Scammed by Network Solutions?

[James Rodman]

EDIT POST: not sure who the scammer is. looks like NS might be

 

[Keith DeBoer]

Nice to see a happy ending. Congrats to both of you for seeing it through!

 

[James Rodman]

Nice to see a happy ending. Congrats to both of you for seeing it through!

not really a happy ending for me but im glad chetan is happy.....

 

[Beezy]

not really a happy ending for me but im glad chetan is happy.....

Has Flippa shined any light on the seller yet? What about the mods on namepros regarding that user account?

 

[James Rodman]

Has Flippa shined any light on the seller yet? What about the mods on namepros regarding that user account?

i sent an email to flippa but no reply still

 

[Paul]

2015-01-28: Last WHOIS update before 2015 expiration date; owner is Long Island Online Services, Inc
2015-07-21: Domain expired with registrar (NETWORK SOLUTIONS, LLC; IANA ID 2)
2015-08-25: Dropcatchers were reporting that Lio.net had expired and was pending drop the same day
2015-08-25: Lio.net dropped; picked up by NameJet
2015-08-29: Lio.net picked up and sold by NameJet for $1,800
2015-09-02: Lio.net parked with Sedo

The domain was not renewed in July. Part of NameJet's deal with Network Solutions is that they agree to back-pay the renewal costs. The domain was renewed on 8/25 by NameJet.

Without taking into account either of the stories written here, the history of these domain seems pretty clear: an end-user owned it, it expired, NameJet got it, high bidder bought for $1,800. I don't see how anyone else mentioned--James or Chetan--ever had their hands on this domain in this timeframe.

I'm not going to read all 15 pages of speculation, but I noticed mention of Flippa while skimming through. It looks like this auction probably took place shortly after NameJet sold the domain. At first, this leads me to believe that Chetan bought the domain from Danny ort privately, resulting in the auction being cancelled shortly after its creation. But this doesn't quite make sense: if I understand correctly, Chetan bought it for $440, but Danny ort bought it only days prior for $1,800. That math doesn't quite add up. Nevertheless, we'll ignore that for now, because...

2015-09-11: (+/- 2 days) Nameservers for Lio.net now point to ns1/ns2.cyanhost.com. WHOIS for cyanhost.com has Chetan's name.

So, without doubt, by 2015-09-11, Chetan was the rightful owner of the domain.

Then we have this curious event:

2015-09-15: (+/- 2 days) Nameservers for Lio.net now point to ns2626/ns1626.ztomy.com

ztomy's server redirects to malware distribution sites, probably for affiliate pay. So, here's how it works:

1. You go to one of ztomy's websites
2. You get a virus
3. ztomy (or someone else--does it matter?) gets your usernames, passwords, credit cards, and (evil laugh) domains.

@chetan9693, @James Rodman, one of you got hacked. If that domain ever made it into your account, James, it was you. Otherwise, it was Chetan.

My secret sources lead me to believe that James was the unfortunate victim. That's not definitive, though. There's also the remote possibility that Chetan or James is the culprit behind ztomy.

tl;dr: One of you needs to change your passwords. Probably both of you just to be safe.

To everyone else who reads this and feels the need to investigate ZTOMY: Don't. You'll end up in the same mess.

 

[Beezy]

2015-01-28: Last WHOIS update before 2015 expiration date; owner is Long Island Online Services, Inc
2015-07-21: Domain expired with registrar (NETWORK SOLUTIONS, LLC; IANA ID 2)
2015-08-25: Dropcatchers were reporting that Lio.net had expired and was pending drop the same day
2015-08-25: Lio.net dropped; picked up by NameJet
2015-08-29: Lio.net picked up and sold by NameJet for $1,800, allegedly to New Ventures LLC
2015-09-02: Lio.net parked with Sedo

The domain was not renewed in July. Part of NameJet's deal with Network Solutions is that they agree to back-pay the renewal costs. The domain was renewed on 8/25 by NameJet.

