What should you do if you see a fraudulent .LV website?

Most hackers use domain names that are similar to the names of well-known brands or companies, but contain typos that are difficult to notice at first glance (for example, svedbank.om, itunes.cm, defi.lt, wwwss.lv, onbox.lv or netflix.om). They tend to choose extensions (like .shop, .xyz, .om, or others) in which it is easier to register malicious domain names since the registrant’s information is not verified.

The personal information of .LV domain name holders is carefully checked! While this does not completely prevent fraudsters from using .LV domain names for malicious purposes, it significantly limits their opportunities.

WHAT SHOULD YOU DO IF YOU SEE A FRAUDULENT .LV WEBSITE?

In such cases, we suggest you immediately report it to:

• CERT.LV (the Information Technology Security Incident Response Institution of the Republic of Latvia) by writing an e-mail to cert@cert.lv or by calling +371 67085888. As soon as CERT.LV detects a violation, it will place the website name in the DNS firewall, preventing its users from accessing the harmful website. Additionally, CERT.LV will conduct further research and may ask the website maintainer to disable the website or the .LV registry to block the domain name.

• NIC.LV (.LV registry), by writing to dns@nic.lv. NIC.LV will verify the personal information of the domain name holder. In accordance with the Policy for acquisition domain names under the top level domain .LV, NIC.LV has the right to terminate a domain name registration agreement if inaccurate or false personal data is provided. Since NIC.LV is not responsible for the content of the website, this domain name cannot be arbitrarily disabled by NIC.LV without an official request from the competent authorities.

• If the domain name was registered via a .LV registrar, please contact the registrar directly, as they will verify the holder’s identity on their part. Use the WHOIS service - to determine whether a domain name was registered through a .LV registrar.

We recommend that you follow these steps if you have entered personal or bank information on this website:

• Immediately notify your bank;

• In the event of material losses (transfers to the attacker’s account or computer systems infected with malware), please inform the State Police or the Economic Crimes Administration (ENAP) at cyber@vp.gov.lv (keep a copy of the application);

• Make sure all passwords are changed using another machine;

• Use an antivirus program to scan your computer.

Organizations responsible for Latvian cyberspace, whom to contact for help or advice are listed here - https://cert.lv/lv/kontakti/noderigi-kontakti

Attackers also tend to infect legitimate websites and use them for fraudulent purposes without their owners’ knowledge. In these cases, it is crucial that you provide CURRENT and CORRECT contact information when registering your .LV domain name. By doing so, you will make it easier for the competent authorities to contact you and resolve the issue as quickly as possible.

Your contact information can be updated using the “My Data” section of the NIC online system. Using the WHOIS service, you can view the contact information for a .LV domain name registered to a legal entity. According to GDPR regulations, WHOIS does not display the data of natural persons.

Make sure you protect yourself and your data!