Domains.co.za customer data leak?

[1337]

So I get a phishing email from Domains.co.za to an alias inbox -only- used for Domains.co.za saying a domain I own failed to autorenew.

A while later, an email from Domains.co.za warning about the phishing campaign.

How did the actors obtain this email if it is just an alias I use for my Domains.co.za account, know the domain was owned by me, and know it is due for renewal?

@Domains.co.za (Wayne)

 

[ronnie_94]

As per Wayne's response to my dm.

Hi Ronnie
Thanks for this, we picked it up yesterday afternoon pretty quickly and blocked this from our network but unfortunately, some of these emails did get through to people in our network.

As you can see from the URL (https://afrihost.annatuerlich.de/domains.co.za/new/.), they started out with Afrihost and then changed the banner to us.

This phishing attempt has hit most of the providers in South Africa.

Thanks again for letting me know, greatly appreciated.

Regards

Wayne

 

[PaulGherkin]

As per Wayne's response to my dm.

Hi Ronnie
Thanks for this, we picked it up yesterday afternoon pretty quickly and blocked this from our network but unfortunately, some of these emails did get through to people in our network.

As you can see from the URL (https://afrihost.annatuerlich.de/domains.co.za/new/.), they started out with Afrihost and then changed the banner to us.

This phishing attempt has hit most of the providers in South Africa.

Thanks again for letting me know, greatly appreciated.

Regards

Wayne

Hostking is also affected. They started spamming me after 7+ years all of a sudden

 

[1337]

Another round of phishing to an emails ONLY Domains.co.za has (a specific alias created for Domains.co.za specific emails)

How are these scammers getting ahold of your actual customer info? @Domains.co.za (Wayne)

 

[PaulGherkin]

Another round of phishing to an emails ONLY Domains.co.za has (a specific alias created for Domains.co.za specific emails)

How are these scammers getting ahold of your actual customer info? @Domains.co.za (Wayne)

They got hold of the info by means of a breach, that means they got into the databases storing customer information. So that's how.

 

[1337]

They got hold of the info by means of a breach, that means they got into the databases storing customer information. So that's how.

As this email alias has only ever been given to Domains.co.za are you suggesting Domains.co.za got breached?

 

[ronnie_94]

They got hold of the info by means of a breach, that means they got into the databases storing customer information. So that's how.

Wonder how my details would be in their customer information if I have never been a customer.

 

[PaulGherkin]

Wonder how my details would be in their customer information if I have never been a customer.

Not speaking to your case specifically

 

[PaulGherkin]

As this email alias has only ever been given to Domains.co.za are you suggesting Domains.co.za got breached

They're supposed to disclose breaches but I bet, being a typical SA company they're keeping it under wraps.
I never used them before so I don't get this, however I am getting spam/spear phising on Gmail accounts used with a bunch of other providers

 

[RedViking]

No issues on my side

 

[IamNoone]

I received one of these on an email address that is not public at all. It is a test mailbox for use to test clients sending/receiving on their email accounts.

I guess one of these clients had their mailbox compromised as that is the only way that mailbox would be known.

 

[SauRoNZA]

As this email alias has only ever been given to Domains.co.za are you suggesting Domains.co.za got breached?

Is the email not attached to the domain? And they would know exactly when that expires too using public information.

 

[1337]

Is the email not attached to the domain? And they would know exactly when that expires too using public information.

the email is only attached to my Domains.co.za account, it's literally domains.co.za@mydomain

co.za does not have any public WHOIS, so even if it was, it is not public

 

[IamNoone]

the email is only attached to my Domains.co.za account, it's literally domains.co.za@mydomain

co.za does not have any public WHOIS, so even if it was, it is not public

whois - ZARC

registry.net.za

 

[Progenix Oj101]

whois - ZARC

registry.net.za

View attachment 1756827

I wouldn't REALLY call that a whois, more a whatis. It tells you the domain creation date and that's about where the useful info stops. No addresses, contact numbers, email addresses, etc.

 

[1337]

whois - ZARC

registry.net.za

View attachment 1756827

lmao

 

[theratman]

All my domains.co.za hosted sites received a "Confirm your Etsy email" mail. Anyone else getting them too?

Edit : looks like it's everywhere

 

[DStvNothingOn]

I've got two of them now, one a personal mail and one on a work mail.
On the personal never been with domains.co.za on the work pretty sure the same thing.

All my domains.co.za hosted sites received a "Confirm your Etsy email" mail. Anyone else getting them too?

 

[Adenoid Hynkel]

All my domains.co.za hosted sites received a "Confirm your Etsy email" mail. Anyone else getting them too?

Also received them on 3 of my domains. None of my domains are with domains.

 

[McGuywer]

All my domains.co.za hosted sites received a "Confirm your Etsy email" mail. Anyone else getting them too?

Same for me.
@Domains.co.za (Wayne)?