alert Bitcoin Escrow Scam

[HDmarketing]

Hello all, just to warn the community here that I've received suspicious Flippa offers recently.

I've played around one of them to learn more about the structure of the scam. Replied to the offer and took screnshots during the negociation that followed to document the process.

I had in mind that I may write a small step-by-step for all to learn how to detect scams.

Here is what happened.

1. Offer (suspicious!)

Context:
MusiqueClassique .com is listed as Make offer > $1,000 on Flippa
(means "Classical Music" in french).

I've received many lowball offers during the years so I've put a 4 figures min offer to stop these.

Here is the message I received.

​

Why is it suspicious?

• Comes from a brand new user (Flippa account created a few days before message). 0 transactions yet.
• "Kan JUn" seems like an Asian name, the domain is a 2 french words one MusiqueClassique .com and is quite niche. Agreed a French user could want it and create a fake account to hide his ID, but I think he would chose a French name or pseudo.

My reply "BIN is $9,995, ready to consider any 4 figure offers".


2. Negociation (very suspicious!!)

He comes back with "I'm ready to offer $5,700 but payment has to be in Bit-coin because I am from china and international payment is difficult".

• He confirms that he is from China and interested in this french niche domain. OK, it could happen, but seriously... I love this domain because I'm a musician and I still dream of developping it into a nice website someday, but I'm not sure it's a sound investment for someone willing to pay thousands of dollars in a discreet way from China...
• No negociation, already offering a sum > half BIN. Whereas my min offer is $1,000.
• We will have to move out of the platform as Flippa doesn't offer BTC payment.

I'm not opposed to BTC payments, and since these are final (you can't recover a BTC payment), then there is only one way to secure payment for the buyer: go through a Bitcoin Escrow service.

(Because if the buyer sends BTC directly to the seller, once it is in the seller's wallet, nothing can force him to honour the sale and transfer the domain).

My reply "I'm happy to accept your offer as it is very reasonnable. Flippa doesn't allow BTC payment I think, what do you suggest?"

Let's see where that takes us...


3. Follow me down the rabbit hole (highly very beaucoup très suspicious!!!!)

He offers we follow up on Telegram, gives me the @Amidamary1900 contact which leads to a "Han Chao" profile. Why not!

• Telegram means anonymous / non traceable if you take the right precautions
• We are now "out of platform", so there no third party to turn to if anything bad happens.

Still giving this joke a chance, I decide to act as I would do in a legit transaction. Thus I suggest we go through a BTC-Escrow. There happens to be at least one registrar that can play that role: Epik. Here is my first message on Telegram:

​

If he agrees to that, then it's Christmas! I'm ready to transfer the domain and we can conclude that transaction the same day. But of course, he has his own Escrow solution in mind.

​

4. The BTC-Escrow so suspicious that it's not even fun anymore.

Now we are at the heart of the scam.

What's gonna happen is

• I agree,
• I create an account on the website http://cryptodaxex.xyz,
• wait for "Kan JUn", now "Han", to send his 0,55 BTC or so (BTC on the rise today!).
• I will soon enough receive an email stating that "the funds are secured and I can now transfer the domain safely".
• Once the domain transfered out of my registrar I'll ask for the BTC to be transfer to my wallet. Which will never happen because... http://cryptodaxex.xyz is a scam!!

How do I know? I've done some due dilligence.

"cryptodaxex.xyz" gives only 8 or so results! Well, for an Escrow service, you need TRUST and recognition. 8 results is bad...

One of the google results leads to an article about the death of cryptodaxex 3 years ago

​

Another leads to TrustedsReviews.xyz which gives a few reviews of cryptodaxex, the oldest one being 3 days old! (By "Justin Sun", which is hilarious to those knowing a bit about crypto!)​

​

Looking at the whois of cryptodaxex.xyz and TrustedsReviews.xyz is even funnier...

Both sites are only a few days old. The scammers managed to rank the review site on Google in a few days and started rolling out scam sites that have "reviews"...

With all that data, I decide to have a bit fun and ask my buyer a few questions...

​

Of course, got no replies after that.

That was fun for me, but remember that scam happens and that you need a secure payment solution... And that YOU need to make sure it is really secure!

Best of luck in this wild world...


PS. can't find the conversation in my flippa account anymore, I guess Flippa did detect and suppress the fake account.

 

[Samer]

I avoid flippa to avoid problems. Best decision.

Dear Flippa,

Get someone else other than Escrow.com

Samer

 

[Internet.Domains]

Dear Flippa,

What Samer said.

 

[TheBuyerz]

Even the name sounds scammy: cryptodaxex.xyz lol

Perhaps Flippa removed the conversation since they detected word: BTC, Bitcoin etc. Just like Fiverr use to do by disallowing any external deals to avoid scams, they have habit to send their email, telegram etc. using an attached text file to avoid that detection.

