IDNR - Scam

[URLCollection]

We got the following email from this International Domain Name Registry attempting to have a domain name transfered to them. Another scam - Seems like Tucows should unplug these guys? Just a heads up to all - Steve

International Domain Name Registry
(IDNR) has received an application
for registration of the domain XXX.XXX by a
third party, that is almost identical
to your domain name XXX.XXX .
International Domain Name Registry
was founded for registration, control
and monitoring of domain names and
trade marks that include copyright
control, fair business regulations,
legitimate usage and activity,
dispute and claim consideration of
property breach of the domain for
transfer to the court.

Registration of the domain name similar to your own can be done for the reasons mentioned below:

1. The third party wants to use the domain name for any purposes, including business, distinct from your business activity.
2. The third party wants to register the domain name for creation of a business similar to yours.
3. The third party (that, probably, before registration of a domain name was your competitor also) wants to disrupt the business of a competitor, or intentionally attempt to lure the customers of another business by creating a confusingly similar Web address.

Consequently, it is our opinion that this application may have been submitted in bad faith.

You are required to submit to us your opposition to the third party domain name registration contemplated herein and expressly advise us of your intent to license this domain name (go to www.indregistry.com, choose 'register a domain' then 'block the application of the third party') prior to the expiration of this notice (which is one working day after it is sent) or licensing rights to the domain name would be assigned to any applicant. In this case IDNR WILL NOT BE LIABLE FOR THE LOSS OF DOMAIN NAME LICENSE, IDENTICAL OR CONFUSINGLY SIMILAR USE OF YOUR COMPANY'S NAME; OR INTERRUPTION OF BUSINESS ACTIVITY OR BUSINESS LOSSES.
Also IDNR further will not consider your complaint to infringement of your rights for
IDENTICAL OR CONFUSINGLY SIMILAR USE OF YOUR COMPANY'S NAME; OR INTERRUPTION OF BUSINESS ACTIVITY OR BUSINESS LOSSES.

Thank you.
International Domain Name Registry.

Whois indregistry.com The registrant contact info is for the Beacon Hotel in New York City - Upon a phone call there - They have never had a guest or anyone by the name of David Boui.

Hotel Beacon 2130 Broadway at 75th Street New York, NY 10023
Telephone: 212-787-1100 Fax: 212-724-0839
Toll Free Reservations USA & Canada 800-572-4969 Email Us

TUCOWS INC.
Domain Name: indregistry.com

The results below are provided by TUCOWS INC. (whois.opensrs.net)

Registrant:
David R Boui
2130 Broadway at 75th street
New York, NY 10018
US

Domain name: INDREGISTRY.COM
Administrative Contact:
Chernov, Alexander sysadm@arbatek.ru
31, Lenin av.
Moscow, RU 119991
RU
+7 095 1057610 Fax: +7 095 1057610
Technical Contact:
Chernov, Alexander sysadm@arbatek.ru
31, Lenin av.
Moscow, RU 119991
RU
+7 095 1057610 Fax: +7 095 1057610

Registration Service Provider:
sysadm@arbatek.ru
+7 095 1057610
+7 095 1057610 (fax)

Registrar of Record: TUCOWS, INC.
Record last updated on 23-Dec-2004.
Record expires on 23-Dec-2005.
Record created on 23-Dec-2004.
Domain servers in listed order:
NS1.DREAMDNS.NET 195.161.112.14
NS2.DREAMDNS.NET 195.161.117.3
_________________

[Nexus]

That's a shame. Sounds like they're using some hokey "protect your trademark or brand" excuse to imply people should register a new name with them. That seems to be an increasingly popular tactic.

File a trademark, and people see the publication as incentive for them to mail you all sort of solicitations for "extended services" that look like billing invoices and are supposedly for you own good. At the end of the day, they get to sell you a service they otherwise may not have sold, and you can't say you didn't get what you paid for.

They don't promote it much anymore, but I remember the press release GoDaddy sent about this service:
https://www.godaddy.com/gdshop/devious.asp

About from their odd Whois record, might be useful to check this out:
http://www.indregistry.com/about.php

IDRregistry was founded in 1998 for registration, control and monitoring of domain names and trade marks that includes copyright control, fair business regulations, legitimate usage and activity, dispute and claim consideration of property breach for domain for following transfer to the court.

International domain name registry (IDNR) launched this consumer information site (INDREGISTRY.COM) for the benefit of persons and companies that wish to know who has applied for a domain name or trademarK similar to their own.

230 West 54th Street, New York, NY 10019 Box 2413
Customer Service Line: +1-212-247-5000
Hours: 9:00am - 6:30pm Monday to Friday
All messages will be returned within 12 hours.
Or respond by Toll Free Fax: +1-212-247-5120
Our email is info@idnregistry.com

The phone number listed belongs to Verizon.
Phone Number: 2122475120
CARRIER: VERIZON NEW YORK, INC.
CITY: NWYRCYZN01
STATE: NY
-----

~ Nexus

[actnow]

Steve,

I also got one of those the other day. I read it twice, thinking maybe I'm
missing something.

