Watching out for Stolen Domain Scams

A domain scam has been roaming the internet for a while now that aims to trick domain owners into providing their account details into a faked GoDaddy.com page. The scammer then sells them off as fast as possible on any number of domain marketplaces.

Unfortunately it seems that it is back in circulation and catching people out.

How Does It Work?

This scam works like most other phishing scams.

In a nutshell, folk who have their contact details listed on the domain receive the fake GoDaddy.com email that sends them to a website with a GoDaddy.com look and feel.

Once the victim enters the account details, they may receive a standard “Thanks” message but the scammer now has their account details. As such, they can control the victims domain and thus, to a degree, their website.

The scammer then uses this information to meet any domain ownership validation controls on lists on domain marketplaces and looks for a quick sale.

What does it mean for Website Owners?

Anyone who owns a domain should be aware of this scam.

GoDaddy.com released an alert on this specific scam last year but also provided some warning questions that domain owners should be thinking about:

• Where does the link take you?
• What information are they asking for?
• Is the web page Secure?
• Is the email addressed to you personally?
• Does the email read well?
• Is the page a pop-up?
• Is there an attachment?

You can read their How to Spot Email Scams post for more details.

What does it mean for Website/Domain Buyers?

Despite the warnings and tell-tale signs, some people do fall for this scam.

We have unfortunately had a handful of instances (a miniscule proportion of a percentage of domains listed on Flippa) of these stolen domains being put up for sale on Flippa using increasingly sophisticated measures to circumvent our alerts.

While we look at technical measures to see what we can do to address this (not an easy task when the scammer effectively has full access to the user’s domain registration account), there are a number of tell-tale indicators that should ring alarm bells for potential domain buyers on Flippa.

1. The domain seems to contain a fully fledged website – legitimate domains for sale typically don’t have an abundance of content (ie they’re parked). If a domain for sale has a wealth of content or functionality, you should be questioning as to why it was not listed as an established website for sale
2. The BIN price seems too good to be true – scammers are looking to sell as quickly as possible to avoid being caught. To do this, they set a buy it now price that will drive a quick sale. Any three-letter or popular dictionary word dot-com domain with a BIN below $5,000 should be looked at carefully
3. Whois details have been updated in the last few days – the scammer will sometimes update the whois details with their own contact email. Click on the auction’s “View full WHOIS details collected at listing time” link to check this out. Note that scammers will not always alter these details so no recent changes is not guarantee
4. Seller has only been on Flippa for a few days – the scammer has typically been banned from Flippa before so will set up a new account to offload their stolen wares. Note there are also a number of legitimate scenarios for this but it should still lead to further investigation.
5. Large number of comments have been deleted – as more evidence begins to point to a stolen domain, Flippa users will start asking tougher questions in the public comments. Scammers will typically delete these comments to reduce suspicion however an auction with a number of deleted comments should instead raise suspicions!
6. Seller requests payment via wire transfer (eg Western Union) – OK, so the above measures did not ring enough alarm bells and you won the auction. Scammers will typically propose wire transfer for funds exchange as these services do not provide recourse for the buyer once they realize they’ve paid for a domain they will never own. Escrow remains the recommended service for these transactions and, failing that, payment providers such as PayPal offer better security.

While the existence or absence of one of these indicators does not immediately define a seller as being legit or a scammer, it will hopefully trigger deeper investigation.

Massive thanks to the guys at ariyas.com for working with us on this.

Think there is more that can be done to identify stolen domains? Let us know in the comments below.

Image: alancleaver