warning QUICK CHECK TOOL - Check for Fake Mixed IDN Domains

[barcher]

Hey guys,

A few weeks ago I was suspicious of a domain I saw, thinking it was a mixed IDN fake domain, and wanted to check it. It was. But it took me a while to find a good IDN character check tool.

So I thought it might help others if I posted it here so that everyone can have quick access by bookmarking it. Add it to your toolset for pre-purchase domain checks. Hope it saves some of you from possible $$$ loss.

Eхceptional.com - This is an example of a mixed IDN fake domain-

Can you spot the IDN character in it?​

Here is the Tool - https://www.textmagic.com/free-tools/unicode-detector LINK

Test it on - Eхceptional.com (cut & paste it)

Want to see a real Mixed IDN scam? Heres one for you -> Want to buy a 2 Character .com 'х3.com' for just €50K? -> Here is the ebay listing (live right now- today 20/02/2017)

Spoiler: IMAGE

Spoiler: LINK

http://www.ebay.com.au/itm/No-reser...561817?hash=item237e39a2d9:g:oaQAAOSw2gxYqH-Z

Here is the Real domain

Spoiler: IMAGE

Here is the Owner

(who probably had hoped people would search Whois for x3.com instead)​

Spoiler: IMAGE

Spoiler: TEXT

Domain Name: XN--3-FUB.COM
Registry Domain ID: 2098640045_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http : www. godaddy. com
Update Date: 2017-02-18T16:57:01Z
Creation Date: 2017-02-18T16:57:00Z
Registrar Registration Expiration Date: 2018-02-18T16:57:00Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.4806242505
Registry Registrant ID:
Registrant Name: Laurens Moet
Registrant Organization:
Registrant Street: Kuyperlaan 12
Registrant City: zeist
Registrant State/Province: Utrecht
Registrant Postal Code: 3705HM
Registrant Country: NL
Registrant Phone: +31.623936727
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: Laurens.moet @ gmail.com

Spoiler: NOTE

Note - they try to verify by a Link in the listing, which forwards back to their ebay listing - so the bidders/buyers never get to see the real domain name 'XN--3-FUB.COM' in the address bar. Also NOTE - Nowhere in the listing do they say it is a IDN or IDN mix domain. That then is purposeful misrepresentation. And very probably attempt to defraud

Do you think you can easily spot a mixed IDN domain without tools?

Which one is real -

miсrоsоft.com or microsoft.com
paypal.com or pаypal.com​

Try them in the Character Checker Tool to find out.
__

METHOD 2 - another method to check for Mixed IDN Fake Domains

• Click - Ctrl & F - when on the suspect domain auction page
• Type in the domain name in the Find Box that appears top right
• If the domain fails to highlight you know it is suspicious
• Note: you then have to search each letter individually to find the suspect letters in domain.

But when I'm working, I found I wanted to know fast, just which letters are wrong in domains I suspect. The Tool in method 1 Link lets me check many domains quickly. I think you would be the same. Just cut & paste domain into the tool on it's webpage to check.

Okay, hope this helps you beat any fraudulent domains you see in your domaining.

Just REM - if it walks like a duck, and quacks like a duck - it probably is a duck.

i.e. if the price is too good to be true, and smells like a scam, it probably is ...a scam!!​

Especially for when you’re a newbie - beware!! of mixed IDN fake domains.

You can always check, with this tool or with method 2, if in doubt.

(Btw.. I'm not affiliated with the site. Just like the tool. Oh, and our domain checks on it, are free in any case.)

Also just FYI - the technically correct term for 'mixed IDN domain name' is - homographs in internationalised domain names​

 

[DNWon]

Excellent and very helpful post! Thanks!
All though I did find this tiny "fine print" disclaimer buried deep into the description:
"By buying this item you certify that you are aware you are buying the domain name х3.com which is equal to the punycode xn--3-fub.com"

 

[barcher]

You have fine detective skills Because I looked twice and couldn't find it. Where is it exactly, I'll go check it out. But I think that it should be noticeable enough for buyer to see what they are buying without having to hunt hard in fine print for it. Otherwise it's being hidden purposefully, and the fine print is for defence if caught out.

 

[CursedToast]

Great post. Very frustrating that this is even a possible thing. I wouldn't have been able to tell the difference without it!

 

[DNWon]

Third sentence of the section titled "A Domain Name builds your Brand"

 

[barcher]

HahaHa,
I think lawyers would have a hard battle defending this in court. It is buried right down on line 33 of the description.

