ICANN/DNSO
DNSO Mailling lists archives

[registrars]


<<< Chronological Index >>>    <<< Thread Index >>>

RE: [registrars] Fraud Registrations!


Title: Message

Past two months have been bad for us too. Below is a list of our fradulent registrations - ALL DONE FROM INDONESIA, and ALL IN A SINGLE WEEK. To a certain extent that way i can say that my entire learning of fraudulent patterns and hence building programs to combat the same has been via indonesian transactions :)

My payment gateway fortunately has automatic risk codes which catches all risky transactions. but the past one month has been very busy. check the list below (and think of the cost we bear to combat fraud, both in terms of fraud prevention and those who slip by, where we incur chargeback losses. i have people checking this stuff manually all the time) -

Desc : Registration of bodyworlds.net for 5 years

Desc1: Registration of bizconcern.net for 3 years and Registration of kampoengindonesia.com for 5 years and Registration of cybergalaxy.biz for 2 years and Registration of highconcern.com for 3 years and Registration of webatrium.net for 3 years and Registration

Decs2: Registration of cyberatrium.net for 5 years and Registration of kampoengindonesia.com for 5 years and Registration of cyberatrium.com for 5 years and Registration of kampoengindonesia.net for 5 years

High Risk Code: DIP

Desc3: Registration of cybertradecentre.net for 2 years and Registration of megacyberstore.net for 5 years and Registration of cyberbizcentre.com for 5 years and Registration of megacyberstore.com for 5 years and Registration of cyberbizcentre.net for 5 years

High Risk Code: DIP

Desc4: Registration of biotechworlds.com for 5 years and Registration of letsgohosting.com for 5 years

High Risk Code: DIP-DEM

Order Description: Registration of cradl3.net for 1 years and Registration of cradl3.org for 1 years and Registration of cradl3.com for 1 years and Registration of cradl3.biz for 1 years and Registration of cradl3.info for 1 years

Description: 3072

Order Description: Registration of kalashnikovshopper.com for 2 years and Registration of kalashnikovshopper.net for 2 years

Description: 3184

Order Description: Registration of art4gays.net for 5 years and Registration of art4gays.com for 5 years

High Risk Code: DCON-DIP-DEM

Description: 3091

Order Description: Registration of aremaclub.com for 5 years

High Risk Code: DCON-DEM

 

Description: 3092

Order Description: Registration of completestore.biz for 5 years and Registration of batikshop.net for 5 years

High Risk Code: DCON-DEM

 

Description: 3093

Order Description: Registration of useyourfingers.net for 5 years and Registration of artfingers.net for 5 years

High Risk Code: DIP-DEM-DMC

 

1 & 2Description: 3097

Order Description: Registration of art4adult.net for 5 years and Registration of art4adult.com for 10 years

  

3 & 4Description: 3098

Order Description: Registration of bizworlds.net for 5 years and Registration of giftsjust4u.net for 5 years and Registration of bizworlds.info for 5 years and Registration of bizworlds.biz for 5 years

 

5 Description: 3099

Order Description: Registration of art4adult.com for 10 years and Registration of art4adult.net for 5 years

 

