5

Shortly after I registered a domain with an Italian company that I know for sure is legit (www.register.it) I got an email (pasted below) allegedly from them which sounds to me a lot like a scam coming from someone else, but my research leaves me with doubts as many people seem to have received it and several insist it's legit (f.ex. here).

The main reasons why this email makes me feel it's a scam are the shouting subject and the Italian language used, ridiculously broken and clearly not from a native speaker; both are in my past experience unmistakable trademarks of scams / phishing. Considering that the company I registered the domain with - and from which the email claims to come - is an Italian company in Italy I definitely expect them to write at least the Italian part of the email themselves and also not to send to their mainly Italian customers a so broken Italian text. In Italy they are a well-known registrar and hosting provider which I use since years and all their communications were always in proper Italian.

I haven't got a reply from them and I expect to get one in a few days, but in the meantime I want to research the matter a bit, also because I might learn something useful even if the company confirms this is a scam (BTW I will post here when I get their reply).

I'd be interested in info but also opinions or educated guesses about this because I'm not a webmaster and I am looking for specific expertise even if no definitive conclusion can be reached.

A whois on the domain of the link to click (http://raa.name-services.com/) yields this result, which I cannot tell whether is legitimate:

Registrant Organization: WHOIS PRIVACY PROTECTION SERVICE, INC. Registrant Street: PO BOX 639 Registrant Street: C/O NAME-SERVICES.COM Registrant City: KIRKLAND Registrant State/Province: WA Registrant Postal Code: 98083 Registrant Country: US

Below is the email text, where I just replaced the actual domain name and the UUID parameter on the link's querystring.

The Click here to verify your email address has a link, which is the same you can see under If the above link does not work....

From: "Register.it spa" To: [my email address] Subject: IMMEDIATE VERIFICATION required for [TheDomainIRegistered.online] Date: 9 May 2016 01:10:23 -0700

français italiano português español deutsch Polskie

As of January 1, 2014, the Internet Corporation for Assigned Names and Numbers (ICANN) has mandated that all ICANN accredited registrars begin verifying the WHOIS contact information for all new domain registrations and Registrant contact modifications.

You have registered one or more domains from Register.it spa and verification of the Registrant email address is required for these domain name(s) to remain active. Please click the link below to verify the email address. You have a 15 day window from the time of the original registration to verify the email address. After 15 days, the domain name(s) will be suspended until the e-mail address is verified. Click here to verify your email address

If the above link does not work, please copy-and-paste the following URL into an open web browser to complete the verification process: http://raa.name-services.com/raaverification/verification.aspx?VerificationCode=[a-36-digit-UUID-here] Once you click the link, your email address will be instantly verified and there is nothing further for you to do on the following domains:

[TheDomainIRegistered.online]

Sincerely, Register.it spa

À partir du 1er janvier 2014, la Société pour l’attribution des noms de domaine et des numéros sur Internet (ICANN) exige que tous les registraires accrédités par l’ICANN vérifient désormais l’information de contact WHOIS pour tous les nouveaux enregistrements de domaines et les modifications des informations de contact des titulaires.

Vous avez enregistré un ou plusieurs domaines chez Register.it spa et une vérification de l’adresse courriel du titulaire est requise pour que ce ou ces domaines restent actifs. Veuillez cliquer sur le lien ci-dessous pour vérifier l’adresse courriel. Vous disposez de 15 jours suivant l’enregistrement initial pour vérifier votre adresse courriel. Après 15 jours, le ou les noms de domaine seront suspendus jusqu’à vérification de l’adresse courriel. Cliquez ici pour vérifier votre adresse courriel.

Si le lien ci-dessus ne marche pas, veuillez copier et coller l’URL suivante dans un navigateur ouvert pour compléter le processus de vérification: http://raa.name-services.com/raaverification/verification.aspx?VerificationCode=[a-36-digit-UUID-here] Après avoir cliqué sur le lien, votre adresse courriel sera immédiatement vérifiée et aucune action supplémentaire de votre part ne sera requise concernant les domaines suivants:

[TheDomainIRegistered.online]

Cordialement, Register.it spa

Dal 1° Gennaio 2014, la Internet Corporation de Assigned Names e Numbers (ICANN) ha ordinate che tutti i registrar accreditati da ICANN iniziano verifica le informazioni di contatto WHOIS per tutte le nuove registrazioni di dominio e modifiche di contatto Registrante.