And, I also looked in whois.

As soon as I saw the email address ending in .ru, I deleted the email
knowing that I was being scammed.

(I only received one which tells me they are washing the database so they
only send out one per email address.)

I'm glad to see that others are receiving these type of scam emails.
I thought maybe I had a sign posted on my head saying "stupid". :-D

[URLCollection]

Hi Richard - You would think that there is enough ways to make an honest living online without having to stoop to such bogus scams. I guess this is a sign that our industry is maturing as these types of frauds have been running in most all other industries for years. Sure does put a bad face on the domains registration side of things with scammers like this running wild. I sent a copy of this to a friend in corporate at Tucows and Icann as well. Lets see if then even bother to police this one. Take care - Steve

[Dave Zan]

Kevin Ohashi (kohashi) actually reported about this soon after getting it as
well. His further research discovered the address and phone number listed by
IDNR actually belonging to a hotel.

He's reported it to the FTC. No updates so far.

(PM me if you want the link. I don't know if I'm allowed to post it here)

[mike031]

about a year ago i had a large portion of my domains with a tucows reseller.. probably a lil over 1k names... i remember receiving actual mail from this guys telling me some of my domains were due to expire (which they were within a month or so as i recall) and they included a billing invoice (asking for credit card info, authorization, etc.) the letter was put together nicely and looked authentic.... it was mailed in from canada i believe? i dismissed it but i am sure others who didnt know any better fell for it.

anyways... why are this guys still online? they should of been shut down along time ago......... this is sad

[Nexus]

Originally Posted by URLCollection

We got the following email from this International Domain Name Registry attempting to have a domain name transfered to them. Another scam - Seems like Tucows should unplug these guys? Just a heads up to all - Steve

Kind of an important note, could someone point out the part that seeks to TRANSFER a domain name to them? I was noting earlier that is seems like the "scam" is in simply getting you to register names by implying someone ELSE was going to do it, and only by registering it NOW will you "protect" yourself. Their wording seems a bit thick, but I'm missing the "transfer threat" here. Not that I think trying to get people to buy registrations out of vague "fear" of threat is acceptable either, but I think its important be clear on what we're looking at for threats.

Steve, in your original e-mail, you've replaced the domain names in the quote. Were BOTH mentions the SAME name, or different?
-----------------
registration of the domain XXX.XXX by a
third party, that is almost identical
to your domain name XXX.XXX .
-----------------

~ Nexus

[Acro]

Got it as well.

[cwsteam.com]

Hey, how can u check who is the carrier of a phone ? I saw above you said it was a verizon phone ....!! I need to check a few whether they are cell phone numbers or not.

[mike031]

you can't really tell if a number is a cell/home/business line anymore... even cell phone numbers can be switched around from one carrier to another easily... so if a number was originally assigned to verizon for example and it was switched around to a different service just recently, it wouldn't show the new carrier... you can still try out the site below, use the "reverse phone lookup"

http://www.reversephonedirectory.com

[URLCollection]

Update - Just got an email reply from them -

Dear Sir,

Please be informed that we have received the notification of your concern regarding the fraudulent information, coming from the owner of INDREGISTRY.COM domen.

We have sent the inquiry to our client to confirm the personal data, mentioned in his request for the domen registration. The inquiry dated 02-21-2004 was sent at 03:07 PM Moscow time. For the moment we have not received any feed back from the client, neither they answer our phone calls.

With this letter I would like to inform you that JSC Arbatek provides hosting services and register domains as the reseller of the Tucows Inc. (OpenSRS) for many years. We are very strict with following up on the procedures for the domen registration according to the agreement with Tucows Inc. (OpenSRS), and require from our clients full coherence with the rules and procedures, set by ICANN and it's accredited registrars.

We are ready to provide you full support in the investigation of this scam upon receipt of an inquiry from the interested agencies in established order.


Regards,
Oleg Danilov,
System Administrator
Arbatek JSC, Webhosting Co.
sysadm@arbatek.ru
+7 095 1057610
Moscow, RF.

Then we got this response from INDR =

----- Original Message -----
From: "International Domain Name Registry (IDNR)" <support@indregistry.com>
To: <URLCOLLECTION.COM>
Sent: Friday, February 25, 2005 5:01 AM
Subject: your letter

Anyway, thank you for your attention.

the INDRegistry team.

[Dave Zan]

Originally Posted by URLCollection

Then we got this response from INDR =

----- Original Message -----
From: "International Domain Name Registry (IDNR)" <support@indregistry.com>
To: <INFO@URLCOLLECTION.COM>
Sent: Friday, February 25, 2005 5:01 AM
Subject: your letter

Anyway, thank you for your attention.

the INDRegistry team.