And more importantly all of a sudden the Font size halves with the insert of the real domain name. That very tellingly is an attempt to hide it, while doing the very minimum possible legally for defense if needed.

i.e.
"By bidding on this item you certify that you are aware you are buying the domain name х3.com which is equal to the punycode xn--3-fub.com"

Anyone can see that being honest is not the ebay sellers agenda, or radar, and if some poor smuck got excited over a 2 Character .com and paid $xx,xxx for it, then it's too bad for them.

 

[CursedToast]

I have a three character acronym for people like that seller...

 

[barcher]

@CursedToast Oh cmon, Do share, tell us, tell us. What is it?

 

[CursedToast]

@CursedToast Oh cmon, Do share, tell us, tell us. What is it?

Well it's certainly not Point of Sale....

 

[barcher]

Hahaha Yup, thats what s/he is alright!

 

[DNWon]

Yes, I agree with you! In my opinion the $50,000 Buy it Now price is also an attempt to make the IDN seem much more valuable than it actually is, but anyone that knows anything about domain names would hopefully do their due diligence (Whois) and figure it out, if in perhaps they miss the puny code fine print, before placing a bid, but for a first time purchaser, I could see how they could get caught up, thinking it's the deal of a lifetime, and bidding more than the market value of an IDN, thinking it's something it is not!

 

[barcher]

Yes, I agree with you! In my opinion the $50,000 Buy it Now price is also an attempt to make the IDN seem much more valuable than it actually is, but anyone that knows anything about domain names would hopefully do their due diligence (Whois) and figure it out, if in perhaps they miss the puny code fine print, before placing a bid, but for a first time purchaser, I could see how they could get caught up, thinking it's the deal of a lifetime, and bidding more than the market value of an IDN, thinking it's something it is not!

Agreed, it is very obvious it is an attempt to pull a fast one. With the option to pull out if needed ..by a tiny line in the fine print.

Yes, your right, experienced domainers would know better, but just because con artist inputs fine print, I don't think we as domainers should refrain from calling a spade a spade, in regard to it a thinly veiled con attempt happening right in front of us, to pass off domain as valuble. Otherwise when do we speak up when we see it? When someone actually gets ripped off?

 

[DNWon]

I see that they got their first bidder, so the 50,000 GBP Buy it Now option is now thankfully gone.

 

[barcher]

I see that they got their first bidder, so the 50,000 GBP Buy it Now option is now thankfully gone

No mate not gone, it lives on in evidence infamy forever, in the images attached to this post. Thats why I am glad I took screenshot and clips. I knew the listing wouldn't last forever.

Also, I was about to report the listing using ebay 'report' link, but I refrained, as I was thinking of doing this post, and I wanted the listing to stay up, as the perfect example for you guys.

 

[barcher]

All of a sudden the ebay auction was ended by the seller early. It was due to go on for 3 days more.

"This listing was ended by the seller because the item is no longer available."​

And the background of the listing is now grey, with all text on white strips, EXCEPT for the half sized fonted phrase "х3.com which is equal to the punycode xn--3-fub.com" which all of a sudden, now makes it slightly more visible. Was all white background before. Shifty!!

Not sure if this post had anything to do with it but the timing is very coincidental. Or perhaps someone clicked 'ebay report this listing', and an ebay 'please explain' message, made the item lister lose their nerve?!

Interesting. In any case, the good thing, is that for the knowledge of future NPers for how to spot a mixed IDN fake domain scam, the screen shots and clippings will stay accessible for us, under the 'spoiler' buttons in the post permanently. Even in future, when the ebay listing is gone.

 

[barcher]

By the way, a Thank You to @usernamex, who filled me in on the how to's of 'spoiler' button code to enable this post. He sent cheery and detailed answer to my inquiry of him as a complete stranger. He's one of the guys who makes NP a great forum. Cheers for that UsernameX.

 

[ekbron]

Domains are for sale on Ebay again.

 

[barcher]

Domains are for sale on Ebay again.

Could you post the Ebay link?

 

[todaygold]

Could you post the Ebay link?

ebay.com.au/itm/No-reserve-Massive-opportunity-3-com-2-character-com-domain-name-/152444050197?hash=item237e5f9b15:g:A44AAOSw2gxYq1fz

 

[briguy]

Seems the seller has a history with those types of domains...


http://m.ebay.com.au/itm/No-reserve...%3A6441c04b15a0a5e0d672eca5ffee58e7%7Ciid%3A2


"By bidding on this item you certify that you are aware you are buying the IDN domain name аох which can be converted into the punycode xn--80a2av "