Tuesday, 17 March 2009

pedma.com domain appraisals?

From time-to-time I get a unsolicited offers to buy domains that I hold, so it isn't wholly unexpected to get the occasional email about them. Here's one that came in today:

Subject: Regarding your domain [REDACTED].COM
From: "James Johnson" j.johnson98@rocketmail.com

Hello,
I came across your domain name [REDACTED]COM and I would be interested in buying it from you.
Here is my offer, you have to send me a professional appraisal from one of the following companies. and I will pay you 85% of the appraised price.
For payments under $2000 I prefer to use paypal. And for larger amounts of money I prefer if we used escrow.com

I accept appraisals from any of these companies:

-sedo.com
-pedma.com
-accuratedomains.com

If you already have an appraisal from one of those companies please forward it to me, and we will do business.

Regards,
James Johnson
For reference, the relevant mail headers are:

Received: from eatfire.nexcess.net (208.69.122.200)
by [redacted] with SMTP; 17 Mar 2009 10:07:22 -0000
Received: (qmail 10697 invoked by uid 108); 17 Mar 2009 10:06:16 -0000
Received: from unknown (HELO LYNKSIS) (admin@1nb0x.com@174.133.179.205)
by eatfire.nexcess.net with ESMTPA; 17 Mar 2009 10:06:16 -0000
From: "James Johnson"
Subject: Regarding your domain [redacted]
To: [redacted]
Well, my spidey sense started to tingle. The domain in question is not great and I'm really holding it for a future project that I haven't gotten around to. So I have certainly never had it professionally appraised.

So, let's say that I'm interesting in selling this domain and want to get a professional appraisal. Sedo charge $29, Accurate Domains charge $27 and Pedma charges $22.95. What's more, Pedma promises to refund your appraisal money or buy the domain itself if you don't sell it within 6 months.

Pedma looks like the best option. But who are they exactly?

Here's the thing - there is almost nothing about them in Google. It looks like they have been in the domain appraisal business for hardly any time at all. So isn't it odd that they are being recommended?

Let's look at the WHOIS details:

Registrant:
Billy McDOW
366 Kingswood Dr
Bedford, Nova Scotia B4B 1T8
Canada

Domain Name: PEDMA.COM
Created on: 01-Jul-08
Expires on: 01-Jul-09
Last Updated on: 12-Mar-09

Administrative Contact:
McDOW, Billy support@pedma.com
366 Kingswood Dr
Bedford, Nova Scotia B4B 1T8
Canada
9024950112 Fax --

Technical Contact:
McDOW, Billy support@pedma.com
366 Kingswood Dr
Bedford, Nova Scotia B4B 1T8
Canada
9024950112 Fax --

Domain servers in listed order:
NS1501.HOSTGATOR.COM
NS1502.HOSTGATOR.COM
It's hard to say if the details are genuine or not, but it certainly isn't an obvious fake. But a few days ago, pedma.com was registered to someone else:

Registrant:
Manuel Fichter
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada

Domain Name: PEDMA.COM
Created on: 01-Jul-08
Expires on: 01-Jul-09
Last Updated on: 05-Mar-09

Administrative Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024950112 Fax --

Technical Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024950112 Fax --

Domain servers in listed order:
DNS53-1.NEXCESS.NET
DNS53-2.NEXCESS.NET
About the same time, the IP address of pedma.com changed from 208.69.122.200 to 174.132.194.58. Now, the 208.x.x.x address was mentioned a few days ago on another blog for questionable domain practices, so you might suggest that this is not a coincidence.

The site itself seems to be free of malware, so poking around at the pedma.com site reveals a few other interesting things.

Click through to the Contact page:

The following contact details are listed:

20 Crawford Street
London
W1H 1PJ
United Kingdom

Email: support@pedma.com
It looks like this may be an accommodation address or perhaps a virtual office of some sort, probably located above a shop [sorry, IE required]. Definitely not Canada. (Update: it looks like a branch of Mail Boxes Etc thanks to Google's new UK streetview.)

Clicking through on the "Buy Now" link takes you to a PayPal page, also mentioning Canada:


The payee is "Unique Desktop". Whoever they are. This is one of the weakness of PayPal - I don't really have an idea who I am dealing with here. I don't advise that you pay them anything, indeed there is no part of the payment process that actually specified what domain you want appraising or your contact details.

A further clue that something is wrong comes from their "Service" page which contains the following text:


How much is your domain really worth? An expert evaluation of a domain name's value is critical intelligence for domain buyers and sellers looking to determine a fair market price. An appraisal is your first step to making a great sale!

Every appraisal individually researched by domain industry pros, because no software is a substitute for real-world experience.

