Fishy domain sale/purchase - Plse advise!

[Atco]

Dear All,

it's my first time to purchase a domain 2nd hand, and it's for $xx,xxx at the first time! Which is a lot of money for me, almost all of my savings, but this will be important for the business I'm planning to do as I lost my job recently.

Ok found a good domain for sale, agreed on the price, and we're at closing. but it's getting a bit fishy so I thought I'll post the story here for everyone to see if you guys have the same odd feelings. I've used substitute names to protect privacy, but the story applies.

So far:
- We agreed via email, sent funds $xx,xxx to escrow(dot)com
- Received confirmation that domain name valuabledomain(dot)com (I'm using a substitute name, for illustration) was pushed to my Moniker account
- Seller called to ask me to release the $xx,xxx right now, urgently, and immediately from escrow(dot)com. Which made me feel a bit uneasy, since we agreed to 5 days inspection period.

However, I discovered a few odd things:

1. In the past hour, I received three separate Moniker confirmations: one from Moniker (no order number) and two others forwarded by the Seller, which two had distinct order numbers: xxxxx49 and xxxxx22 respectively. Also the email address on the forwarded confirmation was info(at)wellnames(dot)com (this is what was used for communication) while the registrant's email is different info(at)buycoolnames(dot)com.

Does anyone know why we have two order numbers for the same transaction with Moniker? Is it allowed to use different email addresses for the order, than the registrant email?

2. It appears that the registrant name was changed from "Name Premium, BuyCooNames(dot)com" yesterday to "Ali al-Sahhah" earlier today (I'm using substitute names to illustrate the point) with the same address. Then, later in the day valuabledomain(dot)com was pushed to my Moniker account.

Do you guys think it's fine to update the registrant details twice within 3 days? Will it not impede my rights to ownership? thought there was a 60 day rule of some kind..

3. Escrow.com shows "Ajebah al-Sahhah" as seller, which is slightly confusing, as the registrant was "Name Premium, BuyCoolNames(dot)com" before - until earlier today, when the registrant name was changed to "Kamil al-Sahhah", same London address. Then, later today the domain valuabledomain(dot)com was pushed to my account.

Is there a trick here, or can the seller update the registrant on the day of the sale, and still make it valid? Can it be different for escrow(dot)com and the registry?

4. I agreed everything by email with "Ben" at info(at)wellnames(dot)com, but domain registrant is/was "Name Premium, BuyCoolNames(dot)com" with email address info(at)buycoolnames(dot)com. A third person "Ajebah al-Sahhah" shows up as seller in escrow(dot)com. On the phone, I spoke with a person called "Ali al-Sahhah" (as apprently only he speaks English) who was trying to push me to release the funds today.

Is there anyone else who finds this confusing?

5. Is there a way to check that I have ownership and "complete control" of valuabledomain(dot)com (and not only the registrant contact details were updated)?

6. Do I need to obtain a username, password, and/or an authorization code to verify that I have complete control of the domain?

7. Is there anything else I can do to verify that I have complete control of the domain, and to ensure a clean transaction, and maximise security? Would buying a MaxLock from Moniker, or sthng similar help?

The seller is trying to tell me that this is all normal, but I have my doubts. After all these, I am a bit hesitant to go ahead, and I'm considering pulling out, asking the seller to close via Moniker(dot)com's escrow service or sthng. It will mean a few hundred dollars of sunk cost (transfers, escrow, etc) but still better than making a $xx,xxx mistake.

What do you think? Or is it just me being too suspicions?

Plse advise...
Thanks!

 

[jyotsna01]

hey frnd...
i read ur post and what i personally felt is updating the registrant details twice within 3 days is unfair and doubtful on the part of moniker and can be risk at your ownership...
see you are the owner of purchased domain so why do not you ask for valid username, password or some code that will confirm and satisfe your purchase..as you have the full right to do so..
moreover i am seeing around there are many people who are having problem with sedo or moniker so do confirm your doubts by taking a username and password as soon as possible..
happy blogging..!!

 

[Havela]

What do you think? Or is it just me being too suspicions?

Plse advise...
Thanks!

Well, I don't want to be the bearer of bad tidings, but this sounds fishy to me, too. Actually, the first association I got was that the domain might be stolen. Have you checked available stolen domains records? Googled the original and new registrant? Googled the domain name to see what shows up?

I know of one stolen domains search site:

http://domaintheft.org/

but maybe the more experienced domainers may be able to tell you about others.

Also, have you tried phoning Escrow.com to ask their opinion, and if they have any experience with this seller?

Obviously, the seller had control over the domain since they were able to update the details and push it to you, but it might be stolen anyway.

The three elements that make me uneasy:

1. They are pushing you to make a quick transfer of the money, thereby bypassing your security buffer (and what was agreed).

2. Whois details did not match / were updated at the last minute.

3. A very large amount of money is involved.

I would investigate this thoroughly before I decided whether to proceed.

 

[dompro]

does TOS of Escrow.com say anything about to what extend do they guarantee the transaction? Do they virtually buy it from the seller and then you buy it from them? Will they refund the money in case of future problem with the sale?

 

[Ms Domainer]

*

I agree with Havela.

If your gut is telling you that something is wrong, chances are it is fishy.

*

 

[secretagentdad]

Back out bro.

Smells like a scam.

I vaguely remember something about escrow using who is based verification and scammers abusing that.

 

[bulkdomainz]

Do NOT release the money from ESCROW yet! If possible, let ESCROW know you are not sure about this transaction. Make sure you have the name in your possession before you release the money. He knows you agreed a 5-day inspection period and should not be in a hurry to get the money!

---------- Post added at 10:28 PM ---------- Previous post was at 10:01 PM ----------

Also speak with the Reps at Moniker, if you are not sure you have total control of the name. You should be able to change the reg/admin/tech/billing contacts, nameservers, url forwarding for the name in your admin. If you can, let ESCROW and the seller know you need further time to inspect the domain.

 

[DubDubDubDot]

I'm assuming your statement that you found a good domain for sale means that you contacted him. That in itself makes it unlikely that the domain is stolen. These cases generally involve the thief reaching out to potential victims and offering the domain at a discounted price. It is possible that you contacted him just after the domain was stolen, but the odds of that are incredibly low.

Get a DomainTools membership and take a look at the whois history. If all the info changed just recently, I'd contact the previous owner and ask about it.

I agree with the advice of contacting Escrow.com and Moniker about this. Moniker should be able to take a look at account access IP address info. If every login over the past five years has been from a certain ISP in the UK and this week there has been a change in that, it could be a red flag. They should also be able to check which other accounts (if any) the IP address used to push the domain has logged into. If the owner of your domain is supposed to be in the UK and the guy who pushed the domain to your account has logged into accounts belonging to people in the US, Canada and so on, again, another red flag. Moniker can check this if they want to (assuming they log all of this data, which they should be).