New scam: Domain Abuse Notice: from DomainCop.net

38 Comments

• Reply

  Just received a similar email. Smells indeed like fake. I didn't clicked on any link.
  

• Reply

  Got the same email from Evelyn Russell supposedly with DomainCop Inc - which doesn't appear to actually exist. I assumed it was fake because my domain is new and certainly isn't sending out a lot of email to anyone. I cannot find anything anywhere that would make me believe it's genuine.
  

• Reply

  I have gotten one too. From maya-holmes@domaincop.net.
  I own the domain but there is no website nor any other activity from that domain.
  

• Reply

  Just received this....
  
  From: Lucas Clarke <lucas.clarke@domaincop.net>
  
  Dear Domain Owner,
  
  Our system has detected that your domain: xxxxxxxxxx.com is being used for spamming and spreading malware recently.
  You can download the detailed abuse report of your domain along with date/time of incidents. Click Here
  
  We have also provided detailed instruction on how to delist your domain from our blacklisting.
  
  Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  Click Here to Download your Report
  
  Please look into it and contact us.
  
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 715-45-56
  

• Reply

  We got the same notice.
  

• Reply

  ... I received the same nice email but sender was Freddie White....
  

• Reply

  Just received one this morning as well.
  

• Reply

  Thank you for sharing. Glad I did some research first and found your post.
  I received same message from Evelyn Russell <evelyn.russell@domaincop.net>
  

• Reply

  I received the same. Oddly enough as i refreshed the domaincop.net address it redirects to a different landing page. Had one for Sony, Problogger etc. Think it may be a form of PTC spam otherwise I cannot see the point.
  

• Reply

  Domain registered yesterday (22 nov 2016)
  
  Website "protected" by cloudflare.com
  Mailserver in India. (mail.domaincop.net)
  
  
  inetnum: 37.61.222.128 - 37.61.222.191
  netname: VELIANET-DE-UNISOFTTECHNOLOGIESPVTLTD
  descr: Unisoft Technologies Pvt Ltd.
  country: DE
  org: ORG-UTPL2-RIPE
  admin-c: UTPL2-RIPE
  tech-c: UTPL2-RIPE
  status: ASSIGNED PA
  remarks: ticket.velia.net 77546
  mnt-by: FGK-MNT
  created: 2016-11-09T11:51:44Z
  last-modified: 2016-11-09T11:51:44Z
  source: RIPE # Filtered
  
  organisation: ORG-UTPL2-RIPE
  org-name: Unisoft Technologies Pvt Ltd.
  org-type: OTHER
  address: 27A. MG Road
  address: 700078 Kolkata
  address: India
  phone: +91 9237225432
  admin-c: UTPL2-RIPE
  tech-c: UTPL2-RIPE
  abuse-c: UTPL2-RIPE
  mnt-ref: FGK-MNT
  mnt-by: FGK-MNT
  created: 2016-11-09T11:50:44Z
  last-modified: 2016-11-09T11:50:44Z
  source: RIPE # Filtered
  
  role: Unisoft Technologies Pvt Ltd.
  address: 27A. MG Road
  address: 700078 Kolkata
  address: India
  phone: +91 9237225432
  nic-hdl: UTPL2-RIPE
  mnt-by: FGK-MNT
  created: 2016-11-09T11:50:44Z
  last-modified: 2016-11-09T11:50:44Z
  source: RIPE # Filtered
  abuse-mailbox: unisofttech2014@gmail.com
  
  % Information related to '37.61.208.0/20AS29066'
  
  route: 37.61.208.0/20
  descr: velia.net
  origin: AS29066
  mnt-by: FGK-MNT
  created: 2016-05-10T12:44:41Z
  last-modified: 2016-05-10T12:44:41Z
  source: RIPE # Filtered
  
  % This query was served by the RIPE Database Query Service version 1.88 (BLAARKOP)
  

• Reply

  Just received one 15 minutes ago...
  
  
  From: Sophie Simpson [mailto:sophie.simpson@domaincop.net]
  
  Dear Domain Owner,
  
  Our system has detected that your domain: TheNameOfTheDomain.com is being used for spamming and spreading malware recently.
  You can download the detailed abuse report of your domain along with date/time of incidents. Click Here
  
  We have also provided detailed instruction on how to delist your domain from our blacklisting.
  
  Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  Click Here to Download your Report
  
  Please look into it and contact us.
  
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 723-31-04
  
  

• Reply

  We got same email from lucas_clarke@domaincop.org
  
  Dear Domain Owner,
  
  Our system has detected that your domain: Galaxyhostplus.com is being used for spamming and spreading malware recently.
  You can download the detailed abuse report of your domain along with date/time of incidents.
  Click Here
  
  We have also provided detailed instruction on how to delist your domain from our blacklisting.
  
  Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  
  Click Here to Download your Report
  
  Please look into it and contact us.
  
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 719-51-12
  

• Reply

  Received this couple of hours back. I did click on the link, but took me to a dead link. Absolute scam.
  
  Dear Domain Owner,
  
  Our system has detected that your domain: xxxxxxx.com is being used for spamming and spreading malware recently. You can download the detailed abuse report of your domain along with date/time of incidents. Click Here
  
  We have also provided detailed instruction on how to delist your domain from our blacklisting.
  
  Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  Click Here to Download your Report
  
  Please look into it and contact us.
  
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 729-59-00
  

• Reply

  I got the same email from Sophia Marshall <sophia.marshall@domaincop.org>
  I click on it but it looks just a spam
  
  regards
  

• Reply

  got the same email from Sophia Marshall <sophia.marshall@domaincop.org>
  I got the same email from Sophia Marshall <sophia.marshall@domaincop.org>
  I click on it but it looks just a spam
  
  
  Dear Domain Owner,
  
  Our system has detected that your domain: Iranntv.com is being used for spamming and spreading malware recently.
  You can download the detailed abuse report of your domain along with date/time of incidents. Click Here
  
  We have also provided detailed instruction on how to delist your domain from our blacklisting.
  
  Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  Click Here to Download your Report
  
  Please look into it and contact us.
  
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 729-59-00
  

• Reply

  I recived a email from these clowns today. I am an IT sec specialist and my team is lookimg into this. If there going to be scaming we will find and report them.
  

• Reply

  Ours came from Jessica Bell. Sent to IT@<ourdomain>.com
  

• Reply

  Got an email by "Florence Shaw", exact content as above. WhoIs provides interesting information, such as the registration date (today) on the registrant:
  
  Domain Name: DOMAINCOP.NET
  Registrar: NAMESILO, LLC
  Sponsoring Registrar IANA ID: 1479
  Whois Server: whois.namesilo.com
  Referral URL: http://www.namesilo.com
  Name Server: HERA.NS.CLOUDFLARE.COM
  Name Server: MARIO.NS.CLOUDFLARE.COM
  Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
  Status: clientHold https://icann.org/epp#clientHold
  Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
  Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
  Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
  Updated Date: 22-nov-2016
  Creation Date: 22-nov-2016
  Expiration Date: 22-nov-2017
  

• Reply

  Got the same one an hour or so ago, from an Isaac Wright. It's in reference to a domain I registered about two months ago and I assume is linked in to whatever list they can pull of new domains, same as all the SEO and advertising adverts I've been getting ever since registering it.
  

• Reply

  Got one from a Thomas Thomas.
  
  Apparently a domain that I own that literally has nothing in it has been spreading malware and being used to spam!
  
  -------- Original Message --------
  Subject: Domain Abuse Notice: domain.name.here
  Date: 2016-11-22 07:42
  From: "Thomas Thomas" <thomas_thomas@domaincop.net>
  To: domain.name.here <abuse@domain.name.here>
  
  Dear Domain Owner,
  
  Our system has detected that your domain: domain.name.here is
  being used for spamming and spreading malware recently.
  You can download the detailed abuse report of your domain along with
  date/time of incidents. Click Here [1]
  
  We have also provided detailed instruction on how to delist your domain
  from our blacklisting.
  
  Please download the report immediately and take proper action within 24
  hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and
  persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  Click Here to Download your Report [1]
  
  Please look into it and contact us.
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 729-41-97
  
  
  
  Links:
  ------
  [1] http://www.domaincop.net/6VbA8C64ZzNBdF23xgKlsKluVKFgKlsKluVKliNlusWObzMig52c/artisans-hitchhiker
  

• Reply

  Got the same this morning from a Matilda-Richards@domaincop.net
  
  Dear Domain Owner,
  
  Our system has detected that your domain: xxxx.com is being used for spamming and spreading malware recently.
  You can download the detailed abuse report of your domain along with date/time of incidents. Click Here
  
  We have also provided detailed instruction on how to delist your domain from our blacklisting.
  
  Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  Click Here to Download your Report
  
  Please look into it and contact us.
  
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 719-51-12
  

• Reply

  Thanks for sharing, I've just got it too and googled your post here. Mine however was easier to say it's a scam as the domain mentioned in it expired some months ago ;)
  

• Reply

  Received the same some little time ago regarding my domain. Did not push any links and sent to spambox. Looks like fake
  

• Reply

  Sure is scam. My domain still only redirects to one of my older sites, so no spam or malware could be spread from that domain.
  

