WARNING: I am in NO WAY saying to do this or advising you to try this. This is a fictional story based on something that could happen!
Let’s say a online domain name auction service offered bidding services on expired domain names. It cost’s $5 to sign up to use the service.
Since no detailed investigation is used to verify an account, phony account information can be used when your account is created in order to become a bidder and a pre-paid credit card to pay the $5 fee. As most scammers do, a proxy service is used when creating the account so locating the person who created the account is nearly impossible.
Using a different proxy service, one could repeat this process, which would equal phony account number 2 with both accounts showing a different IP address location and phony account info again. (looking like two different people). $10 invested.
An auction starts for $10 for the expired domain name with No Reserve. This is a valuable domain name with a value estimated around $10,000.
Bidder #1 places a $10 bid. Seconds later, bidder #2 put’s in a high bid of $20,000. To raise the proxy bid price, Bidder #1 bids $20,100 making the auction bid price $20,100. Bidder #2 puts in a final bid for $20,200 and the auction ends for $20,200 to bidder #2.
Since the auction price went up so fast and the bid price higher then the domain names value by a fair amount, nobody else really had a chance to bid or would bid at that point for the domain.
Emails from the auction service are sent out to collect the winning amount from bidder #2. Over a short period of time, no payment is made. Bidder #2 doesn’t pay for the domain name, doesn’t reply to emails.
Since the auction services policy is: if the winning bidder doesn’t pay, the second highest bidder is offered the domain name without another public auction. Since the #2 bidder became a non-paying bidder, the price could not have "gone up" with bidder #2’s bids, meaning all bidder #2’s bids are voided.
Since there were only two bidders in the auction with bidder #2’s bids voided putting the actual bid price back down to $10… the only "real bid" needed.
Bidder #1 obtains an estimated $10,000 domain name for $20. ($10 bid, $5 account fee x’s 2)
Since the auction service runs tens of thousands of domain name auctions per week and likely has non-paying bidders pretty often, a situatation like "real value" of the domain name would be questionable and not picked up by a "computer system" as many domain names end with a $10 bid.
This story was created based on an online domain name auction services auction policy not to "rerun" an auction after a non-paying bidder has occured and reward the domain name to the next high bidder with the non-paying bidders bids voided.



Very interesting post Jamie, scary how easy that could be. I hope bringing this flaw to light is enough to get the company to change the policy.
June 29th, 2009