"PD Domains": topnameappraisals.com and greatestnamesonline.com scam

Two more scam domain appraisal sites - greatestnamesonline.com and topnameappraisals.com following on from pddomains.com and countless other ones.

If you receive an unsolicited email listing either of these two companies as appraisal outfits, then it's a scam. More information here.

Update: there's also topnameappraisal.com which is another domain doing exactly the same thing.

Fleos.com and Flyappraisal.com scams

Two more domain appraisal scams following on from this one, Fleos.com has been around for a few days and is a copy of the flyappraisals.com / flyrating.com fraud.

In the same vein, the scammers have also registered Flyappraisal.com which will not doubt be used for another batch of fake domain appraisal fraud soon.



Avoid these, and if you have paid for a so-called appraisal via PayPal, then use the PayPal dispute procedure to get your money back.

pddomains.com scam

This is part of a long-running scam where you receive an unsolicited offer for a domain name.. the scam is that you are offered a choice of three appraisal services, the cheapest of which is controlled by the scammer. Once you have paid for your appraisal, the offer to buy the domain mysteriously dries up.

Subject: Offer to buy [redacted]
From: "Resale Domain" <resaledomain@gmail.com>
Date: Sun, August 9, 2009 6:00 am

Dear Sir,

we are interested to buy your domain name [redacted] and offer 65% of the appraised market value.
As of now we accept appraisals from either one of the following leading appraisal companies:

sedo.com
pddomains.com
accuratedomains.com

If you already have an appraisal please forward it to us.

As soon as we have received your appraisal we will send you our payment (we use Paypal for amounts less than $2,000 and escrow.com for amounts above $2,000) as well as further instructions on how to complete the transfer of the domain name.

We appreciate your business,

Thank you,

B. Phillips
Resale Domain

The site looks professional enough, but it's a cookie-cutter design that has been used for previous frauds here, here, here and here although sometimes the same crew use this design.

Email originates from 64.186.128.191 in the US and points to a domain on 124.217.231.209 in Malaysia. WHOIS details are anonymised and the domain was only registered on 7th August, nontheless the most likely perpetrator is detailed here.

If you have paid for an appraisal, then you should start a PayPal dispute to get a refund. Hopefully, that will also get the fraudster's account shut down.

Domain scam: ntwifinetwork.com / js-wifi.cn

The old Chinese domain scam has been around for years, but these guys are getting lazy because they haven't changed their domains for months, this is esentially unchanged from April.

Subject: Domain Dispute and Registration
From: "Sunny"
Date: Thu, July 2, 2009 4:07 am

To whom it may concern: 2009-7-2

We are a domain name registration service company in Asia,

Last week we received a formal application submited by Justin Lin who wanted to use the keyword "REDACTED" to register the Internet Brand and with suffix such as .cn /.com.cn /.net.cn/.hk/ .asia/ domain names.

After our initial examination, we found that these domain names to be applied for registration are same as your domain name and trademark. We aren¡¯t sure whether you have any relation with him. Because these domain names would produce possible dispute, now we have hold down his registration, but if we do not get your company¡¯s an reply in the next 5 working days, we will approve his company's application

In order to handle this issue better, Please contact us by Fax ,Telephone or Email as soon as possible.



Yours sincerely

Sunny

Checking Department

Tel: 86 513 8532 1087
Fax: 86 513 8532 2065
Email:Sunny@ntwifinetwork.com
Website: www.js-wifi.cn

Our File No.:2272363

Originating IP is 122.193.216.10.

As ever, legitimate domain registrars do not send out this type of email because they are NOT responsible for this activity. Sometimes the Chinese domains get registered, sometimes they are ALREADY registered, and often they never get registered. But before you panic and pay money to these scammers, consider this: there are hundreds of top-level domains in the world. Do you really want to buy your domain for all of them? The answer is probably "no".

The best advice is to ignore this email completely.

flyrating.com scam

Flyrating.com is a re-run of the flyappraisals.com scam - a fake domain name evaluation service that is spamvertised through a bogus offer to buy a domain.


Although the servers are hosted in Malaysia, there is strong evidence linking these to a person of German origin living in Canada. More information here.

flyappraisals.com scam

Part of an ongoing domain name scam, flyappraisals.com is a fake domain name appraisal used in conjunction with a bogus unsolicited offer to buy a domain, similar to the following:

We are interested to buy your domain name [redacted] and offer to buy it from you for 65% of the appraised market value.

