warning QUICK CHECK TOOL - Check for Fake Mixed IDN Domains

[barcher]

Hey guys,

A few weeks ago I was suspicious of a domain I saw, thinking it was a mixed IDN fake domain, and wanted to check it. It was. But it took me a while to find a good IDN character check tool.

So I thought it might help others if I posted it here so that everyone can have quick access by bookmarking it. Add it to your toolset for pre-purchase domain checks. Hope it saves some of you from possible $$$ loss.

Eхceptional.com - This is an example of a mixed IDN fake domain-

Can you spot the IDN character in it?​

Here is the Tool - https://www.textmagic.com/free-tools/unicode-detector LINK

Test it on - Eхceptional.com (cut & paste it)

Want to see a real Mixed IDN scam? Heres one for you -> Want to buy a 2 Character .com 'х3.com' for just €50K? -> Here is the ebay listing (live right now- today 20/02/2017)

Spoiler: IMAGE

Spoiler: LINK

http://www.ebay.com.au/itm/No-reser...561817?hash=item237e39a2d9:g:oaQAAOSw2gxYqH-Z

Here is the Real domain

Spoiler: IMAGE

Here is the Owner

(who probably had hoped people would search Whois for x3.com instead)​

Spoiler: IMAGE

Spoiler: TEXT

Domain Name: XN--3-FUB.COM
Registry Domain ID: 2098640045_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http : www. godaddy. com
Update Date: 2017-02-18T16:57:01Z
Creation Date: 2017-02-18T16:57:00Z
Registrar Registration Expiration Date: 2018-02-18T16:57:00Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.4806242505
Registry Registrant ID:
Registrant Name: Laurens Moet
Registrant Organization:
Registrant Street: Kuyperlaan 12
Registrant City: zeist
Registrant State/Province: Utrecht
Registrant Postal Code: 3705HM
Registrant Country: NL
Registrant Phone: +31.623936727
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: Laurens.moet @ gmail.com

Spoiler: NOTE

Note - they try to verify by a Link in the listing, which forwards back to their ebay listing - so the bidders/buyers never get to see the real domain name 'XN--3-FUB.COM' in the address bar. Also NOTE - Nowhere in the listing do they say it is a IDN or IDN mix domain. That then is purposeful misrepresentation. And very probably attempt to defraud

Do you think you can easily spot a mixed IDN domain without tools?

Which one is real -

miсrоsоft.com or microsoft.com
paypal.com or pаypal.com​

Try them in the Character Checker Tool to find out.
__

METHOD 2 - another method to check for Mixed IDN Fake Domains

• Click - Ctrl & F - when on the suspect domain auction page
• Type in the domain name in the Find Box that appears top right
• If the domain fails to highlight you know it is suspicious
• Note: you then have to search each letter individually to find the suspect letters in domain.

But when I'm working, I found I wanted to know fast, just which letters are wrong in domains I suspect. The Tool in method 1 Link lets me check many domains quickly. I think you would be the same. Just cut & paste domain into the tool on it's webpage to check.

Okay, hope this helps you beat any fraudulent domains you see in your domaining.

Just REM - if it walks like a duck, and quacks like a duck - it probably is a duck.

i.e. if the price is too good to be true, and smells like a scam, it probably is ...a scam!!​

Especially for when you’re a newbie - beware!! of mixed IDN fake domains.

You can always check, with this tool or with method 2, if in doubt.

(Btw.. I'm not affiliated with the site. Just like the tool. Oh, and our domain checks on it, are free in any case.)

Also just FYI - the technically correct term for 'mixed IDN domain name' is - homographs in internationalised domain names​

 

[DNWon]

Excellent and very helpful post! Thanks!
All though I did find this tiny "fine print" disclaimer buried deep into the description:
"By buying this item you certify that you are aware you are buying the domain name х3.com which is equal to the punycode xn--3-fub.com"

 

[barcher]

You have fine detective skills Because I looked twice and couldn't find it. Where is it exactly, I'll go check it out. But I think that it should be noticeable enough for buyer to see what they are buying without having to hunt hard in fine print for it. Otherwise it's being hidden purposefully, and the fine print is for defence if caught out.

 

[CursedToast]

Great post. Very frustrating that this is even a possible thing. I wouldn't have been able to tell the difference without it!

