WARNING: How to Avoid Domain Scams and Scammers

**-REECE-** · 01-29-2008, 11:04 PM

Prevention:

Google the domain (also try adding words like stolen, scammed, help, missing, etc), asking other domainers about the domain in question, checking the various marketplaces and making sure things add up... The biggest single indicator of a potential scam is the price. A scammer will want to price the domain low enough that it sells before he gets caught. Keep a watchful eye on new members. Recently modified whois is another warning sign. If other indicators are present (ex. extremely low price), proceed with extreme caution.

Some known scams:

1. Appraisal Scam -- If they ask for an appraisal, it's probably a scam.

2. Snail mail scam letters -- Letters through the mail reminding you to renew your domains from companies which aren't your current registrar

3. Compromised web-based email accounts and keyloggers -- Using an email provided to you by your Internet Service Provider is generally safer than web-based email solutions. There have been known security flaws in certain webmail applications in the past (ex. Gmail) which made compromising member accounts considerably easier than guessing a password. Understand the risks involved with using a web-based solution. Download spyware software such as Adaware Lavasoft and scan your computer daily. Keyloggers are A) easy to put on someone's computer and B) potentially catastrophic to a web based business.

4. Unauthorizing funds (particularly bad with Paypal). Paypal makes it very easy to create chargebacks. Don't accept large amounts by Paypal unless you're dealing with people you absolutely trust. Moneybookers/Escow.com are a step above Paypal, however the best option would be to go with a true escrow service such as Sedo Escrow, Moniker Domain Escrow Service or EscrowDNS.

5. Emails saying your domain requires renew/transfer/you to take a certain action. Check the email and make sure that A) it's from your registrar and B) the url mentioned matches what your registrar's would be. Safer to just visit the registrar than click the links in the email.

6. Incorrect Whois emails -- if your whois isn't incorrect, beware. Phone your registrar if you think they made a mistake.

7. Traffic/Click Fraud -- Self explanatory. If it isn't direct navigation it shouldn't be sold as such. Due diligence is required here.

8. Hijacking -- If you use one of your own domain names as the nameserver, be sure to make sure it doesn't expire or someone could fraudulently gain control of your domains.

9. Escrow.com is NOT 100% safe. They do not cover stolen domains -- buyer beware. Don't think processing a "bargain" through Escrow.com won't potentially end in you being out money. In the event a domain is stolen from someone's account, the domain WILL be returned to the original owner and you'll be out whatever you paid for the domain.

10. One thing I should add: Most free webmail providers will delete accounts after certain periods of inactivity. A clever scammer could notice that your Hotmail/Yahoo/other webmail account had expired, register that same email address (which is now available) and then proceed to "Request Password" at various registrars using what was previously your email address. If you plan on using your webmail infrequently, it's recommend you verify what amount of inactivity is tolerable and won't result in email account deletion.

sibaong · 01-29-2008, 11:09 PM

Quote:

Originally Posted by Paypal

This payment has been selected for review and we have opened an investigation.

We suspect that this transaction may not have been authorized by the PayPal account holder.

We have placed a temporary hold on the funds until the investigation is complete.

Please provide some additional information about this transaction.

Response deadline: Feb. 5, 2008
Inquiry by PayPal - Case ID: PP-412-497-287
Status:
Waiting For Seller's Response
Transaction ID: 20C52167YT566570K
Buyer Name & Email: James Morris, iggymorris@gmail.com
Transaction Amount: $350,00 USD
Transaction Date: Jan. 29, 2008

Domain Whois
Administrative Contact:
nospam, kev kevdomain@yahoo.com

**-REECE-** · 01-29-2008, 11:12 PM

I posted this here (and paid for a sticky) because it seems like this guy is preying on Namepros members.. With how fast he's targetting them, having merely a post in the Warnings and Alerts section just won't get the word out soon enough...

Anyone with more info on this guy, please let us know. As EG.Domains, the NPer who alerted me to this scammer told me -- it's very probable that large holders of LLLL.coms are at the very top of his list of people to scam.

Quote:

Originally Posted by sibaong

Domain Whois
Administrative Contact:
nospam, kev kevdomain@yahoo.com

SlimPickins · 01-29-2008, 11:14 PM

thanks for the headsup! i actually received a bulk offer on my names from this person last night by email using the kevnospam account. i had an odd feeling, Declined his offer, and told him (since the text from my LLLL offers thread was pasted into the email) to please make future offers via pm or post OVER the forum, for both of our safety, as it includes a level of 'identity' and credibility. He made a second offer anyway via email which i declined. havent heard back since! thanks again for the info and i hope everyone gets their names back! sp

Expron · 01-29-2008, 11:17 PM

It always stinks how a few bad seeds ruin it for the rest of us!

