Domain Hijack Attempt Today...

**JuniperPark** · 10-08-2009, 01:01 PM

Looks like we may have a hijacker from The Netherlands trolling the waters.

He made an offer, I accepted, and he insisted on Escrow.com. Since I use eNom push to change ownership, and that only takes a minute, I set the 'inspection period' to 2 days. This is plenty of time to log in an verify the domain is there, but NOT enough time to transfer it elsewhere (aka STEAL it).

For those not aware, one method scam artists use is to require a long 'inspection period', transfer the domain out, then cancel escrow and get a refund claiming the domain is not in the account it was supposed to be in.

When I explained this to today's buyer, he was not only unable to give a valid reason for needing 7 days, he suggested I "Google is name to see his reputation" and to cancel the deal if I would not give him 7 days.

That completes the trifecta of fraud -- social engineering + urgency + threat of loss of sale + opportunity to steal the domain.

I'm guessing he's working on another domainer as I type this....

EDIT: I want to make it clear there is nothing wrong with Escrow.com or their procedure. This is entirely about a scam artist playing us all, and trying to buy as much time as possible to get away with it.

**Mike Cruz** · 10-08-2009, 04:48 PM

thanks for the heads up

**JuniperPark** · 10-08-2009, 04:52 PM

There has now been a 3rd request (within 24 hours) from a "different" person about another domain requiring use of Escrow.com and a long inspection period, from a "throwaway" email address.

Someone is working the domain hijacking angle this week!

**Big P** · 10-08-2009, 04:57 PM

Possible to put the email addys you are getting these from?

**JuniperPark** · 10-08-2009, 07:45 PM

Originally Posted by Big P

Possible to put the email addys you are getting these from?

I don't want to post the emails of these because it's only a strong suspicion at this point. I definatly post emails of those who rip me off, however

**tekz999** · 10-08-2009, 08:54 PM

Thanks for the heads up. Well-spotted.

**BidNo** · 10-08-2009, 09:05 PM

Yes, thanks for the heads up.

**loudbeats.com** · 10-08-2009, 09:10 PM

Originally Posted by JuniperPark

I don't want to post the emails of these because it's only a strong suspicion at this point. I definatly post emails of those who rip me off, however

lol why would you wanna get ripped off anyways? if its suspicious, it's more likely a scam!!

**bigfishion** · 10-08-2009, 09:52 PM

I just had an attempt from a DNForum member. His username is ydnaemsti, and he is trying to buy Nokia domains. He offered to pay upfront and test my domain for 5 days. This sounded just like the scam mentioned in this thread so I refused. He replied with the following "sorry, dont want it for free". What does that mean? I don't want to sell my domain with a 5 day tasting period, and he doesn't "want it for free"? Even more alarms are going off. Be warned about him as well.

**TechMan** · 10-09-2009, 12:56 AM

Originally Posted by bigfishion

I just had an attempt from a DNForum member. His username is ydnaemsti, and he is trying to buy Nokia domains. He offered to pay upfront and test my domain for 5 days. This sounded just like the scam mentioned in this thread so I refused. He replied with the following "sorry, dont want it for free". What does that mean? I don't want to sell my domain with a 5 day tasting period, and he doesn't "want it for free"? Even more alarms are going off. Be warned about him as well.

He is the same user who asked me to change nameservers for 5 days before purchasing.

http://www.dnforum.com/f34/someone-a...ad-389736.html

**Big P** · 10-09-2009, 01:03 AM

Originally Posted by JuniperPark

I don't want to post the emails of these because it's only a strong suspicion at this point. I definatly post emails of those who rip me off, however

Gotcha! Thanks for the heads up.

**Stian** · 10-09-2009, 02:16 AM

Originally Posted by JuniperPark

Looks like we may have a hijacker from The Netherlands trolling the waters.

He made an offer, I accepted, and he insisted on Escrow.com. Since I use eNom push to change ownership, and that only takes a minute, I set the 'inspection period' to 2 days. This is plenty of time to log in an verify the domain is there, but NOT enough time to transfer it elsewhere (aka STEAL it).

