WARNING: SEVERAL STOLEN NAMES, MUST READ!

TheLegendaryJP · Sep 12, 2016

I am back to running down thieves, never stopped but stumbled across a rather large operation a week ago and feel I need to share with the community. I am aware it may tip off the thief to a degree but unless the names are made public he is and will continue to sell them. He likes contacting domainers privately and using 4.CN. He also uses several rars and sometimes transfers ownership 1-2 times to make separation.

Back round: About 1+ weeks ago I was informed of a stolen 4 letter dot com (remain anon for now).

I was asked for my help in recovery of said name and have done so, in fact any day now it will be recovered. I have many people at RAR's to thank and will once back to rightful owners account.

As par the course when you discover 1 you unearth many more and this case is no different.

Most all these names were stolen in 2015 and up until recently (most seem to be from web.com rars/register.com/netsol but not always). I reverse searched the thief and discovered in 2015 he went from owning a dozen or so "garbage" names to suddenly trading in 3L dot com 4L dot com 4-5N dot com etc. Rather a huge upswing set off red flags. I placed several calls to their former owners and confirmed many are stolen. I also discovered a few are legit buys from drops and other places, likely with funds made from selling the stolen names. My advice at this point avoid buying anything from this person it is just too risky and they are a confirmed thief. It was also interesting to tie them to the theft of Ammar.com, google that story, name was recovered. I also noticed this thief was a member of Namepros until banned but no reason I can see was given.

If you have a good contact for 4.CN please notify them of these thefts and the names being listed on their site! Hopefully they will remove them and ban his account.

Names confirmed stolen are as follows, names I cannot confirm yet have a (?) beside them, waiting to be contacted.

1371.com STOLEN spoke to victim
XXXX.com STOLEN working to recover will unveil name once complete
VXL.com STOLEN?
AMMAR.com STOLEN and recovered
09931.com STOLEN?
ETTI.com STOLEN?
ETST.com STOLEN?
PJDO.com Apparent buy off drop
MMAZ.com STOLEN?
7576.com STOLEN? Hope not because it appears thief already resold
ESVV.com STOLEN?
39339.com STOLEN?
2517.com STOLEN?
LFQH.com STOLEN Spoke with victim
PZYA.com STOLEN?
RQEI.com STOLEN?
ZAWA.com STOLEN?
QURO.com STOLEN

Thieves info is as follows, he went from showing info to using privacy but the link to him is undeniable. He also seems to like to scatter where he transfers them too as well.

Registrant Name: STANISLAV KHRAMOV
Registrant Organization:
Registrant Street: METALLURGOV 7-7
Registrant City: MAGNITOGORSK
Registrant State/Province: CHE
Registrant Postal Code: 455023
Registrant Country: RU
Registrant Phone: +7.9124020000
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]

Ammar.com which was I believe one of if not the first name he stole, notice the email contact, same guy as above but he changed that email out on his later thefts since that cover was blown. I believe he brute force the registrants password and switched out email to complete the theft.

Registrant Name: Mohammed Ali
Registrant Organization: Mohammed Ali
Registrant Street: Villa 24, Block 4, Al-Mutawakel Street
Registrant City: Kuwait City
Registrant State/Province: Da-aiyah
Registrant Postal Code: 13113
Registrant Country: KW
Registrant Phone: +965.22563033
Registrant Fax: +965.22563033
Registrant Email: [email protected]

Here was his namepros.com account I believe....God only knows if Poob.com was clean?
https://www.namepros.com/threads/poob-com.846270/

If you have any info on this guy please share.

UPDATE TO COME!

LucidDomains · Sep 17, 2016

TheLegendaryJP said:
I am back to running down thieves, never stopped but stumbled across a rather large operation a week ago and feel I need to share with the community. I am aware it may tip off the thief to a degree but unless the names are made public he is and will continue to sell them. He likes contacting domainers privately and using 4.CN. He also uses several rars and sometimes transfers ownership 1-2 times to make separation.

Back round: About 1+ weeks ago I was informed of a stolen 4 letter dot com (remain anon for now).

I was asked for my help in recovery of said name and have done so, in fact any day now it will be recovered. I have many people at RAR's to thank and will once back to rightful owners account.

As par the course when you discover 1 you unearth many more and this case is no different.