Thanks for the heads up Reece,

Without your warning, Many would probably fall victim of this scam. The odds always are... & with so many attempts...

Be on the lookout.

EG.domains · 01-29-2008, 11:18 PM

Thanks to your Blog post all his emails indexed in Google now

Please keep your blog updated with any info about him. %90 of domainers search Google before selling or replying to "direct email offers"

4LTR.org · 01-29-2008, 11:26 PM

So he broke into someone's paypal account and purchased a name with someone elses money? And slimpickins can you post his email account so we can investigate.

.................................................. .......................

Duh....I just saw that we have his email addresses. I'm sure he will get caught now.

EG.domains · 01-29-2008, 11:31 PM

If your stolen domains on GoDaddy , contact :

support@godaddy.com & undo@secureserver.net

**mellowmasher** · 01-29-2008, 11:34 PM

Quote:

Originally Posted by Reece

The scammer is not a Namepros member which makes dealing with him more difficult. .

Staff are on the case and looking at an account

EG.domains · 01-29-2008, 11:40 PM

His Yahoo Messenger nickname : Crazy crazy

His Yahoo Messenger photo

-----

More info found by NPer Ronald Regging

Quote:

Originally Posted by Ronald Regging

Did some digging, heres what I found so far:

http://forums.digitalpoint.com/showthread.php?t=606491

A post on DP by a user named Kevnospam (banned), asking for an appraisal for the domain PayMass.com

PayMass.com is owned by:

Whois Record

Registrant:
Dorobantu Marian
bd tomis nr 68
Constanta, Constanta 8700
Romania

Did a bit more digging for this name and found another related scam thread on NP from Nov..

http://www.namepros.com/domain-name-...name-ebay.html

Looks to be the same guy.

Wibrodomains helped get the domains back for the person in the above thread, so I have asked him if he can check out this thread and maybe shed some light. Worth a shot at least

Don · 01-29-2008, 11:54 PM

Kudos to you Reece for the sticky and extra exposure!

Hopefully nobody else will fall victim to this putz.

Basement · 01-29-2008, 11:56 PM

Thanks for the info Reece.
I'll try do some digging as well.

4LTR.org · 01-29-2008, 11:57 PM

Hmmm....word of advice. Last night someone posted an unbelievable offer for a great domain at a fantastic price here at Namepros. However, the ad said NO PM'S and he stated that you needed to send him and email. He then spelled out his email with the dot etc.. The person was a member since 2004 so I thought, it was a little strange, but, o.k.

Being a dummy late at night (12:00 am in California) I opened up my email program and sent them a letter saying I'd take the name. However, now looking back I realize this person has my personal email addres. So exercise caution not only if someone contacts you through your email, but, when responding to great offers for domains with a message that they won't accept PM's and that you need to email them.

**-REECE-** · 01-30-2008, 12:12 AM

As long as you pay with Paypal, you're covered should the seller choose not to follow through. The burden is on the seller to provide proof that he "shipped" the item in question.

I've never been a big fan of selling domains using Paypal tbh -- and I'm sure some of you have seen one of my many rants on here about it. I was the victim of a similar scam (nothing to do with LLLL.coms though) in December of 2006 and am surprised at how little Paypal did to investigate the situation or even give me the time of day to tell my side of the story... They're clearly focussed on being "Buyer Safe" rather than "Transaction Safe" like Escrow.com would be...

I never do any transactions through Paypal with people who send emails to my whois listed email address. I'm very cautious about even doing Paypal transactions with newer Namepros members or members with little feedback. You can never be too safe... That $25 escrow fee is really worth the peace of mind... I do every transaction over $500 via escrow except when I have a good relationship with the buyer.

Quote:

Originally Posted by 4ltrorg

Hmmm....word of advice. Last night someone posted an unbelievable offer for a great domain at a fantastic price here at Namepros. However, the ad said NO PM'S and he stated that you needed to send him and email. He then spelled out his email with the dot etc.. The person was a member since 2004 so I thought, it was a little strange, but, o.k.

Being a dummy late at night (12:00 am in California) I opened up my email program and sent them a letter saying I'd take the name. However, now looking back I realize this person has my personal email addres. So exercise caution not only if someone contacts you through your email, but, when responding to great offers for domains with a message that they won't accept PM's and that you need to email them.