As of now we accept appraisals from either one of the following leading appraisal companies:

sedo.com
flyappraisals.com
accuratedomains.com


If you already have an appraisal please forward it to us.

As soon as we have received your appraisal we will send you our payment (we use Paypal for amounts less than $2,000 and escrow.com for amounts above $2,000) as well as further instructions on how to complete the transfer of the domain name.

We appreciate your business,

Out of these three "appraisal" companies, flyappraisals.com is the cheapest. So, naturally a lot of people will part with some money for an appraisal. Of course, the offer to buy the domain name never comes through and the domain name owner is out of pocket.

It looks like this scam is being run out of Canada, and we have covered it many times before: here, here, here and here. If you live in Canada and have been ripped off, then reporting it to the RCMP may get some results. You should also raise a dispute with PayPal to get a refund.


This particular site has a jolly bit of flash on it, unlike the plain HTML of the old sites. It is hosted on 124.217.231.209 in Malaysia.

Podzz.com domain scam

Podzz.com is the latest incarnation of a fraudulent domain appraisal scam being run out of Canada. The basic pitch is that you receive an unsolicited offer for a domain name, with a list of three or more possible appraisal services to evaluate it. In this case, podzz.com is the cheapest, and the most likely for the victim to choose.

Of course, what then happens is that the offer disappears and the victim is out of pocket. We have covered this scam and the people behind it here, here and here. Avoid.

NameOrange / nameorange.com scam

Another variant of this scam and this scam linked to a guy called Manuel Fichter - the basic pitch is that you get an email offering to buy your domain name which lists a number of "approved" domain appraisers, the one that appears to be cheapest is actually run by the scammer.



Avoid this one. If you live in Canada and believe that you have been defrauded, then contact your local RCMP and make a complaint about:

Manuel Fichter
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada

"Yadu Investment Co., Ltd." / ntwifinetwork.com / tech-wifi.com

This email (supposedly from a Chinese domain registrar) follows a well-worn path of trying to sell useless names to owners of existing dot coms.

From: Joy [mailto:Joy@ntwifinetwork.com]
Sent: 10 April 2009 07:47
To: [redacted]
Subject: Notice of Intellectual Property Protection

Dear Sir/Madam: 2009-4-10

We are a domain name registration service company in Asia,
Last week we received a formal application submited by “Yadu Investment Co., Ltd.” Which wanted to use the keyword " [redacted]" to register the Internet Brand and with suffix such as .cn /.com.cn /.net.cn/.hk/ .asia/ domain names.
After our initial examination, we found that these domain names to be applied for registration are same as your domain name and trademark. We aren’t sure whether you have any relation with this company. Because these domain names would produce possible dispute, now we have hold down this registration, but if we do not get your company’s an reply in the next 5 working days, we will approve his application
In order to handle this issue better, Please contact us by Fax ,Telephone or Email as soon as possible.

Yours sincerely

Joy

Checking Department


Tel: 86 513 8532 2060
Fax: 86 513 8532 2065
Email :Joy@ntwifinetwork.com
Website: www.ntwifinetwork.com
Mail No.: [redacted]

Registrars DO NOT check trademarks before registrations (the exception is "sunrise registrations" for completely new top-level domains). This is an attempt to get you to buy an overpriced domain name that you don't need.

This mail may come from twifinetwork.com, tech-wifi.com or other domains, the domains are hosted on 174.138.60.95, some of the wording is lifted from asiaregistry.com although it is not possible to tell if they are affiliated.

If you are concerned about securing these domains, then most registrars now deal in Asian TLDs and can register them for you, else you are probably same to ignore it.

btw, the pitch is not new and has been used here, here and here.

Tropicalnames.com scam

tropicalnames.com is the new name for the pedma.com domain appraisal scam. The basic pitch is that you get an unsolicited offer for a domain name, along with a list of recognised appraisal companies. The cheapest company is controlled by the scammers who sent the email (apparently operating out of Canada).

Domain was registered on 3rd April 2008 with anonymised details and is hosted on 124.217.231.173 in Malaysia. If you get one of these, treat it as spam and file a complaint with abuse -at- piradius.net.

