warning QUICK CHECK TOOL - Check for Fake Mixed IDN Domains

[barcher]

Hey guys,

A few weeks ago I was suspicious of a domain I saw, thinking it was a mixed IDN fake domain, and wanted to check it. It was. But it took me a while to find a good IDN character check tool.

So I thought it might help others if I posted it here so that everyone can have quick access by bookmarking it. Add it to your toolset for pre-purchase domain checks. Hope it saves some of you from possible $$$ loss.

Eхceptional.com - This is an example of a mixed IDN fake domain-

Can you spot the IDN character in it?​

Here is the Tool - https://www.textmagic.com/free-tools/unicode-detector LINK

Test it on - Eхceptional.com (cut & paste it)

Want to see a real Mixed IDN scam? Heres one for you -> Want to buy a 2 Character .com 'х3.com' for just €50K? -> Here is the ebay listing (live right now- today 20/02/2017)

Spoiler: IMAGE

Spoiler: LINK

http://www.ebay.com.au/itm/No-reser...561817?hash=item237e39a2d9:g:oaQAAOSw2gxYqH-Z

Here is the Real domain

Spoiler: IMAGE

Here is the Owner

(who probably had hoped people would search Whois for x3.com instead)​

Spoiler: IMAGE

Spoiler: TEXT

Domain Name: XN--3-FUB.COM
Registry Domain ID: 2098640045_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http : www. godaddy. com
Update Date: 2017-02-18T16:57:01Z
Creation Date: 2017-02-18T16:57:00Z
Registrar Registration Expiration Date: 2018-02-18T16:57:00Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.4806242505
Registry Registrant ID:
Registrant Name: Laurens Moet
Registrant Organization:
Registrant Street: Kuyperlaan 12
Registrant City: zeist
Registrant State/Province: Utrecht
Registrant Postal Code: 3705HM
Registrant Country: NL
Registrant Phone: +31.623936727
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: Laurens.moet @ gmail.com

Spoiler: NOTE

Note - they try to verify by a Link in the listing, which forwards back to their ebay listing - so the bidders/buyers never get to see the real domain name 'XN--3-FUB.COM' in the address bar. Also NOTE - Nowhere in the listing do they say it is a IDN or IDN mix domain. That then is purposeful misrepresentation. And very probably attempt to defraud

Do you think you can easily spot a mixed IDN domain without tools?

Which one is real -

miсrоsоft.com or microsoft.com
paypal.com or pаypal.com​

Try them in the Character Checker Tool to find out.
__

METHOD 2 - another method to check for Mixed IDN Fake Domains

• Click - Ctrl & F - when on the suspect domain auction page
• Type in the domain name in the Find Box that appears top right
• If the domain fails to highlight you know it is suspicious
• Note: you then have to search each letter individually to find the suspect letters in domain.

But when I'm working, I found I wanted to know fast, just which letters are wrong in domains I suspect. The Tool in method 1 Link lets me check many domains quickly. I think you would be the same. Just cut & paste domain into the tool on it's webpage to check.

Okay, hope this helps you beat any fraudulent domains you see in your domaining.

Just REM - if it walks like a duck, and quacks like a duck - it probably is a duck.

i.e. if the price is too good to be true, and smells like a scam, it probably is ...a scam!!​

Especially for when you’re a newbie - beware!! of mixed IDN fake domains.

You can always check, with this tool or with method 2, if in doubt.

(Btw.. I'm not affiliated with the site. Just like the tool. Oh, and our domain checks on it, are free in any case.)

Also just FYI - the technically correct term for 'mixed IDN domain name' is - homographs in internationalised domain names​

 

[barcher]

@Jeff Weller. I agree. I was thinking to do that, with a question "this listing is actually selling 'xn--3-fub.com' right and NOT x3.com as on the keyboard, right?!" as a simpler way to warn people who don't know about puny code / IDN.

But I admit, I wanted listing to stay up, for us at NP as a demo. Bit selfish I know.

btw..Is there any way the ebay lister can remove the question from ebay listing if we do that? i.e. a misuse of a 'remove abusive question' button for example?

 

[todaygold]

btw..Is there any way the ebay lister can remove the question from ebay listing if we do that? i.e. a misuse of 'remove abusive question' button?

I haven't used ebay in quite some time, but if I recall correctly, I think it's option if the seller wants to publicly display the question or not?