.................................................. ..........................

I just checked my email and I see that he accepted my offer. Do you think I should take a chance and buy it???

zurc.net · 01-30-2008, 12:38 AM

Even more of a reason to hold onto my LLLL.com's

Thanks for the heads up, I have gotten a few offers on my LLLL.com's via email, I checked to see if any were him, but they weren't..

Thanks again,
-zurc

Chris · 01-30-2008, 12:41 AM

Quote:

Originally Posted by Reece

The scammer is not a Namepros member which makes dealing with him more difficult.

Checked the system and there was a match. His account here is:

securekev

Also had: securenkvd & kevnospam with 0 posts.

mktgmark · 01-30-2008, 12:49 AM

Big applause to everyone involved. Thanks for making Namepros safer and a great lesson to always be on the lookout for scammers.

htmlindex · 01-30-2008, 12:58 AM

Quote:

Originally Posted by Chris

Checked the system and there was a match. His account here is:

securekev

Also had: securenkvd & kevnospam with 0 posts.

Glad to see that you've closed the accounts.

I've also posted this info on DP as well to warn them just incase.

weblord · 01-30-2008, 01:12 AM

been indexed by google already and saw posted on
http://www.fka200.com/2008/01/30/lll...loose-warning/

Charley · 01-30-2008, 02:07 AM

Quote:

Originally Posted by Reece

The scammer is not a Namepros member which makes dealing with him more difficult. If you receive any unsolicited offers to purchase your LLLL.coms by Paypal, be on the lookout. The scammer initiates chargebacks after having had the LLLL.coms pushed into his account.

I've got these for somebody's else domain names saying they are for sale. When I contacted the owners, they were surprised.

h3rm4w4n · 01-30-2008, 02:09 AM

Quote:

Originally Posted by sibaong

Domain Whois
Administrative Contact:
nospam, kev kevdomain@yahoo.com

....

EG.domains · 01-30-2008, 03:35 AM

Some of his domains :

Canadawallet.com
Dieforcash.com
Fep.name
Masspayment.net
Orderbulk.net
Paybycent.com
Paybymoney.com
Paygp.com
Paymass.com
Pokergeneraltalk.com
Sexismylife.net
Pokerwish.net
Uswallet.com

Update....

I found his/her own forum : http://www.theonlinedeal.com

After more and more evidences .. This ~~guy~~ is definitely (should be a girl in this case) :

Name: Marian, Dorobantu
Address: bd tomis nr 68
City/State: Constanta, Constanta
Zip code: 8700
Country: Romania
Tel: 721328329

bricio · 01-30-2008, 04:37 AM

thanks Reece for making this thread a sticky and put this THIEF in the lights
this scammer must be caught!!!

italiandragon · 01-30-2008, 04:54 AM

Maybe we should send someoen to visit him....

I invite everyone to start selling by Ecrow services , especially Moniker`s Escrow.....the safest.

filter · 01-30-2008, 05:07 AM

I have a feeling that Alex could bring some serious weight to bear in this matter ... (Pun intended, and Alex is a big guy ... but probably not the proverbial gentle giant when precious LLLL.com are involved!)

