January 6, 2017
A new round of emails claiming to be from the Internet Corporation For Assigned Names and Numbers (ICANN) are trapping unwary domain registrants.
The email subject line indicates the communication is a "domain abuse notification". The body of the message tells the registrant their domain has been blacklisted due to spreading spam and if the recommended action isn't taken, the domain name will be suspended permanently.
The reader is instructed to download and open a file that harbors malware. Abuse.ch, a Swiss security blog, states the malware is Cerber Ransomware, which uses AES encryption algorithm to encode the target's files; effectively locking the victim out of all their documents and critical applications.
A demand is then sent to the victim for payment in order to unlock the files.
For any business, large or small, being locked out of files could be a disaster, so the ransom is often paid.
As with many of these sorts of scams, one of the flags that something is not quite right is the way the email is written. There's a couple of common sentence structure errors, but as these things go it's quite well drafted compared to some other attempts.
ICANN, which develops policy on the Internet's unique identifiers and co-ordinates the Internet's naming system, does not communicate with domain registrants in this way. Nor does it send out domain renewal notices, or WHOIS Data Reminder Policy (WDRP) messages. It does not collect any sort of fees from registrants directly.
ICANN says a real email from them would never include an attachment.
The domain the emails are coming from was only registered in late December.
ICANN is aware of the situation and is warning registrants to be vigilant.
"If you receive a suspicious email, please FORWARD it to [email protected]," says part of a statement from the organisation.
"Our team can take a look to determine if it's a fake. If it is, we'll work to get the source of the email shut down if possible. Reporting these emails helps protect the entire ICANN community."
Have a web site or blog? Get our free domain news widget.
How to register a name: Enter your choice in the search tool and click 'GO'. If after the check the domain names search results show your choice is available, you will then have the option to proceed to purchase registration; which is a very quick and easy process - start a search and find your ideal website address now.
AUSTRALIAN OWNED AND OPERATED SINCE 1996
1300 863 436