Domain offer spam from [email protected]

[Peter]

Just received the spam below. Appears to be a new 1 going about. Carried out a quick search on google and only 4 or 5 responses for the email address. Anyway be vigilant.

From: [email protected] <[email protected]>
Subject: domain.com (modified but this will match your domain)
Message

Hello,
I am interested in purchasing this domain name (not the website content, only the domain).
If you are open to selling please let me know ASAP and I will submit my best offer.
Thanks for your time,
Steve Johnson ([email protected])

Notice the email it was sent from was actually [email protected]. The email address this was sent too is only used on my whois.

 

[prorank]

About this email make offer on domain ....

I noticed a few people mention they think they are getting this email because of the type of domain or wonder why they get the emssage for good domains or not etc.... The person sending them is most likely NOT choosing the domain names himself it is probably done by a computer program and randomly sends out the email to any domain name, like I previously mentioned it is a way to harvest email addresses, plain and simple. They send the admin contact email address an email in hopes they will get a reply. once they get the reply they can start sending you emails offering services like web design, seo, hosting etc.. anything related to domains. Plus like also previously mentioned they sell the list of emails as working verified email addresses to other spammers. It's just like if you build a web site and put your email address on one of the pages, an email harvester is guaranteed to get the email and start spamming you. I own tons of sites and built many client sites adn have tested this theory and know this for a fact. Usually spam will start anywhere from 1 week to at most a month and you will start getting the spam.

Well I hope this helps some people understand more about this stuff.
PS. If anyone is looking to buy some really graet one word adn top level domains in the .ca version let me know I have many available at great prices...and of course some .com's mostly good traffic domains.
Prorank

I just received the same email from mikesbikes444 (email copied at end).

I also received a similar one 2 weeks ago for the same domain (from a different email address).

Also, for the same domain again, I've had at least 3 emails offering the plural version of the domain to me.

It's a decent quality 2 word generic dotcom.

So maybe they are targeting specific domains?

 

[enlytend]

Got one of these today - different name, different email, exact same message. Mine was from "Mike Howard" - mikesbikes445 @ yahoo.com. Also sent from [email protected]

 

[RevolutionaryDomains]

[email protected]

I just received this, only he has a new email addy, or so it would appear.

It seemed a bit fishy considering s/he uses a free yahoo email addy to contact people for business. Not to mention the ciphersense addy is also attached in the email. Silly kids!



Received: (qmail 334 invoked by uid 30297); 6 Sep 2012 17:27:11 -0000
Received: from unknown (HELO p3pismtp01-057.prod.phx3.secureserver.net) ([10.6.12.121])
(envelope-sender <[email protected]>)
by p3plsmtp01-02.prod.phx3.secureserver.net (qmail-1.03) with SMTP
for <removed.com>; 6 Sep 2012 17:27:11 -0000
X-IronPort-Anti-Spam-Result: ApoCAEbaSFDRVd+plGdsb2JhbABFgm6CUqQKkW8IIgEBAQEJCQsJEimCMgcCFw8GAQE4gQ8BBAEFAQMBBisih1sBAQIPAZxWCQOKZoE9CYJqAQWFTAMBiX0Gii6EDIMchwOBUIs5gmWFRYQ7gWGBST5Dg2CCFw
Received: from mail-ie0-f169.google.com ([209.85.223.169])
by p3pismtp01-057.prod.phx3.secureserver.net with ESMTP; 06 Sep 2012 10:18:30 -0700
Received: by iec9 with SMTP id 9so3980422iec.0
for <removed.com>; Thu, 06 Sep 2012 10:18:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=ciphersense.com; s=ciphersense.com;
h=message-id:mime-version:from:to:reply-to:date:subject:content-type
:content-transfer-encoding;
bh=Aq8a5Fpmi30USuPfzi6F0XzTCMXVQOSLE2XuNmsN42s=;
b=SjrJPeUcOS8iXLWIgQiiQK8coMVdg/pGl6NK9xGqzy2FzpPyzTDrgSf6ndJoFwyOBW
NvWEJRB+xfxlbonTygdYthMieSDvA91cAp4xr5brBkgcMfRv7b7r231XcX+P6VitdJVa
M/ZqRFHCrfiUT6dzve/s1VJ1lMHDedp4Ijnk4=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=google.com; s=20120113;
h=message-id:mime-version:from:to:reply-to:date:subject:content-type
:content-transfer-encoding:x-gm-message-state;
bh=Aq8a5Fpmi30USuPfzi6F0XzTCMXVQOSLE2XuNmsN42s=;
b=b3lvr8x/3GYmd4xP8xEhrd1KYGbEmuAGbhCQ9S9koYt9nEOFk0f1vpA02c9tyLeZjp
bL+ufy+FHGkco1Iyly8AYevPVWkNX//3g2oaZYIBcUvygZKtQZS7MGqpdgo1POnMWh0c
/ad/yUre1TXTqhHB2V6YO8KVmsUoKkmXmkNfvbae0kJGKT+95GClz50VENmGwHP8+lPW
eZhmnKKqO9e4PLypceCDIwPCFkQhzgJEV47xRRT1x13PM7zGefiOCLl33TSgB6/vXJv0
t5aBKXf9FMqblUbOhpcLBrDkw5Z1pbh4cesJ5mudTt3EnM9/kzdWgg3elI5IEfKrLMOV
s7rQ==
Received: by 10.50.57.202 with SMTP id k10mr4147524igq.45.1346951595131;
Thu, 06 Sep 2012 10:13:15 -0700 (PDT)
Return-Path: <[email protected]>
Received: from njacksondwin8-d ([2601:d:3f00:13:793b:cefe:480d:8441])
by mx.google.com with ESMTPS id bp8sm6537909igb.12.2012.09.06.10.13.13
(version=TLSv1/SSLv3 cipher=OTHER);
Thu, 06 Sep 2012 10:13:14 -0700 (PDT)
Message-ID: <[email protected]>
MIME-Version: 1.0
From: "[email protected]" <[email protected]>
To: removed.com
Reply-To: [email protected]
Date: Thu, 06 Sep 2012 10:13:14 -0700 (PDT)
Subject: removed.com
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
X-Gm-Message-State: ALoCoQnYaIromDk8FzKOciKLucnYLw7y5l0ejLDf1b7RaQyM9zV3HPamoZGyJTIEgqjju7AgzcMR
X-Nonspam: None