Ti sei registrato uno o più domini da Register.it spa è richiesta la verifica dell'indirizzo e-mail Registrante per queste nome (s) dominio di rimanere attivi. Cliccate il link qui sotto per verificare l'indirizzo di posta elettronica. Hai una finestra di 15 giorni dal momento della registrazione originale per verificare l'indirizzo di posta elettronica. Dopo 15 giorni, il nome di (s) dominio verrà sospeso fino a quando l'indirizzo e-mail è verificato. Clicca qui per verificare il tuo indirizzo email

Se il link sopra non funziona, tagliare e incollare il seguente URL in un browser web aperto per completare il processo di verifica: http://raa.name-services.com/raaverification/verification.aspx?VerificationCode=[a-36-digit-UUID-here] Una volta cliccato il link, il tuo indirizzo email sarà immediatamente verificata e non c'è più nulla da fare per voi sui seguenti settori:

[TheDomainIRegistered.online]

Sinceramente, Register.it spa

A partir do dia 1° de janeiro de 2014 , a Corporação da Internet para Nomes e Números (ICANN) exige que todos os registradores credenciados pela ICANN começam verificando as informações de contato WHOIS para todos os novos registros de domínio e modificações de contato dos registrantes.

Você registrou um ou mais domínios de Register.it spa e verificação do endereço de e-mail do Registrante é necessária para estes nomes de domínio para permanecer ativo . Por favor, clique no link abaixo para verificar o endereço de e-mail. Você tem uma janela de 15 dias a partir da data do registo inicial para verificar o endereço de e-mail. Após 15 dias , os nomes de domínio seráo suspenso até que o endereço de e-mail esteja confirmado. Clique aqui para verificar o seu endereço de email

Se o link acima não funcionar , por favor, cortar e colar o seguinte URL em um navegador aberto para completar o processo de verificação: http://raa.name-services.com/raaverification/verification.aspx?VerificationCode=[a-36-digit-UUID-here] Depois de clicar no link, o seu endereço de e-mail será verificado imediatamente e não há nada mais para você fazer nos seguintes domínios:

[TheDomainIRegistered.online]

Atenciosamente, Register.it spa

Desde el 1 de Enero de 2014, la Corporación de Internet para Nombres y Números ( ICANN) ha ordenado que todos los registradores acreditados por ICANN comienza la verificación de la información de contacto de WHOIS para todos los nuevos registros de dominio y modificaciones de contacto del titular .

Se ha registrado uno o más dominios de Register.it spa y se requiere la verificación de la dirección de correo electrónico registrada para estos nombres de dominio para permanecer activo. Por favor, haz clic en el enlace de abajo para verificar la dirección de correo electrónico. Usted tiene una ventana de 15 días desde el momento del registro inicial para verificar la dirección de correo electrónico. Después de 15 días , los nombres de dominio serán suspendido hasta que se verifique la dirección de correo electrónico . Haz clic aquí para verificar su dirección de correo electrónico

Si el enlace anterior no funciona , por favor corte y pegue el siguiente URL en un navegador web para completar el proceso de verificación : http://raa.name-services.com/raaverification/verification.aspx?VerificationCode=[a-36-digit-UUID-here] Una vez que hace clic en el enlace, su dirección de correo electrónico será verificada al instante y no hay nada más para hacer con los siguientes dominios:

[TheDomainIRegistered.online]

Atentamente, Register.it spa

Ab dem 1. Januar 2014 im Internet Corporation for Assigned Names and Numbers (ICANN ) hat angeordnet, dass alle ICANN- akkreditierten Registraren beginnen die Überprüfung der WHOIS Kontaktin;formationen für alle neuen Domain-Registrierungen und Registrant Kontakt Modifikationen.

Sie haben eine oder mehrere Domains registriert von Register.it spa und Überprüfung der E-Mail- Adresse ist Registrant für diese Domain Name (n) erforderlich , aktiv zu bleiben . Bitte klicken Sie auf den Link unten, um die E-Mail -Adresse zu überprüfen . Sie haben eine 15- Tage-Fenster aus der Zeit der ursprünglichen Eintragung , die E-Mail- Adresse zu bestätigen. Nach 15 Tagen wird der Domain-Name (n) ausgesetzt, bis die E-Mail- Adresse überprüft werden. Klicken Sie hier, um Ihre E-Mail -Adresse bestätigen

Wenn der Link oben nicht funktioniert, bitte Ausschneiden und fügen Sie den folgenden URL in einen offenen Web-Browser , um die Prüfung abzuschließen: http://raa.name-services.com/raaverification/verification.aspx?VerificationCode=[a-36-digit-UUID-here] Sobald Sie auf den Link klicken , wird Ihre E-Mail- Adresse sofort überprüft werden und es ist nichts weiter für Sie auf den folgenden Bereichen zu tun:

[TheDomainIRegistered.online]

Mit freundlichen Grüßen, Register.it spa

Z dniem 1 stycznia 2014 Internet Corporation for Assigned Names and Numbers (ICANN) wymaga aby wszyscy akredytowani przez ICANN rejestratorzy rozpoczeli weryfikacje danych abonenta, zapisanych w WHOIS, dla wszystkich nowych rejestracji domen oraz modyfikacji danych abonenta.

