We received a renewal notice today from scammers apparently based in Latvia, north-eastern Europe.

Below is the message we received, showing full headers (some items removed for privacy). Spelling and grammatical errors have been left unchanged (they’re a handy giveaway if you pay attention).

The intention of the sender is simple: to jump the gun so that this message arrives before your own Registrar notifies you that the domain will soon require renewal, in the hope that you’re ignorant, careless or gullible enough to assume that this is a legitimate message so that you — or an inexperienced staff member — will click the link and renew the domain name for their outrageous price of 60 Euros (US$80) instead of the regular fee we pay of US$9.69 — an 800% hike in price.

The Bottom Line: Pay attention to the details, or you’ll pay a hefty Gullibility/Stupidity Tax!

From:     ian.reid <ian.reid@domainremeber.info>
Subject:     Info regarding your domainname
Date:     29 March 2010 1:13:37 PM AEDT
To:     [REMOVED]
Reply-To:     ian.reid@/root/bin/start-mail
Return-Path:     <ian.reid@domainremeber.info>
Envelope-To:     [removed]
Delivery-Date:     Sun, 28 Mar 2010 22:20:06 -0500
Received:     from ien1.dva.lv ([81.198.160.244]:33181) by [removed] (envelope-from <ian.reid@domainremeber.info>) id 1Nw5WI-0002e6-Lt for [removed] Sun, 28 Mar 2010 22:20:06 -0500
Received:     from localhost.localdomain ([127.0.0.1] helo=domainremeber.info) by ien1.dva.lv with esmtp (Exim 4.63) (envelope-from <ian.reid@domainremeber.info>) id 1Nw4Tx-0001wB-H8 for [removed]; Sun, 28 Mar 2010 22:13:37 -0400
User-Agent:     Thunderbird 2.0.0.23 (Windows/20090812)
Content-Type:     multipart/mixed; boundary=”sEC9EjMU+mHMJP5E”
Mime-Version:     1.0
Message-Id:     <E1Nw4Tx-0001wB-H8@ien1.dva.lv>

Domain holder

This is to remind you that, your domain name [REMOVED] has not been renewed and will expire 60 days .
Renew your domain automatically with a Domain Renewal.
Click below to extend your domainname
—>  http://[REMOVED].domainrenewalonline.org/

Your domain will be renewed once your payment has been received by us.
__________________________________

Sincerely ISP Renewal
__________________________________

More info.
Your domainname [REMOVED] will expire shortly. We therefor remind you to renew the domain in order to avoid loss or expiration. You can renew your domain name for 1, 2 or 3 years. The domainname in question is stated in the beginning of this mail. When you choose to renew the domainname you can use the link in this mail in order to complete the payment for the renewalfee. You will see the total charge before you complete the payment. No additional fees will be charged regarding this matter. We will not change any information such as nameservers or other information in the whois data. Your current internetprovider or other companies may also assist you in the renewal operation.
If you need any assitance from our customer service support please contact us. Contact information is listed on our website.

Here’s the Whois lookup result on their own domain names:

Whois For : ‘domainremeber.info’

Domain ID:D32020655-LRMS
Domain Name:DOMAINREMEBER.INFO
Created On:25-Mar-2010 13:14:33 UTC
Last Updated On:26-Mar-2010 17:16:08 UTC
Expiration Date:25-Mar-2011 13:14:33 UTC
Sponsoring Registrar:Name.com LLC (R279-LRMS)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:ncr-7419726-9611
Registrant Name:Protected Domain Services – Customer ID: NCR-2437601
Registrant Organization:Protected Domain Services – Customer ID: NCR-2437601
Registrant Street1:125 Rampart Way
Registrant Street2:Suite 300
Registrant Street3:
Registrant City:Denver
Registrant State/Province:CO
Registrant Postal Code:80230
Registrant Country:US
Registrant Phone:+1.7202492374
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:domainremeber.info@protecteddomainservices.com
Admin ID:nca-7419727-1a07
Admin Name:Protected Domain Services – Customer ID: NCR-2437601
Admin Organization:Protected Domain Services – Customer ID: NCR-2437601
Admin Street1:125 Rampart Way
Admin Street2:Suite 300
Admin Street3:
Admin City:Denver
Admin State/Province:CO
Admin Postal Code:80230
Admin Country:US
Admin Phone:+1.7202492374
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:domainremeber.info@protecteddomainservices.com
Billing ID:ncb-7419729-3170
Billing Name:Protected Domain Services – Customer ID: NCR-2437601
Billing Organization:Protected Domain Services – Customer ID: NCR-2437601
Billing Street1:125 Rampart Way
Billing Street2:Suite 300
Billing Street3:
Billing City:Denver
Billing State/Province:CO
Billing Postal Code:80230
Billing Country:US
Billing Phone:+1.7202492374
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:domainremeber.info@protecteddomainservices.com
Tech ID:nct-7419728-6760
Tech Name:Protected Domain Services – Customer ID: NCR-2437601
Tech Organization:Protected Domain Services – Customer ID: NCR-2437601
Tech Street1:125 Rampart Way
Tech Street2:Suite 300
Tech Street3:
Tech City:Denver
Tech State/Province:CO
Tech Postal Code:80230
Tech Country:US
Tech Phone:+1.7202492374
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:domainremeber.info@protecteddomainservices.com
Name Server:NS1.NAME.COM
Name Server:NS2.NAME.COM
Name Server:NS3.NAME.COM
Name Server:NS4.NAME.COM

Protecteddomainservices.com is the private registration service for their Registrar:

Christian Investments LLC  d/b/a Protected Domain Services
125 Rampart Way
Suite 300
Denver
CO
80230
US
Phone:         +1.3034596012
Email Address: dns@protecteddomainservices.com

Here’s the Whois lookup results for domainrenewalonline.org

Domain ID:D144355987-LROR
Domain Name:DOMAINRENEWALONLINE.ORG
Created On:24-Apr-2007 11:02:12 UTC
Last Updated On:11-Mar-2010 17:02:23 UTC
Expiration Date:24-Apr-2010 11:02:12 UTC
Sponsoring Registrar:DomainInfo AB (R29-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:DI-86-GRU
Registrant Name:Pierre Grundstom
Registrant Organization:Domain Renewal SA
Registrant Street1:Berzu 3
Registrant City:Cesis
Registrant Postal Code:5400
Registrant Country:LV
Registrant Phone:+371.25977574
Registrant Email:xolxo72@gmail.com
Admin ID:DI-86-GRU
Admin Name:Pierre Grundstom
Admin Organization:Domain Renewal SA
Admin Street1:Berzu 3
Admin City:Cesis
Admin Postal Code:5400
Admin Country:LV
Admin Phone:+371.25977574
Admin Email:xolxo72@gmail.com
Tech ID:DI-86-GRU
Tech Name:Pierre Grundstom
Tech Organization:Domain Renewal SA
Tech Street1:Berzu 3
Tech City:Cesis
Tech Postal Code:5400
Tech Country:LV
Tech Phone:+371.25977574
Tech Email:xolxo72@gmail.com
Name Server:NS.IVIDHOSTING.NET
Name Server:NS2.IVIDHOSTING.NET