 

[Jeff Weller]

I asked a question of the seller - we'll see if it gets publicly posted. Couple of other oddities that add up to no good are....
"The user you are contacting is registered on another eBay site and may speak a different language. Your message will be sent exactly as typed below. "
The payment as I view it here in the US is converted from Aussie dollars - so the seller is using an AU based account. You can play with this a lot so seller could be anywhere.
The item's "location" is stated as "zeist, South Yorkshire, United Kingdom"
Zeist appears to be in the Netherlands.
All the positive transactions for this seller were buyer transactions and the majority of those were to buy something from PrepaidMania - likely prepaid mobile time.
But we all suspected the seller was attempting to seriously mislead.
I asked:
xn--3-fub Which is for sale?
I ain't good with this internet stuff. Are selling X3.com or some kind of whatever IDN is - xn--3-fub? I don't follow you. Seems weird. And what country are you in case I need help?

Let's see if I get a reply.

 

[ekbron]

Approx 11h left for the listing, any reply from the seller?

 

[Jeff Weller]

No response, not surprised - but am shocked the bidding has reached $144.50 with probably a 10 different bidders - interestingly enough there is a payment disclosure "Refunds by law: In Australia, consumers have a legal right to obtain a refund from a business for goods purchased if the goods are faulty, not fit for purpose or don't match description. More information at returns ." But since chances are the winner won't be in Australia - - the winner will have to rely on the deceptiveness of the ad as their basis for a refund. Amazing.

 

[todaygold]

Well the totals are in. One went for USD $761 and the other for $386. Looking at the bid list, the auctions were nearly one by the same bidder, until a last minute bidder came in. Should be interesting to keep an eye on the names and see if they get transferred or relisted or what happens.

 

[barcher]

Wow, someone just got scammed US $386- (AU $504- where I'm from) in the new Ver 2.0 ebay x3.com Scam Listing.

I didn't think it would actually go through. Thought it would be stopped like last time. But NO, the bidding has ended at that amount and item was sold.

Here are the Links
LISTING Here - Now states Bidding Ended LISTING at Auction End - Scroll Down on page

@Jeff Weller I checked at the Bottom of Page and didnt see your question. The seller must of found a way to delete it. See Image below-



And this has gone beyond seeing the scammer as a amusing example of Mixed IDN Fraud and has now moved into an aspect of someone actually taking a hit financially. When I saw the bidding had ended, I hit the report Link to warn ebay. And possibly halt payment.

But ebay in their wisdom, to minimise employee time and expense, has created a endless report flow loop, where you can only report items within strict criteria and they don't allow a simple email contact, for customers to email reports of fraud or scams.

SEE Here - and

So Anyone reading this who wants to help and has an ebay account can I ask you to go to Ebay LISTING LINK and hit report button. Maybe it will help if a lot of us report it. And if anyone who trys, can get through to an ebay email please put in your report that Seller sold 'xn--3-fub.com' and NOT x3.com, and made listing appear to offer Buyers x3.com.

I tried to see how to warn the successful bidder, as there is probably still time to block or reverse payment, but ebay blocks out bidder and buyer identity, ironically for bidder security.

So I guess we ended up getting a lesson on Mixed IDN Scam, to it's final conclusion, and bad ending. Though I wish it hadn't gone this way. Shows you can lose $xxx. Even on reputable sites like ebay.

Not happy at all, with outcome. Keep thinking on buyer and how s/he is feeling. Hope he can reverse charge it. Thats if s/he paid by CCard.

 

[barcher]

I just went to have another go at finding a ebay email to properly report the Scam to help buyer. Searched for "ebay fraud report email" Hows this for irony. Got this as response in search listings -

" Find great deals on eBay for report fraud and fraud investigation. Shop with confidence."

and this

" Find great deals on eBay for Fraud and report fraud. Shop with confidence "

Search LINK

On TOP of these in Search Listings was - eBay Security Center: Welcome

But it was just another Customer Frequently Asked Questions and Answers endless Flow Process (i.e. a CRM Maze designed to prevent actual ebay human CRM) and no way to get to an actual email to give Scam details or request payment stop.​

Those were the results for search. Very slack effort with only SEO to sell, not to help customers report, ebay! Ok, that's it, I'm off to sleep. Hope another NPer has more success reporting this to ebay.

 

[Jeff Weller]

The question was definitely posted as I have the confirmation from eBay - however - by default it wouldn't appear since the seller ignored it during the auction period and it certainly won't appear now.
I was able to file a fraudulent listing report however my category options were limited and there was no opportunity to provide a detailed description of the actual attempt to mislead - so I doubt it will get anyone's attention.

 

[todaygold]

As an update, it appears that the domain х3.com was transferred to the winning bidder. Whois is now showing the buyer who lists an address in New York. So I guess at least one of the winning bidders paid...it should be interesting to see if anything further happens.

 

[todaygold]

Well the mystery deepens. It appears both domains were transferred yesterday. Both domains now list the SAME owner...even though 2 different bidders won the 2 auctions. Interesting.