Is this legit?

ceomp3 · Feb 26, 2016

I got the following email about a domain, but being suspicious of out of the blue solicitations, is this likely to be some form of scam, Googling and checking LinkedIn fails to find a Dennis Berger associated with one-and-one.

And the email comes from a spoof style domain registered at GoDaddy and via a GoDaddy IP (n1nlsmtp03.shr.prod.ams1.secureserver.net. [188.121.43.193])(allegedly in the name of 1and1, but 1and1 is a registrar so they wouldn't use GoDaddy)

So I'm pretty confident it is a scam. But how does it work,do they effectively steal your domain?

----

Hello!

I represent an investor from the Great Britain who wants to buy xxxxremovedxxx for a new project.

I located your contact information in a domain name whois lookup and understand that you own the domain name.

Are you still interested in selling?

If you have more names I can help you to sell them.

Best Regards,

Dennis Berger

Vice President

Intellectual Property Specialist

1and1 UK Hosting Company

Systreg · Feb 26, 2016

Looks like the typical appraisal scam email, also, take a couple of lines form the email and you get these other results which confirm the same:

https://www.google.co.uk/search?cli...&ie=utf-8&oe=utf-8&channel=suggest&gws_rd=ssl

Same email used here an shows how the appraisal scam works: http://morganlinton.com/most-popular-domain-name-scams-part-i/

ceomp3 · Feb 26, 2016

Delivered-To: xxxxxxxxx
Received: by 10.13.253.197 with SMTP id n188csp697227ywf;
Thu, 25 Feb 2016 15:20:35 -0800 (PST)
X-Received: by 10.28.188.195 with SMTP id m186mr988214wmf.64.1456442435646;
Thu, 25 Feb 2016 15:20:35 -0800 (PST)
Return-Path: <[email protected]>
Received: from n1nlsmtp03.shr.prod.ams1.secureserver.net (n1nlsmtp03.shr.prod.ams1.secureserver.net. [188.121.43.193])
by mx.google.com with ESMTPS id mb1si12421083wjb.176.2016.02.25.15.20.35
for <xxxxxxxxxx>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 25 Feb 2016 15:20:35 -0800 (PST)
Received-SPF: neutral (google.com: 188.121.43.193 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=188.121.43.193;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 188.121.43.193 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: from N1NW8SHG123 ([188.121.41.139])
by : HOSTING RELAY : with SMTP
id Z5D1akBWH1jprZ5D1aSpo4; Thu, 25 Feb 2016 16:20:35 -0700
thread-index: AdFwIyEZWccRjxTSTdiCybtq2DZV3g==
Thread-Topic: Offer to purchase sixry.com
From: <[email protected]>
To: <xxxxxxxxxxxx>
Subject: Offer to purchase xxxxxxxxxx
Date: Thu, 25 Feb 2016 16:20:35 -0700
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6002.18463
X-CMAE-Envelope: MS4wfOWgwCeY6l7aCC6Dddz7GEb9KpwSEyQ30uS4PUCKXGbwP6nPeA3r3utymFSZC9Z6DgjKgrzgNP/5+ZujRT2ZM91ecgf3sqdPjpUPSYPqGe9uJwEyBCIK
zFRN7eZNddVBfyxrR/YywCsSkWP7/Wji8e7r2CyIJIxH5pB4OJsTEDnrbKS9LM9a9x2QxmSAzSH+nQ==

ceomp3 · Feb 26, 2016

Thanks,

Yes I see now, the fraud is domain appraisal.

I guess 1and1 won't care too much that people are abusing their trademarks to commit fraud, but if they care to find this thread the email header shows them what domain to ask GD to close down.

Alien · Feb 26, 2016

Yes, a scam e.g: http://morganlinton.com/most-popular-domain-name-scams-part-i/

You'd probably get scammed for an expensive 'appraisal' if you went to sell.

Edit: Crossed posts above!