From Subject (Thread Messages) Date Size
Hello,
I am interested in purchasing this domain name (not the website content, only the domain).
If you are open to selling please let me know ASAP and I will submit my best offer.
Thanks for your time,
Mike Howard ([email protected])

 

[Kate]

how domain can be stolen due to bouncing email?

If the whois record has an expired E-mail address or one based on a domain name that no longer exist, then you can claim the address (eg. free mail like yahoo) or re-register the domain, then recreate the E-mail address and take over the account at the registrar (using the password reminder feature).

 

[Kate]

Received this a couple days ago, and it sounds like it's automated.

 

[cache]

got the same email. But when replying, the email was rejected: "Delivery to the following recipient failed permanently:

[email protected]

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 5.2.1 The email account that you tried to reach is disabled. k4si17386001wea.21 (state 13)."

 

[Kate]

I guess the account was disabled after too many spam reports.

 

[Kate]

I would like to know what is the point of those (e.g. domain appraisal or some other scam?), had someone replied and figured it out?

On a blog somebody suggested it could be a ploy to spot domains that could be stolen from bouncing E-mails.

Or see post #18.

 

[AndyB]

I too got the same email as above, from mikesbikes444. When I got a 2nd one, to a different email address for a totally unrelated domain, I got suspicious. The good news, is that I joined this forum because of it

 

[prorank]

about the domain offer email

I noticed someone asked what teh purpose was for this person to send us these emails saying they want to make an offer on a domain. Well there is only 1 logical explanation and that is the person is most likely collecting emails that are of real people who reply to him. Then he sells a verified list of email addresses...Another spam A..H...
Prorank

 

[Kate]

This is one more reason to have a different whois email from the registrar account email I guess.

Yes, it's an additional layer of security. It also makes sense not to use free E-mail accounts or that you do not otherwise control for critical stuff.

 

[RogueWriter]

:lol:just recieved the same!googled his email and landed right here!

Maybe the truth is out..... namepros.com is using this as a recruiting tool! Make an offer, don't respond to any replies or offers, the domain owner gets curious and researches the email address and voila, another NP member.

Genius, pure genius.

:notme:

 

[gemstar]

Got one of these today - different name, different email, exact same message. Mine was from "Mike Howard" - mikesbikes445 @ yahoo.com. Also sent from [email protected]

Got one Sept 10th..Did not notice it untill today. ;P

mikesbikes445​

 

[south]

Got this today also. On a domain that is pending deletion.

 

[Peter]

Got this today also. On a domain that is pending deletion.

Lol they are not the brightest then. Looking at the results on google it appears it only started being sent out today.

 

[jmcc]

And there I was thinking that some one was going to buy one of my three word domains for millions.

Regards...jmcc

 

[dombastic]

i got one too, on friday
also an expired domain

what do they want?
appraisals?

 

[Acroplex]

Watch out for stevesplace48. Not sure what is the fuss about obvious spam emails. Not newsworthy.

 

[Peter]

Watch out for stevesplace48. Not sure what is the fuss about obvious spam emails. Not newsworthy.

Ubfortunately people fall for such scams.

 

[damon]

Got this exact message today with different emails and name. Glad I found this thread, was about to reply.

[email protected]

Hello,
I am interested in purchasing this domain name (not the website content, only the domain).
If you are open to selling please let me know ASAP and I will submit my best offer.
Thanks for your time,
Mike Howard ([email protected])

 

[RogueWriter]

-sigh-

This is why I always check namepros after receiving an inquiry.

 

[twomoon]

Sold a name to Steve for $6500

jk

Got the same email a week ago and replied him "it's for sale". He didn't reply back

 

[LinM]

Got 2 of these, 1 from steve 1 from mike. What worried me a bit is no appraisal scam reply so what are these geniuses up to I wonder?

 

[zoomactive.com]

Don't walk! RUN!!!!!!!!!!!!!