Without taking into account either of the stories written here, the history of these domain seems pretty clear: an end-user owned it, it expired, NameJet got it, high bidder was New Ventures LLC. I don't see how anyone else mentioned--James or chetan--ever had their hands on this domain in this timeframe.

I'm not going to read all 15 pages of speculation, but I noticed mention of Flippa while skimming through. It looks like this auction probably took place shortly after New Ventures LLC acquired the domain. It's a possibility that Danny ort = New Ventures LLC--of course, someone probably already pointed this out. At first, this leads me to believe that chetan bought the domain from Danny ort privately, resulting in the auction being cancelled shortly after its creation. But this doesn't quite make sense: if I understand correctly, chetan bought it for $440, but New Ventures LLC bought it only days prior for $1,800. That math doesn't quite add up. Nevertheless, we'll ignore that for now, because...

2015-09-11: (+/- 2 days) Nameservers for Lio.net now point to ns1/ns2.cyanhost.com. WHOIS for cyanhost.com has Chetan's name.

So, without doubt, by 2015-09-11, Chetan was the rightful owner of the domain.

Then we have this curious event:

2015-09-15: (+/- 2 days) Nameservers for Lio.net now point to ns2626/ns1626.ztomy.com

ztomy's server hosts a malware distribution site. So, here's how it works:

1. You go to one of ztomy's websites
2. You get a virus
3. ztomy gets your usernames, passwords, credit cards, and (evil laugh) domains.

@chetan9693, @James Rodman, one of you got hacked. If that domain ever made it into your account, James, it was you. Otherwise, it was Chetan.

My secret sources lead me to believe that James was the unfortunate victim. That's not definitive, though.

tl;dr: One of you needs to change your passwords. Probably both of you just to be safe.

To everyone else who reads this and feels the need to investigate ZTOMY: Don't. You'll end up in the same mess.

New Ventures LLC is a division of Network Solutions, btw. You can look up their 570 number it resolves to several Network Solutions departments.

I think this is the whois they use when sending domains to auction at Namejet (please someone correct me if I'm wrong).

 

[Paul]

New Ventures LLC is a division of Network Solutions, btw. You can look up their 570 number it resolves to several Network Solutions departments.

I think this is the whois they use when sending domains to auction at Namejet (please someone correct me if I'm wrong).

Makes sense. I'll update the post; thanks.

 

[DomainGist]

I'm not going to read all 15 pages of speculation, but I noticed mention of Flippa while skimming through. It looks like this auction probably took place shortly after New Ventures LLC acquired the domain. It's a possibility that Danny ort = New Ventures LLC--of course, someone probably already pointed this out. At first, this leads me to believe that chetan bought the domain from Danny ort privately, resulting in the auction being cancelled shortly after its creation. But this doesn't quite make sense: if I understand correctly, chetan bought it for $440, but New Ventures LLC bought it only days prior for $1,800. That math doesn't quite add up. Nevertheless, we'll ignore that for now, because...

Danny Ort is James Rodman, who didn't sell the name on flippa.

Chetan didn't buy the domain from flippa, and didn't buy it for $440.

James Rodman (Danny Ort) purchased the domain for $440 on flippa, and then sold it to Chetan for $1000+

 

[James Rodman]

Makes sense. I'll update the post; thanks.

wowww. i think chetan got hacked by ztomy then or i understood it wrong. just to clear up i was the one who bought this on flippa (i m not ventures llc or whoever they are) for 440 and chetan bought from me on here as private deal for 1000 and yesterday it was gone from his account. so were we all wrong that thisguy named "Jack" wasnt the scammer?

 

[Jordan22111]

I highly doubt networksolutions are scamming people, maybe they are just ruthless business practices because they have been in business since the start along with the other early risers in the domain industry.

 

[Paul]

wowww. i think chetan got hacked by ztomy then or i understood it wrong. just to clear up i was the one who bought this on flippa (i m not ventures llc or whoever they are) for 440 and chetan bought from me on here as private deal for 1000 and yesterday it was gone from his account. so were we all wrong that thisguy named "Jack" wasnt the scammer?

