'Transfer Domain Request' - Is This A Scam?

Request to transfer domain coming out of nowhere

[markd]

I handle all domain registration as part of my marketing consultancy duties for a client (we are not a registery or an ISP).

The client registered a .com domain through a registry about 3 years ago and this domain is hosted by a separate ISP. It was due to expire in about 15 days and when I searched for the domain it directed me to a certain commercial registry and I renewed the domain for another 3 years.

Shortly before I renewed the domain, the client received a notification by email from the hosting ISP saying that they had 'received a transfer request to move this domain to a different registrar'.
When I queried who had asked for this transfer with the ISP they said it was an 'automated request' and they could not tell me who had originated this.
On the email there was a link to approve or disapprove of this transfer, but after following it the resulting web page said:

'The key identifier passed to this page is invalid. This transfer requestdoes not exist'.

As I had renewed the domain (and received a confirmation of this) I took no further action.

Today, the client has received the same message from a well-known registry (NOT the one I renewed the domain through) with the same message - again linking to a page which says the transer request is 'invalid'.

I am wondering if this is a scam on the part of a less than professional registery/hosting company to spot domains which are about to expire and send spam to the domain contact to try to get them to renew through the company in question whilst cross-selling their other services?

I am assuming that as the domain is renewed I (and the client) can safely ignore this spam?

[ScottM]

Methinks someone is trying to steal your domain name...

[markd]

Please elaborate Scott - if I have renewed the domain before the expiry date, presumably all is safe?

Is there a way I can check that the expriy date on the domain matches the new date of 3 years time?

[dauction]

markd,

1)did you renew the domain at the same registra that it was registered at 3 years ago?

If so then simply do not reply to the "transfer" email

2)actually you should do this 1rst.. go to [internic.net...] and type in the domain and make sure you are still the administrative contact, the email address are correct and the registrant al that is correct..

Check to see if the day that you renewed is correct, and the expiation date is correct.

and make sure the domain was "created by" the company that you registered at..Created by Registrar:
Last Updated by Registrar:

If every thing is correct then you are fine and just ignore the email..could be either a really bad domain hijacking attempt by a person or it could be from a sleazy registracompany trying to "steal" your business...trick you into renewing at their company

[markd]

Thanks for the advice dauction.

The original registra seems to be redirecting to another well-known company and I renewed through them.

When I am doing a Whois look-up at the registra's site its showing the correct contact details and also showing:

'Record expires on 03-Nov-2005.'

So I guess all is OK?

Still puzzled by this 'transfer request'!

[dauction]

Yeah, looks like everything is OK..

Most liely another register was trying to trick you into moving to their company..but it also could have been someone actually trying to steal the domain..

Contact your registra and make sure you have a "lock" on your domain.

This link may be useful.. not my site mods..
[domainscams.com...]

[markd]

Guess what dauction - the companies mentioned in your email are PRECISELY the companies involved in my issue!

Add another one to this list, 'The Domain Registry of Europe'.

I hope other members come across this thread - the information you have provided via your link may be of use to others also. Brett, is it worth drawing this to the attention of others?

I am not sure the current host (as opposed to the registra) offer the option to 'lock the domain'.

What is particularly worrying is the part which says 'you must decline the transfer...' The link this company is sending to do this seems to be bogus, and the page it links to non-functioning.

I think I will contact the current domain host straight away!

thanks again for this advice.

[rcjordan]

>but it also could have been someone actually trying to steal the domain..

Absolutely! Some sort of bogus transfer has been tried on my high-$$$ domain about 3 times in the last 4 or 5 years.

[markd]

rcjordan, what did you do as a response to this?

Did you just ignore it or did you take some action in some way?

[rcjordan]

I keep the best ones in netsol primarily because they have been so, ummmm, anal about dotting the i's on transfers. I figure it's a good defensive position. I'm set up on email verification and when the change requests have come from netsol, I deny them. I sent a separate email (online form, actually) to report the suspected bogus transfer, just to get my protest logged onto their system.

[markd]

Netsol's domain seems to be going to another company - who are the outfit I renewed the domain with!

Getting a bit confused now - but at least it seems that my clients domain is safe as the renewal is registering!

[Ken_Johns]

I had exactly the same thing from the "Domain Registry of America", with what appears to be a drop-box in London for an address. The lady that opened this in our office thought it was the renewal notice for our domain registration and passed it through for signing off. I was just about to sign it when I saw the words, "Transfer and Renewal". Reading a bit closer I saw it was not an invoice but an offer to transfer to another registrar. After digging about at domainscams.com I saw an exact copy of the letter we received