Most all these names were stolen in 2015 and up until recently (most seem to be from web.com rars/register.com/netsol but not always). I reverse searched the thief and discovered in 2015 he went from owning a dozen or so "garbage" names to suddenly trading in 3L dot com 4L dot com 4-5N dot com etc. Rather a huge upswing set off red flags. I placed several calls to their former owners and confirmed many are stolen. I also discovered a few are legit buys from drops and other places, likely with funds made from selling the stolen names. My advice at this point avoid buying anything from this person it is just too risky and they are a confirmed thief. It was also interesting to tie them to the theft of Ammar.com, google that story, name was recovered. I also noticed this thief was a member of Namepros until banned but no reason I can see was given.

If you have a good contact for 4.CN please notify them of these thefts and the names being listed on their site! Hopefully they will remove them and ban his account.

Names confirmed stolen are as follows, names I cannot confirm yet have a (?) beside them, waiting to be contacted.

1371.com STOLEN spoke to victim
XXXX.com STOLEN working to recover will unveil name once complete
VXL.com STOLEN?
AMMAR.com STOLEN and recovered
09931.com STOLEN?
ETTI.com STOLEN?
ETST.com STOLEN?
PJDO.com Apparent buy off drop
MMAZ.com STOLEN?
7576.com STOLEN? Hope not because it appears thief already resold
ESVV.com STOLEN?
39339.com STOLEN?
2517.com STOLEN?
LFQH.com STOLEN Spoke with victim
PZYA.com STOLEN?
RQEI.com STOLEN?
ZAWA.com STOLEN?
QURO.com STOLEN?

Thieves info is as follows, he went from showing info to using privacy but the link to him is undeniable. He also seems to like to scatter where he transfers them too as well.

Registrant Name: STANISLAV KHRAMOV
Registrant Organization:
Registrant Street: METALLURGOV 7-7
Registrant City: MAGNITOGORSK
Registrant State/Province: CHE
Registrant Postal Code: 455023
Registrant Country: RU
Registrant Phone: +7.9124020000
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]

Ammar.com which was I believe one of if not the first name he stole, notice the email contact, same guy as above but he changed that email out on his later thefts since that cover was blown. I believe he brute force the registrants password and switched out email to complete the theft.

Registrant Name: Mohammed Ali
Registrant Organization: Mohammed Ali
Registrant Street: Villa 24, Block 4, Al-Mutawakel Street
Registrant City: Kuwait City
Registrant State/Province: Da-aiyah
Registrant Postal Code: 13113
Registrant Country: KW
Registrant Phone: +965.22563033
Registrant Fax: +965.22563033
Registrant Email: [email protected]

Here was his namepros.com account I believe....God only knows if Poob.com was clean?
https://www.namepros.com/threads/poob-com.846270/

If you have any info on this guy please share.

UPDATE TO COME!

Slightly confused here, have your domains been stolen or is this pure just speculation?

Can you clearly stick to the facts please. Which domains do you know is 100% stolen and you have proof to back it up.

Cheers.

TheLegendaryJP · Sep 17, 2016

@Khramov7, so you want us all to believe you too are a victim and for over 1 1/2 years have bought a steady stream of 20+ stolen domains from another party with little to no proof of purchase?

You also claim you will return the domains to each party who can prove they are stolen, how nice of you, will you continue to move the names to several different registrars and use private whois while they prove their ownership as well?

"You say that you know the IP address, and they are the same? We first prove that it is my IP address and what I went and stole these domains!"

We have, you call us idiots but you are the idiot who did not fake IP location each time and registrars can easily match log in and talk to each other!...That is why you will lose another domain shortly. You do not even deny the same IP was used in your reply, brilliant!

GAME OVER, YOU ARE EXPOSED!

There is no registrar you can move them too where they will not be recovered, authorities have been contacted, Tax office where you live and your sales points will be cut off further.

You are a thief there is no doubt. The only hope for you is to return the names to where you stole them, if you want help with that I would glad do so.

TheLegendaryJP · Sep 17, 2016

LucidDomains said:
Slightly confused here, have your domains been stolen or is this pure just speculation?

Can you clearly stick to the facts please. Which domains do you know is 100% stolen and you have proof to back it up.

Cheers.

