« Old Phishing Wine in Old Phishing Bottles | Main | Name That Scam! »

June 13, 2006

I usually like the types of online organizations that provide a live chat method of support. When reporting phishing sites, time is of the essence, and if a web hosting service or domain name registrar lets me alert a real person immediately about a fraudulent site, then there's a good chance that the report will get the necessary attention and escalation, rather than sitting in an email queue.

Fairly frequently, in my experience, the live chat support folks are literate, reasonably technically knowledgable, and downright helpful. This is not one of those stories.

A standard phishing email message arrived here, and I followed my usual protocol to get the site taken off the air as soon as possible. This one had a newly minted domain name with the word "paypal" right in the name. Unfortunately, the site was hosted in China, whose ISPs generally don't react quickly to phishing reports (in English, at least).

But I was in luck. The domain's whois record showed that it had been registered through register.com. I checked the register.com tech support site, and found that they offered live chat support. Great! Or so I thought.

My first couple of attempts using Firefox on my Mac didn't work completely. The chat interface was loaded as a Java applet in a separate window, and I could see the comments from the register.com support person, but I could not type into the field where my comments were to go. I tried a second time, and then again in Safari, but it wasn't going to work.

So, over to a Windows machine, where, with Internet Explorer (always giving me the heebee jeebies) worked. I was on live with a support person. I'll leave out his name because these days, one never knows where on the planet a tech support person is situated, or under what nom de keyboard he or she might be working.

Here is the transcript of what turned out to be an extremely frustrating session:

Register.com:Thank you for visiting Register.com's Live Support. How can I help you?
You: Phishing domain registered through register.com: paypal-[redacted].com
Register.com: Could you provide me with your domain name please?
You: dannyg.com
You: I am not a register.com customer
Register.com: Okay.
Register.com: Thank you for the domain name. Please wait while I check for this domain name in our records.
You: I am reporting a fraudulent site whose domain is registered through you.
Register.com: Okay.
Register.com: can you provide you with that domain name?
You: paypal-[redacted].com
Register.com: Okay.
Register.com: Let me check for the domain name.
Register.com: What is the problem you are facing?
You: the domain is for a fraudulent paypal phishing site. Here's the url:
You: www.paypal-[redacted].com/PayPal/cgi-bin/webscrcmd_login.php
Register.com: Thank you . Please wait while I check for it.
Register.com: What do you find fishy about this?
You: Do you know what phishing is?
Register.com: I am sorry.
You: Pass this info along to your security folks. They'll understand.
Register.com: What due you find fraudulent about this?
You: The page is an imposter. It is not a real PayPal page, but instead captures usernames/passwords of PayPal customers for fraudulent activity.
Register.com: I will surely pass this issue to the appropriate department.
Register.com: Is there anything else I can help you with?
You: I doubt it.

Is it possible in the year 2006 for an individual working in the Web site domain industry to have not heard of "phishing?" Apparently so.

Like a lot of companies, Register.com appears to see the world through rose-colored glasses...a world in which there are no disputes, no crooks, no frauds perpetrated through their services. I searched their support pages for key words in these areas and came up empty on all counts. Whatever you do, don't make it easy for someone to report Bad Stuff, and don't train your people to be on the lookout for Bad Stuff.

Visualize me walking away slowly, shaking my head.

UPDATE: I'm happy to report that within about six hours of my attempt, the phishing site is no longer active, and the domain is no longer registered. I'm not claiming responsibility for the closure, but I sure hope I helped the cause.