bhavin



> -----Original Message-----
> From: owner-registrars@dnso.org
> [mailto:owner-registrars@dnso.org] On Behalf Of Patricio Valdes
> Sent: Saturday, March 08, 2003 3:41 AM
> To: Joyce Lin; 'Registrars'
> Subject: RE: [registrars] Fraud Registrations!
>
>
> He did come from IP: 203.162.xxx.xxx
>
> We ended up blocking also some IP addresses in that block.
> Wonder if it is the same person. But if we had for example a
> shared database with lets say domains registerd using
> fraudalent CC's we could prevent some of this.
>
> Patricio Valdes
> Parava Networks
>
> -----Original Message-----
> From: Joyce Lin [mailto:joyce@007names.com]
> Sent: Friday, March 07, 2003 3:59 PM
> To: Patricio Valdes; 'Registrars'
> Subject: Re: [registrars] Fraud Registrations!
>
>
> Patricio,
>
> We had somebody registered the following names  with a total
> payment of $375 on Nov. 19 last year. We suspected it and
> deleted them all on Nov. 20.  Our log file showed he accessed
> from 203.162.124.216 (below attached shows where this IP is
> located) and it just did not match the information he entered
> in our db.  We blocked quite a few class C address of this
> subnet from access our site and he never showed up again.  He
> will have to travel to another region to do the evil.
>
>
> vietcisco.net
> eyahoo.net
> vietcisco.info
> vietcisco.org
> eyahoo.org
> vietcisco.com
> vietcisco.biz
>
>
> Search results for: 203.162.124.216
>
>
> OrgName:    Asia Pacific Network Information Centre
> OrgID:      APNIC
> Address:    PO Box 2131
> City:       Milton
> StateProv:  QLD
> PostalCode: 4064
> Country:    AU
>
> NetRange:   202.0.0.0 - 203.255.255.255
> CIDR:       202.0.0.0/7
> NetName:    APNIC-CIDR-BLK
> NetHandle:  NET-202-0-0-0-1
> Parent:
> NetType:    Allocated to APNIC
> NameServer: NS1.APNIC.NET
> NameServer: NS3.APNIC.NET
> NameServer: NS.RIPE.NET
> NameServer: RS2.ARIN.NET
> NameServer: DNS1.TELSTRA.NET
> Comment:    This IP address range is not registered in the
> ARIN database.
> Comment:    For details, refer to the APNIC Whois Database via
> Comment:    WHOIS.APNIC.NET or
> http://www.apnic.net/apnic-bin/whois2.pl
> Comment:    ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
> Comment:    for the Asia Pacific region. APNIC does not
> operate networks
> Comment:    using this IP address range and is not able to investigate
> Comment:    spam or abuse reports relating to these
> addresses. For more
> Comment:    help, refer to http://www.apnic.net/info/faq/abuse
> Comment:
> RegDate:    1994-04-05
> Updated:    2002-09-11
>
> OrgTechHandle: SA90-ARIN
> OrgTechName:   System Administrator
> OrgTechPhone:  +61 7 3858 3100
> OrgTechEmail:  hostmaster@apnic.net
>
>
>
>
> Joyce
> 007names.com
>
>
>
>
> ----- Original Message -----
> From: "Patricio Valdes" <valdes@parava.net>
> To: "'Registrars'" <Registrars@dnso.org>
> Sent: Friday, March 07, 2003 3:24 PM
> Subject: [registrars] Fraud Registrations!
>
>
> > I know this might be kind of old but going back to Fraudalent
> registrations.
> >
> > During January and February we saw a huge increase in Fraudalent
> > transactions. The advantage of being a small registrar is that its
> > easier
> to
> > monitor these kind of things.
> >
> > Sombody or someone out of Vietnam started Registering
> domain names for
> > 1
> or
> > 2 years in defferent accounts, different names and contact info. We
> > tried contacting these persons and all were non existent.
> > Registrations were
> made
> > with US cards or International cards.
> >
> > We proceeded to delete these accounts, most of them anyway.
> He managed
> > to get away with about 10 - 13 registrations, most under different
> > accounts. After deleting the accounts, the person would
> come back the
> > next day and register the same domain under a different registrant,
> > they kept doing
> this
> > for about 3 weeks in a row, for every different name we
> deleted they
> > would come back and try it again 4 or 5 days in a row. I
> guess it was
> > a joke to them, all the time using different credit cards.
> >
> > Finally it seems they have gone away. Searching through some of the
> > names they tried to register and we managed to delete in time, we
> > found that
> they
> > went to a different registrar to register them, im almost 100% sure
> > that
> the
> > Registrars will be getting chargebacks soon. By the way, we have
> > already received chargebacks for most of the registrations
> that this
> > person pulled through us. Here are some examples, all these
> names use
> > a DNS server that
> he
> > managed to register through us:
> >
> > Domain Name: CHEAPVIETNAM.NET
> > Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
> >
> > Domain Name: CHEAPVIETNAM.COM
> > Registrar: NETBENEFIT PLC AKA NETNAMES
> >
> > Domain Name: TUYENMINH.COM
> > Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
> >
> > Domain Name: MINHTUYEN.NET
> > Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
> >
> > Domain Name: ANNINHMANG.COM
> > Registrar: ENOM, INC.
> >
> > Domain Name: GV12A7.COM
> > Registrar: SPOT DOMAIN LLC DBA DOMAINSITE.COM
> >
> > I believe we should try and figure out a way to be able to delete
> > these registrations and get credit of some sort. These
> persons pulled
> > 10 - 13 chargebacks on us during one and a half months, how
> many names
> > do we have
> to
> > sell to make up for chargeback fees?
> >
> > Patricio Valdes
> > Parava Networks
> >
> >
>
>



<<< Chronological Index >>>    <<< Thread Index >>>