That said a lot. :-D

[Nexus]

Originally Posted by mike031

you can't really tell if a number is a cell/home/business line anymore... even cell phone numbers can be switched around from one carrier to another easily... so if a number was originally assigned to verizon for example and it was switched around to a different service just recently, it wouldn't show the new carrier... you can still try out the site below, use the "reverse phone lookup"

Yikes. Or you could just go to PhoneNumber.com to begin with and avoid all the pop-ups.
http://www.phonenumber.com/2321/reverse-phone
http://www.phonenumber.com/2321/sear...e=212-247-5000
-------------
Ameritania Hotels
230 W 54th St
Manhattan, NY 10019
(212) 247-5000
-------------
Still missing any reference to someone trying to TRANSFER your names. It sounds like its a registration scam though. Registering a "similar" name to yours through them looks to be akin to throwing your wallet into the street (high identity theft/credit card fraud risk).

~ Nexus

[adoptabledomains]

I received one today as well. However, most similar cases I've seen try to get you to register a name that's available in another TLD. The one they sent me in which I have the 3-letter .info, suggests I should register the 3-letter .com on their site. Since it is and has been taken, I would now conclude it's a phishing and/or domain theft scam since I know they don't have it available and can't make it available.

My letter says to click this domain diregistry.com, which was only registered 3 weeks ago, says NY in the whois, but has a Russion IP. The sites "since 1998" on the front page.

I'll bet they attempt to get you to register the name, hoping you use the same login/password as the one they mentioned. This would then let them steal the one you have if they gained access. It also could just be getting you to enter your credit card as a standard phishing scam, but just using the domain story to get you there.

[jberryhill]

http://www.gnso.icann.org/mailing-li.../msg02783.html

[adoptabledomains]

Originally Posted by jberryhill

http://www.gnso.icann.org/mailing-li.../msg02783.html

In regards to who's behind them, the IP# resolves here:

80.250.185.110


Blacklist Status: Clear
Whois History: 3 records stored
Record Type: IP Address
IP Location: Russian Federation Russian Federation - Primorskiy Kray - Vladivostok - Nethouse-spb
Reverse IP: Web server hosts 51 websites (reverse ip tool requires free login)
Reverse DNS: krews.majordomo.ru
% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

inetnum: 80.250.185.0 - 80.250.185.255
netname: NETHOUSE-SPB
descr: NetHouse
descr: Krasnogvardeyskiy per., 15A, 3/17
descr: Saint-Petersburg, Russia
country: RU
admin-c: ALD2-RIPE
tech-c: ALD2-RIPE
status: ASSIGNED PA
mnt-by: RUNNET-MNT
notify: Whois Privacy and Spam Prevention by Whois Source
notify: Whois Privacy and Spam Prevention by Whois Source
changed: Whois Privacy and Spam Prevention by Whois Source 20030523
source: RIPE

route: 80.250.160.0/19
descr: RUNNet
descr: Russian Federal University Network
origin: AS3267
notify: Whois Privacy and Spam Prevention by Whois Source
mnt-by: RUNNET-MNT
changed: Whois Privacy and Spam Prevention by Whois Source 20021014
source: RIPE

person: Aleksey L Dudenko
address: Krasnogvardeyskiy per., 15A, 3.17
address: Saint-Petersburg
e-mail: Whois Privacy and Spam Prevention by Whois Source
phone: +7 812 3200732
fax-no: +7 812 3200732
notify: Whois Privacy and Spam Prevention by Whois Source
nic-hdl: ALD2-RIPE
changed: Whois Privacy and Spam Prevention by Whois Source 20020409
changed: Whois Privacy and Spam Prevention by Whois Source 20030915
source: RIPE

Russion college student maybe?

I reported the false whois info to godaddy on the domain.

[Salient]

Steve, do you mind if I copy and paste what you typed up into my scams website? Its too easy to link a thread, but I am afraid noone will check it out otherwise - much better if I can have something for people to read!

Regards,
Stuart.

[URLCollection]

Originally Posted by Salient

Steve, do you mind if I copy and paste what you typed up into my scams website? Its too easy to link a thread, but I am afraid noone will check it out otherwise - much better if I can have something for people to read!

Regards,
Stuart.

Hi Stuart - No problem at all - Please help yourself to any of this - Also we started getting faxes as well today from these folks - Same scam just now they are faxing them in - Steve

[Keyword Factory]

Originally Posted by URLCollection

We got the following email from this International Domain Name Registry attempting to have a domain name transfered to them. Another scam - Seems like Tucows should unplug these guys? Just a heads up to all - Steve

This is interesting coming from you. You have been operating a scam for a long time where you steal the whois data and send out phony intellectual property notices. You use foreign servers to try to fend off complaints to your hosting company.

When I spoke to you on the phone you threatened me.

Someone should unplug you Mr. scammer/spammer/thief