Most posts published on Flippa are scams (Especially for mobile apps - Not about domain names), you will notice that there is a pick of visitors only the first month in the stats, after that if you wait one month later and check back that same post, the monthly visitors will be zero.

There is not too much trusted escrow service for cryptocurrencies other than EPIK and DAN (For DAN, they still have to solve one problem, you can't deal with crypto if you are not online at same time as their agents, too complicated), I used before a decentralized solution like: bitrated.com that worked well, but was not comfortable with it.

It is an obvious scam that everyone must be aware of it ! Thank you for sharing.

 

[easywebdomains.net]

@HDmarketing Thank you very much for sharing, especially showing the whole route through the scam. I hope no one gets caught out with this scam.

 

[ikhub]

Epik and Dan support Bitcoin as payment and both provide escrow service. If buyer is not eager for a reputed site and leads to a unknown new born site, its obvious a scam.
Of Course flippa is not to be blamed here because the deal is being done outside.

 

[Stevestan]

Ok. Some more info here . I can not believe I fell for this but yes I did. Unfortunately I even went one step further and lost about 400 usd in this scam . I’m writing this as a warning but also yeah... just so angry at myself for being a dumbass!! I received exactly the same info from same person as above and followed the pattern Exactly. The scammer even went as far as to set up an account With my domain name register so I could transfer the name easily. This required him to set up billing details . (Effort!!)

he set up a deal and transferred the bitcoins into my created profile on that site with the weird name above . From what I could see those funds where in there and it was a done deal.

He sent me a password after I had transferred over to unlock.. all I had to do now was to withdraw my funds . This is the part where the scam comes in and I became the idiot. Duh!

to withdraw it said you had to upload a 0.05 bitcoin amount to the wallet to verify I was real. This would unlock the wallet and I could withdraw all my funds. This came to about 400 usd. I checked the site before doing this... it had a support section, the bitcoins I could see where rising and changing with the charts of the day , the terms and conditions seemed legit and it showed the company was based in London which I checked on a map. It seemed to me this could be legit so I risked it .dumb dumb dumb.

i then tried to withdraw and it failed . I contacted support and actually got a real person who said sorry they could not help and nothing they could do and it was because I had forgotten to take into account the 1 percent commission in their terms and conditions so the bitcoin amount was wrong. The conversation went back and forwards with them getting more indignant ... I soon realised. Scam

I contacted the original buyer via telegram who got really mad , called me loads of names and asked why on earth I had cancelled the domain . ( I realised I had 5 days to cancel the transfer so I actually still got to keep my domain name )

they then blocked me and I will never hear from them ... or see my 400 dollars again.

Lesson learned .

 

[Stevestan]

@HDmarketing Thank you very much for sharing, especially showing the whole route through the scam. I hope no one gets caught out with this scam.

Yep... see below in the thread I’m afraid I did .

 

[DN_Hunter]

thanks for these details. these scammers need to be caught and prosecuted to the full extent of the law...

 

[CraigD]

I would just avoid any transaction where bitcoin is the payment option.

Simple!

A great piece of investigative research @HDmarketing !

 

[easywebdomains.net]

@Stevestan Really sorry to hear this.

However look on the bright side. We've all made financial errors. I've lost a fair amount of money over the years, making various mistakes, but we have one thing in common. YOU REMEMBER THE MISTAKE, you learn from it and you don't repeat it. You are still in the game, and wiser. Good luck in your future purchases.

 

[3sixty]

"We need to build credibility. We need a domain extension which exudes confidence. Let's go with .xyz."


Said no one ever.

 

[CraigD]

Personally, I would not have even visited the xyz domain.

I'm not implying the site is dodgy, but if it was, they now have your IP and whatever else they could have harvested from your session, along with whatever other information you have ever revealed across public sites.

 

[HDmarketing]

Personally, I would not have even visited the xyz domain.

I'm not implying the site is dodgy, but if it was, they now have your IP and whatever else they could have harvested from your session, along with whatever other information you have ever revealed across public sites.

I know what you mean, but know that I have ways to hide my IP / disable cookies etc when I start "investigating"...

Plus various security measures to protect my assets online (2FAs etc...)

 

[HDmarketing]

@Stevestan : Sad story, my post was too late for you I'm afraid.

to withdraw it said you had to upload a 0.05 bitcoin amount to the wallet to verify I was real. This would unlock the wallet and I could withdraw all my funds. This came to about 400 usd. I checked the site before doing this... it had a support section, the bitcoins I could see where rising and changing with the charts of the day , the terms and conditions seemed legit and it showed the company was based in London which I checked on a map. It seemed to me this could be legit so I risked it .dumb dumb dumb.