01-29-2008, 11:04 PM	#1 (permalink)
-REECE- www.LLLL.com Forum Moderator Join Date: Sep 2004 Location: Canada Posts: 8,791 0.36 NP$ (Donate)	WARNING: How to Avoid Domain Scams and Scammers Prevention: Google the domain (also try adding words like stolen, scammed, help, missing, etc), asking other domainers about the domain in question, checking the various marketplaces and making sure things add up... The biggest single indicator of a potential scam is the price. A scammer will want to price the domain low enough that it sells before he gets caught. Keep a watchful eye on new members. Recently modified whois is another warning sign. If other indicators are present (ex. extremely low price), proceed with extreme caution. Some known scams: 1. Appraisal Scam -- If they ask for an appraisal, it's probably a scam. 2. Snail mail scam letters -- Letters through the mail reminding you to renew your domains from companies which aren't your current registrar 3. Compromised web-based email accounts and keyloggers -- Using an email provided to you by your Internet Service Provider is generally safer than web-based email solutions. There have been known security flaws in certain webmail applications in the past (ex. Gmail) which made compromising member accounts considerably easier than guessing a password. Understand the risks involved with using a web-based solution. Download spyware software such as Adaware Lavasoft and scan your computer daily. Keyloggers are A) easy to put on someone's computer and B) potentially catastrophic to a web based business. 4. Unauthorizing funds (particularly bad with Paypal). Paypal makes it very easy to create chargebacks. Don't accept large amounts by Paypal unless you're dealing with people you absolutely trust. Moneybookers/Escow.com are a step above Paypal, however the best option would be to go with a true escrow service such as Sedo Escrow, Moniker Domain Escrow Service or EscrowDNS. 5. Emails saying your domain requires renew/transfer/you to take a certain action. Check the email and make sure that A) it's from your registrar and B) the url mentioned matches what your registrar's would be. Safer to just visit the registrar than click the links in the email. 6. Incorrect Whois emails -- if your whois isn't incorrect, beware. Phone your registrar if you think they made a mistake. 7. Traffic/Click Fraud -- Self explanatory. If it isn't direct navigation it shouldn't be sold as such. Due diligence is required here. 8. Hijacking -- If you use one of your own domain names as the nameserver, be sure to make sure it doesn't expire or someone could fraudulently gain control of your domains. 9. Escrow.com is NOT 100% safe. They do not cover stolen domains -- buyer beware. Don't think processing a "bargain" through Escrow.com won't potentially end in you being out money. In the event a domain is stolen from someone's account, the domain WILL be returned to the original owner and you'll be out whatever you paid for the domain. 10. One thing I should add: Most free webmail providers will delete accounts after certain periods of inactivity. A clever scammer could notice that your Hotmail/Yahoo/other webmail account had expired, register that same email address (which is now available) and then proceed to "Request Password" at various registrars using what was previously your email address. If you plan on using your webmail infrequently, it's recommend you verify what amount of inactivity is tolerable and won't result in email account deletion. Last edited by Reece; 10-03-2008 at 12:24 AM.

01-29-2008, 11:14 PM	#4 (permalink)
SlimPickins Senior Member Join Date: Jun 2007 Posts: 1,244 224.35 NP$ (Donate)	thanks for the headsup! i actually received a bulk offer on my names from this person last night by email using the kevnospam account. i had an odd feeling, Declined his offer, and told him (since the text from my LLLL offers thread was pasted into the email) to please make future offers via pm or post OVER the forum, for both of our safety, as it includes a level of 'identity' and credibility. He made a second offer anyway via email which i declined. havent heard back since! thanks again for the info and i hope everyone gets their names back! sp __________________ ---------------------> Snappy Domains! Last edited by SlimPickins; 01-29-2008 at 11:30 PM.

01-29-2008, 11:17 PM	#5 (permalink)
Expron Senior Member Join Date: Sep 2007 Location: Chicago, IL USA Posts: 591 220.00 NP$ (Donate)	It always stinks how a few bad seeds ruin it for the rest of us! Thanks for the heads up Reece, Without your warning, Many would probably fall victim of this scam. The odds always are... & with so many attempts... Be on the lookout. __________________ Domain Drop Catching Tools - Server & Desktop Based. Expron Solutions - Checkout the drop catching tools!

01-29-2008, 11:18 PM	#6 (permalink)
EG.domains GenericDomainMarket.com Join Date: Apr 2007 Posts: 6,538 1,448.17 NP$ (Donate)	Thanks to your Blog post all his emails indexed in Google now Please keep your blog updated with any info about him. %90 of domainers search Google before selling or replying to "direct email offers" __________________ Generic & Premium Domains

01-29-2008, 11:26 PM	#7 (permalink)
4LTR.org NamePros Regular Join Date: Sep 2007 Location: CA,USA Posts: 814 626.50 NP$ (Donate)	So he broke into someone's paypal account and purchased a name with someone elses money? And slimpickins can you post his email account so we can investigate. .................................................. ....................... Duh....I just saw that we have his email addresses. I'm sure he will get caught now. __________________ FIRE SALE!!! Fantastic Domains Just $1 and UP! Going Quick!!!

01-29-2008, 11:31 PM	#8 (permalink)
EG.domains GenericDomainMarket.com Join Date: Apr 2007 Posts: 6,538 1,448.17 NP$ (Donate)	If your stolen domains on GoDaddy , contact : support@godaddy.com & undo@secureserver.net __________________ Generic & Premium Domains

01-29-2008, 11:54 PM	#11 (permalink)
Don Live Chat Operator NamePros Chat Operator Join Date: Jun 2005 Location: NY Posts: 925 173.97 NP$ (Donate)	Kudos to you Reece for the sticky and extra exposure! Hopefully nobody else will fall victim to this putz. __________________ ` ... .