Your domain name could be worth thousands of dollars and may even be tax deductible!

Join many others who discovered what their domains were worth using our Domain Name Appraisal Service! Your domain will be appraised based on a number of separate factors including marketability, brand recognition, unique type in traffic, and comparison with other domain name sales. In addition to the following criteria:

* TLD Value
* Length
* Hyphen
* Web Frequency
* Search Frequency
* Industry Value

After you make your first purchase we will email you your Pedma Account log in information. Once you are logged in, you will find all your domain appraisals neatly organized (including appraisal reports, and appraisal banners). We make it easy to keep track of all your appraisals!
In fact, the majority of this text is stolen directly from Sedo and Moniker - it's a straight copy-and-paste job.

So: this "appraisal" site appears to have been active for just a few days, the site content is stolen from others, the contact details on the page do not match the WHOIS, the payment process does not allow you to specify the domain to appraise and your contact details, and the IPs have recently been connected to another dubious domain name pitch.

It looks on the surface as if this is an attempt to get people to sign up for this so-called appraisal service, and nothing more. Pedma.com is certainly not a recognised or trustworthy site, so it is likely that the offer to buy the domain is similarly dubious. Of course, if you work for Pedma.com, please feel free to correct any errors in the comments section below.

If you have spent any money on the appraisal, then I would advise you to start a PayPal dispute to recover the money as there is some evidence to suggest that the original offer is not genuine.

Additional information:
a bit more research shows indicates the domain pedma.com was sold via eBay item #170253846100 in August 2008 to a member called unique*money, presumably this is Manuel Fichter.





Now, it might be that Mr Fichter sold the domain on and perhaps it is a coincidence that the new owner lives in the same area and has used exactly the same telephone number. Note that the seller "bargaindomains" is a reputable eBay seller who just sold the domain on in August.

About the London address: there is no company by the name of "Pedma" operating in the UK, according to Companies House.

The PayPal billing name of "Unique Desktop" is connected with the domain "fastbooster.com". The terse WHOIS details for that mention an email address of willyfichter@googlemail.com, but earlier last year it had a rather more full domain description:

Owner Contact:
Willy Fichter
Immo-World24 Limited
Am Soeldnermoos 17
Hallbergmoos, 85399, DE

Punycode Name: fastbooster.com
Unicode Name: fastbooster.com

Admin Contact
Willy Fichter

willyfichter@googlemail.com
Am Soeldnermoos 17
Hallbergmoos, 85399, DE
phone: +49 89381684552

Technical Contact
Hostmaster Strato Rechenzentrum
Cronon AG Professional IT-Services
hostmaster@cronon-isp.net
Emmy-Noether-Str. 10
Karlsruhe, D-76131, DE
phone: +49 72166320305

Zone Contact
Hostmaster Strato Rechenzentrum
Cronon AG Professional IT-Services
hostmaster@cronon-isp.net
Emmy-Noether-Str. 10
Karlsruhe, D-76131, DE
phone: +49 72166320305

Record expires on: 2009-05-04 20:35:24

Domain servers in listed order:

shades02.rzone.de
docks18.rzone.de

It is hard to be 100% certain who is sending out these "offers". But at a guess, one of these Mr Fichters might have an idea.

Update:
pedma.com has been suspended by HostGator. Yeay.



Another update (18/3):
The owner of pedma.com is now desperately trying to punt the domain name on Sedo for $1000, which is a bit rich considering that he ripped off Sedo's text for the fake appraisal site!


23 comments:

Patrick E. Semaan said...

Hi,
I got the exact same email from the same person asking to buy one of my domain names.

Is this a bogus or fake company, some sort of a scam? Or is it real?

Did you end up selling to them? Let me know.

Thanks.

John said...

GOT THE SAME EMAIL 3-17-09.

PROBABLY SENT HUNDREDS OF THESE EMAILS TO GET INCOME FROM HIS PEDRA.COM APPRAISAL SERVICE.

dcon said...

I also received the identical offer today.

Tim said...

I received the same email this morning and started poking around. You've done more than enough research to convince me that this is one to stay away from. Thank you!

donnacha said...

Same here, interesting evolution of this scam, thanks for researching it so well.

Chas F said...

I also received this offer today. I was very suspicious and your research confirms my suspicions. Thanks for the leg-work!

Will Thien said...

Thanks,
I received the same response. I have a few domains and received them on all. That was the real tip off to me.

It might be worth selling a couple domains just to get rid of the junk mail. lol


Will Thien

boyeut said...

I also received exactly the same email.

I have no idea why he is doing this.

Saskboy said...

I got the same email, but they only offered me 65% fake dollars.

Donna Mc said...

