Hacker News Reader

Comment by billspreston | Hacker News Reader

Can this be done via a "click here to confirm" email, or does this require phone conversations with the registrar? I don't like registering domains using my real name.

View on HN

I got such an email from Namecheap yesterday, and confirmed it with one click.

And unlike the intended trigger for verification ("changes to contact information"), I didn't make any changes to my domain. Either a WHOIS cloak expired, or some other action by Namecheap triggered the verification step.

What exactly is the verification step? Do they mail you a verification token? Because it sounds like you simply clicked a link to verify your address.

Yes, I just clicked a link that went to http://raa.name-services.com/raaverification/verification.as...

The email Namecheap sends out is very shady looking. I had to google around quite a bit before concluding it was genuine. The verification link leads to the domain raa.name-services.com and is not delivered over https. It looks exactly like I imagine a targeted phishing email to look.

That's the same domain they use in the e-mail you get asking you to review the accuracy of your WHOIS data. They send that e-mail for every domain you own, every year, as required by ICANN. For Namecheap customers, the domain should be familiar, after the first mail at least.

The subject line of those mails is: Important Notice Regarding Your Domain Name(s)

The new mails have a stronger subject line: IMMEDIATE VERIFICATION required for [domain]

It's not Namecheap sending those out: Namecheap is simply an eNom reseller and the email you received was likely directly from eNom, with some Namecheap branding attached. *.name-services.com is used for various eNom-related stuff.

It can also be triggered by using the same contact with another domain being registered. Registrars aren't required to verify any existing contacts, but the moment there's an update, they have to. That said, if they want to, they can.

Also, Namecheap is an eNom reseller, so you actually got that email from them, not Namecheap.

Isn't there some rule that a domain must be registered with a real name, or it doesn't really belong to you (and all anonymization services for domains are therefore suspect)?

Only if the privacy service isn't ran by the registrar the domain is managed by. You should have a read over ICANN's 2013 RAA: http://www.icann.org/en/resources/registrars/raa/approved-wi...

Reply on news.ycombinator.com