 

[DNWon]

Third sentence of the section titled "A Domain Name builds your Brand"

 

[barcher]

HahaHa,
I think lawyers would have a hard battle defending this in court. It is buried right down on line 33 of the description.

And more importantly all of a sudden the Font size halves with the insert of the real domain name. That very tellingly is an attempt to hide it, while doing the very minimum possible legally for defense if needed.

i.e.
"By bidding on this item you certify that you are aware you are buying the domain name х3.com which is equal to the punycode xn--3-fub.com"

Anyone can see that being honest is not the ebay sellers agenda, or radar, and if some poor smuck got excited over a 2 Character .com and paid $xx,xxx for it, then it's too bad for them.

 

[CursedToast]

I have a three character acronym for people like that seller...

 

[barcher]

@CursedToast Oh cmon, Do share, tell us, tell us. What is it?

 

[CursedToast]

@CursedToast Oh cmon, Do share, tell us, tell us. What is it?

Well it's certainly not Point of Sale....

 

[barcher]

Hahaha Yup, thats what s/he is alright!

 

[DNWon]

Yes, I agree with you! In my opinion the $50,000 Buy it Now price is also an attempt to make the IDN seem much more valuable than it actually is, but anyone that knows anything about domain names would hopefully do their due diligence (Whois) and figure it out, if in perhaps they miss the puny code fine print, before placing a bid, but for a first time purchaser, I could see how they could get caught up, thinking it's the deal of a lifetime, and bidding more than the market value of an IDN, thinking it's something it is not!

 

[barcher]

Yes, I agree with you! In my opinion the $50,000 Buy it Now price is also an attempt to make the IDN seem much more valuable than it actually is, but anyone that knows anything about domain names would hopefully do their due diligence (Whois) and figure it out, if in perhaps they miss the puny code fine print, before placing a bid, but for a first time purchaser, I could see how they could get caught up, thinking it's the deal of a lifetime, and bidding more than the market value of an IDN, thinking it's something it is not!

Agreed, it is very obvious it is an attempt to pull a fast one. With the option to pull out if needed ..by a tiny line in the fine print.

Yes, your right, experienced domainers would know better, but just because con artist inputs fine print, I don't think we as domainers should refrain from calling a spade a spade, in regard to it a thinly veiled con attempt happening right in front of us, to pass off domain as valuble. Otherwise when do we speak up when we see it? When someone actually gets ripped off?

 

[DNWon]

I see that they got their first bidder, so the 50,000 GBP Buy it Now option is now thankfully gone.

 

[barcher]

I see that they got their first bidder, so the 50,000 GBP Buy it Now option is now thankfully gone

No mate not gone, it lives on in evidence infamy forever, in the images attached to this post. Thats why I am glad I took screenshot and clips. I knew the listing wouldn't last forever.

Also, I was about to report the listing using ebay 'report' link, but I refrained, as I was thinking of doing this post, and I wanted the listing to stay up, as the perfect example for you guys.

 

[barcher]

All of a sudden the ebay auction was ended by the seller early. It was due to go on for 3 days more.

"This listing was ended by the seller because the item is no longer available."​

And the background of the listing is now grey, with all text on white strips, EXCEPT for the half sized fonted phrase "х3.com which is equal to the punycode xn--3-fub.com" which all of a sudden, now makes it slightly more visible. Was all white background before. Shifty!!

Not sure if this post had anything to do with it but the timing is very coincidental. Or perhaps someone clicked 'ebay report this listing', and an ebay 'please explain' message, made the item lister lose their nerve?!

Interesting. In any case, the good thing, is that for the knowledge of future NPers for how to spot a mixed IDN fake domain scam, the screen shots and clippings will stay accessible for us, under the 'spoiler' buttons in the post permanently. Even in future, when the ebay listing is gone.

 

[barcher]

By the way, a Thank You to @usernamex, who filled me in on the how to's of 'spoiler' button code to enable this post. He sent cheery and detailed answer to my inquiry of him as a complete stranger. He's one of the guys who makes NP a great forum. Cheers for that UsernameX.

 

[ekbron]

Domains are for sale on Ebay again.

 

[barcher]

Domains are for sale on Ebay again.

