IT.COM

alert Bitcoin Escrow Scam

Spaceship Spaceship
Watch

HDmarketing

Top Member
Impact
1,097
Hello all, just to warn the community here that I've received suspicious Flippa offers recently.

I've played around one of them to learn more about the structure of the scam. Replied to the offer and took screnshots during the negociation that followed to document the process.

I had in mind that I may write a small step-by-step for all to learn how to detect scams.

Here is what happened.

1. Offer (suspicious!)

Context:
MusiqueClassique .com is listed as Make offer > $1,000 on Flippa
(means "Classical Music" in french).

I've received many lowball offers during the years so I've put a 4 figures min offer to stop these.

Here is the message I received.

upload_2020-7-28_16-58-9.png


Why is it suspicious?

  • Comes from a brand new user (Flippa account created a few days before message). 0 transactions yet.
  • "Kan JUn" seems like an Asian name, the domain is a 2 french words one MusiqueClassique .com and is quite niche. Agreed a French user could want it and create a fake account to hide his ID, but I think he would chose a French name or pseudo.
My reply "BIN is $9,995, ready to consider any 4 figure offers".


2. Negociation (very suspicious!!)


He comes back with "I'm ready to offer $5,700 but payment has to be in Bit-coin because I am from china and international payment is difficult".
  • He confirms that he is from China and interested in this french niche domain. OK, it could happen, but seriously... I love this domain because I'm a musician and I still dream of developping it into a nice website someday, but I'm not sure it's a sound investment for someone willing to pay thousands of dollars in a discreet way from China...
  • No negociation, already offering a sum > half BIN. Whereas my min offer is $1,000.
  • We will have to move out of the platform as Flippa doesn't offer BTC payment.
I'm not opposed to BTC payments, and since these are final (you can't recover a BTC payment), then there is only one way to secure payment for the buyer: go through a Bitcoin Escrow service.

(Because if the buyer sends BTC directly to the seller, once it is in the seller's wallet, nothing can force him to honour the sale and transfer the domain).

My reply "I'm happy to accept your offer as it is very reasonnable. Flippa doesn't allow BTC payment I think, what do you suggest?"

Let's see where that takes us...


3. Follow me down the rabbit hole (highly very beaucoup très suspicious!!!!)

He offers we follow up on Telegram, gives me the @Amidamary1900 contact which leads to a "Han Chao" profile. Why not!
  • Telegram means anonymous / non traceable if you take the right precautions
  • We are now "out of platform", so there no third party to turn to if anything bad happens.
Still giving this joke a chance, I decide to act as I would do in a legit transaction. Thus I suggest we go through a BTC-Escrow. There happens to be at least one registrar that can play that role: Epik. Here is my first message on Telegram:


upload_2020-7-28_17-36-25.png

If he agrees to that, then it's Christmas! I'm ready to transfer the domain and we can conclude that transaction the same day. But of course, he has his own Escrow solution in mind.

upload_2020-7-28_17-37-43.png

4. The BTC-Escrow so suspicious that it's not even fun anymore.

Now we are at the heart of the scam.

What's gonna happen is
  • I agree,
  • I create an account on the website http://cryptodaxex.xyz,
  • wait for "Kan JUn", now "Han", to send his 0,55 BTC or so (BTC on the rise today!).
  • I will soon enough receive an email stating that "the funds are secured and I can now transfer the domain safely".
  • Once the domain transfered out of my registrar I'll ask for the BTC to be transfer to my wallet. Which will never happen because... http://cryptodaxex.xyz is a scam!!

How do I know? I've done some due dilligence.

"cryptodaxex.xyz" gives only 8 or so results! Well, for an Escrow service, you need TRUST and recognition. 8 results is bad...

One of the google results leads to an article about the death of cryptodaxex 3 years ago :xf.eek::xf.eek::xf.eek:

upload_2020-7-28_17-56-51.png


Another leads to TrustedsReviews.xyz which gives a few reviews of cryptodaxex, the oldest one being 3 days old! (By "Justin Sun", which is hilarious to those knowing a bit about crypto!)​

upload_2020-7-28_17-53-45.png


Looking at the whois of cryptodaxex.xyz and TrustedsReviews.xyz is even funnier...

upload_2020-7-28_17-59-53.png



upload_2020-7-28_18-0-27.png


Both sites are only a few days old. The scammers managed to rank the review site on Google in a few days and started rolling out scam sites that have "reviews"...

With all that data, I decide to have a bit fun and ask my buyer a few questions...

upload_2020-7-28_18-4-26.png

upload_2020-7-28_18-5-10.png

upload_2020-7-28_18-5-29.png


Of course, got no replies after that.

That was fun for me, but remember that scam happens and that you need a secure payment solution... And that YOU need to make sure it is really secure!