"Shanghai QiPeng Network Information Technology" / "Sopper Investment Co. LTD"

This particular pitch has been around for a long time - a domain name registrar (or reseller) who is "checking" about a domain registration that might infringe on your trademarks. Of course, registrars are not responsible for checking trademarks (can you imagine how complicated and expensive the process would be!)

Usually this approach is an attempt to get you to register useless domain names at inflated prices.. and in all probability these domain names they are warning about will never even be registered. If you really are concerned, then register them through a reputable registrar, else you are best off ignoring it.

Subject: Domain Issues for "[redacted]"
From: "Ramon zhang"
Date: Fri, March 27, 2009 9:20 am

If you are not the person who is in charge of this, please forward to the right person/department. Thank you)

Dear CEO,

We , a registrar organization in China, have something to check with you. We received an application today One South Korea company called " Sopper Investment Co. LTD" is applying for "[redacted]" as internet brand and following Asian/.CN domain names to use.
[redacted].com.tw
[redacted].hk
[redacted].in
[redacted].net.cn
[redacted].org.cn
[redacted].tw

After our initial checking, we found the internet brand and keyword of these domain names are as same as your company¡¯s.Because of it involves your company's intellectual property, so we need to check this with your company. If the aforesaid company is your subsidiary company or your business partner, please DO NOT reply us, we will approve the application automatically. If you have no any relationship with this company, please contact us within 7 workdays. If out of the deadline, we will approve the application submitted by "Sopper Investment Co. LTD" unconditionally.
Look forwarding to hearing from you.Thanks.

Best Regards,

Ramon Zhang
Leader Checker
Shanghai QiPeng Network Information Technology Co.,Ltd
Tel£º +86-21-6992-9440 Fax£º +86-21-6992-9447

Postal Code£º 200063
website:http://www.qipeng.org.cn


Shanghai QPNIC Web Property Solutions Limited is a comprehensive company engaged in the Internet intellectual property services that mainly provides network-based service, network intellectual property service.
Company objective: The good faith first, the customer is supreme.

The same approach can be seen here and here.

Pozde.com domain valuation scam

A copy of the recent Pedma.com domain appraisal scam, this time with the name pozde.com. The pitch is something similar to the following:

Dear sir,

we are interested to buy your domain name [REDACTED] and offer to buy it from you for 70% of the appraised market value.

As of now we accept appraisals from either one of the following leading appraisal companies:

sedo.com
pozde.com
moniker.com
accuratedomains.com

If you already have an appraisal please forward it to us.

As soon as we have received your appraisal we will send you our payment (we use Paypal for amounts less than $2,000 and escrow.com for amounts above $2,000) as well as further instructions on how to complete the transfer of the domain name.

We appreciate your business,

Thanks,

P. Jackson

Pozde.com is the fake appraisal site, and because it is cheaper than the others (which are legitimate) there's a chance you will try to use it. Although this time they have remembered to give you a box to specify your domain (they didn't with the old version), you should be under no doubt that this is an attempt to defraud.

The WHOIS entry for pozde.com is a crude fake:

Registrant:
Richard Smith
563 queen st
bruckberg, er 54767
Iceland

Domain Name: POZDE.COM
Created on: 19-Nov-08
Expires on: 19-Nov-09
Last Updated on: 20-Mar-09

Administrative Contact:
Smith, Richard admin@bizing.biz
563 queen st
bruckberg, er 54767
Iceland
+1.9024312570 Fax --

Technical Contact:
Smith, Richard admin@bizing.biz
563 queen st
bruckberg, er 54767
Iceland
+1.9024312570 Fax --

Domain servers in listed order:
NS1.IPNAMES.NET
NS2.IPNAMES.NET

In fact, it is actually registered to:

Registrant:
Manuel Fichter
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada

Domain Name: POZDE.COM
Created on: 19-Nov-08
Expires on: 19-Nov-09
Last Updated on: 05-Mar-09

Administrative Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024312570 Fax --

Technical Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024312570 Fax --

You should also consider the domains tysoo.com (recently bought by Manuel Fichter) and dexpay.com as suspect, because it seems that there is a pattern emerging here.

So why is it a scam? Pedma.com was definitely a scam - when you sent off your PayPal payment there was no way to specify what you wanted appraising, the fact that Pozde.com has added this in is immaterial. The WHOIS entry is fake (the registrant is in Canada, not Iceland).

Site is hosted on 124.217.231.173 in Kuala Lumpur. Send abuse reports to abuse -at- piradius.net.

