Walk on my Path: Adam Senour's Blog

The following scam warning concerns a company called Domain Registry of Canada (DROC), associated with Domain Registry of America (DROA), and another “company” called “Brandon Gray Internet Services Inc.”

ASIDE: For those unfamiliar with DROA’s past conduct as it pertains to domain registrations and illegal harvesting of contact information from WHOIS database, please visit SynUK’s excellent synopsis of the previous scam. For those of you who are familiar with DROA and with scams of this nature in general, please bear with me, as I will explain this in as much detail as possible for those who are not.

This morning, I received an email regarding a domain for which I am listed as the administrative contact. I have removed the activation link, since I don’t want anyone to trigger the link, accidentally or otherwise. The rest of the email is posted verbatim:

Attention: Adam Senour,

Re: Transfer of greenbuildingfinder.com

BRANDON GRAY INTERNET SERVICES INC. dba Namejuice.com has received a request from Domain Registry of Canada on 12/4/2008 8:06:07 AM for us to become the new registrar of record.

You have received this message because you are listed as the Registered Name Holder or Administrative contact for this domain name in the WHOIS database.

Please read the following important information about transferring your domain name:

1) You must agree to enter into a new Registration Agreement with us. You can review the full terms and conditions of the Agreement at http://namejuice.com/regagree.asp
2) Once you have entered into the Agreement, the transfer will take place within five (5) calendar days unless the current registrar of record denies the request.
3) Once a transfer takes place, you will not be able to transfer to another registrar for 60 days, apart from a transfer back to the original registrar,in cases where both registrars so agree or where a decision in the dispute resolution process so directs.

If you WISH TO PROCEED with the transfer, you must respond to this message via one of the following methods (note if you do not respond by Tuesday, December 16, 2008, greenbuildingfinder.com will not be transferred to us.).

Option 1
Please go to our website, link removed here to confirm.

Option 2
Please email us with the following message:

‘I confirm that I have read the Domain Name Transfer - Request for Confirmation Message.

I confirm that I wish to proceed with the transfer of greenbuildingfinder.com from TUCOWS INC. to BRANDON GRAY INTERNET SERVICES INC. dba Namejuice.com .’

Option 3
Please print out a copy of this message and send a signed copy to :

(fax to)+1-905-415-2682
(mail to):7100 Warden Avenue, Suite 8, Markham, Ontario, Canada, L3R8B5

If you DO NOT WANT the transfer to proceed, then don’t respond to this message.

If you have any questions about this process, please contact us at following information.
info@namejuice.com

or please contact your reseller Domain Registry of Canada support@droc.ca

The Immediate Flaw With This Email

Since I have not registered a domain name with DROC/DROA/Domain Registry Services/whatever company name they decide they want to use that day, nor would I ever register a domain with them for any reason, both the first and last lines were very suspicious. Why was “Domain Registry of Canada” acting as the original registrar, when they clearly weren’t? They even acknowledge as such via the following line:

I confirm that I wish to proceed with the transfer of greenbuildingfinder.com from TUCOWS INC. to BRANDON GRAY INTERNET SERVICES INC. dba Namejuice.com .’

Further contact with my client led me to believe that no one else had anything to do with this, either. So I decided to do some research of my own.

WHOIS Lookup

I started with WHOIS lookups on namejuice.com and droc.ca, and noticed some telling signs:

1. The IP address for namejuice.com is 209.167.25.57. The IP address for droc.ca is 209.167.25.53. It is very unusual for two “competing” registrars to use IPs in the same Class C IP block (for non-techies, two sites in the same Class C IP block are either hosted on the same web server or at least within the same network of web servers).
2. There is an overlap of telephone and fax numbers within the technical contacts for droa.ca.

   Namejuice.com:

   Technical Contact:
   Domain Registrar
   Brandon Gray Internet Services Inc.
   7100 Warden Ave
   Unit 8
   Markham
   ON, L3R 8B5 CA
   +1.9054152681
   +1.9054152682

   DROC.ca:

   Technical contact:
   Name: Mr Larry Coker
   Job Title:
   Postal address: 7100 Warden Avenue
   Suite 8
   Markham ON L3R8B5 Canada
   Phone: (905) 415-2681 x401
   Fax: (905) 415-2682

   This seemed even more suspicious.
   

At this point, I noticed the key piece of information that tied Brandon Gray Internet Services Inc. directly to Domain Registry of Canada (DROC), within the WHOIS for droc.ca:

Domain name: droc.ca
Domain status: EXIST
Domain number: 323545
Approval date: 2001/08/08
Renewal date: 2016/08/08

Registrar:
Name: Brandon Gray Internet Services Inc.
Number: 985491
Registrant:
Name: 1446513 Ontario Limited o/a Domain Registry of Canada
Number: 323545

In other words, Brandon Gray Internet Services is claiming to be the domain registrar of a domain for a domain registrar with the same telephone number and fax number, and whose site is hosted within the same server network. This is clearly not the case.

Additional Scam Evidence

As you can see via the information provided within the aforementioned WHOIS databases and email, Brandon Gray Internet Services is stating that they have received a request to transfer a domain to themselves from…themselves.

There are other signs of a scam within the two websites themselves (namejuice.com and droc.ca). However, it is unnecessary to go through said evidence to further establish that which is already obvious i.e. that DROA/DROC is up to its old tricks and using another “company” as a front for said chicanery. If you wish to, please feel free to do so; however, for the sake of brevity I won’t.

Do NOT, under any circumstances, transfer your domain to Brandon Gray Internet Services Inc. The best thing you can do with the email is simply to disregard it. If your registrar has the ability to Lock or otherwise block transfers, get in touch with them and lock your domain as well just to be on the safe side.

ICANN’s Responsibilities and Obligations

As the SynUK.org link clearly demonstrates, and as is common knowledge throughout those who have some degree of expertise in the web design and marketing communities, this scam is nothing new on the part of the DROA/DROC camp. They have attempted to pull scams off in the past, and will attempt to again.

The question that I have is this: how is it possible for an organization to accredit a registrar without even so much as a basic phone number check and/or a simple level of cursory research (as I have performed) to determine whether or not the company is associated with other companies who have shown to exhibit illegal and/or unethical activity in the past? I would seriously like to know the answer, as I suspect many others would as well.