Best of luck in this wild world...


PS. can't find the conversation in my flippa account anymore, I guess Flippa did detect and suppress the fake account.
 
Last edited:
51
•••
The views expressed on this page by users and staff are their own, not those of NamePros.
Ok. Some more info here . I can not believe I fell for this but yes I did. Unfortunately I even went one step further and lost about 400 usd in this scam . I’m writing this as a warning but also yeah... just so angry at myself for being a dumbass!! I received exactly the same info from same person as above and followed the pattern Exactly. The scammer even went as far as to set up an account With my domain name register so I could transfer the name easily. This required him to set up billing details . (Effort!!)

he set up a deal and transferred the bitcoins into my created profile on that site with the weird name above . From what I could see those funds where in there and it was a done deal.

He sent me a password after I had transferred over to unlock.. all I had to do now was to withdraw my funds . This is the part where the scam comes in and I became the idiot. Duh!

to withdraw it said you had to upload a 0.05 bitcoin amount to the wallet to verify I was real. This would unlock the wallet and I could withdraw all my funds. This came to about 400 usd. I checked the site before doing this... it had a support section, the bitcoins I could see where rising and changing with the charts of the day , the terms and conditions seemed legit and it showed the company was based in London which I checked on a map. It seemed to me this could be legit so I risked it .dumb dumb dumb.

i then tried to withdraw and it failed . I contacted support and actually got a real person who said sorry they could not help and nothing they could do and it was because I had forgotten to take into account the 1 percent commission in their terms and conditions so the bitcoin amount was wrong. The conversation went back and forwards with them getting more indignant ... I soon realised. Scam

I contacted the original buyer via telegram who got really mad , called me loads of names and asked why on earth I had cancelled the domain . ( I realised I had 5 days to cancel the transfer so I actually still got to keep my domain name )

they then blocked me and I will never hear from them ... or see my 400 dollars again.

Lesson learned .
Has he asked you to use Escrow service from www.cryptcourt.com right? I have had the same story but I rejected his suggestion to close deal via www.cryptcourt.com (Created: 2020-06-08). As my experience, I have never had any buyer who placed a high offer like that, that's why I know he is a scammer.
 
3
•••
He's using CryptoDust.us now. What a loser lol.
 
2
•••
He's using CryptoDust.us now. What a loser lol.
Nick "Jan Lean", is it right? :), he sent me "Hi again, I can offer $ 15500 on the condition that we conduct a transaction via bit-coin, the fact is that I live in China and in my country there are problems with paying abroad due to the policy in my country"

And finally he said: "only crypto escrow cryptodust. us"


 
Last edited:
2
•••
OMG “Jan Lean” (and mean)...that’s the one, with exactly the same story.
He led me to KryptoEscrow.xyz.
Can’t believe I was so stupid.
I guess I was desperate selling a name (again).
 
Last edited:
3
•••
I was approached in a similar manner about one of my listings on Flippa on/around 7/10/2020. Once they said they couldn't use DAN or Epik, that was pretty much the end of the discussion for me.

Shortly afterwards, I couldn't find the communication anywhere on Flippa either. But the email notifications pretty much tell the story. Same verbiage used as in OP's description. The username for the person in my case was "Jast Lin." After the offer was made to purchase with BTC (and I suggested DAN or Epik), this was what came next:

flippa3.png


Wasn't the first, and probably won't be the last. Steer clear of these types of "offers" at all costs.
 
Last edited:
0
•••
He's using CryptoDust.us now. What a loser lol.
Interesting, so whois info on CryptoDust (.us) --- DO NOT VISIT -- shows [email protected]

User here on NP @abyzer0001

Keeping in mind the whois info is most likely all fake information...

Whois info (partial below) shows a Japan address, so he/she managed to register it as a business organization.

"Registrant Application Purpose: P1
Registrant Nexus Category: C11"

^ P1 represents a business organization, C11 means "A natural person who is a United States Citizen."

So this person is a US citizen...? Not sure how they verify this information or how .us verifies this. If someone can clarify how this works, that would be great.

Literally, the phone number they used is McDonald's Headquarters of Japan lol - https://numberjp.com/jp-number/0369115000 (reverse phone number search for Japanese numbers)

And searching "abyzer0001" on google brings up 10 results, one of them being this pinterest page - https://www.pinterest.com/abyzer0001 (notice the username)

On that page, you will see the website fyldeweb (.com) --- DO NOT VISIT -- being promoted. Now when you search "fyldeweb.com" on google, I found a Flippa page - https://flippa.com/10438615-fyldeweb-com

User has been banned from Flippa and goes under name of "akash dayal" according to the Flippa profile. Location of Flippa user says India. He was also selling a couple of other domain names on his profile which you can see.