If you feel that you have been defrauded and you live in Canada, you can file a complaint with the RCMP.

Added: some other domains to watch out for, owned by the same person are:

• veecs.com
• grooc.com
• usbabes.info
• tysoo.com (being transferred)
  
• dexpay.com
• bizing.biz
• fastbooster.com
• moviesforme.org
• casinocrew.com

pedma.com domain appraisals?

From time-to-time I get a unsolicited offers to buy domains that I hold, so it isn't wholly unexpected to get the occasional email about them. Here's one that came in today:

Subject: Regarding your domain [REDACTED].COM
From: "James Johnson" j.johnson98@rocketmail.com

Hello,
I came across your domain name [REDACTED]COM and I would be interested in buying it from you.
Here is my offer, you have to send me a professional appraisal from one of the following companies. and I will pay you 85% of the appraised price.
For payments under $2000 I prefer to use paypal. And for larger amounts of money I prefer if we used escrow.com

I accept appraisals from any of these companies:

-sedo.com
-pedma.com
-accuratedomains.com

If you already have an appraisal from one of those companies please forward it to me, and we will do business.

Regards,
James Johnson

For reference, the relevant mail headers are:

Received: from eatfire.nexcess.net (208.69.122.200)
by [redacted] with SMTP; 17 Mar 2009 10:07:22 -0000
Received: (qmail 10697 invoked by uid 108); 17 Mar 2009 10:06:16 -0000
Received: from unknown (HELO LYNKSIS) (admin@1nb0x.com@174.133.179.205)
by eatfire.nexcess.net with ESMTPA; 17 Mar 2009 10:06:16 -0000
From: "James Johnson"
Subject: Regarding your domain [redacted]
To: [redacted]

Well, my spidey sense started to tingle. The domain in question is not great and I'm really holding it for a future project that I haven't gotten around to. So I have certainly never had it professionally appraised.

So, let's say that I'm interesting in selling this domain and want to get a professional appraisal. Sedo charge $29, Accurate Domains charge $27 and Pedma charges $22.95. What's more, Pedma promises to refund your appraisal money or buy the domain itself if you don't sell it within 6 months.

Pedma looks like the best option. But who are they exactly?

Here's the thing - there is almost nothing about them in Google. It looks like they have been in the domain appraisal business for hardly any time at all. So isn't it odd that they are being recommended?

Let's look at the WHOIS details:

Registrant:
Billy McDOW
366 Kingswood Dr
Bedford, Nova Scotia B4B 1T8
Canada

Domain Name: PEDMA.COM
Created on: 01-Jul-08
Expires on: 01-Jul-09
Last Updated on: 12-Mar-09

Administrative Contact:
McDOW, Billy support@pedma.com
366 Kingswood Dr
Bedford, Nova Scotia B4B 1T8
Canada
9024950112 Fax --

Technical Contact:
McDOW, Billy support@pedma.com
366 Kingswood Dr
Bedford, Nova Scotia B4B 1T8
Canada
9024950112 Fax --

Domain servers in listed order:
NS1501.HOSTGATOR.COM
NS1502.HOSTGATOR.COM

It's hard to say if the details are genuine or not, but it certainly isn't an obvious fake. But a few days ago, pedma.com was registered to someone else:

Registrant:
Manuel Fichter
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada

Domain Name: PEDMA.COM
Created on: 01-Jul-08
Expires on: 01-Jul-09
Last Updated on: 05-Mar-09

Administrative Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024950112 Fax --

Technical Contact:
Fichter, Manuel admin@bizing.biz
38 Matthew Drive
Hammonds Plains, NS B4B 1T8
Canada
9024950112 Fax --

Domain servers in listed order:
DNS53-1.NEXCESS.NET
DNS53-2.NEXCESS.NET

About the same time, the IP address of pedma.com changed from 208.69.122.200 to 174.132.194.58. Now, the 208.x.x.x address was mentioned a few days ago on another blog for questionable domain practices, so you might suggest that this is not a coincidence.

The site itself seems to be free of malware, so poking around at the pedma.com site reveals a few other interesting things.

Click through to the Contact page:

The following contact details are listed:

20 Crawford Street
London
W1H 1PJ
United Kingdom

Email: support@pedma.com

It looks like this may be an accommodation address or perhaps a virtual office of some sort, probably located above a shop [sorry, IE required]. Definitely not Canada. (Update: it looks like a branch of Mail Boxes Etc thanks to Google's new UK streetview.)