Thanks for doing all the legwork on this! I got the same email & it smelled bad, but I couldn't figure out how they were going to make money if I went to Sedo for an appraisal. Your point about Pedma being the cheapest appraisal makes beaucoup sense.

franglais said...

I got the same email, except "pedma" is replaced with "pozde."

NOLA_Jen said...

Thank you so much for the extensive research. I got the same email on the 17th, and now I know to stay away. If anything, this has sparked my interest in selling a few of my old neglected domains, and I'm going to handle the sales of those domains myself.

Thanks Again!

Daniel said...

Hello everyone,

please, don't fall for something like this.

If you receive an offer by mail, kindly ask the potential buyer to simply place a bid on the marketplace that you are using to sell your domains.

Best Regards,

Daniel Klotz
Senior Specialist / Security & Compliance
www.sedo.com

Chris said...

Thanks for sharing your research. I received the exact same email except instead of pedma.com it was listing:

tropicalnames.com

as the cheapest.

Looks like the guy's moved on once pedma.com was shut down.

acado said...

Pedma seems to be now nameorange.com

I just got this email today from a charles.johnson55@gmail.com:
...
As of now we accept appraisals from either one of the following leading appraisal companies:

sedo.com
nameorange.com
accuratedomains.com

...

Andrew said...

from: charles.johnson55@gmail.com

Dear Sir or Madam,

We are interested to buy your domain name [REDACTED]COM and offer to buy it from you for 65% of the appraised market value.

As of now we accept appraisals from either one of the following leading appraisal companies:

sedo.com
nameorange.com
accuratedomains.com


If you already have an appraisal please forward it to us.

As soon as we have received your appraisal we will send you our payment (we use Paypal for amounts less than $2,000 and escrow.com for amounts above $2,000) as well as further instructions on how to complete the transfer of the domain name.

We appreciate your business,

Yours truly,

Charles Johnson

Islander said...

I got the same email - the new site they are scamming on is http://www.nameorange.com

Islander said...

I received the same email - the new site they are scamming from is http://www.nameorange.com

Islander said...

http://www.nameorange.com is the new scamming site

Dan N said...

flyappraisals.com is the new scam site:

Dear Sir or Madam,

We are interested to buy your domain name [DOMAININQUESTION].COM and offer to buy it from you for 65% of the appraised market value.

As of now we accept appraisals from either one of the following leading appraisal companies:

sedo.com
flyappraisals.com
accuratedomains.com


If you already have an appraisal please forward it to us.

As soon as we have received your appraisal we will send you our payment (we use Paypal for amounts less than $2,000 and escrow.com for amounts above $2,000) as well as further instructions on how to complete the transfer of the domain name.

We appreciate your business,

Yours truly,

Mr. Parker

kevinparker65@gmail.com

RIDER SHACK said...

Got the same email as Dan N but from jeffmiller44@gmail.com.

THANK YOU Dynamoo!

offer said...

We are interested to buy your domain name (Domain Removed).COM and offer to buy it from you for 80% of the appraised market value.

As of now we accept appraisals from either one of the following leading appraisal companies:

- flyrating.com
- sedo.com

If you already have an appraisal please forward it to us.

As soon as we have received your appraisal we will send you our payment (we use Paypal for amounts less than $2,000 and escrow.com for amounts above $2,000) as well as further instructions on how to complete the transfer of the domain name.

We appreciate your business,

Yours truly,

David Williams

Aaron.Walkhouse said...

This scam is still active as of August 13.

For your firewalls:
pddomains.com, Fleos.com domain appraisal scam:64.186.128.191-64.186.128.191
pddomains.com, Fleos.com domain appraisal scam:124.217.231.209-124.217.231.209
pddomains.com, Fleos.com domain appraisal scam:208.69.122.200-208.69.122.200
pddomains.com, Fleos.com domain appraisal scam:174.132.194.58-174.132.194.58

…and for your HOSTS file:
127.0.0.1 (tab) fastbooster.com (tab) #Domain appraisal scam
127.0.0.1 (tab) pddomains.com (tab) #Domain appraisal scam
127.0.0.1 (tab) Fleos.com (tab) #Domain appraisal scam
127.0.0.1 (tab) pedma.com (tab) #Domain appraisal scam
127.0.0.1 (tab) eatfire.nexcess.net (tab) #Domain appraisal scam
127.0.0.1 (tab) Pozde.com (tab) #Domain appraisal scam
127.0.0.1 (tab) NameOrange.com (tab) #Domain appraisal scam
127.0.0.1 (tab) TropicalNames.com (tab) #Domain appraisal scam

If there are more to add, put them here. This blog entry is currently the most detailed report on this ongoing scam so I'll keep an eye on it.