• Reply

  I got the same from a different sender.
  I also received another scam email from same ip block:
  37.61.222.141
  37.61.222.142
  
  Alert - Your Credit Card has been charged
  
  Dear Customer,
  
  We have just processed your payment against Invoice no.KW1521 ( Download Receipt).
  The payment details are:
  
  Order Value: $1200
  Sales Tax: $96
  ---------------------
  Total Amount Received: $1296
  
  For Payment details and Order information, please download Invoice copy and payment receipt from here: CLICK HERE
  
  
  Should you have any Invoice related queries please do not hesitate to contact either your designated Credit Controller or the main Billing Dept.
  
  For Pricing or other general enquiries please contact your local Sales Team.
  
  Yours Faithfully,
  CC Billing Dept.
  Tel.: (139) 789-50-45
  

• Reply

  
  We have also provided detailed instruction on how to delist your domain from our blacklisting.
  
  Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  Click Here to Download your Report
  
  Please look into it and contact us.
  
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 711-69-73
  ---------------------------------------------------
  Dear Customer,
  
  We have just processed your payment against Invoice no.KW1521 ( Download Receipt).
  The payment details are:
  
  Order Value: $1200
  Sales Tax: $96
  ---------------------
  Total Amount Received: $1296
  
  For Payment details and Order information, please download Invoice copy and payment receipt from here: CLICK HERE
  
  
  Should you have any Invoice related queries please do not hesitate to contact either your designated Credit Controller or the main Billing Dept.
  
  For Pricing or other general enquiries please contact your local Sales Team.
  
  Yours Faithfully,
  CC Billing Dept.
  Tel.: (139) 711-69-73
  ---------------------------------------------------------
  
  i got too...iam from srilanka...
  

• Reply

  Looks like it's pretty widespread, everyone posting is from the past couple of hours - and that's just those of us who Googled and posted here.
  

• Reply

  Exactly the same email
  We look after about 20 domains and they picked one which is almost inactive - which did stop me for a second...
  I didn't click on aything because it was in my junk email.
  Sender was Lily Saunders...
  If in doubt wether your website has been flaggd by Google don't forget to check the google safe browsing site
  https://www.google.com/transparencyreport/safebrowsing/diagnostic/?hl=en
  

• Reply

  I got the same email from mia_griffiths@domaincop.net it's a relief to know it's fake.
  

• Reply

  Got the same one today. Completely fake. Moreover the site (Domaincop) now doesn't even open from my place.
  

• Reply

  I just got one today. The link is one of those nonsense looking URLs.
  

• Reply

  Dear Domain Owner,
  
  Our system has detected that your domain: Ih8trump.org is being used for spamming and spreading malware recently.
  You can download the detailed abuse report of your domain along with date/time of incidents. Click Here
  
  We have also provided detailed instruction on how to delist your domain from our blacklisting.
  
  Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  Click Here to Download your Report
  
  Please look into it and contact us.
  
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 711-96-01
  

• Reply

  LOL looks more like a mass spread of malware from this email.
  
  Received from: Muhammad Lewis <muhammad.lewis@domaincop.org>
  Dear Domain Owner,
  
  Our system has detected that your domain: xxxxxxxxx is being used for spamming and spreading malware recently.
  You can download the detailed abuse report of your domain along with date/time of incidents. Click Here
  
  We have also provided detailed instruction on how to delist your domain from our blacklisting.
  
  Please download the report immediately and take proper action within 24 hours otherwise your domain will be suspended permanently.
  
  There is also possibility of legal action depend on severity and persistence of your abuse case.
  
  Three Simple Steps:
  1. Download your abuse report.
  2. Check your domain abuse incidents along with date and time.
  3. Take few simple steps for prevention and to avoid domain suspension.
  
  Click Here to Download your Report
  
  Please look into it and contact us.
  
  
  Best Regards,
  Domain Abuse Admin
  DomainCop Inc.
  Tel.: (139) 789-51-56
  

• Reply

  Defenitely SPAM,
  They used Admin email, of Worldwatersymposium.org which has 301 forwarding to www.worldwaterconference.com,
  My website is new and under construction, yet SSL-EV and SPAM protection were installed first.
  

• Reply

  not just spam - a MASSIVE campaign attempt without much thought from domain provider? im guessing millions of emails were sent by what I am seeing here....I was also affected with both those emails
  
  typical mail server would have shut them down you would assume.
  

• Reply

  Got same mail but sender ID is different.
  

• Reply

  I also received this email. It's a spam email. Don't worry about it. Just ignore.. more details about this spam email here http://techiewheels.com/ignore-any-spam-email-from-domaincop-org-asking-to-download-domain-abuse-report/
  

• Reply

  Just receive the same one, this time from isabelle.rose@domaincop.net
  
  But the domain domaincop.net appears to be desabled or not to be active just now.,