Scammers registering date-based domain names
phishing scam spam · 26 comments · 300 words · Viewed ~27,848 times.
Yesterday, January 2nd, my wife received a billing alert from her phone provider. 
Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date.
If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is where a / should be? A quick look at the URl shows a trusted domain at the start - followed by today's date.
It starts with https:// - that means it's secure, right? Is .info even recognisable as Top Level Domain?
Scammers know these domains get blocked pretty quickly - so there's no point registering a generic name like billing-pdf.biz only to have it burned within a day. By the time I'd fired up a VM to inspect it, major browsers were already blocking the site as suspicious.
Is there any way to stop this? No, not really. Domain names are cheap - you can buy a new .info for a couple of quid. The https:// certificate was freely provided by Let's Encrypt. The site was probably hosted somewhere cheap, and whose support staff are asleep when abuse reports come in from the UK.
And that's the price we pay for anyone being able to buy their own domain and run their own secure site.
Money and technical expertise used to be strong barriers to prevent people from registering scam domains. But those days are long gone. There are no technical gatekeepers to keep us safe. We have to rely on our own wits.
Best of: What I blogged about in 2020
Sergey Salnikov says:
David McBride says:
Markus Laker says:
Andrew McGlashan says:
gerard says:
Jeremy says:
Robert Stonehouse says:
uk.co.ee-billing-update-jan-02- I suspect that would food the same number of people. Especially as a small screen device is liable only to show the first 15 characters.Scammer's Internet Domain Uses the Date to Mask Phishing Attack said on :
@blog It's really much much simpler than that, in this particular case at least. *Any* message which asks you to "update your info" is a scam - there's no need to worry about the detail.
@edent says:
The problem is, that ignores all the hundreds of messages which are genuine. It's all very well smugly saying that you know a secret way to never getting fooled, but the real world isn't like that.
@blog I have never ever received a genuine message asking me to "update my info". Has anyone?
@edent says:
Yes. When I change credit cards, or close bank accounts, or things like that. Just because things don't happen to you, doesn't mean they don't happen. Evidently lots of people do get messages like this or spammers wouldn't bother trying to replicate them.
But, regardless, your suggestion that people simply just be as clever as you isn't really a long-term solution.
@TimWardCam @blog Yes. I have.