Site hosting news, tutorials, tips, How Tos and more

Archive for the ‘Internet’ category

Defending your domain


Your domain name is serious business; it represents you or your brand on the Internet, and you want to do all you can to protect it. Which is why we continue to see scams around domain names. Some of these have been going on for more than a decade, others are more recent. But just about every day someone asks us, “Is this real? Do I need to respond to this?” and the answer is always, ‘no.’

What is a typical domain registration scam?

One of the oldest scams started under the name of Domain Registry of America (or Domain Registry of Canada, or several other “Domain Registries of”), and it involves a form letter sent to the physical address listed as the admin contact for the domain in the whois record. The letter looks like a legitimate domain renewal notice—it contains your whois information, the domain expiration date, everything you might expect for a renewal.

The only problem is, it is not sent by your registrar, and if you respond to the letter and pay the fee (which is typically several times more than what you’re already paying), you are contractually agreeing to transfer your domain name to the new company. Once that happens, they make it very difficult to transfer it back out, and often in the fine print of the agreement you unknowingly entered into, they can charge you a “transfer out” fee! No legitimate registrar will ever charge you any fees outside of the domain registration fee itself.

This type of scam relies on victimizing people who are busy or just not paying attention and think, “Oh, another bill,” and throw it into a pile and write a check at the end of the week.

So be very wary of any regular postal mail that has anything to do with your domain name. It is unlikely to be from your registrar.

What’s new in the world of domain scams?
Another scam that has been circulating via email for a few years, and continues today, has to do with “trademarks” and Country Code TLDs. Country Code TLDs are the two letter domain extensions that were designated for use by specific countries, such as .us, .de, .uk, .jp, etc.

Large companies with brand names and trademarks to protect often register many of these domains in an effort to protect their primary domain. If you visit or, for example, you’ll see very different sites than, but they are all legitimate sites run by PepsiCo.

The trademark domain registration scam attempts to get you to register a version of your domain name in different Country Code TLDs (most frequently seen these days using the .cn, .hk and .tw Country Code TLDs). There are dozens of variations of the email, but the gist of it is this:

We have been contacted by an individual or company to register the domain names:

It has come to our attention that you currently hold the trademark to yourdomain. In order to protect your trademark, please respond to this email within five days. Failure to respond could result in loss of your trademark, etc., etc.

When you respond to such an email you are met with a convenient “offer” to “protect” your trademark or domain name by registering, and yourself. They prey on your fear of loss of control of your name or trademark in order to sell you domains that you don’t necessarily want and almost certainly don’t need.

In case you haven’t guessed, no one attempted to register, or The scammers simply plug existing .com, .net or .org domains into their form letter and mass email them to millions of domain owners.

There are a couple of ways to avoid becoming a victim of one of these domain registration scammers. First, very carefully review any correspondence pertaining to your domain name. Second, enable whois protection, a service that removes your direct contact information from the domain’s whois record.

You can add whois protection to your Winhost domains in Control Panel. And always remember, if your domain is registered through Winhost, any legitimate email about the domain renewal will come from Winhost Domain Services <[email protected]>.

If you ever have any questions or concerns about your domains registered through Winhost, don’t hesitate to contact us.

Microsoft doesn’t seem to like Gmail too much

Here’s another funny Microsoft video – this one dissing Gmail:

Vote for Winhost!

We wanted to let you know that Winhost has been nominated in the category of Best Hosting Service in the 2011 DevProConnections Community Choice Awards. That’s kind of a big deal for us, as we’re up against some big-name, established hosts.

Want to help us give them a run for their money? Vote!

We’re listed in the “Hosting Service” category, #13. Please take a minute out of your day to pull the virtual lever for Winhost and make the big boys sit up and say, “Hey, who is that?

Thanks for your time, your support, and most of all, thanks for using Winhost!

Phishing for Tweets

A recent Twitter virus has re-surfaced, and we were sent the link via a direct message on Twitter:

@jkruessel to Winhost dm: Someone is posting a pic of you all over twitter ;( link2pic here http://no.thanks/yZkg
August 24, 2011 at 11:37 AM

Don’t let the bad guys hook you!


Clicking that link (which we’ve changed, of course) takes you to a Twitter login page that is really a phishing site. Once the bad guys have your Twitter login, they use it to phish in more of your friends and contacts and spam moneymaking schemes all over Twitter.

We’re all used to being cautious where email attachments and links are concerned, but these newer social media exploits rely on people being less suspicious of links that show up via Twitter or Facebook. But of course you should still be wary when clicking any link that comes to you out of the blue, especially when it’s been cloaked using a URL shortening service. One way to check on such links is to use a site like, which shows you the real URL behind the shortened version.

Since we’re talking about Twitter, be sure to follow @Winhost. We’ll never steer you wrong!

Open sesame


We have a lot of discussions and meetings about security. Not only back-end network security, but security of the customer interface, and security policies as far as communicating with customers.

If you have ever locked yourself out of an online account because you forgot a username or password, you know what a frustrating experience it can be to try to get that access back. At Winhost we have a system in place that is email and temporary password based, so you can usually regain access to your account without even contacting us. In the event that fails, you can always contact the billing department and provide the answer to your security question to regain access.


We are working on extending the authentication system even further to include a second security question. The meeting about that was interesting because there were as many different opinions on security as there were people in the room, and a common question becomes how much security is too much?

And like everyone in that meeting, every one of our customers also has a different idea of “perfect” security. The thing is, you cannot design and build a system that accommodates everyone’s idea of perfect security. It would have so many barriers to entry that it would be unusable. So we have to design systems that meet most people’s needs. Which means some people will find flaws with it…

“Why don’t you require a password change every thirty days for Control Panel?”

“Why can’t I enter a 255 character password?”

“Send me my login information, but do NOT send my username via email!”

“Can I register my retina scan with you, and then you don’t allow access to my account unless it is accompanied by a live retina scan that matches the retina scan that you have registered? Oh, and I’ll register a new retina scan with you every seven days. Please? Why not?!”

Okay, I made the last one up. But we’ve heard all the others. Some more than once.

We take security very seriously, but there is a line somewhere between ultra-strict security and usability, and we have to straddle that line to provide a usable service to a large number of people. That isn’t to say our security isn’t strict – I won’t bore you with our multitude of internal security policies regarding customer data and information – but we hope we provide a secure, yet user-friendly, experience.

And whatever you do, don’t make your account password, “password.” Okay? Really, just don’t do it.