Clicking through on the "Buy Now" link takes you to a PayPal page, also mentioning Canada:


The payee is "Unique Desktop". Whoever they are. This is one of the weakness of PayPal - I don't really have an idea who I am dealing with here. I don't advise that you pay them anything, indeed there is no part of the payment process that actually specified what domain you want appraising or your contact details.

A further clue that something is wrong comes from their "Service" page which contains the following text:

How much is your domain really worth? An expert evaluation of a domain name's value is critical intelligence for domain buyers and sellers looking to determine a fair market price. An appraisal is your first step to making a great sale!

Every appraisal individually researched by domain industry pros, because no software is a substitute for real-world experience.

Your domain name could be worth thousands of dollars and may even be tax deductible!

Join many others who discovered what their domains were worth using our Domain Name Appraisal Service! Your domain will be appraised based on a number of separate factors including marketability, brand recognition, unique type in traffic, and comparison with other domain name sales. In addition to the following criteria:

* TLD Value
* Length
* Hyphen
* Web Frequency
* Search Frequency
* Industry Value

After you make your first purchase we will email you your Pedma Account log in information. Once you are logged in, you will find all your domain appraisals neatly organized (including appraisal reports, and appraisal banners). We make it easy to keep track of all your appraisals!

In fact, the majority of this text is stolen directly from Sedo and Moniker - it's a straight copy-and-paste job.

So: this "appraisal" site appears to have been active for just a few days, the site content is stolen from others, the contact details on the page do not match the WHOIS, the payment process does not allow you to specify the domain to appraise and your contact details, and the IPs have recently been connected to another dubious domain name pitch.

It looks on the surface as if this is an attempt to get people to sign up for this so-called appraisal service, and nothing more. Pedma.com is certainly not a recognised or trustworthy site, so it is likely that the offer to buy the domain is similarly dubious. Of course, if you work for Pedma.com, please feel free to correct any errors in the comments section below.

If you have spent any money on the appraisal, then I would advise you to start a PayPal dispute to recover the money as there is some evidence to suggest that the original offer is not genuine.

Additional information:
a bit more research shows indicates the domain pedma.com was sold via eBay item #170253846100 in August 2008 to a member called unique*money, presumably this is Manuel Fichter.





Now, it might be that Mr Fichter sold the domain on and perhaps it is a coincidence that the new owner lives in the same area and has used exactly the same telephone number. Note that the seller "bargaindomains" is a reputable eBay seller who just sold the domain on in August.

About the London address: there is no company by the name of "Pedma" operating in the UK, according to Companies House.

The PayPal billing name of "Unique Desktop" is connected with the domain "fastbooster.com". The terse WHOIS details for that mention an email address of willyfichter@googlemail.com, but earlier last year it had a rather more full domain description:

Owner Contact:
Willy Fichter
Immo-World24 Limited
Am Soeldnermoos 17
Hallbergmoos, 85399, DE

Punycode Name: fastbooster.com
Unicode Name: fastbooster.com

Admin Contact
Willy Fichter

willyfichter@googlemail.com
Am Soeldnermoos 17
Hallbergmoos, 85399, DE
phone: +49 89381684552

Technical Contact
Hostmaster Strato Rechenzentrum
Cronon AG Professional IT-Services
hostmaster@cronon-isp.net
Emmy-Noether-Str. 10
Karlsruhe, D-76131, DE
phone: +49 72166320305

Zone Contact
Hostmaster Strato Rechenzentrum
Cronon AG Professional IT-Services
hostmaster@cronon-isp.net
Emmy-Noether-Str. 10
Karlsruhe, D-76131, DE
phone: +49 72166320305

Record expires on: 2009-05-04 20:35:24

Domain servers in listed order:

shades02.rzone.de
docks18.rzone.de

It is hard to be 100% certain who is sending out these "offers". But at a guess, one of these Mr Fichters might have an idea.

Update:
pedma.com has been suspended by HostGator. Yeay.



Another update (18/3):
The owner of pedma.com is now desperately trying to punt the domain name on Sedo for $1000, which is a bit rich considering that he ripped off Sedo's text for the fake appraisal site!

