After buying a couple of new domains, I received a suspicious email from a Richard Chavez who claimed to be interested in purchasing one of them as an investment. At first he simply asked how much I wanted for the domain and whether I had received any offers on it yet (I found this strange since I has just purchased the domain in question and just put the listing up on afternic.com... and the price was clearly shown on my parked page.)

After I told him my asking price, he then insisted that I have the domain name appraised so that we would both know the fair market value of the domain so that he would know whether it was a good deal or not. He even sent a link to a fake discussion forum where everyone recommended one particular appraisal site. Very clever. I told him that it's HIS responsibility to determine whether the domain was a good investment or not, not mine.

After another email insisting that I purchase an appraisal, I did a Google search and discovered that many other people have been scammed by this guy. Here are a couple of links that I came across:

http://domainnamewire.com/2005/06/13/anatomy-of-a-domain-name-appraisal-scam/

http://www.idnauction.com/appraisal-scam.html

So, the moral of the story: If someone insists that you buy a domain appraisal, red warning flags should go up! After all, when you invest in real estate or equities, it's the BUYER'S responsibility to research/evaluate/appraise said property, not the seller!

Here is the discussion thread that I had with the scammer:


-----Original Message-----
From: R Chavez [mailto:rchavez@toughguy.net]
Sent: Monday, August 01, 2005 2:37 PM
To: ********
Subject: Re: ********.com (sent 29-Jul-05)

You are asking for serious money and I need to be sure your name is not
overpriced.

Usually, sellers provide buyers with appraisals. It's good practice because
both parties must know a fair price.

Thank you for understanding. I'm looking forward to do business with you.


----- Original Message -----
From: ********
To: "'R Chavez'" <rchavez@toughguy.net>
Sent: Monday, August 01, 2005 8:54 PM
Subject: RE: ********.com (sent 29-Jul-05)


> When you buy real estate, it's the buyer's responsibility to know the value
> of said property. That's why the buyer pays for a professional appraisal.
>
> When investing in the stock market, the buyer must be prudent in determining
> the value (and risk) of said equity to access whether it will increase in
> value over time.
>
> So, with that said, it is not my responsibility to do your legwork in
> determining whether your investment is a smart one or not.
>
>
>
>
> -----Original Message-----
> From: R Chavez [mailto:rchavez@toughguy.net]
> Sent: Monday, August 01, 2005 12:17 PM
> To: ********
> Subject: Re: ********.com (sent 29-Jul-05)
>
> I visited your site.
>
> Ok.
>
> Do you offer a web site or domain name only? I'm mostly interested in
> names.
>
> Do you have an appraisal ? I need an independent appraisal certificate for
> domain priced in your range. I consider your name as an investment. In other
> words I'm going to sell your name later and make a profit. If I overpay I
> won't be able to make a profit in the future. It's very important for you
> and me to know the current market value of your domain.
>
> Of course, we must be sure that you are engaging a reputable appraisal
> company. Please note that I don't trust free or cheap appraisals.
>
> To avoid mistakes I asked domain experts about reputable appraisal companies
> in a forum
> http://www.domaintalk.ourplace.com/Archive/28014.htm
>
> Juck check this posting.
>
> After I verify an appraisal from you we'll continue our negotiations.
>
>
> Looking forward to your reply.
> ----- Original Message -----
> From: ********
> To: "'Tough Technologies Consulting'" <rchavez@toughguy.net>
> Sent: Monday, August 01, 2005 6:31 PM
> Subject: RE: ********.com (sent 29-Jul-05)
>
>
> > Dr. Chavez,
> >
> > My asking price is clearly listed on the domain's homepage
> > (http://www.********.com). If you're interested, please submit a serious
> > offer.
> >
> > Best regards
> >
> >
> >
> > -----Original Message-----
> > From: Tough Technologies Consulting [mailto:rchavez@toughguy.net]
> > Sent: Friday, July 29, 2005 3:09 PM
> > To: ********
> > Subject: ********.com (sent 29-Jul-05)
> >
> >
> > To Whom It May Concern,
> >
> > I'm interested in your domain name listed for sale.
> >
> > Can you drop me your desired price?
> >
> > If I can afford it I'll reply.
> >
> > By the way, did you receive offers from other buyers?
> >
> > I run a software development company. Selling & buying names is not my main
> > business. Just another way to invest money and make additional income.
> >
> > Please keep our correspondence confidential.
> >
> > Best regards,
> >
> > Richard Chavez
> >
> > Ph. D. President
> >
> > Tough Technologies Consulting
> >
> >
>
============================================================================
> > NOTICE - This communication may contain confidential and privileged
> > information that is for the sole use of the intended recipient. Any
> > viewing, copying or distribution of, or reliance on this message by
> > unintended recipients is strictly prohibited. If you have received this
> > message in error, please notify us immediately by replying to the message
> > and deleting it from your computer.
> >
> >
>
===========================================================================

Any viewing, copying or distribution of, or reliance on this message by unintended recipients is strictly prohibited.Oops. ;)

Thank you for the warning.

