Suspicious message from CIRA contact form? (3.Viewing)

Nafti · Apr 26, 2024

Just received 2 suspicious messages (5 minutes apart) on 2 of my premium .ca’s. The Whois on both domains is private. Both domains are also at different registrars.

Has anyone else here received something similar or the same?

I will not be replying to either one of the messages.

LCM · Apr 26, 2024

Got one too... this is a real person working at an Ottawa-based company, so I'm not sure if it's CIRA testing their system, or malicious?

Either way, not good as I thought the contact form at CIRA was meant to keep out these types of emails

https://www.linkedin.com/in/tarek-galleze/

His specialty is "Penetration Testing"

Nafti · Apr 26, 2024

LCM said:
His specialty is "Penetration Testing"

This could mean so many different things……. I’ll leave that one there.

rlm · Apr 26, 2024

i got it too on ultra premium…

@richard.schreier ??

richard.schreier · Apr 26, 2024

The message above is a legitimate request through the Message Delivery Form. CIRA does not audit or monitor content of these messages but we do verify the email address of the sender before sending the message to the registrant email on file. The process is something like... requestor fills in the MDF and includes their email address.... CIRA sends a validation request to the requestors email address.... if the verification link is clicked within 7 days, then the message is forwarded to the registrant

richard.schreier · Apr 26, 2024

We also impose limits as to the number of requests that can be made for a specific domain and from a specific IP address in a 24 hour period

LCM · Apr 26, 2024