I just wanted to warn people of another scam email attempt that I got today. The person sent me an email stating they owned the ".com version" of a domain I owned. No biggie so far….
He wanted to sell his ".com version" for $195 to me since it’s the same domain but in another extension.
The problem: ALL extensions of the domain are AVAILABLE besides the .us. I own the .us version because it get’s traffic and the only reason behind why I own the .us version of the domain and none of the others.
The scam here is, they are trying to sell you domain names THEY do not even own!
Email Address: shawnwilson50@googlemail.com / royalwoo@changi.nswebhost.com
The subject line was: Regarding your domain name SAMPLEDOMAIN.com
Email Content:
"Hi,
I own the .COM version of your domain name sampledomain.us and I want to sell it.
I was wondering if you would be interested in buying this domain for $195 seeing as though you own the same domain but in another extension ?
Let me know
Thanks
Shawn."
Using the header, I checked the "real email address" which showed me royalwoo@changi.nswebhost.com . Then checking whois on NsWebHost.com show Whois Privacy, but shows whois history records of 1,032. That is a Massive Number and clearly LOTS of people have been checking whois on this domain!
The Recieved from IP address was: 203.211.149.240 (QALA.COM.SG) QALA SINGAPORE PTE LTD. This appears to be a Broadband company, but the funny thing.. The site is 100% English, so I’m sure a Proxy was used.
I tried to go to the NsWebhost.com domain, but only get a white page. Compete.com shows Approx 47K visitors per month to the site….. which is Pretty Amazing, since it only carries a blank page!
Since this persons real email was the subdomain changi.nswebhost.com , I ran a scan on the domains on the normal server! 217 total. Several of the domains were owned by "the same person" but not enough for me to call out a name. While digging around I did found out that, nswebhost.com is owned by Hosting Zoom, Inc. . The Contact email address is Domain@nswebhost.com on HostingZoom.com and the couple times the privacy was removed, the mailing address matches what Hosting Zoom does business under.
I have sent an email to the owner of Hosting Zoom to see what the standards are with all the spam leaving his servers. If you do a simple search on google for "nswebhost.com" you will see many posts that say Spam this, Spam that etc. Watch out for anything from the servers NSWEBHOST.com and make sure to check your headers in the emails!