It's always suspicious when someone wants to buy your domain only days after you registered it. If they were that desperate, they would have registered it before you.

This IS a common and continuing scam that's been around in several different forms.

I had not seen the link to the fake forum before... that was precious. It sounds to me like the same person wrote the whole forum script. And the inclusion of the $4,100 PayPal "transaction" was a real knee slapper.

Thanks, bluecrab, that was a useful warning for those who haven't heard about the scam and that fake forum was a fun read for me. :D

Thanks for the warning, bluecrab. Additionally, here's something funny about the fake forum posts:

http://domaintalk.ourplace.com/Archive/24076.htm
http://domaintalk.ourplace.com/Archive/26074.htm

Watch the names change! :laugh:

Priceless. Not knowing quite what you meant by "watch the names change" I opened the two posts in tabs and clicked back and forth between them. Absolutely priceless. :)

On another note, though, as a responsibile seller of domains it seems to me that one may want to consider getting appraisals for your high-ticket domains. As a personal case in point, I just purchased appraisals for 65 of my domains from sedo. They were done by a human (in Germany, it would seem).

Now, on the face of it, sedo have a very good reputation and there's no reason to not place some faith in their appraisals. But (there's always a 'but') the report contains numerous typos where the person that did it clearly neglected to change things like "this" to "these" in the boiler-plate paragraphs. So it's not clear to me how attentive she really was.

And note that I said appraisals. Some of the same domains have been appraised and/or valued by other organizations. And the numbers are quite different.

Sedo values one of my .coms at 50K while GreatDomains say its 150K. Some of my two-character domains are valued by sedo at $2K while GreatDomains say $20K.

Who's right? Both. And neither.

It demonstrates that there's a range. Using the real estate analogy from above, if you build houses, the value of swampland in Florida isn't so great. But if I raise alligators, Florida swampland's worth far more to me.

So when someone offers you a number that you think is rediculously low for one of your domains, don't take it personally or get annoyed. It used to really annoy me, because I thought they were wasting my time. But in reality, there really are different values placed by different people/organizations for the same domain.

The true value of any domain is whatever you're able to sell it for.

Originally posted by Krang
Thanks for the warning, bluecrab. Additionally, here's something funny about the fake forum posts:

http://domaintalk.ourplace.com/Archive/24076.htm
http://domaintalk.ourplace.com/Archive/26074.htm

Watch the names change! :laugh:

Too funny!!

and if you have an attachment to a name you are less likley to sell it cheap

I stumbled onto this thread and had a good laugh because this exact same thing happened to me. I thought it was a little suspicious when he remained interested after I told him my name was $10k, but didn't fall into his appraisal scam. This guy is copy-pasting these emails, because it was the same thing word for word.

My domain was also on Afternic, so it might be a script that he is using to harvest email adresses from them. They might want to look into this.

I got an email from, probably, this guy in the last couple days too. He seemed to use a different email address.

I used to get these all the time until my spam filter started catching them

hey, if i could obtain ********.com, I'd want a fair price too!


In reality, thats a whole lot of scheming and trouble to go through. I feel bad for the guy, really.....

Originally posted by Domainitor
Priceless. Not knowing quite what you meant by "watch the names change" I opened the two posts in tabs and clicked back and forth between them. Absolutely priceless. :)

Classic :)


Recently, right after I purchase a domain I've been getting a letter in the mail stating that the domain that I just bought a few days ago is about to expire immediately and I must renew the domain for the low low price of $59 a year.

They could at least send the letter a few months after the fact to make it just a bit more convincing :)

Originally posted by Randomizer
Classic :)


Recently, right after I purchase a domain I've been getting a letter in the mail stating that the domain that I just bought a few days ago is about to expire immediately and I must renew the domain for the low low price of $59 a year.

