I own the domain www.turningthekey.com which is a pretty nice domain, I think. I had someone offer me 30 dollars for it (gasp!), but I decided to hang onto it incase it was worth some real money some day.

Well, about 30 seconds ago I got a weird phone call. My cell phone rang, and caller ID said that it was from phone number 210. That's it. Just "210". Three digits.

So, I answered and there is this lady with this reeeeally heavy accent that I can barely understand, and she starts asking me questions about confirming my domain information. Well, I was extremely suspicious so I wouldn't have told her anything overly personal. But she said that she wanted to speak to Karl Dorn (that's me!), and then she said my phone number and asked if it was mine. I said it was, then she asked me to repeat the phone number back to her. I told her that I didn't have my phone number memorized because I never call myself. Then she got really pissed, and asked me what the fax number was. And I told her that I wasn't sure that I had a fax number hooked-up at the time. Then she hung-up on me without even saying goodbye or ever saying who she is. She could have effortlessly gotten everything she asked about from my public WHOIS information.

So what the bloody hell just happened? What is "210"? Is someone trying to steal my domain? If I thought it was worth enough to be worth stealing I would auction it off - I'm a poor college student with a negative amount of money in the bank who probably won't go to graduate school because of that! Or, was this an actual confirmation or something? Why didn't she identify herself? Why did she just hang-up on me? What should I do right now? Also, I just checked and for whatever reason the fax in the WHOIS is listed as (123)123-1234. If I remember back to when I registered it (I was barely 18), it told me I had to put a fax down. So I just did that. I think I've fixed it as of 5 min. ago, but it's obvious that isn't a fax number. But it also seems obvious that "210" isn't a phone number either... yet I was just called from it. So what the heck?

Am I going to lose my domain? Is it actually worth stealing or something? I'm going to be pissed if that happens. Why didn't she at least identify herself? She said she wanted to confirm the information, but she didn't say who she was.

This post has been edited by Karl: Apr 10 2008, 10:31 AM

It sounds like you got a call from a private number in Greece.

When someone has a silent number and dials internationally, the country code is all that gets sent to caller ID... It seems like turningthekey may be hot property over in Athens

Lol.

Should I be worried though? Also, I've been running participants the last couple weeks, and it's working way better thanks to the iframe shim! So thanks again for that. Every time I get a good idea I run to openthource and post it now! o^__^o

Hmm, if you don't need the domain anymore, it may be enough to only worry about how much you may sell it for.... Could be a big business looking for a promotional website -- LOL - you and I are the only one's over at Open Thource these days... I've been so busy I have been neglecting some of the upgrades I was planning for it

I'm sure nobody could steal your domain name as you didn't give out any passwords or anything.

If ever I get a call that I'm suspicious of I never answer any questions, but I always say "I'm busy just at the moment, but if you give me your phone number I'll call you back in a few minutes" - anybody legit will let you have a number to call them back on (or a number to verify who they are).

I didn't give out my password, but I just realized that the one I had for my account was really basic (again, I was barely 18 when I first registered it!) I upgraded the password, and of course I didn't give anything that personal out over the phone.

As for the "call you back" bit of advice, that is EXTREMELY WISE. Thank you very much for sharing that. There are a lot of really basic things like that, that I simply don't know. And I'm always very grateful when someone takes the time to explain them. So, thanks for that. I am definitely going to do that from now on. And I won't even say who I am over the phone unless I know who is calling. o^__^o

Yeah, that's a good point Vanessa makes... If they do want to deal with you legitimately, YOU should be able to call them and not them you -- kind of like email scams, although less frequent, phone scams happen all the time.

I work for Qantas in Australia and we are constantly having to remind customers that we won't call you about specials -- there are tonnes of dodgy franhises calling Qantas passengers and saying there's a u-beaut fare going and get their credit card details off them

Where is your domain hosted? To stop this in the future, you may want to privatise (is that a word?!) your WHOIS although this will stop potential buyers (legit) from contacting you.. However, if you dont have any plans you may want to put the domain to an agency that will answer the calls and act as a barrier between you and the buyer.

Also Vanessa's advice is very wise ... I always do that if someone out-of-the-ordinary calls me asking for personal details! Also once I've just done "Hello, you've reached Marc Fraser's answer machine.. Please leave your message after the beep *BEEP*".. It always works! lol

By the way, your whoIs information has to be correct or your service can be terminated by the registrar. I received a call from mine and they had to verify my information. They let me know who they were right off the bat AND they didn't actually ask me for my information but informed me that I would be getting a letter at my registered address so I could verify the information by returning the card with my signature. So I highly doubt a real registrar would ever ask you for anything personal over the phone.

If the problem persists and your website isn't a commercial entity then you hide your whois information. Many provider do this for free. Others require a small fee.

Hey guys,

This definitely sounds like a really bad social engineering attempt. Most likely it was the person who made the offer trying to phish enough info from you to hijack the domain. No reputable company will ever contact you and ask you for personal information.



You'd be surprised. A good social engineer only needs "just enough" information from you, and can then engineer the host to do what they want.



This is a great idea. I would take it a step further and simply ask for their full name and extension at the company as they can provide you with a "direct number" to "avoid waiting". Once you have their name and extension you call the company's number and ask for that person at that extension. (Then you ask for a supervisor and find out why they are calling you to ask for personal information!)

My suggestion would be to get a private registration on your domain at this point to help eliminate this sort of thing, as Marc suggested also. Your domain should also be set to "registrar-lock" in your whois information. If not, make sure you get that taken care of asap.

Rich

This is a very interesting topic. I have never received any phone calls like this before, but I would be very suspicious if I ever did. Now, as far as caller ID goes, I would never trust that....it's great for the average person, but it can easily be fooled.

http://en.wikipedia.org/wiki/Caller_ID_spoofing
http://www.calleridspoofing.info/
http://www.usatoday.com/tech/news/2006-03-01-caller-id_x.htm

I agree with Rich, this seems like a horribly pulled off social engineering trick.

What's a social engineering trick?

Social engineering is basically a geek term for being a con man to a certain extent I guess. The whole idea is to get info out of people without them really knowing they're giving it to you. Social engineering is like hacking people essentially.

For instance, I could say something like...

"No way, you live in a pink house? That's awesome! That must be like the only pink house in Maine!" Here I'm waiting for you to tell me how many pink houses are in your area. I already know you're in Wells, 04090, because it says so on your website, and I know you drive a beamer because you posted it on another thread. I'm not sure what color it is, but I could find out later. I also see you ride horses, so I could assume you live on a large property with horses... or just find that out later as well. That's social engineering. Obviously getting an address is pretty easy - I could have just looked up the phone number, but you get the point.

Sorry if that was creepy - I was just trying to give an example. I won't show up at your door I promise.

Caller ID spoofing in extremely easy... and fun! I mean, I've heard. Seriously though, I'm white hat.

The people who called Karl sounded like they were trying to get enough info out of him so they could then call the host and steal his domain, which is also social engineering.

Rich

AHHHHHHHHHH.... YAAAAAAAAAAA....

I I I I get it now!

Fishing...for info without the other person knowing it!