alert Bitcoin Escrow Scam

[HDmarketing]

Hello all, just to warn the community here that I've received suspicious Flippa offers recently.

I've played around one of them to learn more about the structure of the scam. Replied to the offer and took screnshots during the negociation that followed to document the process.

I had in mind that I may write a small step-by-step for all to learn how to detect scams.

Here is what happened.

1. Offer (suspicious!)

Context:
MusiqueClassique .com is listed as Make offer > $1,000 on Flippa
(means "Classical Music" in french).

I've received many lowball offers during the years so I've put a 4 figures min offer to stop these.

Here is the message I received.

​

Why is it suspicious?

• Comes from a brand new user (Flippa account created a few days before message). 0 transactions yet.
• "Kan JUn" seems like an Asian name, the domain is a 2 french words one MusiqueClassique .com and is quite niche. Agreed a French user could want it and create a fake account to hide his ID, but I think he would chose a French name or pseudo.

My reply "BIN is $9,995, ready to consider any 4 figure offers".


2. Negociation (very suspicious!!)

He comes back with "I'm ready to offer $5,700 but payment has to be in Bit-coin because I am from china and international payment is difficult".

• He confirms that he is from China and interested in this french niche domain. OK, it could happen, but seriously... I love this domain because I'm a musician and I still dream of developping it into a nice website someday, but I'm not sure it's a sound investment for someone willing to pay thousands of dollars in a discreet way from China...
• No negociation, already offering a sum > half BIN. Whereas my min offer is $1,000.
• We will have to move out of the platform as Flippa doesn't offer BTC payment.

I'm not opposed to BTC payments, and since these are final (you can't recover a BTC payment), then there is only one way to secure payment for the buyer: go through a Bitcoin Escrow service.

(Because if the buyer sends BTC directly to the seller, once it is in the seller's wallet, nothing can force him to honour the sale and transfer the domain).

My reply "I'm happy to accept your offer as it is very reasonnable. Flippa doesn't allow BTC payment I think, what do you suggest?"

Let's see where that takes us...


3. Follow me down the rabbit hole (highly very beaucoup très suspicious!!!!)

He offers we follow up on Telegram, gives me the @Amidamary1900 contact which leads to a "Han Chao" profile. Why not!

• Telegram means anonymous / non traceable if you take the right precautions
• We are now "out of platform", so there no third party to turn to if anything bad happens.

Still giving this joke a chance, I decide to act as I would do in a legit transaction. Thus I suggest we go through a BTC-Escrow. There happens to be at least one registrar that can play that role: Epik. Here is my first message on Telegram:

​

If he agrees to that, then it's Christmas! I'm ready to transfer the domain and we can conclude that transaction the same day. But of course, he has his own Escrow solution in mind.

​

4. The BTC-Escrow so suspicious that it's not even fun anymore.

Now we are at the heart of the scam.

What's gonna happen is

• I agree,
• I create an account on the website http://cryptodaxex.xyz,
• wait for "Kan JUn", now "Han", to send his 0,55 BTC or so (BTC on the rise today!).
• I will soon enough receive an email stating that "the funds are secured and I can now transfer the domain safely".
• Once the domain transfered out of my registrar I'll ask for the BTC to be transfer to my wallet. Which will never happen because... http://cryptodaxex.xyz is a scam!!

How do I know? I've done some due dilligence.

"cryptodaxex.xyz" gives only 8 or so results! Well, for an Escrow service, you need TRUST and recognition. 8 results is bad...

One of the google results leads to an article about the death of cryptodaxex 3 years ago

​

Another leads to TrustedsReviews.xyz which gives a few reviews of cryptodaxex, the oldest one being 3 days old! (By "Justin Sun", which is hilarious to those knowing a bit about crypto!)​

​

Looking at the whois of cryptodaxex.xyz and TrustedsReviews.xyz is even funnier...

Both sites are only a few days old. The scammers managed to rank the review site on Google in a few days and started rolling out scam sites that have "reviews"...

With all that data, I decide to have a bit fun and ask my buyer a few questions...