They could at least send the letter a few months after the fact to make it just a bit more convincing :)

Let me guess... from the Domain Registry of America? ;)

Thanks for the warning, will keep in mind :)

Originally posted by bluecrab
Let me guess... from the Domain Registry of America? ;)


How did you know? :)

Damn, some people are just too creative. But how many people would pay to have their own domains appraised AFTER they already put the price on it?

Boy, my domain is attracting them like flies!

Now I've got someone insisting that I have my domain "researched" in order to insure that it does not violate trademark laws! Sheesh! The guy is insisting that I use http://www.softforces.com/checkdomain.htm to make sure that my domain is safe to buy (and he's insisting that I pay $49 to do so!).

Here's a snippet from his email:

------------------------------------------------------------------------

I'm not a lawyer and need a professional opinion.



I made my online research and found two reliable services we could use to verify your domain name.

First service URL http://www.legalzoom.com

But their service "WorldScan U.S. and International Search $499.00" is very expensive for us.

I found a cheaper service - http://www.softforces.com/checkdomain.htm
These guys were recommended as Internet security professionals. Looks like this service is unique because I've not found anything similar in the Internet. They will check your domain for trademark conflicts and will run other tests. I'm not a lawyer and need professional opinion on the trademark issue. After we check your domain name we'll proceed with www.escrow.com or other similar service.

This "check domain" service allows to split the fees 50% / 50% between buyer and seller. I thinks it's fair.

They will verify your domain through the stolen names database and will run other tests. I'm not a lawyer and need professional opinion on the trademark issue.

I've already ordered my part and paid $49 fee. I specified your email address so you must receive a confirmation from them shortly. You should submit your information and they will check your domain name.

They will email us the results within 1-2 business days.

Kindest Regards,

Karl Henson

Those people that want to value your domain name are a waste of dosh IMO.

a domain name is only worth what the buyer wants to pay - unless of course you build up the site.

never pay the $49 its scam

tell him if you want to appraisal it use sedo.com's appraisal service and he can pay to appraisal the domain and IF you like the price sell it.

insisting on paying means he will steal you

I will apriase it - sure you may not like what you read, but you would have at least saved yourself 49 quid.

COMSTAR
Moscow’s leading telecommunications operator since 1995.
(Formely known as MTU-INFORM)

HQ.Address: 119121, Moscow, Smolenskaya-Sennaya square, 27/2
Telephone: +7 (095) 956-00-00
Fax: +7 (095) 956-07-07
E-mail: info@comstar-uts.ru


They have a client – an old client – and probably an employee with email addresses: arnellit@mtu-net.ru (arnellit@mtu-net.ru) and/or cableguy@scubadiving.ru (cableguy@scubadiving.ru)

Who may be able to provide valuable information on the suspect who sends email messages that contain header:


MUAN.MTU.RU (muan.mtu.ru [195.34.34.229])


This header on email messages is associated with people who operate the now famous Domain-Name Purchase / Appraisal Scam – over the Internet.

The alleged Domain Name Scammer … is also known as:
Alias: Richard Chavez
Alias: Sarrah Ludwigs
Alias: Sarah Murray
Alias: Robin K. Henson
Alias: George Martin´
Alias: Karl Henson
Alias: Darren Gaudry
Alexander
Etc.


IP-Address (195.34.34.229) - TRACEROUTE:
1 195.34.36.46 (195.34.36.46) 0.920 ms 0.859 ms 0.780 ms
2 195.34.36.45 (195.34.36.45) 0.866 ms 0.824 ms 0.778 ms
3 HGW2GE1-1-3.ssilan.mtu.ru (195.34.52.8) 1.320 ms 1.349 ms 1.343 ms
4 muan.mtu.ru (195.34.34.229) 1.345 ms 1.535 ms 1.965 ms

IMPORTANT:
Companies & Services on the Internet, and their users and clients – specially those associated with the Domain Name Trade Industry … should be aware of these felons.


Hopefully, company COMSTAR will conduct an investigation along with Russian Police and stop the individual or individuals associated with the Domain-Name Purchase / Appraisal Scam.

cybercop-007 That's really good research!

I've more to contribute:
To Whom it may concern. I detected that the company SoftForces is doing
an online Scam with other partners telling people to check that a domain
name has no "trademark conflicts".
After several emails I agreeded to do this check, and paid Emetrix the
amount of 50 €. I want to stop this type of Scam and report it to the
authorities since they are doing this to a lot of people.
Please consider blocking further bussiness from this account since there
will be legal problems after this is reported.
COMPANY NAME: SoftForces

I will copy here tomorrow the full headers of their emails.

