information New type of Scam

[johnn]

I received an email from https://groupoormasan.com/ saying they have customers who will buy my 2 LLL.us at $1,000,000 each. They said before they can procees with the payment I have to pay them $1,750 for each name for the legal fees before I can get pay.
They did not know that I am old and don't get into these types of trap.

Here is her picture and the email:
In N
Hi,

Thanks for your response and sorry for the late reply.
Moving forward, We will definitely need a contract for the domain transaction. The intent use, payment terms and Escrow etc.. Possible shares in the lll.us and lll.us intended company. All these required a contract with a reputable lawyer.

Also, my terms include,

Buyer's Obligation
1. Buyer must pay 100% Escrow fees alongside the agreed purchase price.
2. Buyer must use a reliable escrow service such as Escrow.com for the transfer of the funds.
3. Buyer is expected to make payment for the domain purchase within 3 days once the transaction begins.
Buyer is also mandated to show proof of funds and provide verifiable bank data prior to the transaction.

Seller's Obligation
1. Seller must use a reliable escrow service such as Escrow.com for the transfer of the domain name.
2. Seller must agree that 1% success fee will be deducted from the purchase price at closing upon a successful sale.
3. Seller must begin the domain transfer process to buyer within 3 days after confirming full payment.
Buyer & Seller's Obligation
Buyer and Seller may decide to remain private through out the transaction or decide to exchange contacts to communicate with each other before and after the transaction.
Because buyer and seller are obligated to stay committed to the transaction, buyer and seller are mandated to pay an attorney fee of $3,500 (1,750 US$ each) as legal fee to enable the attorney draft the contract.
Moving forward, you are required to pay 1,750 US$ as a portion of the seller's legal fee and buyer is also required to pay 1,750 US$ as a portion of the buyer's legal fee to enable the lawyer draft the contract for the purchase. A copy of the contract would be forwarded to buyer and seller to review and sign, then the buyer would be mandated to wire the payment to your escrow.com account or to your desired escrow so the transaction can begin.
These are my terms and you reserve the right to Decline or Accept.
If the above Seller's obligations are accepted, kindly let me know when you would be able to make the payment for the 1750 US$ your portion of the legal fee so the attorney can draft the contract and have the buyer wire the payment to Escrow.
I look forward to a positive response from you at your earliest.
Best,
Sally Appleton
High Profile Domain Broker.

 

[URL Stream]

I received an email from https://groupoormasan.com/ saying they have customers who will buy my 2 LLL.us at $1,000,000 each. They said before they can procees with the payment I have to pay them $1,750 for each name for the legal fees before I can get pay.
They did not know that I am old and don't get into these types of trap.

Here is her picture and the email:
Show attachment 293149
Hi,

Thanks for your response and sorry for the late reply.
Moving forward, We will definitely need a contract for the domain transaction. The intent use, payment terms and Escrow etc.. Possible shares in the lll.us and lll.us intended company. All these required a contract with a reputable lawyer.

Also, my terms include,

Buyer's Obligation
1. Buyer must pay 100% Escrow fees alongside the agreed purchase price.
2. Buyer must use a reliable escrow service such as Escrow.com for the transfer of the funds.
3. Buyer is expected to make payment for the domain purchase within 3 days once the transaction begins.
Buyer is also mandated to show proof of funds and provide verifiable bank data prior to the transaction.

Seller's Obligation
1. Seller must use a reliable escrow service such as Escrow.com for the transfer of the domain name.
2. Seller must agree that 1% success fee will be deducted from the purchase price at closing upon a successful sale.
3. Seller must begin the domain transfer process to buyer within 3 days after confirming full payment.
Buyer & Seller's Obligation
Buyer and Seller may decide to remain private through out the transaction or decide to exchange contacts to communicate with each other before and after the transaction.
Because buyer and seller are obligated to stay committed to the transaction, buyer and seller are mandated to pay an attorney fee of $3,500 (1,750 US$ each) as legal fee to enable the attorney draft the contract.
Moving forward, you are required to pay 1,750 US$ as a portion of the seller's legal fee and buyer is also required to pay 1,750 US$ as a portion of the buyer's legal fee to enable the lawyer draft the contract for the purchase. A copy of the contract would be forwarded to buyer and seller to review and sign, then the buyer would be mandated to wire the payment to your escrow.com account or to your desired escrow so the transaction can begin.
These are my terms and you reserve the right to Decline or Accept.
If the above Seller's obligations are accepted, kindly let me know when you would be able to make the payment for the 1750 US$ your portion of the legal fee so the attorney can draft the contract and have the buyer wire the payment to Escrow.
I look forward to a positive response from you at your earliest.
Best,
Sally Appleton
High Profile Domain Broker.

