A blog entry was posted at Sophos about two domain name phishes.
The first is about eNom. A screen shot is included in the blog entry of what the email looks like. It contains a link that is supposed to take users to enom.com. However, if a user clicks the link, he or she will be taken to a different domain.
Network Solutions is the other domain name registrar that was targeted by spammers. The author of the blog entry notes that the fake site looks like a modified version of the official Network Solutions login page. The email is notifying the user that their domain name has expired.
Source: Sophos

Articles
Blogs
Kits
Forums