Beijing AUG Networks Technology Co / augnetworks.cn scam

This is certainly spam.. but is it a scam? Most likely..

Subject: Dynamoo Domain name and Internet keyword Registration
From: "tom.xu"

Dec 19, 2008

Dynamoo

Domain name & Internet keyword

Dear Sir/Madam,

We are Beijing AUG Networks Technology Co., Ltd which is the domain name and internet keyword registration service company in China. We received a formal application from a company who is applying to register " dynamoo " as their domain name and Internet keyword on Dec 16, 2008.Since through our investigation we found that this word has been in use by your company, and this may involve your company name or trade mark so we inform you in no time. If you consider the domain name and internet keyword are important to your company and it is necessary to protect them by registering them first, contact us soon.

Kind Regards,

Tom Xu

Registration Comissioner

Tel/fax: +86-10-82797446

Email: tom.xu@augnetworks.cn

Website: www.augnetworks.cn

augnetworks.cn was only registered on 23/11/2008 to "Beijing AUG Networks Co", it is in no way an official registrar and the company probably doesn't even exist. Domain registrars are not actually responsible for checking trademarks, they most likely have had no such approach from a customer and really the whole thing is designed to make you panic into buying something you don't need.

There's more on Chinese domain malpractice here.

"DOMAIN LISTINGS CENTER" spam

For some reason, I am seeing a big upswing in Canadian spam at the moment. This one is a very misleading offer entitled "ANNUAL WEBSITE SEARCH ENGINE SUBMISSION" for a domain that I have parked and have never used. It is only when you get near the bottom that the message carries a disclaimer "Note that THIS IS NOT A BILL. This is a solicitation. You are under no obligation to pay the amounts stated unless you accept this offer".

---

DOMAIN LISTINGS CENTER
8171 Yonge St. Suite# 149
Thornhill, ON L3T 2C6
Canada

--------------------------------------------------------------------------------
NOTICE
--------------------------------------------------------------------------------

(Please make necessary changes)
ATT: name
address
,
WWW.domain.com

DESCRIPTION OF SERVICES:
Premium Package




ANNUAL WEBSITE SEARCH ENGINE SUBMISSION
FROM DECEMBER 1,2008 THRU DECEMBER 1,2018
OR
FROM DECEMBER 1,2008 THRU DECEMBER 1,2013

TOTAL
$295.00

$185.00


SUBSCRIPTION INCLUDES:




Custom keyword research
Optimized title and meta tags
Submission to 900 search engines and directories
safe follow-up re-submissions every 3 months
Helpful professional support


THIS IS NOT A BILL. This is a solicitation. You are under no obligation to pay the amount(s) stated unless you accept this offer.


--------------------------------------------------------------------------------

Domain Name

WWW.domain.com Amount

Requested Reply

November 10th,2008

THIS NOTICE IS A SOLICITATION AND A RECEIPT OF PAYMENT WILL CONFIRM YOUR ANNUAL SUBMISSION
*100% SATISFACTION IS GUARANTEED OR YOUR MONEY BACK

Please select the number of years you would like to signup for
[ ] 10 Years .......... $295 (Best Value, Most Recommended!)
[ ] 5 Years .......... $185
[ ] 2 Years .......... $99
[ ] 1 Years .......... $75
If you have other domains you may list them below (please send a separate check for each domain and write your domain name on the memo section of the check)
Other domain(s) __________________ , __________________ , __________________


Total $ _______

________________________________
Signature

________________________________
Date


Payment by Check or Money Order
Print and mail a copy of this order form along with a check or money order to the address listed below:
Domain Listings Center
8171 Yonge St. Suite# 149
Thornhill, ON L3T 2C6
Canada

Please do not forget to include a copy of this order form along with your payment!


www.domain.com


--------------------------------------------------------------------------------

By accepting this offer, you agree not to hold DLC liable for any part. Note that THIS IS NOT A BILL. This is a solicitation.
You are under no obligation to pay the amounts stated unless you accept this offer. The information in this letter contains confidential and/or legally privileged information from the notification processing department of the Domain Listing Services Inc.
This information is intended only for the use of the individual(s) named above. If you do not wish to receive further updates from DLC send an email to dolistscent3272@operamail.com to unsubscribe.
If you are not the intended recipient, you are hereby notified that disclosure, copying, distribution or the taking of any action in reliance on the contents for this letter is strictly prohibited.