Know that you never have to pay anything EVER as a seller on Escrow! That's the opposite of what it's made for.
In case of a commission they will bill it AFTER the transaction. And as for sending BTC 0.05 anywhere to just prove you're legit... Well, let's put it that way: you've been burned. Good for you it was for 0.05 BTC and not 5 !!!
May the experience serve you well as @easywebdomains.net said!

 

[Shojib]

very sad story

 

[Heesoon]

Hello all, just to warn the community here that I've received suspicious Flippa offers recently.

I've played around one of them to learn more about the structure of the scam. Replied to the offer and took screnshots during the negociation that followed to document the process.

I had in mind that I may write a small step-by-step for all to learn how to detect scams.

Here is what happened.

1. Offer (suspicious!)

Context:
MusiqueClassique .com is listed as Make offer > $1,000 on Flippa
(means "Classical Music" in french).

I've received many lowball offers during the years so I've put a 4 figures min offer to stop these.

Here is the message I received.

Show attachment 162367

​

Why is it suspicious?

• Comes from a brand new user (Flippa account created a few days before message). 0 transactions yet.
• "Kan JUn" seems like an Asian name, the domain is a 2 french words one MusiqueClassique .com and is quite niche. Agreed a French user could want it and create a fake account to hide his ID, but I think he would chose a French name or pseudo.

My reply "BIN is $9,995, ready to consider any 4 figure offers".


2. Negociation (very suspicious!!)

He comes back with "I'm ready to offer $5,700 but payment has to be in Bit-coin because I am from china and international payment is difficult".

• He confirms that he is from China and interested in this french niche domain. OK, it could happen, but seriously... I love this domain because I'm a musician and I still dream of developping it into a nice website someday, but I'm not sure it's a sound investment for someone willing to pay thousands of dollars in a discreet way from China...
• No negociation, already offering a sum > half BIN. Whereas my min offer is $1,000.
• We will have to move out of the platform as Flippa doesn't offer BTC payment.

I'm not opposed to BTC payments, and since these are final (you can't recover a BTC payment), then there is only one way to secure payment for the buyer: go through a Bitcoin Escrow service.

(Because if the buyer sends BTC directly to the seller, once it is in the seller's wallet, nothing can force him to honour the sale and transfer the domain).

My reply "I'm happy to accept your offer as it is very reasonnable. Flippa doesn't allow BTC payment I think, what do you suggest?"

Let's see where that takes us...


3. Follow me down the rabbit hole (highly very beaucoup très suspicious!!!!)

He offers we follow up on Telegram, gives me the @Amidamary1900 contact which leads to a "Han Chao" profile. Why not!

• Telegram means anonymous / non traceable if you take the right precautions
• We are now "out of platform", so there no third party to turn to if anything bad happens.

Still giving this joke a chance, I decide to act as I would do in a legit transaction. Thus I suggest we go through a BTC-Escrow. There happens to be at least one registrar that can play that role: Epik. Here is my first message on Telegram:

Show attachment 162370
​

If he agrees to that, then it's Christmas! I'm ready to transfer the domain and we can conclude that transaction the same day. But of course, he has his own Escrow solution in mind.

Show attachment 162371
​

4. The BTC-Escrow so suspicious that it's not even fun anymore.

Now we are at the heart of the scam.

What's gonna happen is

• I agree,
• I create an account on the website http://cryptodaxex.xyz,
• wait for "Kan JUn", now "Han", to send his 0,55 BTC or so (BTC on the rise today!).
• I will soon enough receive an email stating that "the funds are secured and I can now transfer the domain safely".
• Once the domain transfered out of my registrar I'll ask for the BTC to be transfer to my wallet. Which will never happen because... http://cryptodaxex.xyz is a scam!!

How do I know? I've done some due dilligence.

"cryptodaxex.xyz" gives only 8 or so results! Well, for an Escrow service, you need TRUST and recognition. 8 results is bad...

One of the google results leads to an article about the death of cryptodaxex 3 years ago

Show attachment 162373
​

Another leads to TrustedsReviews.xyz which gives a few reviews of cryptodaxex, the oldest one being 3 days old! (By "Justin Sun", which is hilarious to those knowing a bit about crypto!)​

Show attachment 162372
​

Looking at the whois of cryptodaxex.xyz and TrustedsReviews.xyz is even funnier...

Show attachment 162374


Show attachment 162375​

Both sites are only a few days old. The scammers managed to rank the review site on Google in a few days and started rolling out scam sites that have "reviews"...

With all that data, I decide to have a bit fun and ask my buyer a few questions...