What lander did it come through?

 

[johnn]

I don't think they contacted me from a lander because the price on a lander is $1,350.
They send email directly to my email.
I just told her that I don't have that much money and I will forward the email to FBI.gov and IC3.gov to see if they can help me to send the money.

 

[johnn]

https://www.saffery.com/our-people/sally-appleton/

 

[E. Silvera]

https://www.saffery.com/our-people/sally-appleton/

Hi @johnn !

This seems to be a case of "spoofing"; the scammer is pretending to be someone that really exists (in this case, Sally Appleton from Saffery.com). How they are technically able to simulate their email comes from the legitimate email address, I don't know exactly (@Future Sensors ?), but they do it very often.

 

[E. Silvera]

Spoiler: Gemini 3 reply about spoofing

What is Spoofing?
In the context of domaining and online security, spoofing is a type of cyberattack where a sender deliberately falsifies information to disguise their identity and appear as a trusted source.
When you receive a spoofed email, the "From" address may look exactly like a legitimate company, a known business associate, or even a fellow member of a community like NamePros. The goal is to trick the recipient into revealing sensitive data, clicking malicious links, or authorizing fraudulent transactions.
Common Types of Spoofing
* Email Spoofing: The most frequent form. Attackers manipulate the "From" header of an email so it appears to come from a reputable domain (e.g., [email protected] or escrow.com).
* Website Spoofing: Creating a fake website that mimics a real one (like a registrar or marketplace login page) to capture usernames and passwords.
* IP/DNS Spoofing: Technical methods used to redirect internet traffic from legitimate servers to fraudulent ones.
Red Flags to Watch For
* Mismatched Headers: Even if the "From" name looks correct, checking the "Reply-To" address or the "Return-Path" in the email headers often reveals the actual, unrelated source.
* Urgent or Threatening Tone: Spoofers often create a false sense of urgency (e.g., "Your domain will be deleted in 2 hours") to pressure you into acting without thinking.
* Slight Spelling Variations: Look closely at the domain name. Attackers often use "typosquatting" (e.g., narnepros.com instead of namepros.com).
How to Protect Yourself
* Verify Independently: If you receive a suspicious request for money or data, do not reply to the email. Contact the person or company through a known, trusted channel (like their official website chat or a previously saved phone number).
* Enable 2FA: Always use Two-Factor Authentication on your registrar and marketplace accounts to prevent unauthorized access even if your credentials are stolen.
* Check Security Records: Legitimate emails use protocols like SPF, DKIM, and DMARC to verify authenticity. Most modern email providers will flag messages that fail these checks as "unverified" or move them to spam.
> Bottom Line: If an email from a "trusted" identity asks for sensitive information or unconventional payment, treat it with extreme caution. Trust, but verify.
>
Would you like me to draft a specific warning post for the NamePros "Industry News" or "Scam Alerts" secti
on based on this?

 

[johnn]

That’s what I am thinking. The email was from https://groupoormasan.com/ not from saffery .com
They are stupid by asking for a high amount. If they lower amount in the $xxx then some people may get into the trap.

 

[johnn]

I am an it teacher so I know these things

 

[bmugford]

Hi @johnn !

This seems to be a case of "spoofing"; the scammer is pretending to be someone that really exists (in this case, Sally Appleton from Saffery.com). How they are technically able to simulate their email comes from the legitimate email address, I don't know exactly (@Future Sensors ?), but they do it very often.

I got a $6M offer from "Dave Ramsey".

It was also for a .US domain. I assume it is the same scam.

https://twitter.com/x/status/1959397143229452412

 

[johnn]

He may be the husband of Sally

 

[bmugford]

High Profile Domain Broker.

I just noticed that.

No legitimate broker is going to use such a douchey title.

Brad

 

[VadimK]

John, let's be honest - it's not you, but probably your wife who said that you should not trust that woman? ))

 

[Future Sensors]

https://twitter.com/x/status/2015482631115206845

 

[freety85]

Offering 1M for domains listed publicly for 1350 USD at least do it properly and select domains with make offer or no lander. But the last thing I want to do is giving tips for these scammers.

Btw I have received Godaddy whois inquiries for some of my domains recently all from .info email addresses. The .info domains were registered recently, so I don't even respond.

Example :

I am quite sure it is a scam as well or they try to get my email on response