warning QUICK CHECK TOOL - Check for Fake Mixed IDN Domains

[barcher]

Hey guys,

A few weeks ago I was suspicious of a domain I saw, thinking it was a mixed IDN fake domain, and wanted to check it. It was. But it took me a while to find a good IDN character check tool.

So I thought it might help others if I posted it here so that everyone can have quick access by bookmarking it. Add it to your toolset for pre-purchase domain checks. Hope it saves some of you from possible $$$ loss.

Eхceptional.com - This is an example of a mixed IDN fake domain-

Can you spot the IDN character in it?​

Here is the Tool - https://www.textmagic.com/free-tools/unicode-detector LINK

Test it on - Eхceptional.com (cut & paste it)

Want to see a real Mixed IDN scam? Heres one for you -> Want to buy a 2 Character .com 'х3.com' for just €50K? -> Here is the ebay listing (live right now- today 20/02/2017)

Spoiler: IMAGE

Spoiler: LINK

http://www.ebay.com.au/itm/No-reser...561817?hash=item237e39a2d9:g:oaQAAOSw2gxYqH-Z

Here is the Real domain

Spoiler: IMAGE

Here is the Owner

(who probably had hoped people would search Whois for x3.com instead)​

Spoiler: IMAGE

Spoiler: TEXT

Domain Name: XN--3-FUB.COM
Registry Domain ID: 2098640045_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http : www. godaddy. com
Update Date: 2017-02-18T16:57:01Z
Creation Date: 2017-02-18T16:57:00Z
Registrar Registration Expiration Date: 2018-02-18T16:57:00Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.4806242505
Registry Registrant ID:
Registrant Name: Laurens Moet
Registrant Organization:
Registrant Street: Kuyperlaan 12
Registrant City: zeist
Registrant State/Province: Utrecht
Registrant Postal Code: 3705HM
Registrant Country: NL
Registrant Phone: +31.623936727
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: Laurens.moet @ gmail.com

Spoiler: NOTE

Note - they try to verify by a Link in the listing, which forwards back to their ebay listing - so the bidders/buyers never get to see the real domain name 'XN--3-FUB.COM' in the address bar. Also NOTE - Nowhere in the listing do they say it is a IDN or IDN mix domain. That then is purposeful misrepresentation. And very probably attempt to defraud

Do you think you can easily spot a mixed IDN domain without tools?

Which one is real -

miсrоsоft.com or microsoft.com
paypal.com or pаypal.com​

Try them in the Character Checker Tool to find out.
__

METHOD 2 - another method to check for Mixed IDN Fake Domains

• Click - Ctrl & F - when on the suspect domain auction page
• Type in the domain name in the Find Box that appears top right
• If the domain fails to highlight you know it is suspicious
• Note: you then have to search each letter individually to find the suspect letters in domain.

But when I'm working, I found I wanted to know fast, just which letters are wrong in domains I suspect. The Tool in method 1 Link lets me check many domains quickly. I think you would be the same. Just cut & paste domain into the tool on it's webpage to check.

Okay, hope this helps you beat any fraudulent domains you see in your domaining.

Just REM - if it walks like a duck, and quacks like a duck - it probably is a duck.

i.e. if the price is too good to be true, and smells like a scam, it probably is ...a scam!!​

Especially for when you’re a newbie - beware!! of mixed IDN fake domains.

You can always check, with this tool or with method 2, if in doubt.

(Btw.. I'm not affiliated with the site. Just like the tool. Oh, and our domain checks on it, are free in any case.)

Also just FYI - the technically correct term for 'mixed IDN domain name' is - homographs in internationalised domain names​

 

[barcher]

The Con Exposed AGAIN - ebay х3.com scam listing V 2.0 LINK

Seems the seller has a history with those types of domains

Yes, but notice how the listing has changed a lot. It seems to be in response to this post or maybe a complaint at Godaddy. It now makes sure that the phrase -

“Sold exactly as in the description, please read.”​

is featured at TOP of Listing - and at TOP of Description

SEE -
TOP of Listing TOP of Description ​

I wouldn't be surprised if Scam lister has come to this post, as NamePros techs have done good work and got high trust with Google and our NP posts get high up in search results. OR... one of our fellow NPers may be the Scam Lister

However note that the attempt to appear above board and honest listing, is only a surface impression.