Show attachment 162376
Show attachment 162378
Show attachment 162379
​

Of course, got no replies after that.

That was fun for me, but remember that scam happens and that you need a secure payment solution... And that YOU need to make sure it is really secure!

Best of luck in this wild world...


PS. can't find the conversation in my flippa account anymore, I guess Flippa did detect and suppress the fake account.

I too have been receiving suspicious Flippa Offers Lately. Just like the ones you posted. I was going to warn the NP community too of this scam. Flippa has yet detected it in my account, despite informing them multiple times of these un-believable scam attempts. Makes me want to Permanently Delete My Flippa Account! This is non-sense.....

 

[S8Power]

Damn I have been scammed in exactly this way and wished I’ve read this warning before. Hopefully I can get back the domain. I am working on it.

“I'm offering $5,700 but payment has to be in Bit-coin because I am from china and international payment is difficult".

Fortunately I have paid nothing but transferred my domain after a “secure deal” and ended up with an account with a fake balance.

look out four user Jan Lean @ Flippa and AmidaMary19 @ Telegram.

And don’t ever visit KryptoEscrow.xyz.

The only things I don’t understand yet:
- why doesn’t take the buyer the opportunity to steal even more domains from me? I have messaged him (without accusing him) that he can get a very similar domain at a discount...but he’s not interested.
- why you can read several news articles if tou Google kryptoescrow.xyz. They seem serious to me.

 

[HDmarketing]

Damn I have been scammed in exactly this way and wished I’ve read this warning before. Hopefully I can get back the domain. I am working on it.

Oh :/ Sorry to hear that. I sincerely hope you can get your domain back.

- why you can read several news articles if tou Google kryptoescrow.xyz. They seem serious to me.

Well, on that point if you search exact match "KryptoEscrow.xyz" in Google you can only 10 results. That should already raise your concerns: an Escrow service is based on trust. They have to be very well established and have to already have a good reputation. You just don't want to use a new/unknown service, period.

Then if you browse the first results:

The first one is a review site: https://trustedsreviews.xyz/reviews/kryptoescrow.xyz
All reviews are les than one week old. That should raise another red flag.

The second one is a fake news site : btcnews.one check the whois for creation date.

Etc etc...

I'm sorry to be blunt but you have to perfect your skills at detecting what a "serious article" is: these all scream "fake" at me.

Second point: as the seller, you want to vet the Escrow solution. If you don't know any, just type "Bitcoin Escrow" and read a few articles to make your mind up as what are the most used solutions. Stick to those or be burned. You have to learn from that experience and better your "scam detection process".

Best of luck, I hope you get your domain back.

 

[S8Power]

@HDmarketing you are completely right.
Several red flags should have come up.
I am glad I paid no btc and only lost my 5L.com. I might get it back but chances are slim.

This post should be on top of Namepros to prevent others from becoming a victim.
I read a lot on NP but clearly missed this topic

 

[CraigD]

The only things I don’t understand yet:
- why doesn’t take the buyer the opportunity to steal even more domains from me? I have messaged him (without accusing him) that he can get a very similar domain at a discount...but he’s not interested.
- why you can read several news articles if tou Google kryptoescrow.xyz. They seem serious to me.

I suspect that is some sort of scammer code - not to get greedy and get caught.
He's had you, and any further communication with you only increases his risk.

 

[S8Power]

I think you’re right.
In the meantime I’ve filed a compliant with FTC.gov as well as Namecheap. My domain is with them now and the scammy .xyz domain also. And I believe many more fraudulent .xyz domains as well as stolen names.
The ‘buyer’ has erased his conversation with me. Shortly after I had taken screenshots of it. Oh and I didn’t accuse him of anything....

I have screenshots of the scammy site too. I do not trust it to visit it anymore. One of the screenshots is this one. I would say the server is Russian...

 

[CraigD]

I think you’re right.
In the meantime I’ve filed a compliant with FTC.gov as well as Namecheap. My domain is with them now and the scammy .xyz domain also. And I believe many more fraudulent .xyz domains as well as stolen names.
The ‘buyer’ has erased his conversation with me. Shortly after I had taken screenshots of it. Oh and I didn’t accuse him of anything....

I have screenshots of the scammy site too. I do not trust it to visit it anymore. One of the screenshots is this one. I would say the server is Russian...

Mail.ru - That's like Gmail or Hotmail.
Nothing good comes from conducting business with people using these addresses, unless you have prior correspondence from them via a more sensible and traceable address.

 

[NetworkPearl]

I always faced a similar situation this week. Buyer asked to use axiocryptocoin.com for payment in btc

 

[jideofor]

It can only be Flippa... A site filled with all manner of scammers and the owners are not doing anything to stop it.