It is a scam and i've said it before.

Although the site that they talked about most was Sedo.com, which isn't a bad service at all! (And if anything, I think they make their appraisals a bit overpriced so they could get a tad bit more on the transfer fee!)

Just recieved the type of e-mail

-----------------
Hello,

I'm contacting you regarding your domain name for sale.

Did you get offers from other people?

I need to know your desired price. Please don't ask to make an offer. Just email the desired price.

I run a software company. We develop client-server systems and databases in Oracle for a local company. Buying and selling domain names is not my main business. Just another way to invest money and make additional income. Hello,

I'm contacting you regarding your domain name for sale.

Did you get offers from other people?

I need to know your desired price. Please don't ask to make an offer. Just email the desired price.

I run a software company. We develop client-server systems and databases in Oracle for a local company. Buying and selling domain names is not my main business. Just another way to invest money and make additional income.
------------------------

~ian

Valuation Scam:

I've had similar experience with these guys under the names....

Charles McQueary , Ph. D.
President
TBC Engineering

Albert K. McQueary , Ph. D.
Vice President
TLC Engineering

Jeffrey A. McQueary , Ph. D.
Vice President
TLC Engineering

The first offer I received we went back and forth a few times about the need for a valuation and who should pay, the forums (pay to join and post) and the appraisor. I figured it out to be a scam. Offered him a valuation from Afternic, which of course wasn't acceptable to him. Left me alone after that :)

Trademark Scam:

Had one of these too. He agreed my price and enquired about trademark issues. I looked up the domain at the US Trademark Office Search http://tess2.uspto.gov/bin/gate.exe?f=searchss&state=6v9qi5.1.1 and told him there were no trademark issues as the trademark had expired. Never heard from him again :)

Here was the enquiry from marc@dangermarc.com

Hi there,

My name is Marc and I'm interested in using the ******.com domain. I see
that you own it and have placeholder content there. Are you willing to
sell it?

Please let me know at this email or call 415.336.6272.

Thanks,
-m

That's my 2 cents worth :)

i receive this scam too...

From: Mark Fasciano <fasciano@bonbon.net>

Hello,

Are you still interested in selling your domain name? I saw it listed for sale.

Did you get offers from other people?

I need to know your desired price. Please don't ask to make an offer. Just email the desired price.

I run a software company. We develop client-server systems and databases in Oracle for a local company. Buying and selling domain names is not my main business. Just another way to invest money and make additional income.

Best regards,
Mark Fasciano Ph.D.
President
BON Engineering

----------------------

Do you sell a developed site or domain only? I prefer domain names.

Do you have an independent valuation from industry experts (appraisal)? I need an appraisal certificate for domain priced in your range. I consider your name as an investment. In other words I'm going to sell your name later and make a profit. If I overpay I won't be able to make a profit in the future. It's very important for you and me to know the current market value of your domain.

Of course, we must be sure that you are engaging a reputable appraisal company. I heard many appraisal companies often made inaccurate appraisals. I will only accept appraisals from independent appraisal companies I know and trust.

To avoid mistakes I asked domain experts about reputable appraisal companies in a forum
http://domaintalk.ourplace.com/Archive/48053.htm

Juck check this posting.


If the appraisal comes higher you can adjust your asking price accordingly.

After I get an appraisal from you we'll continue our negotiations.
-----------

Feeling very stupid here.

Good thing I google for "domain +appraisal +scam +forum"

I too got an email from Mark Fasciano

I emailed him twice back, sounded fishy.

Well thanks for clearing this up.

Now I will continue to find a seller

I am new to this, and I got this email today. Of course, I thought it was suspect since I just registered the domain three days ago. I just thought I would post it because it looks like the name has changed again. I am expecting another reply from the "Dr." (funny how he is always a PH.D., does that lend cred?) any suggestions on a response?

> Hello,
>
> I think you have not sold your domain name yet. I'm very interested in it.
> Can you send your price for the domain?
>
> Did you get offers from other people already?
>
> I run a software company. We develop client-server systems and
> databases
in
> MS SQL and Delphi. Buying and selling domain names is not my main
business.
> Just another way to invest money and make additional income.
>
> Looking forward to do business with you.
>
> Best regards,
> Robert Kramer Ph.D.
> President
> BS Software Engineering

We all know what BS stands for :)

Add some scammer address: both of them referred to allfordomains.com

Opera Engineering johansen@operaen.com
Hello,

What is your price for the domain mentioned in the subject line?