Stop buying from him, do not defend him and assume anything this guy touches is or may be stolen. Anyone who defends this thief or continues to buy from him is frankly no better.

Does he own a handful he bought on drops, sure but we also assume he purchased those with stolen funds so he is dirty all round.

And yes we have proven more to be stolen but out of respect for victims wishes keep it private while they fight. In just the last 2 days I could add 5 more names to that list.

LucidDomains · Sep 17, 2016

I ain't defending anyone, just calling it as I see it. This thread looks more like a personal vendetta than a sincere claim of stolen domains. I haven't understood one point, out of the 20-30 domains you posted, which one(s) have you actually lost yourself? Can we get any owners of any stolen domains to come forward at all to verify your claims.

TheLegendaryJP · Sep 17, 2016

LucidDomains said:
I ain't defending anyone, just calling it as I see it. This thread looks more like a personal vendetta than a sincere claim of stolen domains. I haven't understood one point, out of the 20-30 domains you posted, which one(s) have you actually lost yourself? Can we get any owners of any stolen domains to come forward at all to verify your claims.

Have you bought names from him?

LucidDomains · Sep 17, 2016

TheLegendaryJP said:
Have you bought names from him?

Nope, I'm just someone who likes to go on facts over hearsay or speculation. Am I wrong to do so?

TheLegendaryJP · Sep 17, 2016

LucidDomains said:
Nope, I'm just someone who likes to go on facts over hearsay or speculation. Am I wrong to do so?

Facts, you want facts, perhaps I should not respect the wishes of the victims?

Perhaps the names that have already been confirmed stolen which he holds and the one's he has lost back are not proof enough. I talked to many victims already.

I can assure you he steals domains, I am dealing with people now, their names will not be mentioned further.

Have a good day.

domainer51 · Sep 17, 2016

I had also hijacked my domain. There are real options how to return? GoDaddy (registrar) says: "Took much time gone, - more than 2-3 weeks".

TheLegendaryJP · Sep 17, 2016

domainer51 said:
I had also hijacked my domain. There are real options how to return? GoDaddy (registrar) says: "Took much time gone, - more than 2-3 weeks".

I know it can be frustrating but 2-3 weeks is not too much time, you have a PM coming.

LucidDomains · Sep 17, 2016

I have never heard of a domain theft 'victim' not to come forward and warn others themselves. Sounds like a witch hunt to me.

Good luck with your endeavours.

domainer51 · Sep 17, 2016

Maybe, but that domain has been transferred to another registrar (Ename), which does not respond to questions.

TheLegendaryJP · Sep 17, 2016

domainer51 said:
Maybe, but that domain has been transferred to another registrar (Ename), which does not respond to questions.

I have a good contact at enames Chinese rar's are mostly not an issue. I helped recover a stolen LLL.com just a few months ago from ename.

@LucidDomains there is another victim who posted just below you at this point you are trolling.

TheLegendaryJP · Sep 17, 2016

UPDATE ON FURTHER NAME

HAAT.com

https://domenforum/showthread.php?t=205158

I have been contacted by many members of the Russian Domain forums and HAAT.com has been brought to my attention. I have calls into the rightful owner, waiting on confirmation.

I am not sure if it is tied to our thief here a partner or different guy (they now both use reg.ru) but warning non the less do NOT buy HAAT.com atm. Also stolen from a Web.com registrar Netsol.

I searched and current whois shows a known thief as the owner!

See this link below, same thief of this name is asking just $1k for HAAT.com far below market value.

http://domaingang.com/domain-crime/domain-crime-omed-com-is-a-stolen-domain-name/

Look at whois in above link now look at whois name for HAAT.com below....