Could you post the Ebay link?

 

[todaygold]

Could you post the Ebay link?

ebay.com.au/itm/No-reserve-Massive-opportunity-3-com-2-character-com-domain-name-/152444050197?hash=item237e5f9b15:g:A44AAOSw2gxYq1fz

 

[briguy]

Seems the seller has a history with those types of domains...


http://m.ebay.com.au/itm/No-reserve...%3A6441c04b15a0a5e0d672eca5ffee58e7%7Ciid%3A2


"By bidding on this item you certify that you are aware you are buying the IDN domain name аох which can be converted into the punycode xn--80a2av "

 

[barcher]

The Con Exposed AGAIN - ebay х3.com scam listing V 2.0 LINK

Seems the seller has a history with those types of domains

Yes, but notice how the listing has changed a lot. It seems to be in response to this post or maybe a complaint at Godaddy. It now makes sure that the phrase -

“Sold exactly as in the description, please read.”​

is featured at TOP of Listing - and at TOP of Description

SEE -
TOP of Listing TOP of Description ​

I wouldn't be surprised if Scam lister has come to this post, as NamePros techs have done good work and got high trust with Google and our NP posts get high up in search results. OR... one of our fellow NPers may be the Scam Lister

However note that the attempt to appear above board and honest listing, is only a surface impression.

WHY? See this -

When you get down to the actual description that we are asked to 'please read' we find in the description that the ebay item lister tries to be obtuse and diffuses the description to trap the unwary or unknowledgeable buyer.

i.e. lister inputs this, as the text to legally describe the actual listing domain

" you are buying the IDN domain name х3 which is equal to the punycode xn--3-fub "

i.e. where are the .com parts of the two domain addresses in this?​

instead of the clear correct TLD description, which would be -

" you are buying the IDN domain name 'х3.com' which is equal to the punycode domain name 'xn--3-fub.com' "

i.e. х3.com --> is --> xn--3-fub.com​

SEE Here --> (Click)

WHY did s/he not input the correct .com TLD ending of the address. Because s/he wants to con the unwary buyer.

Then there is this aspect they try to get past us a buyers -

"PROOF OF OWNERSHIP: Paste the following url in your browser: http://www.х3DOTcom/Ebaylistingproofofownership and replace the dot with a . This will take you to this very ebay listing."​

The con here is that the scam con man asks you to "Paste the following URL"
so that unsophisticated domain buyers paste the false х in together with the rest of the address. i.e. x is the 'poison cargo' in amongst that text load, unknown by the unwary.

So to see this, do please Paste the above bold Proof of Ownership (3 bold lines) in paragraph above this one or from ebay listing, into Text Magic --> Link
and see what I mean. (the hidden IDN will instantly appear in orange)

i.e. result -

IMAGE Here --> (Click)

So Scam Ebay Lister has moved Listing and added the 'please read description' to appear to be honest. But when you see how they have attempted to obfuscate it, you see that it is really not what it appears and they are still trying to trap the unwary.


We at NP are safe from making a mistake and getting caught out by this because of our domaining knowledge, but what about casual eBay buyers?

 

[briguy]

Thanks @barcher for sharing your advanced knowledge and yet keeping it ease to understand!

If I wasn't on a strict budget (part of my self-inflicted recovery program lol) pretty sure I would have bought one of these "phony 2C/3C" com's by now...do have a addiction for short character domains!

 

[todaygold]

I wonder why the seller picked ebay, of all places though. Ebay/paypal is well known for siding with the buyer...even if the seller puts 'as is/no refunds'. Once the buyer sees what they bought and complains to ebay/paypal, they will almost certainly remove the funds from the sellers account and give it back to the buyer. Unless the seller is hoping the buyer doesn't notice what they bought for a long time?

 

[barcher]

yet keeping it easy to understand!

No, not advanced knowledge. Just a bit of detective work. Anyone could do it. Then just wanting to help others avoid the scam by laying it out in a fast easy to read format. But thanks.

 

[Jeff Weller]

A few of us with a knack for asking obnoxious questions could log onto our eBay accounts and ask this seller to explain puny code / IDN - the questions would be much more visible than the buried disclaimer. Of course they will just do the same thing on their next listing - but maybe enough pressure will get them to clean up their act.