I'm very interested in this name.

Did you get offers from other people already?

I run a software company. We develop client-server systems and databases in MS SQL and Delphi. Buying and selling domain names is not my main business. Just another way to invest money and make additional income.

Looking forward to do business with you.

Best regards,
Robert Johansen Ph.D.
CEO
Opera Engineering

-------

Neil Stichbury nstichbury@bonbon.net

Hello,

Are you still interested in selling your domain name? I saw it listed for sale.

Did you get offers from other people?

I need to know your desired price. Please don't ask to make an offer. Just email the desired price.

I run a software company. We develop client-server systems and databases in Oracle for a local company. Buying and selling domain names is not my main business. Just another way to invest money and make additional income.

Best regards,
Neil Stichbury, Ph.D.
President
Back Office Net Solutions

--------------

I got the same message from johansen@operaen.com a couple day ago as well. It's all the same scheme but I thought it might be useful to stop these fraudster if more people are educated so I list 10 tips (http://blog.trungson.com/2006/03/10-tips-to-prevent-domain-scamfraud.html) I think is useful to prevent these guys and raise awareness for all of us.

I got one form a guy using a .no email address and a .no web site.

1st one i got ina while.

used to get one from guy claing to be ..
VP D Cheney
trsengineering.

in both cases he also refeered back to that same ourplace.com site.


i actually got his goat one time and had him tleling me he didn't like my attitude.

simply told him, put some bucks in escrow and stop trying to con me and you may get a better attitude.
then i reg'd trsengeineering.com and dcheney.com and told him if he uses my domains in his scam again i'll have legal croungs to sic the FBI on him.

hadn't seen any more like it till just the otherday.

I still have all those emails just incase his true ID is ever discovered, i can present them as eveidence in a fraud case aginst him.

i think next time.... i'll toss up a dummy apprasial on one my parked domains and refer him to it so i can get his ip.
maybe after a couple of times he can be pin pointed.

Here's the one I got today. This is the second email. The first one fooled me, I though it was genuine. This second one threw up flags all over the place. Anytime I am selling something and somebody asks me to pay money, alarms go off. The part near the end - how would you like to get paid?? made me almost certain.

If they were a little slicker than this they might be able to pull it off.


I'm interesed in this name

800 USD + 100 USD for haunted-houses.org. Ok.

Do you sell the name only without web site? I'm interested in the name so
web site is not so important.

Do you have an appraisal certificate for your domain name?

Domain name is an investment for me. In other words I'm going to sell your
name later and make a profit. If I overpay I won't be able to make a profit
in the future. It's very important for you and me to know the current market
value of your domain.

Of course, we must be sure that you are engaging a reputable appraisal
company. I heard many appraisal companies often made inaccurate appraisals.
I will only accept appraisals from independent sources I trust.
I heard some appraisal companies often made inaccurate appraisals. So I
will only accept appraisals from independent sources I
To avoid mistakes I asked domain experts about reputable appraisal companies
in a forum
http://domaintalk.ourplace.com/Archive/93048.htm
Just check this posting.

If the appraisal comes higher you can adjust your asking price accordingly.
I also hope you can give me 10% - 15% discount of the appraised value.

After I get an appraisal from you we'll continue our negotiations.

How do you prefer to get paid: www.escrow.com, www.PayPal.com check or
wire?

Hope we can come to an agreement fast.

Everything on the internet is a scam :)

edit - good read through this thread though, its always funny to look back a year and see what the tricks of the day were then.

It's an old thread, however it is still going around, so I thought I would post the latest....

> >> -----Original Message-----
> >> From: M Saive [mailto:invest@disponent.com]
> >> Sent: Thursday, November 09, 2006 6:14 PM
> >> To:
> >> Subject: ********.com (sent 11/09/06)
> >>
> >>
> >> Hello,
> >>
> >> Please email me price for the name mentioned in the subject line.
> >>
> >> If you have other domain names for sale please send us the
> >> complete list
> >> with prices for consideration.
> >>
> >> I'm a very busy person so it may take several hours before I
> >> respond :-)
> >>
> >> Our company develops software. By the way, investing in domain
> >> names is
> > not
> >> the main direction of our investing strategy but a good way to
> >> generate additional income.
> >>
> >> Looking forward to do business with you.
> >>
> >> Regards,
> >> Michael Saive
> >> President
> >> Disponent Solutions
> >>
> >>
> >
>
============================================================================
> >> NOTICE - This communication may contain confidential and privileged
> >> information that is for the sole use of the intended recipient.
> >> Any viewing, copying or distribution of, or reliance on this
> >> message by unintended recipients is strictly prohibited. If you
> >> have received
this
> >> message in error, please notify us immediately by replying to the
message
> >> and deleting it from your computer.
> >>
> >>
> >
>
===========================================================================