Zarejestrowales jedna lub wiecej domen za posrednictwem Register.it spa i wymagana jest weryfikacja adresu e-mail abonenta dla tej domeny (domen) aby pozostaly aktywne. Prosimy kliknac na ponizszy link aby zweryfikowac swój adres email. Masz 15 dni czasu od momentu rejestracji domeny na zweryfikowanie adresu e-mail. Po 15 dniach, domena badz domeny zostana zawieszone do momentu weryfikacji adresu email. Kliknij tutaj aby zweryfikowac swój adres email

Jesli powyzszy link nie dziala, prosimy o skopiowanie i wklejenie ponizszego adresu do paska adresowego przegladarki aby dokonczyc proces weryfikacji: http://raa.name-services.com/raaverification/verification.aspx?VerificationCode=[a-36-digit-UUID-here] Jak tylko klikniesz na ten link, Twój adres email zostanie natychmiast zweryfikowany i nie trzeba bedzie podejmowac zadnych dodatkowych kroków zwiazanych z ponizszymi domenami:

[TheDomainIRegistered.online]

Z powazaniem, Register.it spa

  • Did you sign up for a "WHOIS privacy protection service"? – MrWhite May 10 '16 at 11:15
  • @w3dk Not that I know of, unless it was "bundled" with the domain registration or something else I signed up for and I missed that, which is possible. However I don't know what a "WHOIS privacy protection service" is, but if there is a way to check whether I'm signed up to that, I can check and post the result. – SantiBailors May 10 '16 at 11:20
  • 1
    Have you used register.it before? Specifically, have you used the same account/email with register.it? – MrWhite May 10 '16 at 11:31
  • 1
    Spammers are unfortunately quite clever (although notoriously terrible spellers) and can spoof this in attempt to confirm active registrant email addresses. It sounds like the representative at your registrar didn't look too closely at the email (if you forwarded it), since the confirmation links should point back to them, and not "name-services.com" - you only need to do a Google search to see that Google indexed their content as "Find Cash Advance, Debt Consolidation and more at Name-Services.com" and countless other scam questions. Verification messages should also appear in your ... – dan May 11 '16 at 9:07
  • 1
    user account for your registrar too. At worst, you might receive some more spam as a result of clicking on the link. If you use privacy protection during registration (like the spammer at name-services.com did) as w3dk asked about, your email address wouldn't be targeted as much for things like this. – dan May 11 '16 at 9:16
1

The registrar eventually confirmed that they did send that email (and that the link in the meantime has expired and they will send a new one). Once again no reply about the highly broken and scam-like Italian language; for sure they did not write that email themselves because no Italian who cleared middle school would write like that, and the language used in that email is squarely the type of broken Italian I see all the time in scam and spam emails I receive.

The "cash advance", "debt consolidation" and other such things normally and rightfully associated with scammers as @dan mentioned, which come up when researching name-services.com, are certainly among the several "red flags" (to say the least) that triggered my suspicions. But I won't even bother to ask the registrar about this because that's very unlikely to result in useful information.

However that email does come from the registrar. I'm extremely surprised about that because that text really, really reads as if it was written with the purpose of making Italian readers think it's a scam (keeping in mind that the registrar is an Italian company in Italy who previously always wrote all their communications in perfect Italian).

This registrar does not have an internal messaging functionality to send messages that the customers can read after logging in. In fact they state that it's important to keep one's email address up to date in the profile because that's how they are going to send all communications to the customers. The only communications that happen through their website after customer login are the support requests, which is how I asked them about this problem.

Fortunately that 1-year free .online domain registration was an unexpected gift associated with a hosting product I recently bought from them, so it's no big deal that it gets deactivated.

However I'm going to have to register domains and buy hosting in future too, so I still would like to understand as much as possible about this weird scenario, so I will keep researching this and welcoming any possible answers I might get to this question, and I will keep it up to date if I find new meaningful information.

UPDATE (May 17, 2016): It's getting weirder, it's now one week after my registrar confirmed that they did send that email and said that the link in the meantime had expired and they will send a new one, but I did not receive it yet (and at this point I don't expect to receive it at all). I regard this as a further hint towards the possibility that email was scam.

And in the meantime I received a couple of similar emails that are undoubtedly scams, related to that same domain registration but unrelated to the initial email, so my domain registration did certainly cause scammers to grab my email address from that domain registration, so it sounds even more likely that the original email was scam. But Register.it did confirm that they had sent it. So the whole thing became even more confusing to me, I'm just glad that I didn't need that domain so it's not a problem if it gets deactivated as a consequence of me not clicking that link as that email warned (I will see in a few days if it does get deactivated and I will add that info here).

UPDATE (July 18, 2016): The domain did not get deactivated, so everything hints to the possibility that that email was pure scam. The only thing that wouldn't add up with this is that my registrar said they did send that email. But for the rest, none of the 2 things the registrar told me would happen did happen (that is, they never sent me another such email and the domain did not get deactivated). In addition to this, another strong hint that it was scam is this page I found on the website of a well-known registrar, which seems to bear many similarities with my case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.