MCI Telecommunications 

                        internetMCI Security Group


Report Title: iMCI MIIGS Security Alert 
Report Name: "interNIC" Registration Scam
Report Number: iMCISE:IMCIMCI031497:01:P1R1
Report Date: 03/14/97
Report Format: Formal
Report Classification: MCI Informational  
Report Reference: http://www.security.mci.net
Report Distribution: iMCI Security, 
                     MCI Internal Internet Gateway Security (MIIGS), 
                     MCI Emergency Alert LiSt (MEALS)
                     (names on file)

-------------------------------------------------------------------------- 
internetMCI Security  has become aware of an e-mail scam that appears 
to be targeting several Internet domains, attempting to solicit credit 
card information from users while fraudulently claiming to represent the 
InterNIC Registration Service.

The email informs users that they have the ability of registering
for .WEB domains and that users must fax their Credit Card Information
to an included fax Number, when in fact the originator of the email
has no association with the InterNIC and may be using collected
credit card data in a fraudulent manner.

Users are encouraged to do the following:

	* Check the email headers to ensure the "FROM" address matches
	  the "RECEIVED" by address:

>>Received: from localhost (ultra2.webcom.com) by e55.webcom.com
>>From: webdomain@rs.internic.net

	* Never provide sensitive or confidential information to anyone,
	  under any medium without taking steps to confirm the identity
	  and validity of the source (eg; sending email or calling InterNIC 
	  in this case).

	* Report any suspicious activity to your Internet Provider.

A sample of the email is included below;

------------------------------------------------------------------------

DEAR INTERNIC REGISTRANT,

1. THE .WEB DOMAIN
WE ARE GLAD TO INFORM YOU THAT A NEW DOMAIN, THE .WEB DOMAIN, HAS
BEEN CREATED.

NOW, YOU CAN REGISTER .WEB DOMAIN NAMES, LIKE "NAME.WEB"
REGISTRATIONS FOR THE .WEB DOMAIN ARE NOW OPEN. 

THE REGISTRATION FEE IS $100 FOR THE FIRST TWO YEARS, AND $50 FOR EACH YEAR
AFTER.  WE CAN ONLY ACCEPT PAYMENT, AT THIS TIME, BY CREDIT CARD.
THE POLICY IS FIRST COME FIRST SERVED, SO IN ORDER TO MAKE THE PROCCESS AS
CLEAR AND SECURE AS POSSIBLE WE REQUEST YOU TO FAX YOUR PAYMENT INFORMATION
TO 08882770295

IF YOU WANT TO MAKE THE RESERVATION(S) OF YOUR DOMAIN(S) NAME(S),
SEND A MESSAGE TO: REGISTER@WEB-DOMAIN.COM  WITH THE FOLLOWING SUBJET LINE:
"NAME1.WEB,NAME2.WEB",(THE .WEB DOMAIN NAMES YOU WISH TO REGISTER SEPARETED
BY 
COMMAS), AND THE INTERNIC DOMAIN NAME YOU HOLD AT THIS TIME IF ANY.

2. EXAMPLE OF DOMAIN NAME RESERVATION

IF YOU SEND THIS EMAIL MESSAGE:

TO: REGISTER@WEB-DOMAIN.COM
SUBJET: SHOP.WEB,STORE.WEB - GAMES.COM

THIS MEANS YOU WANT TO REGISTER THE DOMAIN NAMES SHOP.WEB, AND STORE.WEB,
AND THAT YOU HOLD THE DOMAIN NAME GAMES.COM 


3. FAXING YOUR PAYMENT INFORMATION

AFTER YOU REQUEST YOUR DOMAIN NAME THROUGH EMAIL YOU SHOULD FAX YOUR
PAYMENT INFORMATION TO THE WEB-DOMAIN REGISTER, TOLL FREE NUMBER 08882770295  
(OR 12122082919 FROM OUTSIDE U.S.):

PLEASE INCLUDE:
CREDIT CARD TYPE: MASTER CARD OR VISA
EXPIRATION DATE
NAME ON YOUR CARD
ADDRESS
AMOUNT YOU AUTHORIZE US TO CHARGE YOU ON YOUR CARD
YOUR SIGNATURE

WHY DO YOU RECEIVE THIS E-MAIL?
YOU PROBABLY HOLD A DOMAIN NAME, (.COM,.ORG OR .NET), AND THE SAME ONE HAS
BEEN REQUESTED FROM SOMEONE ELSE WITH THE NEW .WEB EXTENSION. OUR POLICY IS
TO NOTIFY YOU, AND GIVE YOU THE CHANCE TO REGISTER IT, AS WE FEEL YOU
SHOULD BE THE NATURAL OWNER.

WEB-DOMAIN REGISTER
DFZ

---------------------------------------------------------------------

Should you have any questions, please feel free to contact the internetMCI
Security Departmet at "security@mci.net" or the InterNIC Registration
Service at "internic@rs.internic.net".