* 100% satisfaction guaranteed, you may request a refund within 30 days if your are not satisfied with our services.

---

Originating IP is 72.51.46.77. File it in the trash where it belongs.

Asprox: "aspx" domains

Keep an eye out for these following Asprox domains, all recently registered to the email address druid00091@aol.com. Block them or scan your logs for them.

• 24aspx.com
• 2aspx.net
• 6aspx.com
• 9aspx.net
• aspx46.com

These domains follow the same pattern as this one and this one.

Who are Vivids Media GmbH?

If you have been tracking the latest round of SQL Injection domains, then you might be familiar with the name Vivids Media GMBH as being the current registrar of choice.

The odd thing is that Vivids Media GmbH doesn't appear to have a web site or any traceable contact details. However, most of the domain registrations have a contact telephone number in Berlin of +49.3094413291 and some searching around gives this page with what looks like the correct contact details of:

Name: Vivids Media GmbH
Email Address: support@klikdomains.com
Address: Leege-Gr str. 41
City: Berlin
Zip: 13055
Country : Germany
Tel No.: +49.3094413291

That indicates that Vivid Media GmbH is related to klikdomains.com and therefore klikvip.com which are part of another company that claims to be in Berlin, Klik Media GmbH (some of the alleged goings on of this company are mentioned here). A short step away from Klik are a whole set of domains registered via Estdomains (a familiar name to many) and things start to get seedy from there.

There's no evidence that Vivid Media GmbH is directly invovled in anything bad - in fact there is barely any evidence that Vivid Media GmbH actually exists at all. Spammers and other bad guys do have a knack of finding registrars who are slow at terminating their accounts, so let's be charitable and say that Vivids Media are just understaffed in their abuse department.

The problem is that if you want to contact Vivids Media, then it seems to be very difficult. Their website is 56823.myorderbox.com which is a sort of white label domain registrar site. Myorderbox.com seems to be based in India, and looks to be a reseller of ResellerClub which in turns registers names through PublicDomainRegistry.com.

Complicated? Well, yes.. but ultimately PublicDomainRegistry.com are the registrar and it turns out that there is some light at the end of the tunnel. You will find that most of the domains used in these SQL Injection attacks have false WHOIS data, and you can report false WHOIS data here. Hopefully then the domain will be suspended.. not that it really matters too much because the bad guys will just register some more.

So the answer to the question "who are Vivids Media GmbH?" is "I don't know" but for most practical puporses you wouldn't need to deal with them if complaining about one of these domains, go to the registrar and report it there.

Chinese "selling-domain" mails

Probably not a scam, and really only a moderate hit on the Spam-O-Meter, but there do seem to be a number of emails from a person called Liu offering to sell a .cn version of your .com domain.

Subject: selling-domain: ------.cn
From: ljp013@vip.163.com
Date: Thu, June 5, 2008 1:13 am


Hello
We have ------.cn and think it is useful for you to made a China Website and
to explore China market.

We are pleased to inform you that we are now engage an activity by which you
can purchase this domain only with $1000 USD. If you are interested in it
,please reply to us and discuss the domain tranfer matters.
We could finish the transaction through www.sedo.com which is a international
Domain trade agency.Then,sedo.com will help you transferred the domain.
China is the biggest market in the world £¡Dot.cn domains is a symbol of
enterprises in China£¡10,000,000 .cn domains are been registered£¡

At last,Sorry for the disturb if any.

Wish you a happy new year 2008, and welcome to our China to visit Olympic Games.

Best Regards.

Liu


=================

Appendix:
Some large international companies use .cn domain in China.
http://www.google.cn/ The world's largest search company google.com China Station
http://www.Amazon.cn The world's largest online bookstore amazon.com company
China Station
http://www.Yahoo.cn Yahoo.com he is the sub-stations in China

It used to be the case that anyone wanting to register a .CN name had to either live in China or have a business that operated in China, although this is no longer the case and it seems everyone can register a .CN name (some restrictions apply on names and content). Neulevel's FAQs on the .CN TLD are enlightening. There is a dispute policy if you feel that your domain name has been registered unfairly.

To be honest, I'm not at all bothered about .CN names and I certainly won't be shelling out $1000 for something I won't use. But as ever, if you want to protect your brand abroad then perhaps securing the .cn version of your domain might be a good idea, there's a list of registrars at CNNIC.