16

I have received domain abuse notice email from chloe-gray@icann-monitor.org.

The mail asks to download a Word Document which I believe contains a virus.

Dear Domain Owner,

Our system has detected that your domain: example.com is being used for spamming and spreading malware recently.

You can download the detailed abuse report of your domain along with date/time of incidents. Click Here

We have also provided detailed instruction on how to delist your domain from our blacklisting.

Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.

There is also possibility of legal action depend on severity and persistence of your abuse case.

Three Simple Steps:

  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.

Click Here to Download your Report

Please look into it and contact us.

I want to know if I have missed enabling/configuring something on the ISP side or did I leave some email address on my domain because of which these spammers have targeted me as well.

Are there ways to protect / configure my domain to avoid these emails?

unor
  • 246
  • 2
  • 19
AAgg
  • 321
  • 1
  • 4
  • 11
  • 5
    I never get these, because my spam filters block them! :) – Michael Hampton Dec 29 '16 at 23:37
  • Please note that although this was a scam, it is possible to receive a legitimate notice that your domain was used in a spam campaign, you are delivering malware, etc. Most likely from a CERT or ISP, but also some individuals will notify you. Some TLDs will suspend your domain, too. So you shall not blindly disregard any abuse notice :) – Ángel Dec 29 '16 at 23:52
  • I just received the same email from isabelle.rose@icann-monitor.org Whois privacy is enabled buy they must have scraped my contact us email address (not related to the domain registration which is why I was suspicious) – user392712 Dec 29 '16 at 23:17
  • `your domain is being used for spamming`. This is nonsense. How a domain can be used to spamming? A domain is a "unit" of the DNS system, a record and it can not send anything. A **host** can be used for spamming, but not a domain. – VL-80 Dec 30 '16 at 15:18
  • 1
    @VL-80 You're splitting hairs. If an email comes from someone@example.com, saying the email came from example.com is appropriate, and therefore your domain. – SnakeDoc Dec 30 '16 at 20:44
  • @VL-80 Domainkeys etc validating correctly for your domain is also a strong hint that you may be involved, or someone may have stolen your keys. – SomeoneSomewhereSupportsMonica Jan 01 '17 at 10:34

6 Answers6

29

This is spam at the least - at worst, it's a scam. Do not agree to send a read receipt. Do not download unnecessary content. Do not click links. Do not reply. Do not pass Go... etc.

As others have mentioned, protecting your contact details in whois information may help eliminate these emails; I'd also like to add some common signs of spam/scam emails:

  • "Dear <generic name>"
    Legitimate organisations will attempt to use your real name where they can - for example, by taking it from whois information, or by contacting your domain registrar to obtain your name and contact details.
  • "Click Here"
    Legitimate (especially formal, like this) emails are drafted by people who are paid to come up with something better than "click this" for link text - "visit our website to retrieve the full report", perhaps.
  • Bad grammar
    Legitimate emails are written by people who are paid to write good English - and then they're copy-checked before they ever get sent out. "There is also possibility", "depend on severity", and Unnecessary Capital Letters are generally not things that make it into professional communications.
  • Legal threats
    People are more likely to get scared and do what the scammers want them to if they're threatened with things they don't understand, like legal proceedings - even if the threats aren't actionable.
  • Unreasonable time limits
    If a legitimate organisation needs to time-limit you, it'll be on a scale of weeks, or multiple days at the very shortest. It's highly unusual to be given just 24 hours to perform some action - unless, of course, someone wants to scare you into taking action without thinking about it first.
  • Unexpected attachment types
    Attachments such as official reports will usually come as PDFs, or a link to a legitimate webpage. Anything else - an RTF, a Word document, a HTML file, or an executable, should raise a question.

None of these are 100% perfect indicators of scams, but each should raise a small flag - and the presence of multiple should make you highly suspicious. If in doubt, verify the organisation is legitimate, look up a contact email address for them (not the address the email came from, usually), and use that to ask if the email is legitimate. If it is, fine - if it's not, you've done them a favour.

ArtOfCode
  • 410
  • 4
  • 7
  • 1
    Many times hovering over links in the email is enough to see it's spam. Links often go to obviously compromised hosts, or to a different website than they pretend to be linking to. – SnakeDoc Dec 30 '16 at 20:46
18

This is some attempt to spam/phish/infect with malware. Just delete it and carry on.

There is no real way to avoid this crap, but you have your full contact information including mail in the domain record - this makes this extra easy ...

Sven
  • 97,248
  • 13
  • 177
  • 225
9

If you go to mxtoolbox, and check your domain for blacklisting, it doesn't return as listed on any at this time.

You can check for blacklisting on:

http://mxtoolbox.com/blacklists.aspx

If you check domain info, you can see domain icann-monitor.org was registered yesterday, so is definitely not a genuine abuse notice.

http://whois.domaintools.com/icann-monitor.org

Dates   Created on 2016-12-28 - Expires on 2017-12-28 - Updated on 2016-12-29     
Domain Status   Never Registered Before

If you search domain info for your domain, you can see your gmail address, which is how they targeted your email.

You can use WhoisGuard or some other domain/whois privacy tool, to not have your mail published publicly like that, if you are concerned about it being available publicly.

ralz
  • 2,691
  • 2
  • 17
  • 21
  • Just to update on this, the domain was blacklisted soon after this post was made and deleted (I assume, by namecheap itself) just 6 hours later. I had the same issue as OP – CBenni Dec 29 '16 at 22:08
2

just disregard and delete DO NOT open attachments. I've received same messages like "Third Invoice Overdue Notice for xxx.com" or "Final Domain Abuse Notice: xxx.com" from domains like "@ccnotice.net", "@domaincop247.com", "@domaincops.net"

473183469
  • 1,350
  • 1
  • 12
  • 23
Nome Loplagies
  • 21
  • 1
1

It could of course be a canary... Designed to call home and leave a trail of breadcrumbs back to your front door which may not be the same place you host your web site. This could then be used for a later, more targeted, approach or refined password variable dictionary attack.

I had the same email today, hence how I found this chain, and followed the crumbs the other way and checked who had been knocking on my websites door previous to the email - which lead me to Russia, Costa Rica and Panama (all IP ranges now blocked.)

CanaryHunter
  • 11
  • 1
  • You are assuming far more planning than actually exists in these sorts of spam campaigns. –  Dec 31 '16 at 05:46
  • @duskwuff You're not paranoid if they really are out to get you. But I agree, phishing with "open this document" or "sign into your account here" hooks are most often dragnets and rarely part of a tactically coordinated attack. The high-value/strategy attacks run with individualized hand-crafted canaries and legitimate looking sites (no logins required) back stocking them. It may not feel perfect, but it won't feel nearly so *wrong* as this does. – Ruscal Feb 22 '17 at 18:58
0

A couple of other things to help identify spam/phishing

  • Attempts to look like a real authority. ICANN (which actually does govern the Internet) lives at icann.org. That they registered icann-monitor.org means they wanted you to confuse them with ICANN.
  • Office documents (Word and Excel) are notoriously insecure. I'll bet you anything you would have seen an "enable macros" message on that document they wanted you to open. I tell my coworkers to delete emails with attachments (unless they come from within the company)

Can you block them entirely? No. Spammers understand a new domain name has no history to fall back on. It's easy to set up a new domain like this, set up a server, mass phish and reap the rewards (even just 1% of the phished falling for this can be fruitful). Eventually systems on the Internet catch on, but by then the damage is done. Education is your best weapon.

Machavity
  • 834
  • 10
  • 26