Domain Email Sent From
disponent.com (81.27.32.137)

81.27.32.0 - 81.27.33.255
Webhuset Datasenter AS
PROVIDER LIR


Hostmaster for Webhuset Datasenter AS
Webhuset Datasenter AS
Mollendalsbakken 9
N-5009 Bergen
+47 55 38 78 00
+47 55 38 78 01
lir@datacenter.no

Email Received From
diamondoji4lze (ppp129-77.dialup.mtu-net.ru [62.118.129.77])
62.118.128.0 - 62.118.159.255
ZAO MTU-Intel
27-29 Smolenskaya-Sennaya Sq., bld. 2
119121, Moscow
Russia


MTU-Intel NOC
ZAO MTU-Intel
Mamonovskij pereulok d.5, build.1,2
P.O. BOX 38 123001
Moscow, Russia
+7 495 903 9577
+7 495 903 2524


Olga A Dzyubina
ZAO MTU-Intel
Moscow, Russia, 119121
P.O. BOX 38
Smolenskaya-Sennaya sq., 27-29, bld. 2
phone: +7 095 2587878
+7 495 2587878
fax-no: +7 095 2587870
+7 495 2587870

As a recent victim of this scam, I decided to seek my revenge by creating a site dedicated to this scam. DomainAppraisalScam dot com is the result.

Hopefully it will prevent many others from falling for this strange scam.

Enjoy

So they are still at it. Two days back I got hold of a good name and just today I got this mail:

Subject: xyzdomaininquestion.com
From: "ITGN Technologies" <zollinger@toughguy.net>
Date: Thu, December 13, 2007 11:58 am
To: my@emailaddress.com
Priority: Normal
Mailer: NetMasters SMTP Demo

Hello,

We are interested in xyzdomaininquestion.com

Your name was listed for sale. Please let us know your price.

Our works in information technology industry. Our clients are mainly from Europe, Australia, USA and Canada.

So investing in names is just a part of our investment strategy.

Looking forward to do business with you.

Regards,
Armin Zollinger
President
ITGN Technologies
============================================================================
NOTICE - This communication may contain confidential and privileged
information that is for the sole use of the intended recipient. Any
viewing, copying or distribution of, or reliance on this message by
unintended recipients is strictly prohibited. If you have received this
message in error, please notify us immediately by replying to the message
and deleting it from your computer.

===========================================================================

Points that raised the red flag are:
If they are a genuine company why they are using hotpop mail.
They are using demo version software for SMTP
Since the domain is already listed at sedo they can see the rates there and respond there, but instead they are trying to scam me.
Not a professional way of writing that mail.
There is no "ITGN Technologies" found when I searched on the net.
And most important this kind of scam trend i listed here on WHT.

This update is just to alert people that these scammers are still active and using same old tactics.

Still going:

Return-Path: <tgngroup@phreaker.net>
Delivered-To: admin@chatbase.com
Received: (qmail 32725 invoked by uid 89); 13 Feb 2008 06:43:09 -0000
Delivered-To: chatbase.com-tim@chatbase.com
Received: (qmail 32723 invoked from network); 13 Feb 2008 06:43:09 -0000
Received: from smtp-out.hotpop.com (38.113.3.61) by base.studiotracks.com
with SMTP; 13 Feb 2008 06:43:09 -0000
Received: from phreaker.net (kubrick.hotpop.com [38.113.3.105]) by
smtp-out.hotpop.com (Postfix) with SMTP id 223F7B768A88 for
<tim@chatbase.com>; Wed, 13 Feb 2008 07:45:10 +0000 (UTC)
Received: from diamondoji4lze (unknown [213.140.225.228]) by
smtp-3.hotpop.com (Postfix) with ESMTP id 9DADA5FB12DA for
<tim@chatbase.com>; Wed, 13 Feb 2008 07:45:06 +0000 (UTC)
Message-ID: <02b101c86e14$63e6cad0$e4e18cd5@diamondoji4lze>
From: "TGN Group" <tgngroup@phreaker.net>
To: <tim@chatbase.com>
Subject: 2HOST.COM
Date: Wed, 13 Feb 2008 10:44:43 +0300
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_02A4_01C86E2D.713D8520"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-HotPOP: ----------------------------------------------- Sent By
HotPOP.com FREE Email Get your FREE POP email at www.HotPOP.com
-----------------------------------------------
X-Evolution-Source: pop://admin%40chatbase.com@chatbase.com

This is a multi-part message in MIME format.