WHY? See this -

When you get down to the actual description that we are asked to 'please read' we find in the description that the ebay item lister tries to be obtuse and diffuses the description to trap the unwary or unknowledgeable buyer.

i.e. lister inputs this, as the text to legally describe the actual listing domain

" you are buying the IDN domain name х3 which is equal to the punycode xn--3-fub "

i.e. where are the .com parts of the two domain addresses in this?​

instead of the clear correct TLD description, which would be -

" you are buying the IDN domain name 'х3.com' which is equal to the punycode domain name 'xn--3-fub.com' "

i.e. х3.com --> is --> xn--3-fub.com​

SEE Here --> (Click)

WHY did s/he not input the correct .com TLD ending of the address. Because s/he wants to con the unwary buyer.

Then there is this aspect they try to get past us a buyers -

"PROOF OF OWNERSHIP: Paste the following url in your browser: http://www.х3DOTcom/Ebaylistingproofofownership and replace the dot with a . This will take you to this very ebay listing."​

The con here is that the scam con man asks you to "Paste the following URL"
so that unsophisticated domain buyers paste the false х in together with the rest of the address. i.e. x is the 'poison cargo' in amongst that text load, unknown by the unwary.

So to see this, do please Paste the above bold Proof of Ownership (3 bold lines) in paragraph above this one or from ebay listing, into Text Magic --> Link
and see what I mean. (the hidden IDN will instantly appear in orange)

i.e. result -

IMAGE Here --> (Click)

So Scam Ebay Lister has moved Listing and added the 'please read description' to appear to be honest. But when you see how they have attempted to obfuscate it, you see that it is really not what it appears and they are still trying to trap the unwary.


We at NP are safe from making a mistake and getting caught out by this because of our domaining knowledge, but what about casual eBay buyers?

 

[briguy]

Thanks @barcher for sharing your advanced knowledge and yet keeping it ease to understand!

If I wasn't on a strict budget (part of my self-inflicted recovery program lol) pretty sure I would have bought one of these "phony 2C/3C" com's by now...do have a addiction for short character domains!

 

[todaygold]

I wonder why the seller picked ebay, of all places though. Ebay/paypal is well known for siding with the buyer...even if the seller puts 'as is/no refunds'. Once the buyer sees what they bought and complains to ebay/paypal, they will almost certainly remove the funds from the sellers account and give it back to the buyer. Unless the seller is hoping the buyer doesn't notice what they bought for a long time?

 

[barcher]

yet keeping it easy to understand!

No, not advanced knowledge. Just a bit of detective work. Anyone could do it. Then just wanting to help others avoid the scam by laying it out in a fast easy to read format. But thanks.

 

[Jeff Weller]

A few of us with a knack for asking obnoxious questions could log onto our eBay accounts and ask this seller to explain puny code / IDN - the questions would be much more visible than the buried disclaimer. Of course they will just do the same thing on their next listing - but maybe enough pressure will get them to clean up their act.

 

[barcher]

@Jeff Weller. I agree. I was thinking to do that, with a question "this listing is actually selling 'xn--3-fub.com' right and NOT x3.com as on the keyboard, right?!" as a simpler way to warn people who don't know about puny code / IDN.

But I admit, I wanted listing to stay up, for us at NP as a demo. Bit selfish I know.

btw..Is there any way the ebay lister can remove the question from ebay listing if we do that? i.e. a misuse of a 'remove abusive question' button for example?

 

[todaygold]

btw..Is there any way the ebay lister can remove the question from ebay listing if we do that? i.e. a misuse of 'remove abusive question' button?

I haven't used ebay in quite some time, but if I recall correctly, I think it's option if the seller wants to publicly display the question or not?

 

[Jeff Weller]

I asked a question of the seller - we'll see if it gets publicly posted. Couple of other oddities that add up to no good are....
"The user you are contacting is registered on another eBay site and may speak a different language. Your message will be sent exactly as typed below. "
The payment as I view it here in the US is converted from Aussie dollars - so the seller is using an AU based account. You can play with this a lot so seller could be anywhere.
The item's "location" is stated as "zeist, South Yorkshire, United Kingdom"
Zeist appears to be in the Netherlands.
All the positive transactions for this seller were buyer transactions and the majority of those were to buy something from PrepaidMania - likely prepaid mobile time.
But we all suspected the seller was attempting to seriously mislead.
I asked:
xn--3-fub Which is for sale?
I ain't good with this internet stuff. Are selling X3.com or some kind of whatever IDN is - xn--3-fub? I don't follow you. Seems weird. And what country are you in case I need help?

