Decoding the ICANN Scam: Domain Recovery Schemes and Click Fraud Exposed

Have you ever received a phone call from someone claiming to be affiliated with ICANN, the Internet Corporation for Assigned Names and Numbers? While ICANN is a legitimate organization responsible for coordinating the internet’s domain name system, it’s also a name frequently exploited by scammers. This article delves into a recent experience with a potential ICANN-related scam, exploring the tactics used and uncovering the likely goals of the perpetrators.

The Initial Contact: A Suspicious Phone Call

The story begins with a seemingly innocuous phone call. The caller identified himself as being with “an independent agency with I-C-A-N-N,” carefully spelling out each letter. He stated that annual verification of domain name information was necessary. He inquired whether I was the owner of a specific domain name.

It’s crucial to note that ICANN itself doesn’t typically contact domain owners directly for verification purposes. This initial contact is often a red flag. In my case, I knew that I had previously owned the domain name in question, but it had recently expired and was awaiting deletion. The caller proceeded to verify my contact information, mirroring the data that would have been publicly available in the WHOIS database before the domain’s expiration.

Suspecting a scam, I decided to play along, hoping to uncover the caller’s true intentions. I engaged in conversation, carefully noting the information he provided.

Unveiling the Deception: “Back Office Work” and Hidden Names

As the call progressed, I pressed the caller for more details about his affiliation. He reiterated that he was with “an independent agency with I-C-A-N-N,” claiming they performed “back office work and updates” for the organization. This claim is highly dubious. Legitimate ICANN-accredited registrars handle domain name registration and updates, not anonymous “independent agencies.”

When I pressed further, the caller became evasive, stating, “apparently, we cannot disclose our name.” This secrecy is a clear indication of a fraudulent operation. Legitimate businesses are transparent about their identity and operations.

The call originated from the phone number 312-600-4812. A quick online search for this number led to two websites: DirectoryDeal.com and DirectoryPals.com. Initial observations suggested these sites were potentially involved in click fraud – a deceptive practice of generating fraudulent clicks on online advertisements to inflate revenue.

The Click Fraud Connection: DirectoryDeal.com and DirectoryPals.com

[Note: As an update, both DirectoryDeal.com and DirectoryPals.com were taken down shortly after the initial publication of this analysis. This swift removal further suggests illicit activity.]

These now-defunct websites acted as frames for another site, calidirectory.com. The purpose of this framing was likely to mask the true nature of the operation and redirect unsuspecting users to a different domain.

Furthermore, repeated visits to these framing sites would trigger a message urging visitors to click on a specific domain name. This domain name was found to be owned by an entity called Domain Asset Recovery.

Analyzing the HTML code within the frame revealed that the site operator was constantly rotating different domain names, all of which were owned by Domain Asset Recovery. The image displayed on the page followed a specific format: calidirectory.com/files/ZX_Survey3/image2/32195.jpg. By simply changing the number before “.jpg,” different domain names would appear, including nicholslawfirmllc.com, meierlawoffices.com, lawofficeofmichaelanatole.com, and thewillislawfirm.com.

The Domain Recovery Racket: Targeting Expired Domains

Based on these observations and further research, including information found on other websites like this external resource, a clear pattern emerged: the scam was likely a precursor to a domain recovery scheme.

The caller’s initial verification of my contact information served a specific purpose: to confirm that a reachable person was still associated with the expired domain name and might be interested in reclaiming it. This information would then be used to contact me with an offer to “recover” the domain – for a fee, of course.

These domain recovery schemes often prey on individuals and businesses who have inadvertently let their domain names expire. Scammers capitalize on the perceived value of the domain and the owner’s desire to regain control of it, charging exorbitant fees for a service that may not even be necessary or effective.

Protecting Yourself from ICANN-Related Scams

This experience highlights the importance of vigilance and skepticism when dealing with unsolicited communications related to your domain names. Here are some key steps you can take to protect yourself from ICANN-related scams:

• Be wary of unsolicited calls: ICANN does not typically contact domain owners directly. Be suspicious of anyone claiming to be affiliated with ICANN and requesting personal information.
• Verify the caller’s identity: Ask for the caller’s name, organization, and a direct phone number. Independently verify this information through official sources.
• Never provide sensitive information: Do not share your domain registration credentials, financial information, or other sensitive data with an unverified caller.
• Maintain accurate contact information: Ensure your contact information in the WHOIS database is up-to-date to receive important notifications about your domain name.
• Renew your domains on time: The best way to avoid domain recovery scams is to renew your domain names before they expire. Set up automatic renewals whenever possible.
• Research domain recovery services: If you do let a domain expire and are contacted by a domain recovery service, thoroughly research the company before engaging with them. Check online reviews and verify their legitimacy.
• Consider using a domain privacy service: Domain privacy services shield your personal contact information from the public WHOIS database, making it more difficult for scammers to target you.
• Report suspicious activity: If you believe you have been targeted by an ICANN-related scam, report the incident to the appropriate authorities, such as the Federal Trade Commission (FTC) or your local consumer protection agency.

The Bottom Line: Stay Informed and Stay Protected

The internet landscape is constantly evolving, and scammers are always finding new ways to exploit unsuspecting individuals and businesses. By staying informed about common scams, practicing vigilance, and taking proactive steps to protect your domain names, you can significantly reduce your risk of falling victim to these deceptive practices. Remember, knowledge is your best defense against online fraud.