Bah, I can't keep track of who did what. Point is, somebody who doesn't care about your security/privacy/sanity now has the domain.

 

[James Rodman]

Bah, I can't keep track of who did what. Point is, somebody who doesn't care about your security/privacy/sanity now has the domain.

chetan had the domain in his account last and it was gone yesterday. so he was hacked? and domain wasnt expired then right?

 

[Paul]

chetan had the domain in his account last and it was gone yesterday. so he was hacked?

Maybe, maybe not. Hard to say which one of you for sure. You should both change your passwords, just to be safe--though that won't fix the problem if you still have malware. (Or maybe it was just a successful phishing attack; could've been a million things.) This ztomy guy has the domain now, and I doubt he's going to be interested in parting ways with it. Of course, if Network Solutions and Public Domain Registry both cooperate, you may be able to get it back, but that's always a matter of luck. Whoever had the domain last would have to contact them about that. (Chetan, in this case?)

Or ztomy could be Chetan's. Or yours. Who knows

 

[James Rodman]

ok then previous owner "jack" is innocent and everyone blaming me on here for dealing with "Jack" are also wrong as he looks innocent in all this from what Paul is saying. Also now we know flippa isnt involved in this but still curious to see he was banned there

Maybe, maybe not. Hard to say which one of you for sure. You should both change your passwords, just to be safe--though that won't fix the problem if you still have malware. (Or maybe it was just a successful phishing attack; could've been a million things.) This ztomy guy has the domain now, and I doubt he's going to be interested in parting ways with it. Of course, if Network Solutions and Public Domain Registry both cooperate, you may be able to get it back, but that's always a matter of luck. Whoever had the domain last would have to contact them about that. (Chetan, in this case?)

Or ztomy could be Chetan's. Or yours. Who knows

thanks for clearing this up this makes it a lot easier now and we can eliminate certain people who we thought were at fault (jack)

 

[Paul]

WHOIS for ztomy com reveals this:

Registration Service Provided By: SKENZO FZE

Seems to have something to do with http://skenzo.com/.

lio.net was definitely owned by Chetan at one point, which means it left your account. WHOIS doesn't lie. Ethically, Chetan should be taking the loss on this one, unless you'd rather compromise.

 

[forge]

Maybe, maybe not. Hard to say which one of you for sure. You should both change your passwords, just to be safe--though that won't fix the problem if you still have malware. (Or maybe it was just a successful phishing attack; could've been a million things.) This ztomy guy has the domain now, and I doubt he's going to be interested in parting ways with it. Of course, if Network Solutions and Public Domain Registry both cooperate, you may be able to get it back, but that's always a matter of luck. Whoever had the domain last would have to contact them about that. (Chetan, in this case?)

Or ztomy could be Chetan's. Or yours. Who knows

Your scientific method isn't.

I know you can do better (my inner math teacher is speaking).

 

[James Rodman]

i had this domain for basically less than 1 day and chetan had it for a month. who seems like the likely candidate here and had their account hacked?.....

 

[Simon Taylor]

ok then previous owner "jack" is innocent and everyone blaming me on here for dealing with "Jack" are also wrong as he looks innocent in all this from what Paul is saying. Also now we know flippa isnt involved in this but still curious to see he was banned there


thanks for clearing this up this makes it a lot easier now and we can eliminate certain people who we thought were at fault (jack)

I would certainly not fully discount that you were scammed at this point IMHO. Theres too many red flags on the purchase to rule it out at this point.

Did you phone flippa? If it was my money I'd be on the phone yesterday.

 

[Paul]

Your scientific method isn't.

Isn't what? :P I'm sticking to the history that I found. With the exception of one WHOIS record that matches Chetan, I don't know who's who in that history. I can just see that stuff moved. The rest is just guesswork, and I won't pretend it's anything more than that.

 

[James Rodman]

I would certainly not fully discount that you were scammed at this point IMHO. Theres too many red flags on the purchase to rule it out at this point.

Did you phone flippa? If it was my money I'd be on the phone yesterday.

i emailed them as Kevin mentioned in the thread still waiting on a reply