​

Of course, got no replies after that.

That was fun for me, but remember that scam happens and that you need a secure payment solution... And that YOU need to make sure it is really secure!

Best of luck in this wild world...


PS. can't find the conversation in my flippa account anymore, I guess Flippa did detect and suppress the fake account.

 

[CraigD]

The only things I don’t understand yet:
- why doesn’t take the buyer the opportunity to steal even more domains from me? I have messaged him (without accusing him) that he can get a very similar domain at a discount...but he’s not interested.
- why you can read several news articles if tou Google kryptoescrow.xyz. They seem serious to me.

I suspect that is some sort of scammer code - not to get greedy and get caught.
He's had you, and any further communication with you only increases his risk.

 

[S8Power]

I think you’re right.
In the meantime I’ve filed a compliant with FTC.gov as well as Namecheap. My domain is with them now and the scammy .xyz domain also. And I believe many more fraudulent .xyz domains as well as stolen names.
The ‘buyer’ has erased his conversation with me. Shortly after I had taken screenshots of it. Oh and I didn’t accuse him of anything....

I have screenshots of the scammy site too. I do not trust it to visit it anymore. One of the screenshots is this one. I would say the server is Russian...

 

[CraigD]

I think you’re right.
In the meantime I’ve filed a compliant with FTC.gov as well as Namecheap. My domain is with them now and the scammy .xyz domain also. And I believe many more fraudulent .xyz domains as well as stolen names.
The ‘buyer’ has erased his conversation with me. Shortly after I had taken screenshots of it. Oh and I didn’t accuse him of anything....

I have screenshots of the scammy site too. I do not trust it to visit it anymore. One of the screenshots is this one. I would say the server is Russian...

Mail.ru - That's like Gmail or Hotmail.
Nothing good comes from conducting business with people using these addresses, unless you have prior correspondence from them via a more sensible and traceable address.

 

[NetworkPearl]

I always faced a similar situation this week. Buyer asked to use axiocryptocoin.com for payment in btc

 

[jideofor]

It can only be Flippa... A site filled with all manner of scammers and the owners are not doing anything to stop it.

 

[Sinh]

Ok. Some more info here . I can not believe I fell for this but yes I did. Unfortunately I even went one step further and lost about 400 usd in this scam . I’m writing this as a warning but also yeah... just so angry at myself for being a dumbass!! I received exactly the same info from same person as above and followed the pattern Exactly. The scammer even went as far as to set up an account With my domain name register so I could transfer the name easily. This required him to set up billing details . (Effort!!)

he set up a deal and transferred the bitcoins into my created profile on that site with the weird name above . From what I could see those funds where in there and it was a done deal.

He sent me a password after I had transferred over to unlock.. all I had to do now was to withdraw my funds . This is the part where the scam comes in and I became the idiot. Duh!

to withdraw it said you had to upload a 0.05 bitcoin amount to the wallet to verify I was real. This would unlock the wallet and I could withdraw all my funds. This came to about 400 usd. I checked the site before doing this... it had a support section, the bitcoins I could see where rising and changing with the charts of the day , the terms and conditions seemed legit and it showed the company was based in London which I checked on a map. It seemed to me this could be legit so I risked it .dumb dumb dumb.

i then tried to withdraw and it failed . I contacted support and actually got a real person who said sorry they could not help and nothing they could do and it was because I had forgotten to take into account the 1 percent commission in their terms and conditions so the bitcoin amount was wrong. The conversation went back and forwards with them getting more indignant ... I soon realised. Scam

I contacted the original buyer via telegram who got really mad , called me loads of names and asked why on earth I had cancelled the domain . ( I realised I had 5 days to cancel the transfer so I actually still got to keep my domain name )

they then blocked me and I will never hear from them ... or see my 400 dollars again.

Lesson learned .

Has he asked you to use Escrow service from www.cryptcourt.com right? I have had the same story but I rejected his suggestion to close deal via www.cryptcourt.com (Created: 2020-06-08). As my experience, I have never had any buyer who placed a high offer like that, that's why I know he is a scammer.