For those not aware, one method scam artists use is to require a long 'inspection period', transfer the domain out, then cancel escrow and get a refund claiming the domain is not in the account it was supposed to be in.

When I explained this to today's buyer, he was not only unable to give a valid reason for needing 7 days, he suggested I "Google is name to see his reputation" and to cancel the deal if I would not give him 7 days.

That completes the trifecta of fraud -- social engineering + urgency + threat of loss of sale + opportunity to steal the domain.

I'm guessing he's working on another domainer as I type this....

Same thing happened to me once. The buyer insisted on the 7 days inspection period so I asked him why he needed that and he had no good explanation either.

What I did was I talked to Sandra Gordon @ Escrow.com and she just told me to call her before I pushed the domain and she would immediately confirm that the domain was pushed and then she would release his payment to me. The transaction went smooth, but I still think that the buyer was attempting something.

Better be careful. If you have any concerns, a phone call to Escrow.com usually does the trick. They are great with domain name transactions and they know most of the scammer's "tricks" and how to avoid them.

**Mazkel** · 10-09-2009, 06:31 AM

Thanks for the heads up!

**tonyk2000** · 10-11-2009, 09:51 PM

I had successful sales through escrow.com where the buyers insisted on longer inspection periods, I remember a few sales with 1 week inspection period and even 1 sale with 2 weeks period... I was never able to get a straight/reasonable answer from the buyers why do they need such a long inspection period, but the sales came through OK.

Escrow.com should change this aspect of their domain operations... they already lost a lot of business to moniker and sedo, because, indeed, a full service should be escrowing both the domain and $$$... saying nothing about Euro transaction currency available at sedo - a big advantage...

**iestates** · 10-12-2009, 04:34 PM

Originally Posted by JuniperPark

I don't want to post the emails of these because it's only a strong suspicion at this point. I definatly post emails of those who rip me off, however

I think you should post the emails to see if they match emails that anyone else has received...then you would know for sure it was a scam, right?

Originally Posted by bigfishion

I just had an attempt from a DNForum member. His username is ydnaemsti, and he is trying to buy Nokia domains. He offered to pay upfront and test my domain for 5 days. This sounded just like the scam mentioned in this thread so I refused. He replied with the following "sorry, dont want it for free". What does that mean? I don't want to sell my domain with a 5 day tasting period, and he doesn't "want it for free"? Even more alarms are going off. Be warned about him as well.

Experienced the same thing from this member. Didn't bite.

**DotSauce** · 10-13-2009, 12:07 PM

I have received several visitors from Google who were searching for "how to hijack a domain" lol. Of course I don't have any articles like that but the keywords were in place.

I could probably look up their IP in referral logs if anyone wants to give em a taste of their own medicine

**britishbulldog** · 10-13-2009, 12:49 PM

Hang on i had the same,escrow could see i no longer owned the domain and released the money no worries.

**Domainator** · 10-13-2009, 02:51 PM

I have a situation where as I bought a domain and site from a member here on DNF for $200. recently. The guy took my money and then claimed he had accidently sold it to someone else and promised me a refund. Then came all the excuses-- PayPal froze his account, he would western union the funds and so on and so on. All via PM thread. This appears to be another way a scammer can take your hard earned cash and blow you off hoping that you will not retaliate or feel sorry for him.

Scammers ought to be hung by their nucking futs!

BTW, this clown is an Exclusive since 2003....

**britishbulldog** · 10-13-2009, 04:42 PM

Originally Posted by Domainator

I have a situation where as I bought a domain and site from a member here on DNF for $200. recently. The guy took my money and then claimed he had accidently sold it to someone else and promised me a refund. Then came all the excuses-- PayPal froze his account, he would western union the funds and so on and so on. All via PM thread. This appears to be another way a scammer can take your hard earned cash and blow you off hoping that you will not retaliate or feel sorry for him.

Scammers ought to be hung by their nucking futs!

BTW, this clown is an Exclusive since 2003....

name and shame him then so we all don't get ripped off by him ?