.:Computer Defense:.

Hello, my name is Tyler and I have a problem... I'm a domain name addict.

Yes that's right... I buy domain names... stupid domain names that are completely useless... and I'm up to 35 of them. As a result I've decided that I might as well post all the ones I don't use on Sedo in an attempt to at least get back what they cost me. Basically I posted every domain I own (with one or two exceptions) figuring if I get a high enough offer, I'll see it anyways. Within a few hours of posting SecurityBloggers.net I had an email offer.... My conclusion is that the offer was an attempt to steal the domain, so I figured I'd share the email exchange...

First email - Tues, Oct 16 - 2:30AM

Hello,

We are interested in securitybloggers.net

Your name was listed in online auction. What is your price for the name?

Our company is involved in software development/support business.

Now domain invetsing/reselling is just an additional direction of our investment strategy.

Looking forward to do business with you.

Regards,
Anthony McQueary
President
TG Logitech

Notes on this email:

• At the time, TG Logitech returned no relevant Google results (Since then, someone else has written about this scam)
• The email came from a dialup account in Russia via smtp01.mtu.ru
• The email domain was ToughGuy.net, which I can't seem to browse to now, but at the time was HotPop, a free POP/SMTP email provider.

I responded with:

Hello,

My prices are listed on SEDO and I am doing business via SEDO... I'm interested in $2000.

I have not been able to find any information related to your company online, what is the website?

Thank you,
Tyler.

2 hours later I received this:

Sorry for the delay. Members of family was celebrating newborn child of my sister.

Now let's talk about the deal.

2,000 USD. Ok.

Do you sell domain with a web site or just name?

If just name it's ok. Web site is not necessary.

Have you had your domains appraised already? Can you show me your valuation certificates? As fas I know it's a common practice to show appraisal of domain name (even without traffic and web site) before doing business.

Without appraisal I risk to overpay. In other words I won't be able to make a profit on reselling this name. It's very important for you and me to know the current market value of your domains.

Of course, we must be sure that you are engaging an appraisal company with REAL manual service. I heard many appraisal companies often made inaccurate auto-generated appraisals. I will only accept appraisals from independent sources I trust. To avoid mistakes I asked domain experts about reputable appraisal companies in a forum

http://domaintalk.ourplace.com/Archive/972846.htm

Just check this posting.

If the appraisal comes higher you can adjust your asking price accordingly.
I also hope you can give me 10% - 15% discount of the appraised value.

After I get an appraisal from you we'll continue our negotiations.

How do you prefer to get paid: www.escrow.com, www.PayPal.com check or wire?

Hope we can come to an agreement fast.

Looking forward to your reply.

A couple of changes this time:

• smtp03.mtu.ru was the SMTP server used
• The display name changed from TG Logitech to McQueary

I responded the following morning with:

I'm sorry but it seems that the page you listed wasn't available...

As for the price, it is not based on appraisal... While I have posted the site for sale, I am intent on keeping the site, unless someone offers me the price mentioned ($2000)... so I'm unconcerned with the results of an appraisal.

Less then an hour later I received a response, again with McQueary as the display name but this time from smtp01.mtu.ru:

This is a regular practice to provide buyers or resellers with professional and independent valuation. Serious investors must be sure in your price.
Without it they risk to overpay.

Anyway, you won't be able to sell without professional appraisal.

Of course, serious investors cannot accept auto-generated services. They need an accurate valuation made by humans not scripts.

My response:

That's ok.. as I said... I'm not interested in serious investors.

After that the emails magically stopped and I haven't heard anything else... I couldn't find anything a couple days ago, and now I've seen my blog post and the one linked above... obviously this scam is just start (although the premise of the scam isn't exactly new)... so keep an eye out for overly agreeable domain buyers.

UPDATE: More information here.