RE: [registrars] Fraud Registrations!

["Patricio Valdes" <valdes@parava.net>]

He did come from IP: 203.162.xxx.xxx

We ended up blocking also some IP addresses in that block. Wonder if it is
the same person. But if we had for example a shared database with lets say
domains registerd using fraudalent CC's we could prevent some of this.

Patricio Valdes
Parava Networks

-----Original Message-----
From: Joyce Lin [mailto:joyce@007names.com]
Sent: Friday, March 07, 2003 3:59 PM
To: Patricio Valdes; 'Registrars'
Subject: Re: [registrars] Fraud Registrations!


Patricio,

We had somebody registered the following names  with a total payment of $375
on Nov. 19 last year. We suspected it and deleted them all on Nov. 20.  Our
log file showed he accessed from 203.162.124.216 (below attached shows where
this IP is located) and it just did not match the information he entered in
our db.  We blocked quite a few class C address of this subnet from access
our site and he never showed up again.  He will have to travel to another
region to do the evil.


vietcisco.net
eyahoo.net
vietcisco.info
vietcisco.org
eyahoo.org
vietcisco.com
vietcisco.biz


Search results for: 203.162.124.216


OrgName:    Asia Pacific Network Information Centre
OrgID:      APNIC
Address:    PO Box 2131
City:       Milton
StateProv:  QLD
PostalCode: 4064
Country:    AU

NetRange:   202.0.0.0 - 203.255.255.255
CIDR:       202.0.0.0/7
NetName:    APNIC-CIDR-BLK
NetHandle:  NET-202-0-0-0-1
Parent:
NetType:    Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS.RIPE.NET
NameServer: RS2.ARIN.NET
NameServer: DNS1.TELSTRA.NET
Comment:    This IP address range is not registered in the ARIN database.
Comment:    For details, refer to the APNIC Whois Database via
Comment:    WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
Comment:    ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment:    for the Asia Pacific region. APNIC does not operate networks
Comment:    using this IP address range and is not able to investigate
Comment:    spam or abuse reports relating to these addresses. For more
Comment:    help, refer to http://www.apnic.net/info/faq/abuse
Comment:
RegDate:    1994-04-05
Updated:    2002-09-11

OrgTechHandle: SA90-ARIN
OrgTechName:   System Administrator
OrgTechPhone:  +61 7 3858 3100
OrgTechEmail:  hostmaster@apnic.net




Joyce
007names.com




----- Original Message -----
From: "Patricio Valdes" <valdes@parava.net>
To: "'Registrars'" <Registrars@dnso.org>
Sent: Friday, March 07, 2003 3:24 PM
Subject: [registrars] Fraud Registrations!


> I know this might be kind of old but going back to Fraudalent
registrations.
>
> During January and February we saw a huge increase in Fraudalent
> transactions. The advantage of being a small registrar is that its easier
to
> monitor these kind of things.
>
> Sombody or someone out of Vietnam started Registering domain names for 1
or
> 2 years in defferent accounts, different names and contact info. We tried
> contacting these persons and all were non existent. Registrations were
made
> with US cards or International cards.
>
> We proceeded to delete these accounts, most of them anyway. He managed to
> get away with about 10 - 13 registrations, most under different accounts.
> After deleting the accounts, the person would come back the next day and
> register the same domain under a different registrant, they kept doing
this
> for about 3 weeks in a row, for every different name we deleted they would
> come back and try it again 4 or 5 days in a row. I guess it was a joke to
> them, all the time using different credit cards.
>
> Finally it seems they have gone away. Searching through some of the names
> they tried to register and we managed to delete in time, we found that
they
> went to a different registrar to register them, im almost 100% sure that
the
> Registrars will be getting chargebacks soon. By the way, we have already
> received chargebacks for most of the registrations that this person pulled
> through us. Here are some examples, all these names use a DNS server that
he
> managed to register through us:
>
> Domain Name: CHEAPVIETNAM.NET
> Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
>
> Domain Name: CHEAPVIETNAM.COM
> Registrar: NETBENEFIT PLC AKA NETNAMES
>
> Domain Name: TUYENMINH.COM
> Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
>
> Domain Name: MINHTUYEN.NET
> Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
>
> Domain Name: ANNINHMANG.COM
> Registrar: ENOM, INC.
>
> Domain Name: GV12A7.COM
> Registrar: SPOT DOMAIN LLC DBA DOMAINSITE.COM
>
> I believe we should try and figure out a way to be able to delete these
> registrations and get credit of some sort. These persons pulled 10 - 13
> chargebacks on us during one and a half months, how many names do we have
to
> sell to make up for chargeback fees?
>
> Patricio Valdes
> Parava Networks
>
>