Incident type
OTHER
30% confidence
Severity score
LOW — 0/100
Incident does not exhibit high-risk indicators; assigning LOW severity
Routing
SOC
Unclassified report forwarded to SOC for manual review
Summary
A user received a suspected phishing email from "
Severity factors
- Incident does not exhibit high-risk indicators; assigning LOW severity
Workflow
Recommended action
1. Review the report manually and reclassify into the appropriate incident type. 2. Gather additional information from the reporter. 3. Assess whether this is a real incident or a false positive. 4. Assign the correct response team based on further investigation. 5. Block the following indicators at network and email security controls: http://www.name-controls.com/verify
Technical indicators (4)
http://www.name-controls.com/email_verification/
...r verification, both using the 'name-controls.com' domain: 'http://www.name-controls.com/email_verification/...' and 'http://www.name-controls.com/verify'. - A specific...
www.name-controls.com
Extracted from URL: http://www.name-controls.com/email_verification/
http://www.name-controls.com/verify
...'http://www.name-controls.com/email_verification/...' and 'http://www.name-controls.com/verify'. - A specific verification code 'b2fb099d71' is provided i...
do_not_reply@name-controls.com
...' request. - Sender is 'Truehost Cloud' with email address 'do_not_reply@name-controls.com'. - Email threatens 'deactivation of your domain(s)' within...
Routing reasoning
SOC
- Unclassified report forwarded to SOC for manual review
- Analyst should review and reclassify as needed
Privacy findings (1)
…'WHOIS Verification' request. - Sender is 'Truehost Cloud' with email address 'd…
Related incidents (0)
No related incidents found. Similarity is assessed at submission time.
Original report
[Analyst report] I was sent an email to click a link to verify my domain or else my domain will be restricted. [Screenshot evidence: Screenshot 2026-09-17 022119.png] Visible security evidence: - Email claims to be a 'WHOIS Verification' request. - Sender is 'Truehost Cloud' with email address 'do_not_reply@name-controls.com'. - Email threatens 'deactivation of your domain(s)' within 15 days if verification is not completed. - Email states that 'no login' is needed for verification and directs the user to 'Simply click the link below'. - Two URLs are provided for verification, both using the 'name-controls.com' domain: 'http://www.name-controls.com/email_verification/...' and 'http://www.name-controls.com/verify'. - A specific verification code 'b2fb099d71' is provided in the email. - The email references domain activity 'AFTER DECEMBER 31, 2013'. - The email was received on 'Wed, Sep 16, 8:03 AM'.
Sanitized report
PII replaced with tokens for safe onward sharing.
[Analyst report] I was sent an email to click a link to verify my domain or else my domain will be restricted. [Screenshot evidence: Screenshot 2026-09-17 022119.png] Visible security evidence: - Email claims to be a 'WHOIS Verification' request. - Sender is 'Truehost Cloud' with email address '[EMAIL]'. - Email threatens 'deactivation of your domain(s)' within 15 days if verification is not completed. - Email states that 'no login' is needed for verification and directs the user to 'Simply click the link below'. - Two URLs are provided for verification, both using the 'name-controls.com' domain: 'http://www.name-controls.com/email_verification/...' and 'http://www.name-controls.com/verify'. - A specific verification code 'b2fb099d71' is provided in the email. - The email references domain activity 'AFTER DECEMBER 31, 2013'. - The email was received on 'Wed, Sep 16, 8:03 AM'.
Status history
NEW
21/09/2026, 11:26:26