Domain Name: HAAT.COM
Registrar: REGISTRAR OF DOMAIN NAMES REG.RU LLC
Sponsoring Registrar IANA ID: 1606
Whois Server: whois.reg.com
Referral URL: http://www.reg.ru
Name Server: NS1.SEDOPARKING.COM
Name Server: NS2.SEDOPARKING.COM
Status: ok https://icann.org/epp#ok
Updated Date: 16-sep-2016
Creation Date: 02-nov-1997
Expiration Date: 01-nov-2018
>>> Last update of whois database: Sat, 17 Sep 2016 14:01:03 GMT <<<
Domain name: haat.com
Domain idn name: haat.com
Status: ok http://www.icann.org/epp#ok
Registry Domain ID:
Registrar WHOIS Server: whois.reg.com
Registrar URL: https://www.reg.com/
Registrar URL: https://www.reg.ru/
Registrar URL: https://www.reg.ua/
Updated Date:
Creation Date: 1997-11-02T00:00:00Z
Registrar Registration Expiration Date: 2018-11-01
Registrar: Registrar of domain names REG.RU LLC
Registrar IANA ID: 1606
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +7.4955801111
Registry Registrant ID:
Registrant Name: Anton Murzin <-------------------------------
Registrant Organization: Private Person
Registrant Street: Mochalina str, 8-6
Registrant City: Pervomaysk
Registrant State/Province: Nizhegorodskaya
Registrant Postal Code: 220000
Registrant Country: RU
Registrant Phone: +79111234567
Registrant Phone Ext:
Registrant Fax: +79111234567
Registrant Fax Ext:
Registrant Email: [email protected]
Registry Admin ID:

TheLegendaryJP · Sep 17, 2016

Ok @Khramov7 you said this on the Russian forum ...

"Могу сказать так, что если меня потянут за язык, то плохо будет очень многим, потому что я много знаю, но в отличии от наших желто-голубых "друзей" я сижу и помалкиваю, потому что есть понятия у меня свои. А касательно нападок на меня с NP да пожалуйста, пусть сначала приведут реальные доказательства что во первых домены украдены, во вторых что их украл я, а в третьих то что я вообще как то замешан в этом. Да не отрицаю, я купил эти домены. Об их происхождении я не знал, ни одного абуза или претензий со стороны бывших владельцев или регистраторов за почти год не было. И да, за каждый домен я могу ответить."

Which roughly translates to ....

"I can say so, if I pull the tongue, the bad will be very much, because I know a lot, but in contrast to our yellow-blue "friends" I sit and keep quiet, because there is a concept of my own. And regarding the attacks on me with NP yes please, let the first real evidence that will lead stolen during the first domain, and secondly that I stole them, and thirdly what I do as that involved in it. Do not deny it, I bought these domains. Their origins I did not know any abuzy or claims by former owners or recorders were not for almost a year. And yes, for each domain, I can answer."

Here is your chance to prove you purchased the domains mentioned, not the ones you bought off drops or legit from other domainers but names like...and please no photoshop we can detect that crap. I want real evidence via payments that can be confirmed. Also name the source you claim to be buying all these 20+ stolen names from, details.

Lets start with just 3

1371.com (also your email screen shot is only proof you complained when the name was locked after the real owner complained it was stolen and didn't get the help he deserved. It is not evidence it wasn't stolen.)
LFQH.com
7576.com

LucidDomains · Sep 17, 2016

domainer51 said:
Maybe, but that domain has been transferred to another registrar (Ename), which does not respond to questions.

TheLegendaryJP said:
I have a good contact at enames Chinese rar's are mostly not an issue. I helped recover a stolen LLL.com just a few months ago from ename.

@LucidDomains there is another victim who posted just below you at this point you are trolling.

@domainer51, can you confirm that your domain was stolen by the same guy @TheLegendaryJP is talking about?

@TheLegendaryJP, I'm not trolling, I'm just fully aware that you have made a lot of accusations publically without providing any evidence publically.

This guy might be a thief, I'm not denying that, but I never take shit at face value. Just because a person on the forum said something, doesn't mean I believe it.

Good luck with your detective work.

TheLegendaryJP · Sep 17, 2016

LucidDomains said:
@domainer51, can you confirm that your domain was stolen by the same guy @TheLegendaryJP is talking about?

@TheLegendaryJP, I'm not trolling, I'm just fully aware that you have made a lot of accusations publically without providing any evidence publically.

This guy might be a thief, I'm not denying that, but I never take sh*t at face value. Just because a person on the forum said something, doesn't mean I believe it.

Good luck with your detective work.

Understood but you will learn that when this person (me) says something, it's true. You don't have to believe it, seeing is believing so google me. I have helped recover more quality names then most people will ever own, never wrong about a thief, never. I do many days of research and when there is no doubt I post it. I have helped and continue to help multiple people over this mass theft, they are not all lying about having their name stolen. It isn't some mass conspiracy against Khramov its a pattern a pattern of theft. There is no way one person over 1 1/2+ years buys dozens of stolen names from dozens of different people who live in different countries and use differing registrars. Either Khramov defies the laws of math and luck or he is the thief. I didn't even have to use that to conclude things, the victims tell me over the phone quite clearly their struggle.