------=_NextPart_000_02A4_01C86E2D.713D8520
Content-Type: text/plain; charset="koi8-r"
Content-Transfer-Encoding: quoted-printable


Hello,

Your name 2HOST.COM was for sale. Please let me know your price. Our =
company works on Internet communication software market.

So Internet names is just a part of our investment strategy.=20

Looking forward to do business with you.

Regards,
John Slaughter
President
TGN Group
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
NOTICE - This communication may contain confidential and privileged
information that is for the sole use of the intended recipient. Any
viewing, copying or distribution of, or reliance on this message by
unintended recipients is strictly prohibited. If you have received this
message in error, please notify us immediately by replying to the =
message
and deleting it from your computer.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


------=_NextPart_000_02A4_01C86E2D.713D8520
Content-Type: text/html; charset="koi8-r"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dkoi8-r">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Hello,</FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Your name 2HOST.COM was for sale. =
Please let me=20
know your price. Our company works on Internet communication software=20
market.</FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>So Internet names is just a part of our =
investment=20
strategy. </FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Looking forward to do business with=20
you.</FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Regards,<BR>John =
Slaughter<BR>President<BR>TGN=20
Group<BR>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D<BR>NOTICE=20
- This communication may contain confidential and =
privileged<BR>information that=20
is for the sole use of the intended recipient.&nbsp; Any<BR>viewing, =
copying or=20
distribution of, or reliance on this message by<BR>unintended recipients =
is=20
strictly prohibited.&nbsp; If you have received this<BR>message in =
error, please=20
notify us immediately by replying to the message<BR>and deleting it from =
your=20
computer.</FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=3DArial=20
size=3D2>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D<BR></FONT></DIV></BODY></HTML>

------=_NextPart_000_02A4_01C86E2D.713D8520--

Pardon, I didn't realize this thread was so old when I replied above.

I am actually selling 2host.com at this very time and I replied letting him know I didn't have a set price and best offer gets it, and then informed him I'm also selling 2tech.com and tohost.com and sent the email off.

Then I realized as I hit the send button, that the free hotpop.com email address as the sender of his email. So, I searched for the company name and found nothing close. So, I did a lookup on the IPs and saw the Russian IP (not that this matters completely), and then I did a search on the IP.

A google search on the IP (and computer name came up with a lot of results) I also saw that his IP and computer name don't seem to change, or at least his computer name doesn't: diamondoji4lze (unknown [213.140.225.228]). Anyway, I'd have quickly found it was a scam as soon as he would have insisted on the domain name appraisal.

So, when he replies with it, I'll post the new appraisal scam domain he asks me to use (if it's different), and he surely will, and just report him for spam. I doubt anything will happen, but this can serve well as a way of others finding out in case they would have been duped. Unlikely that the information will change enough to need to be posted.

Though this thread is old, but updating it with relevant information is good for every one.

The appraisal scam's web site is at http://www.EasyNameSale.com now. Here's the scam/spam email report (a little different from the normal format, but I had to explain what the report was about, if there's any hope of action finally being taken):

Subject: SPAM: Domain appraisal scam! [Fwd: Re: 2HOST.COM]

CC: kiselev@centelcom.ru, postmaster@centelcom.ru, abuse@centelcom.ru, abuse@retn.net, admin@retn.net, abuse@cogentco.com, abuse@hotpop.com, registrar@magma.ca, getaway@getaway.com, abuse@godaddy.com, abuse@ultrashock.com, miko@ultrashock.com, dhswip@peer1.com, abuse@peer1.com

Body:

This has been ongoing for YEARS. This person emails people asking them to sell their domains, tricks them into using their domain appraisal service for a fee and then disappears. They are spamming for their own service, but acting like they are a potential client of the service. I will provide relevant links to prove this, along with the email and email headers below:

I have emailed the following contacts, for the following reasons:

Spammer's IP reported to: kiselev@centelcom.ru, postmaster@centelcom.ru, abuse@centelcom.ru

Spammer's IP (upstream, as emails above to centelcom.ru bounce!): abuse@retn.net, admin@retn.net