Lastly, TrustedsReviews (.xyz) --- DO NOT VISIT -- is 100% connected to [email protected] because on the site there is a review from a user "abyzer0001". Remember, [email protected] was used as the whois email for the CryptoDust (.us) domain --- DO NOT VISIT -- And please keep in mind, all the reviews are fake, obviously.

Y2VAMar.png


Someone else can investigate further...stay safe out there everyone.
 
4
•••
Ok. Some more info here . I can not believe I fell for this but yes I did. Unfortunately I even went one step further and lost about 400 usd in this scam . I’m writing this as a warning but also yeah... just so angry at myself for being a dumbass!! I received exactly the same info from same person as above and followed the pattern Exactly. The scammer even went as far as to set up an account With my domain name register so I could transfer the name easily. This required him to set up billing details . (Effort!!)

he set up a deal and transferred the bitcoins into my created profile on that site with the weird name above . From what I could see those funds where in there and it was a done deal.

He sent me a password after I had transferred over to unlock.. all I had to do now was to withdraw my funds . This is the part where the scam comes in and I became the idiot. Duh!

to withdraw it said you had to upload a 0.05 bitcoin amount to the wallet to verify I was real. This would unlock the wallet and I could withdraw all my funds. This came to about 400 usd. I checked the site before doing this... it had a support section, the bitcoins I could see where rising and changing with the charts of the day , the terms and conditions seemed legit and it showed the company was based in London which I checked on a map. It seemed to me this could be legit so I risked it .dumb dumb dumb.

i then tried to withdraw and it failed . I contacted support and actually got a real person who said sorry they could not help and nothing they could do and it was because I had forgotten to take into account the 1 percent commission in their terms and conditions so the bitcoin amount was wrong. The conversation went back and forwards with them getting more indignant ... I soon realised. Scam

I contacted the original buyer via telegram who got really mad , called me loads of names and asked why on earth I had cancelled the domain . ( I realised I had 5 days to cancel the transfer so I actually still got to keep my domain name )

they then blocked me and I will never hear from them ... or see my 400 dollars again.

Lesson learned .

sad story: I just lost about 3175 USD because this scam. they lead me to cryptcourt .com, and the rest story is similar to yours, the difference is I was more stupid than you were, I send 0.26 BTC(worth about 3175 USD) in total to the wallet.
I paid a lot for this lesson, damn it.

although there are many many signs that shows it might be a scam, but I'm blinded because of my greed. how stupid I was.
 
2
•••
Terrible. I am glad I did not transfer anything and just lost my 5L.com...

This topic should be in a pop-up screen when visiting Namepros😬
 
2
•••
See attachment
 

Attachments

  • 43CE3DD8-30AF-4551-BEC0-1F8302314B28.png
    43CE3DD8-30AF-4551-BEC0-1F8302314B28.png
    422.1 KB · Views: 356
2
•••
Such scams might bring doubts in minds of buyers for genuine marketplaces utilizing crypto as a payment method.
Just when crypto payments are gaining momentum,such scams hinder the growth.
 
3
•••
sad story: I just lost about 3175 USD because this scam. they lead me to cryptcourt .com, and the rest story is similar to yours, the difference is I was more stupid than you were, I send 0.26 BTC(worth about 3175 USD) in total to the wallet.
I paid a lot for this lesson, damn it.

although there are many many signs that shows it might be a scam, but I'm blinded because of my greed. how stupid I was.
I'm sorry to hear Andy. Thanks for sharing.

Would you care to share the BTC address the scammer was using? By doing this, we can link other BTC addresses the scammer is using.
 
2
•••
sad story: I just lost about 3175 USD because this scam. they lead me to cryptcourt .com, and the rest story is similar to yours, the difference is I was more stupid than you were, I send 0.26 BTC(worth about 3175 USD) in total to the wallet.
I paid a lot for this lesson, damn it.

although there are many many signs that shows it might be a scam, but I'm blinded because of my greed. how stupid I was.
I'm sorry to hear Andy. Thanks for sharing.

Would you care to share the BTC address the scammer was using? By doing this, we can link other BTC addresses the scammer is using.

yeah sure,
here are the bitcoin addresses they are using:
3NkNCnK9LY4J4yG3zgTLUpkNGZ85MkKK3q
3D4TEZYt1626v3Yotnn9Xebh9CS2RA8u5m
3KCcKxLZWT3f5JAfrM3g9RT4pbFVsyBUBn
1GjhKEreUgRkWt6wNnRPwg3LNarUWEb4vj

image: i. imgur. com/LYBrJ8i. png
 
3
•••
yeah sure,
here are the bitcoin addresses they are using:
3NkNCnK9LY4J4yG3zgTLUpkNGZ85MkKK3q
3D4TEZYt1626v3Yotnn9Xebh9CS2RA8u5m
3KCcKxLZWT3f5JAfrM3g9RT4pbFVsyBUBn
1GjhKEreUgRkWt6wNnRPwg3LNarUWEb4vj

image: i. imgur. com/LYBrJ8i. png
thank you Andy!
 