LucidDomains · Sep 17, 2016

TheLegendaryJP said:
Understood but you will learn that when this person (me) says something, it's true. You don;t have to believe it, seeing is believing so google me.

No offence but I'm not going to Google you. I don't care if you're the owner of Google or a homeless man, I will treat you the same way. If you throw accusations on the net publically, I will ask the same questions I have done here regardless of who you are.

TheLegendaryJP · Sep 17, 2016

LucidDomains said:
No offence but I'm not going to Google you. I don't care if you're the owner of Google or a homeless man, I will treat you the same way. If you throw accusations on the net publically, I will ask the same questions I have done here regardless of who you are.

That is your choice not to see who a source is goodbye and when one day you need help don't ask me because who am I, maybe just a homeless guy or owner of google and cannot be trusted lol

LucidDomains · Sep 17, 2016

TheLegendaryJP said:
That is your choice not to see who a source is goodbye and when one day you need help don't ask me because who am I, maybe just a homeless guy or owner of google and cannot be trusted lol

If you want to let your ego dictate your actions, that's totally up to you.

Good luck.

Addison · Sep 17, 2016

@LucidDomains,

If you had done your own research from the information that has been provided in this thread, you wouldn't be questioning it. It's very obvious that Khramov Stanislav is a crook. Do the research, make a few phone calls, and send a few emails. This is not difficult to confirm.

There is a big difference between a healthy skepticism of posts on a forum vs. ignoring everything that has been posted and requesting more proof unnecessarily. You are ignorantly providing credence to this criminal and doubt about the information that has been provided, which can all be easily verified if you took the time to do any research yourself. Will I tell you how to do that research? No. Why? Because then I'd be telling the thief himself how to hide his tracks.

Please research before posting, or just stay out of it if you are too lazy to do the necessary research. Your idleness is causing harm.

LucidDomains · Sep 17, 2016

If domains are stolen, I do wish for a speedy resolution. If @TheLegendaryJP is as helpful to the domaining community as he says he is, then he's an asset. I will be monitoring this thread for further information and hopefully if Khramov Stanislav is confirmed to be a thief, we taken him down and recover all that's been lost.

Good luck.

domainer51 · Sep 17, 2016

LucidDomains said:
@domainer51, can you confirm that your domain was stolen by the same guy @TheLegendaryJP is talking about?

Oy, no this guy. I just wonder what to do in case of stolen.

LucidDomains · Sep 17, 2016

domainer51 said:
...I just wonder what to do in case of stolen.

Contact your registrar immediately.
Change your passwords on your registrar and email accounts.
Ensure 2FA is added everywhere.
Create a post on NamePros informing others that your domain has been stolen.
Provide evidence to relevant parties to confirm you had ownership.
Ensure you move your domains to reputable registrars.
If the domain is worth a lot, you might want to seek legal advice from a domain lawyer, some offer free initial consultations.

Peter · Sep 18, 2016

Thats quite common Stimpi, people tend to list their domains but forget to delist them on all services when they sell the domain.

Kenny · Sep 18, 2016

Peter said:
Thats quite common Stimpi, people tend to list their domains but forget to delist them on all services when they sell the domain.

Hey Peter

This happens a lot. Getting an offer on a domain you sold even years ago is one example.

Peace,
Cyberian

WARNING: SEVERAL STOLEN NAMES, MUST READ!

VIP Member

LucidDomains.comTop Member

VIP Member

VIP Member

LucidDomains.comTop Member

VIP Member

LucidDomains.comTop Member

VIP Member

Account Closed

VIP Member

LucidDomains.comTop Member

Account Closed

VIP Member

VIP Member

VIP Member

LucidDomains.comTop Member

VIP Member

LucidDomains.comTop Member

VIP Member

LucidDomains.comTop Member

Top Member

LucidDomains.comTop Member

Account Closed

LucidDomains.comTop Member

VIP Member

Top Member

Similar threads

We're social

Pinned

Appreciation

Agreement