Abuse reports to hotpop are never taken against against: abuse@hotpop.com,

As abuse reports to hotpop.com are always ignored (this spammer has been using them for YEARS), I'm emailing their upstream for this spam mail server: abuse@cogentco.com

The fake forum post site the spammer has been using: ourplace.com
Spammer's URL: http://domaintalk.ourplace.com/Archive/790536.htm

Report for ourplace.com: registrar@magma.ca getaway@getaway.com

Spam says to go to: easynamesale.com (the domain appraisal scam site)

EasyNameSale.com registered: abuse@godaddy.com
EasyNameSale.com hosted at: abuse@ultrashock.com, miko@ultrashock.com
Upstream for web host: dhswip@peer1.com, abuse@peer1.com

Here is proof of this ongoing scam and spam:

http://www.webhostingtalk.com/showthread.php?t=430411

http://xbrain.biz/2007/10/23/scammercheating-domain-buyer/

http://www.namepros.com/warnings-and-alerts/355839-more-about-securenamesale-scams.html

http://travisisaacs.com/2007/08/08/on-domain-name-scammers/

http://www.sedo.com/forum/index.php4?task=showthread&thread=2772&tmp=&tracked=&partnerid=&language=e

http://www.antionline.com/archive/index.php/t-264726.html

http://www.bloglah.org/xbrain.biz/2007/10

http://paulenderson.com/2007/10/12/toughguynet-domain-name-appraisal-scam

Here is the scammer/spammer's email, with headers:

-------- Forwarded Message --------
Return-Path: <tgngroup@phreaker.net>
Delivered-To: admin@chatbase.com
Received: (qmail 31537 invoked by uid 89); 14 Feb 2008 07:42:20 -0000
Delivered-To: chatbase.com-tim@chatbase.com
Received: (qmail 31532 invoked from network); 14 Feb 2008 07:42:19 -0000
Received: from smtp-out.hotpop.com (38.113.3.61) by base.studiotracks.com with SMTP; 14 Feb 2008 07:42:19 -0000
Received: from phreaker.net (kubrick.hotpop.com [38.113.3.105]) by smtp-out.hotpop.com (Postfix) with SMTP id 57768BC8F002 for <tim@chatbase.com>; Thu, 14 Feb 2008 08:44:39 +0000 (UTC)
Received: from diamondoji4lze (unknown [213.140.225.228]) by smtp-1.hotpop.com (Postfix) with ESMTP id D33F91482F3 for <tim@chatbase.com>; Thu, 14 Feb 2008 08:44:36 +0000 (UTC)
Message-ID: <022301c86ee5$d9439430$e4e18cd5@diamondoji4lze>
From: TGN Group <tgngroup@phreaker.net>
To: tim@chatbase.com
References: <02b101c86e14$63e6cad0$e4e18cd5@diamondoji4lze> <1202922136.1083.92.camel@localhost.localdomain>
Subject: Re: 2HOST.COM
Date: Thu, 14 Feb 2008 11:42:54 +0300 (00:42 PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="koi8-r"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-Mimeole: Produced By Microsoft MimeOLE V6.00.2800.1106
X-HotPOP: ----------------------------------------------- Sent By HotPOP.com FREE Email Get your FREE POP email at www.HotPOP.com -----------------------------------------------
X-Evolution-Source: pop://admin%40chatbase.com@chatbase.com

From: TGN Group <tgngroup@phreaker.net>
To: tim@chatbase.com
Subject: Re: 2HOST.COM
Date: Thu, 14 Feb 2008 11:42:54 +0300
Can you accept 12,000 USD?

Do you sell domain with a web site or just name?

If just name it's ok. Web site is not necessary.

Have you had your domain names evaluated in the past? I mean domain
appraisals.

Without valuation we cannot be sure in the sale price. It's very important
for me in terms of reselling too.

But we must engage a valuation company with REAL manual service. So I will
only accept valuations from independent sources I trust.

To avoid mistakes I asked domain experts about reputable appraisal companies
in a forum
http://domaintalk.ourplace.com/Archive/790536.htm

Just check this posting.

If, for example, the valuation comes higher you can adjust your asking price
accordingly. It will be fair. I also hope you can give me 12% - 15%
discount.

After you send me valuation via email (usually it takes 1-2 days to obtain
it) we'll continue our negotiations.

What is your preferred payment method: Escrow.com, International wire
transfer, PayPal.com or something else?

Hope we can come to an agreement fast.

Looking forward to your reply.