01-29-2008, 11:56 PM	#12 (permalink)
Basement Senior Member Join Date: Oct 2007 Posts: 1,187 1.00 NP$ (Donate)	Thanks for the info Reece. I'll try do some digging as well.

01-29-2008, 11:57 PM	#13 (permalink)
4LTR.org NamePros Regular Join Date: Sep 2007 Location: CA,USA Posts: 814 626.50 NP$ (Donate)	Hmmm....word of advice. Last night someone posted an unbelievable offer for a great domain at a fantastic price here at Namepros. However, the ad said NO PM'S and he stated that you needed to send him and email. He then spelled out his email with the dot etc.. The person was a member since 2004 so I thought, it was a little strange, but, o.k. Being a dummy late at night (12:00 am in California) I opened up my email program and sent them a letter saying I'd take the name. However, now looking back I realize this person has my personal email addres. So exercise caution not only if someone contacts you through your email, but, when responding to great offers for domains with a message that they won't accept PM's and that you need to email them. __________________ FIRE SALE!!! Fantastic Domains Just $1 and UP! Going Quick!!! Last edited by 4ltrorg; 02-11-2008 at 12:22 AM.

01-30-2008, 12:38 AM	#15 (permalink)
zurc.net Account Closed Join Date: Jul 2007 Location: Florida Posts: 663 10.00 NP$ (Donate)	Even more of a reason to hold onto my LLLL.com's Thanks for the heads up, I have gotten a few offers on my LLLL.com's via email, I checked to see if any were him, but they weren't.. Thanks again, -zurc

01-30-2008, 12:49 AM	#17 (permalink)
mktgmark Senior Member Join Date: Feb 2006 Location: www.TwoFreeLinks.com Posts: 1,038 472.40 NP$ (Donate)	Big applause to everyone involved. Thanks for making Namepros safer and a great lesson to always be on the lookout for scammers. __________________ Football Trivia - Biodiesel Information - Traffic Webcams

01-30-2008, 01:12 AM	#19 (permalink)
weblord NamePros Legend Join Date: Dec 2005 Location: Philippines - www.Nabaza.com Posts: 19,840 21,700.43 NP$ (Donate)	been indexed by google already and saw posted on http://www.fka200.com/2008/01/30/lll...loose-warning/

01-30-2008, 03:35 AM	#22 (permalink)
EG.domains GenericDomainMarket.com Join Date: Apr 2007 Posts: 6,538 1,448.17 NP$ (Donate)	Some of his domains : Canadawallet.com Dieforcash.com Fep.name Masspayment.net Orderbulk.net Paybycent.com Paybymoney.com Paygp.com Paymass.com Pokergeneraltalk.com Sexismylife.net Pokerwish.net Uswallet.com Update.... I found his/her own forum : http://www.theonlinedeal.com After more and more evidences .. This ~~guy~~ is definitely (should be a girl in this case) : Name: Marian, Dorobantu Address: bd tomis nr 68 City/State: Constanta, Constanta Zip code: 8700 Country: Romania Tel: 721328329 __________________ Generic & Premium Domains Last edited by EG.domains; 01-30-2008 at 03:53 AM.

01-30-2008, 04:37 AM	#23 (permalink)
bricio Senior Member Join Date: Apr 2007 Location: Rio de Janeiro Posts: 2,553 300.00 NP$ (Donate)	thanks Reece for making this thread a sticky and put this THIEF in the lights this scammer must be caught!!! __________________ Why .mobi? Last edited by bricio; 01-30-2008 at 04:43 AM.

01-30-2008, 04:54 AM	#24 (permalink)
italiandragon NamePros Expert Join Date: Mar 2006 Location: AUSTRALIA Posts: 5,734 140.00 NP$ (Donate)	Maybe we should send someoen to visit him.... I invite everyone to start selling by Ecrow services , especially Moniker`s Escrow.....the safest. __________________ Great quality LLLL.coms : OPPB.com / MMCP.com / IFUV.com 100+ great LLLL.com for CHEAP SALE, make your offer NOW! >>CLICK HERE<<

01-30-2008, 05:07 AM	#25 (permalink)
filter Domain Wanker Join Date: Sep 2007 Location: San Francisco Posts: 1,614 1.33 NP$ (Donate)	I have a feeling that Alex could bring some serious weight to bear in this matter ... (Pun intended, and Alex is a big guy ... but probably not the proverbial gentle giant when precious LLLL.com are involved!)

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Forum Moderator

Forum Moderator

Forum Moderator

NamePros Chat Operator

Forum Moderator