 

[slader23]

He's using CryptoDust.us now. What a loser lol.

 

[Sinh]

He's using CryptoDust.us now. What a loser lol.

Nick "Jan Lean", is it right? , he sent me "Hi again, I can offer $ 15500 on the condition that we conduct a transaction via bit-coin, the fact is that I live in China and in my country there are problems with paying abroad due to the policy in my country"

And finally he said: "only crypto escrow cryptodust. us"

 

[S8Power]

OMG “Jan Lean” (and mean)...that’s the one, with exactly the same story.
He led me to KryptoEscrow.xyz.
Can’t believe I was so stupid.
I guess I was desperate selling a name (again).

 

[Bertrell]

I was approached in a similar manner about one of my listings on Flippa on/around 7/10/2020. Once they said they couldn't use DAN or Epik, that was pretty much the end of the discussion for me.

Shortly afterwards, I couldn't find the communication anywhere on Flippa either. But the email notifications pretty much tell the story. Same verbiage used as in OP's description. The username for the person in my case was "Jast Lin." After the offer was made to purchase with BTC (and I suggested DAN or Epik), this was what came next:

Wasn't the first, and probably won't be the last. Steer clear of these types of "offers" at all costs.

 

[mdrn]

He's using CryptoDust.us now. What a loser lol.

Interesting, so whois info on CryptoDust (.us) --- DO NOT VISIT -- shows [email protected]

User here on NP @abyzer0001

Keeping in mind the whois info is most likely all fake information...

Whois info (partial below) shows a Japan address, so he/she managed to register it as a business organization.

"Registrant Application Purpose: P1
Registrant Nexus Category: C11"

^ P1 represents a business organization, C11 means "A natural person who is a United States Citizen."

So this person is a US citizen...? Not sure how they verify this information or how .us verifies this. If someone can clarify how this works, that would be great.

Literally, the phone number they used is McDonald's Headquarters of Japan lol - https://numberjp.com/jp-number/0369115000 (reverse phone number search for Japanese numbers)

And searching "abyzer0001" on google brings up 10 results, one of them being this pinterest page - https://www.pinterest.com/abyzer0001 (notice the username)

On that page, you will see the website fyldeweb (.com) --- DO NOT VISIT -- being promoted. Now when you search "fyldeweb.com" on google, I found a Flippa page - https://flippa.com/10438615-fyldeweb-com

User has been banned from Flippa and goes under name of "akash dayal" according to the Flippa profile. Location of Flippa user says India. He was also selling a couple of other domain names on his profile which you can see.

Lastly, TrustedsReviews (.xyz) --- DO NOT VISIT -- is 100% connected to [email protected] because on the site there is a review from a user "abyzer0001". Remember, [email protected] was used as the whois email for the CryptoDust (.us) domain --- DO NOT VISIT -- And please keep in mind, all the reviews are fake, obviously.

Someone else can investigate further...stay safe out there everyone.

 

[Andy C]

Ok. Some more info here . I can not believe I fell for this but yes I did. Unfortunately I even went one step further and lost about 400 usd in this scam . I’m writing this as a warning but also yeah... just so angry at myself for being a dumbass!! I received exactly the same info from same person as above and followed the pattern Exactly. The scammer even went as far as to set up an account With my domain name register so I could transfer the name easily. This required him to set up billing details . (Effort!!)

he set up a deal and transferred the bitcoins into my created profile on that site with the weird name above . From what I could see those funds where in there and it was a done deal.

