Yet another possible stolen LL dot com

[TheLegendaryJP]

While doing the usual look see at some LL names I ran across SY.com again.

Whois looked solid, think he has turned me and others down several times in the past but figured it doesnt hurt to shoot again, so I did. This is his contact info...

Registrant:
Butler, Paul S.
108 COATBRIDGE LN
MADISON, AL 35758-6218
US

Administrative Contact, Technical Contact:
Butler, Paul S.
108 COATBRIDGE LN
MADISON, AL 35758-6218
US
256-830-0880 fax: 256-721-1575

pbutler@hiwaay.net


The reply however to the email sent to the whois admin was from this guy..

centralemails@gmail.com; on behalf of; Gaurd Dragon [GaurdDragon@Gmail.com]

Obviously a big red flag so I decided to do a little research and found this...

http://74.125.95.132/search?q=cache:...&ct=clnk&gl=ca

As you can see he is linked to several other thefts, naturally looking to see if I could help I called the owner ( home ) left a voice message and sent an email to a different addresss on another name he owns.

Any way, no reply or returned call so not alot more I can do but warn everyone here to be careful and hope that Paul responds or at least is aware and working on it already.

Clearly the theif has hacked his email and has yet to change any whois info so always be on the lookout for strange replies/email addresses when buying.


P.S. not sure if these two are stolen as well, the whois is very suspicious but again not sure. Range.com appears to belong to Denny007 at one point last motnh so not sure if Range.com was stolen, sold, never his ??? Any way here was the guys reply.

Looking for 80K
also we can deal on Range.com Or Strikers.com , tell me your offer for them if intersted...

[stewie]

thx

[denny007]

Damn true, range.com stolen no idea HOW
Will do research

[TheLegendaryJP]

Denny see the link for the names stolen the owners got back. If any were at the same registrar as range.com use that as evidence when calling the registrar and maybe they push it back etc. Good Luck

[denny007]

After investigation:
The theft happened at Enom, it is name from TRAFFIC auction
24.2. it was in reseller account "dotsold@gmail.com" belonging to Cyber2Media
8.3. it was in reseller account "info2@enom.com dotsold@gmail.com" still belonging to Cyber2Media
This is already strange
10.3. it was in reseller account "info2@enom.com escrow@moniker.com" belongning to Moniker escrow
It's stranger now
12.3. it was allegedly in my reseller account "grrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrrrrr@startseek.com" till 23.3.
(how they could push so soon after another push when Enom has 7-day rule ?)
24.3. it was in reseller account PRETENDING to be mine "grrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrrrrr@startseek.com domainlistingagency@gmail.com" still using PARTIALLY my credentials in whois

I just talk with someone and something like that happened to him too the trick was domain password

I still have other valuable domains in that Enom account, none missing, so this theft must have something to dowith previous owner - Banana can you check if this Cyber2media had some domains stolen, maybe dead account ? Or maybe someone sold stolen domains via TRAFFIC auction ?

I will get it abck and lesson: NEVER accept push from escrow, always wait for transfer to Moniker.

[TheLegendaryJP]

Ill check it out in the morning, off to bed soon but yes I saw Cyber2media whois before yours. Ill report back

[Acro]

*Many* former Cyber2Media domains were sold on NameJet as pre-released.

[denny007]

*Many* former Cyber2Media domains were sold on NameJet as pre-released.

Yeah this is strange, one would say dead account, but this guy bought 401.com recently so he is pretty much alive. Something really fishy going on here, my acccount has not been compromised, nor email, this domain likely had set password on it.

[TheLegendaryJP]

Sent Daniel ( Cyber2 ) a PM on another forum with a link to this thread so we'll see what he has to say.

[cyber2]

Got a message from Josh Pelissero @ DBR. We sold range.com at Domainfest in January as it was not a vertical we wanted to pursue anymore. Congrats on the pickup whoever got it. Not sure the connection with SY.com - we have never owned that.

[denny007]

Got a message from Josh Pelissero @ DBR. We sold range.com at Domainfest in January as it was not a vertical we wanted to pursue anymore. Congrats on the pickup whoever got it. Not sure the connection with SY.com - we have never owned that.

The connection with SY.com is same thieve stole it.
Can you tell details about range.com - how did you acquire it ? There was password on it, I was not aware password gets pushed when account is pushed. Did you setup password or from whom did you buy it and when.
Also can you comment on changes in reseller accounts at Enom posted above ? When did you push to Moniker ?
Thanks

[TheLegendaryJP]

Not seeing a connection when I scan the list of stolen names in the other thread in regards to a pattern at a partocular registrar. Its all over the place, enom, netsol, name.com etc etc etc

This guy has no target at one registrar, he either is using some software or works really hard at tricking them to give up passwords. Its interesting in some cases he leaves the whois alone, in these cases it must be a password hack.

[denny007]

This guy has no target at one registrar, he either is using some software or works really hard at tricking them to give up passwords. Its interesting in some cases he leaves the whois alone, in these cases it must be a password hack.

Not in my case, really. I will try to make Enom investigate but question is if they will be willing

[TheLegendaryJP]

I know he got more but trying to connect it back to one individual atm with no luck so far.

[denny007]

Domain is frozen at Answerable communicating with Enom, Enom will investigate how exactly it happened and Moniker helping big time too. For me most important is to find out HOW it happened, it's for me even more improtant than have the domain back. Once I know details I will post it here. Hopefully Enom logs everything and keep those logs for a while.

[TheLegendaryJP]

Keep us posted.

[victornumber]

thanks for the tip!

[tomsa]

Seems ado.com is also part of the theft (see recent whois history)

babe.org and reserve.org were stolen too but apparently recovered by the previous owner

[dominator]

Aftermarket.com listing

36 Range.com $20,000

[denny007]

Aftermarket.com listing

Good find
Listed for GEOEXPO
http://www.domaintools.com/domain-au...ve/GeoExpo2009
Those thieves are idiots

If anyone has direct emailt to someone from Aftermarket pls let me know, I just sent them email to their whois contact not sure if someones reads it