Let's see if I get a reply.

 

[ekbron]

Approx 11h left for the listing, any reply from the seller?

 

[Jeff Weller]

No response, not surprised - but am shocked the bidding has reached $144.50 with probably a 10 different bidders - interestingly enough there is a payment disclosure "Refunds by law: In Australia, consumers have a legal right to obtain a refund from a business for goods purchased if the goods are faulty, not fit for purpose or don't match description. More information at returns ." But since chances are the winner won't be in Australia - - the winner will have to rely on the deceptiveness of the ad as their basis for a refund. Amazing.

 

[todaygold]

Well the totals are in. One went for USD $761 and the other for $386. Looking at the bid list, the auctions were nearly one by the same bidder, until a last minute bidder came in. Should be interesting to keep an eye on the names and see if they get transferred or relisted or what happens.

 

[barcher]

Wow, someone just got scammed US $386- (AU $504- where I'm from) in the new Ver 2.0 ebay x3.com Scam Listing.

I didn't think it would actually go through. Thought it would be stopped like last time. But NO, the bidding has ended at that amount and item was sold.

Here are the Links
LISTING Here - Now states Bidding Ended LISTING at Auction End - Scroll Down on page

@Jeff Weller I checked at the Bottom of Page and didnt see your question. The seller must of found a way to delete it. See Image below-



And this has gone beyond seeing the scammer as a amusing example of Mixed IDN Fraud and has now moved into an aspect of someone actually taking a hit financially. When I saw the bidding had ended, I hit the report Link to warn ebay. And possibly halt payment.

But ebay in their wisdom, to minimise employee time and expense, has created a endless report flow loop, where you can only report items within strict criteria and they don't allow a simple email contact, for customers to email reports of fraud or scams.

SEE Here - and

So Anyone reading this who wants to help and has an ebay account can I ask you to go to Ebay LISTING LINK and hit report button. Maybe it will help if a lot of us report it. And if anyone who trys, can get through to an ebay email please put in your report that Seller sold 'xn--3-fub.com' and NOT x3.com, and made listing appear to offer Buyers x3.com.

I tried to see how to warn the successful bidder, as there is probably still time to block or reverse payment, but ebay blocks out bidder and buyer identity, ironically for bidder security.

So I guess we ended up getting a lesson on Mixed IDN Scam, to it's final conclusion, and bad ending. Though I wish it hadn't gone this way. Shows you can lose $xxx. Even on reputable sites like ebay.

Not happy at all, with outcome. Keep thinking on buyer and how s/he is feeling. Hope he can reverse charge it. Thats if s/he paid by CCard.

 

[barcher]

I just went to have another go at finding a ebay email to properly report the Scam to help buyer. Searched for "ebay fraud report email" Hows this for irony. Got this as response in search listings -

" Find great deals on eBay for report fraud and fraud investigation. Shop with confidence."

and this

" Find great deals on eBay for Fraud and report fraud. Shop with confidence "

Search LINK

On TOP of these in Search Listings was - eBay Security Center: Welcome

But it was just another Customer Frequently Asked Questions and Answers endless Flow Process (i.e. a CRM Maze designed to prevent actual ebay human CRM) and no way to get to an actual email to give Scam details or request payment stop.​

Those were the results for search. Very slack effort with only SEO to sell, not to help customers report, ebay! Ok, that's it, I'm off to sleep. Hope another NPer has more success reporting this to ebay.

 

[Jeff Weller]

The question was definitely posted as I have the confirmation from eBay - however - by default it wouldn't appear since the seller ignored it during the auction period and it certainly won't appear now.
I was able to file a fraudulent listing report however my category options were limited and there was no opportunity to provide a detailed description of the actual attempt to mislead - so I doubt it will get anyone's attention.

 

[todaygold]

As an update, it appears that the domain х3.com was transferred to the winning bidder. Whois is now showing the buyer who lists an address in New York. So I guess at least one of the winning bidders paid...it should be interesting to see if anything further happens.

 

[todaygold]

Well the mystery deepens. It appears both domains were transferred yesterday. Both domains now list the SAME owner...even though 2 different bidders won the 2 auctions. Interesting.