Knowledgebase

IMPORTANT: Fraudulent Suspension Notices

28 October 2015

It has come to our attention that fake suspension notices are being sent as part of a phishing scam. These emails are sent to the registrant email address fetched via the whois record associated with a domain name. Many Domain Registrars have been affected by this phishing attack as well, so it is likely that regardless of what registrar you use for your domains, you may receive one of these fake Suspension Notices.  Below is a sample email of one of these.  Identifying information for the recipient has been redacted for privacy purposes:

===== Start of Fake message =====

In a message dated 10/28/2015 01:09:57 P.M. Eastern Daylight Time,

abuse-contact@publicdomainregistry.com writes:

Dear Sir/Madam,

The following domain names have been suspended for violation of the PDR Ltd. d/b/a PublicDomainRegistry.com Abuse Policy:

Domain Name: [REDACTED].COM
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrant Name: [Redacted]

Multiple warnings were sent by PDR Ltd. d/b/a PublicDomainRegistry.com Spam and Abuse Department to give you an opportunity to address the complaints we have received.

We did not receive a reply from you to these email warnings so we then attempted to contact you via telephone.

We had no choice but to suspend your domain name when you did not respond to our attempts to contact you.

Click here and download (hXXp://[REDACTED].ec/abuse_report.php?[REDACTED].COM) a copy of complaints we have received.

Please contact us by email at mailto:abuse-contact@publicdomainregistry.com for additional information regarding this notification.


Sincerely,

PDR Ltd. d/b/a PublicDomainRegistry.com
Spam and Abuse Department
Abuse Department Hotline: 480-124-0101

===== End of Fake message =====


What needs to be done?

Ignore and delete these emails.  Do not click on any links in them, and do not download any files or take any actions based on instructions from such emails, as the attachments might contain malicious files.

Please note that we, 12Wonder, and PublicDomainRegistry.com D/B/A PDR Ltd., will never send a suspension notice from the email address 'abuse-contact@publicdomainregistry.com'.  Ever.

You may contact Domain Support in case of any further questions or concerns.