bold writing, "This notice is not a bill" or "This is a solicitation" or "You are under no obligation". Since they disclose that in plain sight, technically what they're doing is not illegal. It's highly unethical, but if you pay to switch your domain name to them without reading the fine print, that's on you.

Another one like the one above it, but a different "company". Although more than likely it's the same racket with a different name. All people read is, "You must renew your domain name to retain exclusive rights to it", but they don't go any further. Again, this one does say that "This notice is not a bill.

And yet another one, but this one is for "Marketing Services", and it's and quite vague. It doesn't mention anything about the domain name, just says the $289 price includes "12 Month Term on Domain Authority". Apparently it's to list your company on that website, but it doesn't give any other information. The date of the letter is December 21, 2021, but as of June 17, 2022, the website address shown in the letter, www.us-domainauthority.com, doesn't exist (so much for your 12-month term!) According to whois.com, the domain itself does exist, and was registered in November 2021 (just in time for their spam letter campaign!), in the country "KN" (an island area in the West Indies called Saint Kitts and Nevis).

This one is for "Website Listing Service", and the writing and dollar amount suggests that even though the "company" name is different, it's probably the same outfit as the scammer above. The official sounding company name, "Domain Listings", makes you think this has something to do with your domain name, so it must be important. This "company", unlike the other one, does have a website, at www.domain-listings.org (which forwards to https://domainlistings.directory), which does look legitimate on the surface, but it's actually not. If you get your company listed on this website, nobody will ever see your listing unless they visit the website directly (which they will never do, because it's not listed anywhere else). Only the home page of this website is in Google search results (which you can see when you do a search for site:domain-listings.org on Google). That means all the other pages, including any company listings, are hidden (most likely blacklisted) from Google Search.

Why would this company go through the trouble of putting up such a professional looking website that does include listings for companies (probably all of which fell for this scam)? Because when you visit the website, it looks perfectly legitimate! So although this is indeed a scam, it's not illegal, because the company is doing what you're paying them do do, add you to their listing website. There's nothing on the invoice that guarantees that your listing or their website will get found by Google or anyone else.

Why would you pay $228.00 to get listed on an obscure website that nobody will ever see, when you can get added to Google My Business (the most important listing site) for free, as well as other high-ranking, reputable websites that do get indexed by Google?