He sent me a password after I had transferred over to unlock.. all I had to do now was to withdraw my funds . This is the part where the scam comes in and I became the idiot. Duh!

to withdraw it said you had to upload a 0.05 bitcoin amount to the wallet to verify I was real. This would unlock the wallet and I could withdraw all my funds. This came to about 400 usd. I checked the site before doing this... it had a support section, the bitcoins I could see where rising and changing with the charts of the day , the terms and conditions seemed legit and it showed the company was based in London which I checked on a map. It seemed to me this could be legit so I risked it .dumb dumb dumb.

i then tried to withdraw and it failed . I contacted support and actually got a real person who said sorry they could not help and nothing they could do and it was because I had forgotten to take into account the 1 percent commission in their terms and conditions so the bitcoin amount was wrong. The conversation went back and forwards with them getting more indignant ... I soon realised. Scam

I contacted the original buyer via telegram who got really mad , called me loads of names and asked why on earth I had cancelled the domain . ( I realised I had 5 days to cancel the transfer so I actually still got to keep my domain name )

they then blocked me and I will never hear from them ... or see my 400 dollars again.

Lesson learned .

sad story: I just lost about 3175 USD because this scam. they lead me to cryptcourt .com, and the rest story is similar to yours, the difference is I was more stupid than you were, I send 0.26 BTC(worth about 3175 USD) in total to the wallet.
I paid a lot for this lesson, damn it.

although there are many many signs that shows it might be a scam, but I'm blinded because of my greed. how stupid I was.

 

[S8Power]

Terrible. I am glad I did not transfer anything and just lost my 5L.com...

This topic should be in a pop-up screen when visiting Namepros

 

[S8Power]

See attachment

 

[Domain_savvy]

Such scams might bring doubts in minds of buyers for genuine marketplaces utilizing crypto as a payment method.
Just when crypto payments are gaining momentum,such scams hinder the growth.

 

[mdrn]

sad story: I just lost about 3175 USD because this scam. they lead me to cryptcourt .com, and the rest story is similar to yours, the difference is I was more stupid than you were, I send 0.26 BTC(worth about 3175 USD) in total to the wallet.
I paid a lot for this lesson, damn it.

although there are many many signs that shows it might be a scam, but I'm blinded because of my greed. how stupid I was.

I'm sorry to hear Andy. Thanks for sharing.

Would you care to share the BTC address the scammer was using? By doing this, we can link other BTC addresses the scammer is using.

 

[Andy C]

sad story: I just lost about 3175 USD because this scam. they lead me to cryptcourt .com, and the rest story is similar to yours, the difference is I was more stupid than you were, I send 0.26 BTC(worth about 3175 USD) in total to the wallet.
I paid a lot for this lesson, damn it.

although there are many many signs that shows it might be a scam, but I'm blinded because of my greed. how stupid I was.

I'm sorry to hear Andy. Thanks for sharing.

Would you care to share the BTC address the scammer was using? By doing this, we can link other BTC addresses the scammer is using.

yeah sure,
here are the bitcoin addresses they are using:
3NkNCnK9LY4J4yG3zgTLUpkNGZ85MkKK3q
3D4TEZYt1626v3Yotnn9Xebh9CS2RA8u5m
3KCcKxLZWT3f5JAfrM3g9RT4pbFVsyBUBn
1GjhKEreUgRkWt6wNnRPwg3LNarUWEb4vj

image: i. imgur. com/LYBrJ8i. png

 

[mdrn]

yeah sure,
here are the bitcoin addresses they are using:
3NkNCnK9LY4J4yG3zgTLUpkNGZ85MkKK3q
3D4TEZYt1626v3Yotnn9Xebh9CS2RA8u5m
3KCcKxLZWT3f5JAfrM3g9RT4pbFVsyBUBn
1GjhKEreUgRkWt6wNnRPwg3LNarUWEb4vj

image: i. imgur. com/LYBrJ8i. png

thank you Andy!

 

[S8Power]

If this abyzer0001 is a US citizen he should be worried even more. I have contacted ftc.gov (for worldwide internet scams) already and other victims should do the same. Provide them with as many information as you can!

 

[Snowmansk8]

Wish I had found this thread before yesterday. Kryptoescrow.xyz, cryptcourt.com and the other one all lead to the same scam site. Pissed I usually wouldn’t fall for this kind of crap but the platform seemed legit until I read this thread. @Amidamary19 confirmed as the rope you in guy. Avoid transactions on flippa with this dude.