2
•••
If this abyzer0001 is a US citizen he should be worried even more. I have contacted ftc.gov (for worldwide internet scams) already and other victims should do the same. Provide them with as many information as you can!
 
2
•••
Wish I had found this thread before yesterday. Kryptoescrow.xyz, cryptcourt.com and the other one all lead to the same scam site. Pissed I usually wouldn’t fall for this kind of crap but the platform seemed legit until I read this thread. @Amidamary19 confirmed as the rope you in guy. Avoid transactions on flippa with this dude.
 
2
•••
34bL4GvR4zJhpnXApZymZYFbtjXVxrR69e
3283WEKNsrzmoPrjPmjXNY95JqrQYtt48n
3Fn3t2DD6XPEfZmAFtTKZsW6fd4R87nRS6

Here are some additional addresses used by kryptoescrow. Luckily I only lost .1 bitcoin and not more like some others who deposited twice. Still I saw a number of searches where it looked good. And when searched as an exchange has a history going back to 2015. However next time I do a sale and if it is with bitcoin it’ll be done through a more reputable service. Like others now I’m like .....how stupid could I be?
 
2
•••
I haven't read this thread, but the list of Bitcoin addresses caught my attention. Please note that most services use a fresh Bitcoin address for every transaction, so making a list is often a futile effort. There are some exceptions, such as "fake" ransomware (ransomware that is completely incapable of ever actually returning the files), but, generally, per-transaction addresses are needed for most services.
 
Last edited:
3
•••
I haven't read this thread, but the list of Bitcoin addresses caught my attention. Please note that most services use a fresh Bitcoin address for every transaction, so making a list is often a futile effort. There are some exceptions, such as "fake" ransomware (ransomware that is completely incapable of ever actually returning the files), but, generally, per-transaction addresses are needed for most services.
Correct, but you can see where they transfer the money and connect all their Bitcoin addresses together as it's a public ledger. I'm sure they use a mixer of some sort to cover their tracks but they seem to be messy since they're using "abyzer0001" on multiple scams.
 
Last edited:
2
•••
Correct, but you can see where they transfer the money and connect all their Bitcoin addresses together as it's a public ledger. I'm sure they use a mixer of some sort to cover their tracks but they seem to be messy since they're using "abyzer0001" on multiple scams.

Yep this guy isn't very smart imho.
 
0
•••
No negotiation, already offering a sum > half BIN. Whereas my min offer is $1,000.

Why on the earth any legitimate buyer would pay almost 4x the minimum offer price without negations? I would have started with $1500, and not directly jumped to $5700 unless its some super-premium domain like cake.com, coffee.com or clothing.com!!
 
1
•••
Most posts published on Flippa are scams (Especially for mobile apps - Not about domain names), you will notice that there is a pick of visitors only the first month in the stats, after that if you wait one month later and check back that same post, the monthly visitors will be zero.

Also, its quite easy to inflate real traffic to Google Analytics of any user (once you know their UA-XXXXX). So all those GA stats in domain-sales are many-a-time suspicious for "newly created" or "similar/mirror sites" or sometimes even for established sites with sudden spikes in traffic in GA, but on google/bing search there pages don't rank even in top 100 results!
 
3
•••
Yep this guy isn't very smart imho.

Also, if the stolen names all are with Namecheap (like mine) then it would be very easy for the Federal Trade Commission or similar organisation to go after his personal information. He will have to pay his registration or renewal fees from an ordinairy bank account and can’t use his stolen Bitcoins for that. Even if he would close this bankaccount right now he already has a problem.
I have said it before but victims should file a complaint with ftc.gov and be as specific as possible.
 
2
•••
Also, if the stolen names all are with Namecheap (like mine) then it would be very easy for the Federal Trade Commission or similar organisation to go after his personal information. He will have to pay his registration or renewal fees from an ordinairy bank account and can’t use his stolen Bitcoins for that. Even if he would close this bankaccount right now he already has a problem.
I have said it before but victims should file a complaint with ftc.gov and be as specific as possible.

That would be convenient! Hope!! Thanks all!
 
Last edited:
0
•••
1
•••
I lost 800$ in Cryptcourt.com while selling the iOS app

Hopefully this fraudster will be prosecuted in some way. I fell into the trap of a scammer, just like the guys on this forum section. I prepared large material with facts, because Namepros doesn't allow me to attach videos, or at least images (it says that my message include links).
 
0
•••
Back